brcmfmac: prevent possible race condition on usb rx control.

brcmf_usb_tx_ctlpkt sends message using brcmf_usb_send_ctl then
clears boolean and waits for boolean to be set (by another
thread). This can result in situation where flag gets cleared
while result was already received. First clearing the flag and
then sending the data will prevent this.

Reviewed-by: Arend Van Spriel (arend@broadcom.com)
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index a299d42da8e74a358939b8fa5da8a32a01fd312b..ac1ed1fdff9443ff18737220f5d0ab5ec1dd22f1 100644 (file)
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -366,13 +366,13 @@ static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
        if (test_and_set_bit(0, &devinfo->ctl_op))
                return -EIO;
 
+       devinfo->ctl_completed = false;
        err = brcmf_usb_send_ctl(devinfo, buf, len);
        if (err) {
                brcmf_dbg(ERROR, "fail %d bytes: %d\n", err, len);
                return err;
        }
 
-       devinfo->ctl_completed = false;
        timeout = brcmf_usb_ioctl_resp_wait(devinfo, &devinfo->ctl_completed,
                                            &pending);
        clear_bit(0, &devinfo->ctl_op);