Attachment 581432 Details for Bug 815998 – 0001-iwlwifi-fix-a-potential-race-in-receive-buffer-alloc.patch

[patch] 0001-iwlwifi-fix-a-potential-race-in-receive-buffer-alloc.patch

0001-iwlwifi-fix-a-potential-race-in-receive-buffer-alloc.patch (text/plain), 1.57 KB, created by John W. Linville on 2012-05-01 17:20:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: John W. Linville

Created: 2012-05-01 17:20:30 UTC

Size: 1.57 KB

patch

obsolete

>From 5353472345e76deff8c674f6da35f50ef898df44 Mon Sep 17 00:00:00 2001
>From: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
>Date: Mon, 30 Apr 2012 16:28:09 -0700
>Subject: [PATCH] iwlwifi: fix a potential race in receive buffer allocation
>
>The driver can potentially unmap pages that
>have not been mapped yet. Fix this race
>condition.
>
>Change-Id: Idc60cfaa0d483bc835f69788dc608708dd6f524d
>Cc: stable@vger.kernel.org
>Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
>Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
>---
> drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c |    4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)
>
>diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
>index 45d8ca9..8483e8a 100644
>--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
>+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
>@@ -313,7 +313,6 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority)
> 		spin_unlock_irqrestore(&rxq->lock, flags);
> 
> 		BUG_ON(rxb->page);
>-		rxb->page = page;
> 		/* Get physical address of the RB */
> 		rxb->page_dma = dma_map_page(trans->dev, page, 0,
> 				PAGE_SIZE << trans_pcie->rx_page_order,
>@@ -323,6 +322,9 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority)
> 		/* and also 256 byte aligned! */
> 		BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
> 
>+		/* Page *must* be mapped before before updating the rxb. */
>+		rxb->page = page;
>+
> 		spin_lock_irqsave(&rxq->lock, flags);
> 
> 		list_add_tail(&rxb->list, &rxq->rx_free);
>-- 
>1.7.4.1
>

Actions: View | Diff

Attachments on bug 815998: 580046 | 580047 | 581432 | 581642 | 581650 | 584047