Commit c0350024 authored by Christian Lamparter's avatar Christian Lamparter Committed by John W. Linville

p54: fix race condition in memory management

This patch fixes a number of race conditions in the driver.
Up until now, "entry" pointer was initialized before acquiring the right lock.
Signed-off-by: default avatarChristian Lamparter <chunkeey@web.de>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent bd05f28e
...@@ -710,10 +710,11 @@ static struct sk_buff *p54_find_tx_entry(struct ieee80211_hw *dev, ...@@ -710,10 +710,11 @@ static struct sk_buff *p54_find_tx_entry(struct ieee80211_hw *dev,
__le32 req_id) __le32 req_id)
{ {
struct p54_common *priv = dev->priv; struct p54_common *priv = dev->priv;
struct sk_buff *entry = priv->tx_queue.next; struct sk_buff *entry;
unsigned long flags; unsigned long flags;
spin_lock_irqsave(&priv->tx_queue.lock, flags); spin_lock_irqsave(&priv->tx_queue.lock, flags);
entry = priv->tx_queue.next;
while (entry != (struct sk_buff *)&priv->tx_queue) { while (entry != (struct sk_buff *)&priv->tx_queue) {
struct p54_hdr *hdr = (struct p54_hdr *) entry->data; struct p54_hdr *hdr = (struct p54_hdr *) entry->data;
...@@ -732,7 +733,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb) ...@@ -732,7 +733,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
struct p54_common *priv = dev->priv; struct p54_common *priv = dev->priv;
struct p54_hdr *hdr = (struct p54_hdr *) skb->data; struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
struct p54_frame_sent *payload = (struct p54_frame_sent *) hdr->data; struct p54_frame_sent *payload = (struct p54_frame_sent *) hdr->data;
struct sk_buff *entry = (struct sk_buff *) priv->tx_queue.next; struct sk_buff *entry;
u32 addr = le32_to_cpu(hdr->req_id) - priv->headroom; u32 addr = le32_to_cpu(hdr->req_id) - priv->headroom;
struct memrecord *range = NULL; struct memrecord *range = NULL;
u32 freed = 0; u32 freed = 0;
...@@ -741,6 +742,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb) ...@@ -741,6 +742,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
int count, idx; int count, idx;
spin_lock_irqsave(&priv->tx_queue.lock, flags); spin_lock_irqsave(&priv->tx_queue.lock, flags);
entry = (struct sk_buff *) priv->tx_queue.next;
while (entry != (struct sk_buff *)&priv->tx_queue) { while (entry != (struct sk_buff *)&priv->tx_queue) {
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry); struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
struct p54_hdr *entry_hdr; struct p54_hdr *entry_hdr;
...@@ -976,7 +978,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb, ...@@ -976,7 +978,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
struct p54_hdr *data, u32 len) struct p54_hdr *data, u32 len)
{ {
struct p54_common *priv = dev->priv; struct p54_common *priv = dev->priv;
struct sk_buff *entry = priv->tx_queue.next; struct sk_buff *entry;
struct sk_buff *target_skb = NULL; struct sk_buff *target_skb = NULL;
struct ieee80211_tx_info *info; struct ieee80211_tx_info *info;
struct memrecord *range; struct memrecord *range;
...@@ -1014,6 +1016,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb, ...@@ -1014,6 +1016,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
} }
} }
entry = priv->tx_queue.next;
while (left--) { while (left--) {
u32 hole_size; u32 hole_size;
info = IEEE80211_SKB_CB(entry); info = IEEE80211_SKB_CB(entry);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment