Messages in this thread Patch in this message | | | Subject | [PATCH] usb-gadget-ether: Prevent oops caused by error interrupt race | From | Thomas Gleixner <> | Date | Thu, 20 Sep 2007 16:46:51 +0200 |
| |
From: Benedikt Spranger <bene@linutronix.de>
An USB error interrupt (e.g. disconnect) nukes the pending requests for an ethernet gadget device asynchronously. This can race against eth_start_xmit(), where we end up dereferencing the list head itself.
The nuke code is serialized against eth_start_xmit via dev->req_lock, but we need to check the list for empty first instead of unconditionally accessing dev->tx_reqs.next.
This is a long standing bug, which should be fixed in stable as well.
Signed-off-by: Benedikt Spranger <bene@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c index 593e235..f1d7c82 100644 --- a/drivers/usb/gadget/ether.c +++ b/drivers/usb/gadget/ether.c @@ -1989,8 +1989,20 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net) } spin_lock_irqsave(&dev->req_lock, flags); + /* + * dev->tx_reqs may be empty due to an error interrupt which + * nuked all requests. + */ + if (list_empty(&dev->tx_reqs)) { + netif_stop_queue(net); + spin_unlock_irqrestore(&dev->req_lock, flags); + return 1; + } + req = container_of (dev->tx_reqs.next, struct usb_request, list); list_del (&req->list); + + /* last request in list: stop queue */ if (list_empty (&dev->tx_reqs)) netif_stop_queue (net); spin_unlock_irqrestore(&dev->req_lock, flags);
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |