staging: usbip: vhci: use urb->dev->portnum to find port

The access to pending_port was racy when two devices
were being attached at the same time.

Signed-off-by: Max Vozeler <max@vozeler.com>
Tested-by: Mark Wehby <MWehby@luxotticaRetail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

authored by Max Vozeler and committed by Greg Kroah-Hartman 01446ef5 bd65f623

+1 -6
-3
drivers/staging/usbip/vhci.h
··· 100 * But, the index of this array begins from 0. 101 */ 102 struct vhci_device vdev[VHCI_NPORTS]; 103 - 104 - /* vhci_device which has not been assiged its address yet */ 105 - int pending_port; 106 }; 107 108
··· 100 * But, the index of this array begins from 0. 101 */ 102 struct vhci_device vdev[VHCI_NPORTS]; 103 }; 104 105
+1 -3
drivers/staging/usbip/vhci_hcd.c
··· 138 * the_controller->vdev[rhport].ud.status = VDEV_CONNECT; 139 * spin_unlock(&the_controller->vdev[rhport].ud.lock); */ 140 141 - the_controller->pending_port = rhport; 142 - 143 spin_unlock_irqrestore(&the_controller->lock, flags); 144 145 usb_hcd_poll_rh_status(vhci_to_hcd(the_controller)); ··· 573 return urb->status; 574 } 575 576 - vdev = port_to_vdev(the_controller->pending_port); 577 578 /* refuse enqueue for dead connection */ 579 spin_lock(&vdev->ud.lock);
··· 138 * the_controller->vdev[rhport].ud.status = VDEV_CONNECT; 139 * spin_unlock(&the_controller->vdev[rhport].ud.lock); */ 140 141 spin_unlock_irqrestore(&the_controller->lock, flags); 142 143 usb_hcd_poll_rh_status(vhci_to_hcd(the_controller)); ··· 575 return urb->status; 576 } 577 578 + vdev = port_to_vdev(urb->dev->portnum-1); 579 580 /* refuse enqueue for dead connection */ 581 spin_lock(&vdev->ud.lock);