Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1765768AbXKOHAn (ORCPT ); Thu, 15 Nov 2007 02:00:43 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S932520AbXKOGrd (ORCPT ); Thu, 15 Nov 2007 01:47:33 -0500 Received: from pentafluge.infradead.org ([213.146.154.40]:58043 "EHLO pentafluge.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932518AbXKOGrb (ORCPT ); Thu, 15 Nov 2007 01:47:31 -0500 Date: Wed, 14 Nov 2007 22:45:02 -0800 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@kernel.org, linux-usb-devel@lists.sourceforge.net Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Benedikt Spranger , Thomas Gleixner , David Brownell Subject: [patch 21/40] usb-gadget-ether: prevent oops caused by error interrupt race Message-ID: <20071115064502.GV19218@kroah.com> References: <20071115062710.885284510@mini.kroah.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline; filename="usb-gadget-ether-prevent-oops-caused-by-error-interrupt-race.patch" In-Reply-To: <20071115064302.GA19218@kroah.com> User-Agent: Mutt/1.5.16 (2007-06-09) X-Bad-Reply: References and In-Reply-To but no 'Re:' in Subject. Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2249 Lines: 61 -stable review patch. If anyone has any objections, please let us know. ------------------ From: Benedikt Spranger patch 5395353e0c8272fe73ac914acd7e4add0da2bef0 in mainline. Fix a longstanding race in the Ethernet gadget driver, which can cause an oops on device disconnect. The fix is just to make the TX path check whether its freelist is empty. That check is otherwise not necessary, since the queue is always stopped when that list empties (and restarted when request completion puts an entry back on that freelist). The race window starts when the network code decides to transmit a packet, and ends when hard_start_xmit() grabs the freelist lock. When disconnect() is called inside that window, it shuts down the TX queue and breaks the otherwise-solid assumption that packets are never sent through a TX queue that's stopped. Signed-off-by: Benedikt Spranger Signed-off-by: Thomas Gleixner Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/ether.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) --- a/drivers/usb/gadget/ether.c +++ b/drivers/usb/gadget/ether.c @@ -1989,8 +1989,20 @@ static int eth_start_xmit (struct sk_buf } spin_lock_irqsave(&dev->req_lock, flags); + /* + * this freelist can be empty if an interrupt triggered disconnect() + * and reconfigured the gadget (shutting down this queue) after the + * network stack decided to xmit but before we got the spinlock. + */ + if (list_empty(&dev->tx_reqs)) { + spin_unlock_irqrestore(&dev->req_lock, flags); + return 1; + } + req = container_of (dev->tx_reqs.next, struct usb_request, list); list_del (&req->list); + + /* temporarily stop TX queue when the freelist empties */ if (list_empty (&dev->tx_reqs)) netif_stop_queue (net); spin_unlock_irqrestore(&dev->req_lock, flags); -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/