![]() This fixes a race which happens by freeing an object on the stack. Quoting Julius: > The issue is > that it calls usbnet_terminate_urbs() before that, which temporarily > installs a waitqueue in dev->wait in order to be able to wait on the > tasklet to run and finish up some queues. The waiting itself looks > okay, but the access to 'dev->wait' is totally unprotected and can > race arbitrarily. I think in this case usbnet_bh() managed to succeed > it's dev->wait check just before usbnet_terminate_urbs() sets it back > to NULL. The latter then finishes and the waitqueue_t structure on its > stack gets overwritten by other functions halfway through the > wake_up() call in usbnet_bh(). The fix is to just not allocate the data structure on the stack. As dev->wait is abused as a flag it also takes a runtime PM change to fix this bug. Signed-off-by: Oliver Neukum <oneukum@suse.de> Reported-by: Grant Grundler <grundler@google.com> Tested-by: Grant Grundler <grundler@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
---|---|---|
.. | ||
association.h | ||
atmel_usba_udc.h | ||
audio-v2.h | ||
audio.h | ||
c67x00.h | ||
cdc-wdm.h | ||
cdc_ncm.h | ||
ch9.h | ||
chipidea.h | ||
composite.h | ||
ehci_def.h | ||
ehci_pdriver.h | ||
ezusb.h | ||
functionfs.h | ||
g_hid.h | ||
gadget.h | ||
gadget_configfs.h | ||
gpio_vbus.h | ||
hcd.h | ||
input.h | ||
iowarrior.h | ||
irda.h | ||
isp116x.h | ||
isp1301.h | ||
isp1362.h | ||
isp1760.h | ||
m66592.h | ||
msm_hsusb.h | ||
msm_hsusb_hw.h | ||
musb-omap.h | ||
musb-ux500.h | ||
musb.h | ||
net2280.h | ||
of.h | ||
ohci_pdriver.h | ||
omap_control_usb.h | ||
omap_usb.h | ||
otg-fsm.h | ||
otg.h | ||
phy.h | ||
phy_companion.h | ||
quirks.h | ||
r8a66597.h | ||
renesas_usbhs.h | ||
rndis_host.h | ||
samsung_usb_phy.h | ||
serial.h | ||
sl811.h | ||
storage.h | ||
tegra_usb_phy.h | ||
tilegx.h | ||
uas.h | ||
ulpi.h | ||
usb_phy_gen_xceiv.h | ||
usbnet.h | ||
wusb-wa.h | ||
wusb.h |