aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPavel Machek <pavel@suse.cz>2008-05-02 16:45:10 -0700
committerDavid S. Miller <davem@davemloft.net>2008-05-02 16:45:10 -0700
commit026672d0997c911c9bef9aabe862884fc0add106 (patch)
tree6867e7e256f23102e5f73e267aa8a8b790717467
parent84994e16f25dabe234be4fc2d323ec9db95b87cb (diff)
hci_usb.h: fix hard-to-trigger race
If someone tries to _urb_unlink while _urb_queue_head is running, he'll see _urb->queue == NULL and fail to do any locking. Prevent that from happening by strategically placed barriers. Signed-off-by: Pavel Machek <pavel@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/bluetooth/hci_usb.h21
1 files changed, 13 insertions, 8 deletions
diff --git a/drivers/bluetooth/hci_usb.h b/drivers/bluetooth/hci_usb.h
index 414080a4e8f..1790cc8e431 100644
--- a/drivers/bluetooth/hci_usb.h
+++ b/drivers/bluetooth/hci_usb.h
@@ -70,7 +70,8 @@ static inline void _urb_queue_head(struct _urb_queue *q, struct _urb *_urb)
{
unsigned long flags;
spin_lock_irqsave(&q->lock, flags);
- list_add(&_urb->list, &q->head); _urb->queue = q;
+ /* _urb_unlink needs to know which spinlock to use, thus mb(). */
+ _urb->queue = q; mb(); list_add(&_urb->list, &q->head);
spin_unlock_irqrestore(&q->lock, flags);
}
@@ -78,19 +79,23 @@ static inline void _urb_queue_tail(struct _urb_queue *q, struct _urb *_urb)
{
unsigned long flags;
spin_lock_irqsave(&q->lock, flags);
- list_add_tail(&_urb->list, &q->head); _urb->queue = q;
+ /* _urb_unlink needs to know which spinlock to use, thus mb(). */
+ _urb->queue = q; mb(); list_add_tail(&_urb->list, &q->head);
spin_unlock_irqrestore(&q->lock, flags);
}
static inline void _urb_unlink(struct _urb *_urb)
{
- struct _urb_queue *q = _urb->queue;
+ struct _urb_queue *q;
unsigned long flags;
- if (q) {
- spin_lock_irqsave(&q->lock, flags);
- list_del(&_urb->list); _urb->queue = NULL;
- spin_unlock_irqrestore(&q->lock, flags);
- }
+
+ mb();
+ q = _urb->queue;
+ /* If q is NULL, it will die at easy-to-debug NULL pointer dereference.
+ No need to BUG(). */
+ spin_lock_irqsave(&q->lock, flags);
+ list_del(&_urb->list); _urb->queue = NULL;
+ spin_unlock_irqrestore(&q->lock, flags);
}
struct hci_usb {