14a0d635d1
This fixes a race which happens by freeing an object on the stack. Quoting Julius: > The issue is > that it calls usbnet_terminate_urbs() before that, which temporarily > installs a waitqueue in dev->wait in order to be able to wait on the > tasklet to run and finish up some queues. The waiting itself looks > okay, but the access to 'dev->wait' is totally unprotected and can > race arbitrarily. I think in this case usbnet_bh() managed to succeed > it's dev->wait check just before usbnet_terminate_urbs() sets it back > to NULL. The latter then finishes and the waitqueue_t structure on its > stack gets overwritten by other functions halfway through the > wake_up() call in usbnet_bh(). The fix is to just not allocate the data structure on the stack. As dev->wait is abused as a flag it also takes a runtime PM change to fix this bug. Signed-off-by: Oliver Neukum <oneukum@suse.de> Reported-by: Grant Grundler <grundler@google.com> Tested-by: Grant Grundler <grundler@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| association.h | ||
| atmel_usba_udc.h | ||
| audio-v2.h | ||
| audio.h | ||
| c67x00.h | ||
| cdc-wdm.h | ||
| cdc_ncm.h | ||
| ch9.h | ||
| chipidea.h | ||
| composite.h | ||
| ehci_def.h | ||
| ehci_pdriver.h | ||
| ezusb.h | ||
| functionfs.h | ||
| g_hid.h | ||
| gadget.h | ||
| gadget_configfs.h | ||
| gpio_vbus.h | ||
| hcd.h | ||
| input.h | ||
| iowarrior.h | ||
| irda.h | ||
| isp116x.h | ||
| isp1301.h | ||
| isp1362.h | ||
| isp1760.h | ||
| m66592.h | ||
| msm_hsusb.h | ||
| msm_hsusb_hw.h | ||
| musb-omap.h | ||
| musb-ux500.h | ||
| musb.h | ||
| net2280.h | ||
| of.h | ||
| ohci_pdriver.h | ||
| omap_control_usb.h | ||
| omap_usb.h | ||
| otg-fsm.h | ||
| otg.h | ||
| phy.h | ||
| phy_companion.h | ||
| quirks.h | ||
| r8a66597.h | ||
| renesas_usbhs.h | ||
| rndis_host.h | ||
| samsung_usb_phy.h | ||
| serial.h | ||
| sl811.h | ||
| storage.h | ||
| tegra_usb_phy.h | ||
| tilegx.h | ||
| uas.h | ||
| ulpi.h | ||
| usb_phy_gen_xceiv.h | ||
| usbnet.h | ||
| wusb-wa.h | ||
| wusb.h | ||