Commit:     5395353e0c8272fe73ac914acd7e4add0da2bef0
Parent:     9dcfbd97a695a3c28a867501127fa35ac49bc805
Author:     Benedikt Spranger <[EMAIL PROTECTED]>
AuthorDate: Tue Oct 2 14:40:48 2007 -0700
Committer:  Greg Kroah-Hartman <[EMAIL PROTECTED]>
CommitDate: Fri Oct 12 14:55:30 2007 -0700

    usb-gadget-ether: prevent oops caused by error interrupt race
    Fix a longstanding race in the Ethernet gadget driver, which can cause an
    oops on device disconnect.  The fix is just to make the TX path check
    whether its freelist is empty.  That check is otherwise not necessary,
    since the queue is always stopped when that list empties (and restarted
    when request completion puts an entry back on that freelist).
    The race window starts when the network code decides to transmit a packet,
    and ends when hard_start_xmit() grabs the freelist lock.  When disconnect()
    is called inside that window, it shuts down the TX queue and breaks the
    otherwise-solid assumption that packets are never sent through a TX queue
    that's stopped.
    Signed-off-by: Benedikt Spranger <[EMAIL PROTECTED]>
    Signed-off-by: Thomas Gleixner <[EMAIL PROTECTED]>
    Signed-off-by: David Brownell <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Cc: stable <[EMAIL PROTECTED]>
    Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
 drivers/usb/gadget/ether.c |   12 ++++++++++++
 1 files changed, 12 insertions(+), 0 deletions(-)

diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index ff244f4..9f4fd7e 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -1957,8 +1957,20 @@ static int eth_start_xmit (struct sk_buff *skb, struct 
net_device *net)
        spin_lock_irqsave(&dev->req_lock, flags);
+       /*
+        * this freelist can be empty if an interrupt triggered disconnect()
+        * and reconfigured the gadget (shutting down this queue) after the
+        * network stack decided to xmit but before we got the spinlock.
+        */
+       if (list_empty(&dev->tx_reqs)) {
+               spin_unlock_irqrestore(&dev->req_lock, flags);
+               return 1;
+       }
        req = container_of (dev->, struct usb_request, list);
        list_del (&req->list);
+       /* temporarily stop TX queue when the freelist empties */
        if (list_empty (&dev->tx_reqs))
                netif_stop_queue (net);
        spin_unlock_irqrestore(&dev->req_lock, flags);
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to