[ 3.8.y.z extended stable ] Patch "staging: vt6656: [BUG] main_usb.c oops on device_close move flag" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    staging: vt6656: [BUG] main_usb.c oops on device_close move flag

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.11.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From a3784982c86e4048626f9321d8b84bd3163e10a1 Mon Sep 17 00:00:00 2001
From: Malcolm Priestley <tvboxspy at gmail.com>
Date: Sun, 22 Sep 2013 19:48:54 +0100
Subject: staging: vt6656: [BUG] main_usb.c oops on device_close move flag
 earlier.

commit e3eb270fab7734427dd8171a93e4946fe28674bc upstream.

The vt6656 is prone to resetting on the usb bus.

It seems there is a race condition and wpa supplicant is
trying to open the device via iw_handlers before its actually
closed at a stage that the buffers are being removed.

The device is longer considered open when the
buffers are being removed. So move ~DEVICE_FLAGS_OPENED
flag to before freeing the device buffers.

Signed-off-by: Malcolm Priestley <tvboxspy at gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 drivers/staging/vt6656/main_usb.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index f726970..2c3d388 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -1112,6 +1112,8 @@ static int  device_close(struct net_device *dev) {
     memset(pMgmt->abyCurrBSSID, 0, 6);
     pMgmt->eCurrState = WMAC_STATE_IDLE;

+	pDevice->flags &= ~DEVICE_FLAGS_OPENED;
+
     device_free_tx_bufs(pDevice);
     device_free_rx_bufs(pDevice);
     device_free_int_bufs(pDevice);
@@ -1123,7 +1125,6 @@ static int  device_close(struct net_device *dev) {
     usb_free_urb(pDevice->pInterruptURB);

     BSSvClearNodeDBTable(pDevice, 0);
-    pDevice->flags &=(~DEVICE_FLAGS_OPENED);

     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "device_close2 \n");

--
1.8.1.2