Unverified Commit 1ee35309 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11900 [sync] PR-11851: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/11851 
 
PR sync from: Yuan Can <yuancan@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/Q4DJ7JTYVI7RMSHXDYP2T53UYMNPKAKK/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9TXIA 
 
Link:https://gitee.com/openeuler/kernel/pulls/11900

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 195d1ba0 4930484e

drivers/usb/gadget/function/f_fs.c

+4 −0
Original line number Diff line number Diff line
@@ -827,6 +827,7 @@ static void ffs_user_copy_worker(struct work_struct *work) 
	int ret = io_data->req->status ? io_data->req->status :

					 io_data->req->actual;

	bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;

	unsigned long flags;



	if (io_data->read && ret > 0) {

		kthread_use_mm(io_data->mm);
@@ -839,7 +840,10 @@ static void ffs_user_copy_worker(struct work_struct *work) 
	if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)

		eventfd_signal(io_data->ffs->ffs_eventfd, 1);



	spin_lock_irqsave(&io_data->ffs->eps_lock, flags);

	usb_ep_free_request(io_data->ep, io_data->req);

	io_data->req = NULL;

	spin_unlock_irqrestore(&io_data->ffs->eps_lock, flags);



	if (io_data->read)

		kfree(io_data->to_free);