Unverified Commit ac851af3 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8799 usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yuan Can <yuancan@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/7U2RJC7FHLPA2PSKRGHHLAIWP2Q67JMI/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9TXIA 
 
Link:https://gitee.com/openeuler/kernel/pulls/8799

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 9f077cd1 7a0c41e6

drivers/usb/gadget/function/f_fs.c

+4 −0
Original line number Diff line number Diff line
@@ -756,6 +756,7 @@ static void ffs_user_copy_worker(struct work_struct *work) 
	int ret = io_data->req->status ? io_data->req->status :

					 io_data->req->actual;

	bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;

	unsigned long flags;



	if (io_data->read && ret > 0) {

		mm_segment_t oldfs = get_fs();
@@ -772,7 +773,10 @@ static void ffs_user_copy_worker(struct work_struct *work) 
	if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)

		eventfd_signal(io_data->ffs->ffs_eventfd, 1);



	spin_lock_irqsave(&io_data->ffs->eps_lock, flags);

	usb_ep_free_request(io_data->ep, io_data->req);

	io_data->req = NULL;

	spin_unlock_irqrestore(&io_data->ffs->eps_lock, flags);



	if (io_data->read)

		kfree(io_data->to_free);