NFC: Core must test the device polling state inside the device lock

There can ever be only one call to nfc_targets_found() after polling
has been engaged. This could be from a target discovered event from
the driver, or from an error handler to notify poll will never complete.

Signed-off-by: Eric Lapuyade <eric.lapuyade@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

diff --git a/net/nfc/core.c b/net/nfc/core.c
index 32f2832..94ccf07 100644 (file)
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -571,13 +571,18 @@ int nfc_targets_found(struct nfc_dev *dev,
 
        pr_debug("dev_name=%s n_targets=%d\n", dev_name(&dev->dev), n_targets);
 
-       dev->polling = false;
-
        for (i = 0; i < n_targets; i++)
                targets[i].idx = dev->target_next_idx++;
 
        device_lock(&dev->dev);
 
+       if (dev->polling == false) {
+               device_unlock(&dev->dev);
+               return 0;
+       }
+
+       dev->polling = false;
+
        dev->targets_generation++;
 
        kfree(dev->targets);