From: Eugeny S. Mints <emints@ru.mvista.com>
Date: Sat, 2 Sep 2006 10:59:19 +0000 (-0700)
Subject: USB: usb serial gadget smp related bug
X-Git-Tag: v2.6.19-rc1~899^2~36
X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=80f8af0c59385b41564a3ae670f94a1b4caa43b2;p=~emulex%2Finfiniband.git

USB: usb serial gadget smp related bug

Adjust dev->dev_lock spinlock lock/unlock calls to be safe for SMP case.
Otherwise the following sequence may lead to a deadlock in SMP case:

gs_send()->usb_ep_queue()
	->(in case a request is satisfied immediatly) gs_write_complete()

for ex for pxa2xx_udc.c:
usb_ep_queue()->pxa2xx_ep_queue()->write_fifo()->done()->gs_write_complete()
(through req.complete pointer)

Signed-off-by: Eugeny S. Mints <emints@ru.mvista.com>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index e762aa19ab0..b893e3118e1 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -1120,12 +1120,15 @@ static int gs_send(struct gs_dev *dev)
 gs_debug_level(3, "gs_send: len=%d, 0x%2.2x 0x%2.2x 0x%2.2x ...\n", len, *((unsigned char *)req->buf), *((unsigned char *)req->buf+1), *((unsigned char *)req->buf+2));
 			list_del(&req_entry->re_entry);
 			req->length = len;
+			spin_unlock_irqrestore(&dev->dev_lock, flags);
 			if ((ret=usb_ep_queue(ep, req, GFP_ATOMIC))) {
 				printk(KERN_ERR
 				"gs_send: cannot queue read request, ret=%d\n",
 					ret);
+				spin_lock_irqsave(&dev->dev_lock, flags);
 				break;
 			}
+			spin_lock_irqsave(&dev->dev_lock, flags);
 		} else {
 			break;
 		}