usb: wusbcore: move isoc_frame_index from wa_xfer to wa_seg

If multiple segments belonging to an isoc transfer are submitted
concurrently, the isoc_frame_index field in struct wa_xfer can get
corrupted.  This patch moves the isoc_frame_index field from struct
wa_xfer to struct wa_seg to prevent this from happening.

Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 673ad80c1b558d479477907616a78a6d43061a61..6aeb52cdc3fbdb376a2c78b2ebc3a3f2c3245789 100644 (file)
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -124,6 +124,8 @@ struct wa_seg {
        u8 index;                       /* which segment we are */
        int isoc_frame_count;   /* number of isoc frames in this segment. */
        int isoc_frame_offset;  /* starting frame offset in the xfer URB. */
+       /* Isoc frame that the current transfer buffer corresponds to. */
+       int isoc_frame_index;
        int isoc_size;  /* size of all isoc frames sent by this seg. */
        enum wa_seg_status status;
        ssize_t result;                 /* bytes xfered or error */
@@ -158,8 +160,6 @@ struct wa_xfer {
        unsigned is_dma:1;
        size_t seg_size;
        int result;
-       /* Isoc frame that the current transfer buffer corresponds to. */
-       int dto_isoc_frame_index;
 
        gfp_t gfp;                      /* allocation mask */
 
@@ -701,23 +701,23 @@ static void wa_seg_dto_cb(struct urb *urb)
        if (usb_pipeisoc(xfer->urb->pipe)) {
                /* Alereon HWA sends all isoc frames in a single transfer. */
                if (wa->quirks & WUSB_QUIRK_ALEREON_HWA_CONCAT_ISOC)
-                       xfer->dto_isoc_frame_index += seg->isoc_frame_count;
+                       seg->isoc_frame_index += seg->isoc_frame_count;
                else
-                       xfer->dto_isoc_frame_index += 1;
-               if (xfer->dto_isoc_frame_index < seg->isoc_frame_count) {
+                       seg->isoc_frame_index += 1;
+               if (seg->isoc_frame_index < seg->isoc_frame_count) {
                        data_send_done = 0;
                        holding_dto = 1; /* checked in error cases. */
                        /*
                         * if this is the last isoc frame of the segment, we
                         * can release DTO after sending this frame.
                         */
-                       if ((xfer->dto_isoc_frame_index + 1) >=
+                       if ((seg->isoc_frame_index + 1) >=
                                seg->isoc_frame_count)
                                release_dto = 1;
                }
                dev_dbg(dev, "xfer 0x%08X#%u: isoc frame = %d, holding_dto = %d, release_dto = %d.\n",
-                       wa_xfer_id(xfer), seg->index,
-                       xfer->dto_isoc_frame_index, holding_dto, release_dto);
+                       wa_xfer_id(xfer), seg->index, seg->isoc_frame_index,
+                       holding_dto, release_dto);
        }
        spin_unlock_irqrestore(&xfer->lock, flags);
 
@@ -737,8 +737,7 @@ static void wa_seg_dto_cb(struct urb *urb)
                         * send the URB and release DTO if we no longer need it.
                         */
                         __wa_populate_dto_urb_isoc(xfer, seg,
-                               seg->isoc_frame_offset +
-                               xfer->dto_isoc_frame_index);
+                               seg->isoc_frame_offset + seg->isoc_frame_index);
 
                        /* resubmit the URB with the next isoc frame. */
                        result = usb_submit_urb(seg->dto_urb, GFP_ATOMIC);
@@ -1324,12 +1323,12 @@ static int __wa_seg_submit(struct wa_rpipe *rpipe, struct wa_xfer *xfer,
                struct wahc *wa = xfer->wa;
 
                result = usb_submit_urb(seg->isoc_pack_desc_urb, GFP_ATOMIC);
+               seg->isoc_frame_index = 0;
                if (result < 0) {
                        pr_err("%s: xfer %p#%u: ISO packet descriptor submit failed: %d\n",
                               __func__, xfer, seg->index, result);
                        goto error_iso_pack_desc_submit;
                }
-               xfer->dto_isoc_frame_index = 0;
                /*
                 * If this segment contains more than one isoc frame, hold
                 * onto the dto resource until we send all frames.