Patch "mfd: rtsx_usb: Avoid setting ucr->current_sg.status" has been added to the 4.7-stable tree

This is a note to let you know that I've just added the patch titled

    mfd: rtsx_usb: Avoid setting ucr->current_sg.status

to the 4.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mfd-rtsx_usb-avoid-setting-ucr-current_sg.status.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Lu Baolu <[email protected]>
Date: Thu, 11 Aug 2016 10:39:03 +0800
Subject: mfd: rtsx_usb: Avoid setting ucr->current_sg.status

From: Lu Baolu <[email protected]>

commit 8dcc5ff8fcaf778bb57ab4448fedca9e381d088f upstream.

Member "status" of struct usb_sg_request is managed by usb core. A spin lock is used to serialize the change of it. The driver could check the value of req->status, but should avoid changing it without the hold of the spinlock. Otherwise, it could cause race or error in usb core.

This patch could be backported to stable kernels with version later than v3.14.

---
 drivers/mfd/rtsx_usb.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

@@ -46,9 +46,6 @@ static void rtsx_usb_sg_timed_out(unsign
 
 	dev_dbg(&ucr->pusb_intf->dev, "%s: sg transfer timed out", __func__);
 	usb_sg_cancel(&ucr->current_sg);
-
-	/* we know the cancellation is caused by time-out */
-	ucr->current_sg.status = -ETIMEDOUT;
 }
 
 static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,

@@ -67,12 +64,15 @@ static int rtsx_usb_bulk_transfer_sglist
 	ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout);
 	add_timer(&ucr->sg_timer);
 	usb_sg_wait(&ucr->current_sg);
-	del_timer_sync(&ucr->sg_timer);
+	if (!del_timer_sync(&ucr->sg_timer))
+		ret = -ETIMEDOUT;
+	else
+		ret = ucr->current_sg.status;
 
 	if (act_len)
 		*act_len = ucr->current_sg.bytes;
 
-	return ucr->current_sg.status;
+	return ret;
 }
 
 int rtsx_usb_transfer_data(struct rtsx_ucr *ucr, unsigned int pipe,

Patches currently in stable-queue which might be from [email protected] are

queue-4.7/usb-dwc3-fix-clear-stall-ep-command-failure.patch queue-4.7/mfd-rtsx_usb-avoid-setting-ucr-current_sg.status.patch