Messages in this thread Patch in this message | | | Date | Tue, 1 Apr 2008 15:32:12 +0200 | From | Pavel Machek <> | Subject | hci_usb.h: fix hard-to-trigger race |
| |
If someone tries to _urb_unlink while _urb_queue_head is running, he'll see _urb->queue == NULL and fail to do any locking. Prevent that from happening by strategically placed barriers.
Signed-off-by: Pavel Machek <pavel@suse.cz>
diff --git a/drivers/bluetooth/hci_usb.h b/drivers/bluetooth/hci_usb.h index 414080a..1790cc8 100644 --- a/drivers/bluetooth/hci_usb.h +++ b/drivers/bluetooth/hci_usb.h @@ -70,7 +70,8 @@ static inline void _urb_queue_head(struc { unsigned long flags; spin_lock_irqsave(&q->lock, flags); - list_add(&_urb->list, &q->head); _urb->queue = q; + /* _urb_unlink needs to know which spinlock to use, thus mb(). */ + _urb->queue = q; mb(); list_add(&_urb->list, &q->head); spin_unlock_irqrestore(&q->lock, flags); } @@ -78,19 +79,23 @@ static inline void _urb_queue_tail(struc { unsigned long flags; spin_lock_irqsave(&q->lock, flags); - list_add_tail(&_urb->list, &q->head); _urb->queue = q; + /* _urb_unlink needs to know which spinlock to use, thus mb(). */ + _urb->queue = q; mb(); list_add_tail(&_urb->list, &q->head); spin_unlock_irqrestore(&q->lock, flags); } static inline void _urb_unlink(struct _urb *_urb) { - struct _urb_queue *q = _urb->queue; + struct _urb_queue *q; unsigned long flags; - if (q) { - spin_lock_irqsave(&q->lock, flags); - list_del(&_urb->list); _urb->queue = NULL; - spin_unlock_irqrestore(&q->lock, flags); - } + + mb(); + q = _urb->queue; + /* If q is NULL, it will die at easy-to-debug NULL pointer dereference. + No need to BUG(). */ + spin_lock_irqsave(&q->lock, flags); + list_del(&_urb->list); _urb->queue = NULL; + spin_unlock_irqrestore(&q->lock, flags); } struct hci_usb {
-- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
| |