tree 52847eb294c7a08a10d27d8bf35844fb8cd0cf8f
parent 8377c94f627f7943da9a7eefdb21fd2e9e7ec629
author Huajun Li <huajun.li.lee@gmail.com> 1337343171 +0800
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1337384275 -0700

USB: Remove races in devio.c

There exist races in devio.c, below is one case,
and there are similar races in destroy_async()
and proc_unlinkurb().  Remove these races.

 cancel_bulk_urbs()        async_completed()
-------------------                -----------------------
 spin_unlock(&ps->lock);

                           list_move_tail(&as->asynclist,
		                    &ps->async_completed);

                           wake_up(&ps->wait);

                           Lead to free_async() be triggered,
                           then urb and 'as' will be freed.

 usb_unlink_urb(as->urb);
 ===> refer to the freed 'as'

Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Oncaphillis <oncaphillis@snafu.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>