Files
kernel_xiaomi_sm8250/include/linux
Oliver Neukum 14a0d635d1 usbnet: include wait queue head in device structure
This fixes a race which happens by freeing an object on the stack.
Quoting Julius:
> The issue is
> that it calls usbnet_terminate_urbs() before that, which temporarily
> installs a waitqueue in dev->wait in order to be able to wait on the
> tasklet to run and finish up some queues. The waiting itself looks
> okay, but the access to 'dev->wait' is totally unprotected and can
> race arbitrarily. I think in this case usbnet_bh() managed to succeed
> it's dev->wait check just before usbnet_terminate_urbs() sets it back
> to NULL. The latter then finishes and the waitqueue_t structure on its
> stack gets overwritten by other functions halfway through the
> wake_up() call in usbnet_bh().

The fix is to just not allocate the data structure on the stack.
As dev->wait is abused as a flag it also takes a runtime PM change
to fix this bug.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Reported-by: Grant Grundler <grundler@google.com>
Tested-by: Grant Grundler <grundler@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-03-27 14:59:10 -04:00
..
2014-01-24 22:39:54 +01:00
2014-02-13 10:08:52 +05:30
2014-03-10 11:44:42 -04:00
2014-03-10 11:44:42 -04:00
2014-03-10 17:26:19 -07:00
2014-03-04 07:55:47 -08:00
2014-01-26 22:48:35 +01:00
2014-02-25 07:37:52 -08:00
2014-01-25 08:55:09 +01:00
2014-01-27 21:02:39 -08:00
2014-01-25 03:14:05 -05:00
2014-01-27 19:27:53 -05:00
2014-01-22 19:36:57 +01:00
2014-01-28 13:20:09 -08:00
2014-01-27 21:02:39 -08:00
2014-01-30 16:56:55 -08:00