github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-27 02:22:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

firewire: cdev: fix back-transition for iso_resource_auto client resource

Browse Source 
The todo member of iso_resource_auto structure represents the state of the
client resource and normally transitions in the following order:

    ISO_RES_AUTO_ALLOC -> ISO_RES_AUTO_REALLOC -> ISO_RES_AUTO_DEALLOC

However, concurrent access from the work item and the file descriptor
release function can cause the state to transition backwards from
ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC.

Prevent the back-transition by checking the current state before
updating it in the work item.

Fixes: fcabbf40fa ("firewire: core: move allocation/reallocation paths into specific branch after isoc resource management in cdev")
Link: https://lore.kernel.org/r/20260922132639.191593-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
This commit is contained in:
Takashi Sakamoto 2026-09-22 22:26:39 +09:00
parent 93f51579e7
commit c6b51091ca
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/firewire/core-cdev.c
View File

@ -1397,8 +1397,10 @@ static void iso_resource_auto_work(struct work_struct *work)
} else {
// Transit from allocation to reallocation, except if the client requested
// deallocation in the meantime.
scoped_guard(spinlock_irq, &client->lock)
r->todo = ISO_RES_AUTO_REALLOC;
scoped_guard(spinlock_irq, &client->lock) {
if (r->todo == ISO_RES_AUTO_ALLOC)
r->todo = ISO_RES_AUTO_REALLOC;
}
if (channel >= 0)
r->params.channels_mask = BIT_ULL(channel);