summaryrefslogtreecommitdiffstats
path: root/drivers/net
diff options
context:
space:
mode:
authorInaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>2010-05-20 12:27:58 -0700
committerInaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>2010-05-20 12:27:58 -0700
commit3a24934f065d23145f1c9c70da9f630c7a37795f (patch)
tree0fac89df5f2749e21a45d2c07cf99d16e05ef2fc /drivers/net
parent0fb0a4f00aaf5de9f328273d7a46e3aa27dab496 (diff)
downloadlinux-stable-3a24934f065d23145f1c9c70da9f630c7a37795f.tar.gz
linux-stable-3a24934f065d23145f1c9c70da9f630c7a37795f.tar.bz2
linux-stable-3a24934f065d23145f1c9c70da9f630c7a37795f.zip
wimax/i2400m: fix bad race condition check in RX path
The i2400m->rx_roq data structure is protected against race conditions with a reference count (i2400m->rx_roq_refcount); the pointer can be read-referenced under the i2400m->rx_lock spinlock. The code in i2400m_rx_edata() wasn't properly following access protocol, performing an invalid check on i2400m->rx_roq (which is cleared to NULL when the refcount drops to zero). As such, it was missing to detect when the data structure is no longer valid and oopsing with a NULL pointer dereference. This commit fixes said check by verifying, under the rx_lock spinlock, that i2400m->rx_roq is non-NULL and then increasing the reference count before dropping the spinlock. Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/wimax/i2400m/rx.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index c835ae8b89ce..6cd12d64fc7a 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -1033,12 +1033,12 @@ void i2400m_rx_edata(struct i2400m *i2400m, struct sk_buff *skb_rx,
ro_sn = (reorder >> I2400M_RO_SN_SHIFT) & I2400M_RO_SN;
spin_lock_irqsave(&i2400m->rx_lock, flags);
- roq = &i2400m->rx_roq[ro_cin];
- if (roq == NULL) {
+ if (i2400m->rx_roq == NULL) {
kfree_skb(skb); /* rx_roq is already destroyed */
spin_unlock_irqrestore(&i2400m->rx_lock, flags);
goto error;
}
+ roq = &i2400m->rx_roq[ro_cin];
kref_get(&i2400m->rx_roq_refcount);
spin_unlock_irqrestore(&i2400m->rx_lock, flags);