mfd: rtsx_usb: Fix possible race condition

Fix two possible race condition generated by misuse of del_timer in
rtsx_usb_bulk_transfer_sglist() and uninitialized timers before mfd_add_devices
in rtsx_usb_probe().

Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>

diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
index b53b9d46cc4534671066ae03950fb44f25f36af9..0ca79736afe9f09116389f142b2f322e0fdef580 100644 (file)
--- a/drivers/mfd/rtsx_usb.c
+++ b/drivers/mfd/rtsx_usb.c
@@ -67,7 +67,7 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
        ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout);
        add_timer(&ucr->sg_timer);
        usb_sg_wait(&ucr->current_sg);
-       del_timer(&ucr->sg_timer);
+       del_timer_sync(&ucr->sg_timer);
 
        if (act_len)
                *act_len = ucr->current_sg.bytes;
@@ -644,14 +644,14 @@ static int rtsx_usb_probe(struct usb_interface *intf,
        if (ret)
                goto out_init_fail;
 
+       /* initialize USB SG transfer timer */
+       setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr);
+
        ret = mfd_add_devices(&intf->dev, usb_dev->devnum, rtsx_usb_cells,
                        ARRAY_SIZE(rtsx_usb_cells), NULL, 0, NULL);
        if (ret)
                goto out_init_fail;
 
-       /* initialize USB SG transfer timer */
-       init_timer(&ucr->sg_timer);
-       setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr);
 #ifdef CONFIG_PM
        intf->needs_remote_wakeup = 1;
        usb_enable_autosuspend(usb_dev);