On Thursday 20 September 2007, Thomas Gleixner wrote:
> From: Benedikt Spranger <[email protected]>
>
> An USB error interrupt (e.g. disconnect) nukes the pending requests for
> an ethernet gadget device asynchronously. This can race against
> eth_start_xmit(), where we end up dereferencing the list head itself.
>
> The nuke code is serialized against eth_start_xmit via dev->req_lock,
> but we need to check the list for empty first instead of unconditionally
> accessing dev->tx_reqs.next.
Looks OK, although the comments are confusingly incorrect which
made it hard to see what this was doing:
- There is no "nuke()" method in this driver, even comments
don't use that term.
- When "nuke" is used in the gadget stack, it means the way
that controller drivers scrub out a queue of live requests
queued to an endpoint ... *NOT* recycling memory that sits
on a freelist, which is what's involved here.
- Disconnect is *NOT* an error, it's a routine occurrence
which can happen at essentially any time.
If you update the patch and comments accordingly, ACK.
> This is a long standing bug, which should be fixed in stable as well.
>
> Signed-off-by: Benedikt Spranger <[email protected]>
> Signed-off-by: Thomas Gleixner <[email protected]>
>
> diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
> index 593e235..f1d7c82 100644
> --- a/drivers/usb/gadget/ether.c
> +++ b/drivers/usb/gadget/ether.c
> @@ -1989,8 +1989,20 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
> }
>
> spin_lock_irqsave(&dev->req_lock, flags);
> + /*
> + * dev->tx_reqs may be empty due to an error interrupt which
Please reword: "may be empty because disconnecting an
active device cleans out this freelist".
> + * nuked all requests.
> + */
> + if (list_empty(&dev->tx_reqs)) {
> + netif_stop_queue(net);
> + spin_unlock_irqrestore(&dev->req_lock, flags);
> + return 1;
> + }
> +
> req = container_of (dev->tx_reqs.next, struct usb_request, list);
> list_del (&req->list);
> +
> + /* last request in list: stop queue */
> if (list_empty (&dev->tx_reqs))
> netif_stop_queue (net);
> spin_unlock_irqrestore(&dev->req_lock, flags);
>
>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
