Messages in this thread |  | | Subject | Re: [PATCH V2] usbnet: fix race condition caused spinlock bad magic issue | From | Oliver Neukum <> | Date | Wed, 13 Nov 2013 08:58:18 +0100 |
| |
On Wed, 2013-11-13 at 09:11 +0800, wangbiao wrote:
Hi,
> 2, for the same reason,dev->wait should be judged again before use it, > as between the judge point(if(dev->wait)) and use point(wakeup(dev->wait)), > the dev->wait may be set NULL by another cpu. > > for issue 1, declare unlink_wakeup in global section instead of on stack. > for issue 2, use a temporary local var to keep the value of dev->wait > in stack and judge it before using. > > Signed-off-by: wang, biao <biao.wang@intel.com> > Acked-by: Ingo Molnar <mingo.kernel.org@gmail.com> > Acked-by: Oliver Neukum <oneukum@suse.de>
Well, I didn't exactly ack this version. I requested a change to the last version, which you did, but you did also other things.
> Acked-by: Zhang, Di <di.zhang@intel.com> > --- > drivers/net/usb/usbnet.c | 6 ++++-- > 1 files changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c > index 90a429b..0603ef6 100644 > --- a/drivers/net/usb/usbnet.c > +++ b/drivers/net/usb/usbnet.c > @@ -86,6 +86,7 @@ static const char driver_name [] = "usbnet"; > > /* use ethtool to change the level for any given device */ > static int msg_level = -1; > +static DECLARE_WAIT_QUEUE_HEAD(unlink_wakeup); > module_param (msg_level, int, 0); > MODULE_PARM_DESC (msg_level, "Override default message level"); > > @@ -761,7 +762,6 @@ EXPORT_SYMBOL_GPL(usbnet_unlink_rx_urbs); > // precondition: never called in_interrupt > static void usbnet_terminate_urbs(struct usbnet *dev) > { > - DECLARE_WAIT_QUEUE_HEAD_ONSTACK(unlink_wakeup); > DECLARE_WAITQUEUE(wait, current); > int temp;
That solves the first problem.
> @@ -1449,7 +1449,9 @@ static void usbnet_bh (unsigned long param) > // waiting for all pending urbs to complete? > if (dev->wait) { > if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) { > - wake_up (dev->wait); > + wait_queue_head_t *wait_d = dev->wait; > + if (wait_d)
Here's the window. Either it can be freed or not. Moving the check won't help.
> + wake_up(wait_d); > } > > // or are we maybe short a few urbs?
Regards Oliver
|  |