lkml.org 
[lkml]   [2013]   [Nov]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH] usbnet: fix race condition caused spinlock bad magic issue
From
Date
From: wang, biao <biao.wang@intel.com>
Date: Mon, 11 Nov 2013 10:23:40 +0800
Subject: [PATCH] usbnet: fix race condition caused spinlock bad magic issue

there is race between usbnet_terminate_urbs and usbnet_bh, when
unlink_wakeup used in usbnet_bh, it may be already freed and used by
other function as unlink_wakeup was a local var on stack.

btw, dev->wait should be judged again before use it as there is race
too.

Signed-off-by: wang, biao <biao.wang@intel.com>
---
drivers/net/usb/usbnet.c | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 90a429b..22fc27f 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -86,6 +86,7 @@ static const char driver_name [] = "usbnet";

/* use ethtool to change the level for any given device */
static int msg_level = -1;
+static wait_queue_head_t unlink_wakeup;
module_param (msg_level, int, 0);
MODULE_PARM_DESC (msg_level, "Override default message level");

@@ -761,7 +762,6 @@ EXPORT_SYMBOL_GPL(usbnet_unlink_rx_urbs);
// precondition: never called in_interrupt
static void usbnet_terminate_urbs(struct usbnet *dev)
{
- DECLARE_WAIT_QUEUE_HEAD_ONSTACK(unlink_wakeup);
DECLARE_WAITQUEUE(wait, current);
int temp;

@@ -1448,8 +1448,10 @@ static void usbnet_bh (unsigned long param)

// waiting for all pending urbs to complete?
if (dev->wait) {
+ wait_queue_head_t *wait_d = dev->wait;
if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
- wake_up (dev->wait);
+ if (wait_d)
+ wake_up(wait_d);
}

// or are we maybe short a few urbs?
@@ -1602,6 +1604,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
init_timer (&dev->delay);
mutex_init (&dev->phy_mutex);
mutex_init(&dev->interrupt_mutex);
+ init_waitqueue_head(&unlink_wakeup);
dev->interrupt_count = 0;

dev->net = net;
--
1.7.0.4




\
 
 \ /
  Last update: 2013-11-11 04:41    [W:0.085 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site