From: Rasesh Mody <rmody@brocade.com>
To: <davem@davemloft.net>, <netdev@vger.kernel.org>
Cc: <adapter_linux_open_src_team@brocade.com>,
Rasesh Mody <rmody@brocade.com>,
Gurunatha Karaje <gkaraje@brocade.com>
Subject: [net-next 3/3] bna: Eliminate Small Race Condition Window in RX Path
Date: Fri, 16 Sep 2011 18:06:48 -0700 [thread overview]
Message-ID: <1316221608-21392-3-git-send-email-rmody@brocade.com> (raw)
In-Reply-To: <1316221608-21392-1-git-send-email-rmody@brocade.com>
Change details:
- In a continuous sequence of ifconfig up/down operations, there is a small
window of race between bnad_set_rx_mode() and bnad_cleanup_rx() while the
former tries to access rx_info->rx & the latter sets it to NULL. This race
could lead to bna_rx_mode_set() being called with a NULL (rx_info->rx)
pointer and a crash.
- Hold bnad->bna_lock while setting / unsetting rx_info->rx in bnad_setup_rx()
& bnad_cleanup_rx(), thereby eliminating the race described above.
Signed-off-by: Gurunatha Karaje <gkaraje@brocade.com>
Signed-off-by: Rasesh Mody <rmody@brocade.com>
---
drivers/net/ethernet/brocade/bna/bnad.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index 33ab1f8..abca139 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -1875,10 +1875,10 @@ bnad_cleanup_rx(struct bnad *bnad, u32 rx_id)
spin_lock_irqsave(&bnad->bna_lock, flags);
bna_rx_destroy(rx_info->rx);
- spin_unlock_irqrestore(&bnad->bna_lock, flags);
rx_info->rx = NULL;
rx_info->rx_id = 0;
+ spin_unlock_irqrestore(&bnad->bna_lock, flags);
bnad_rx_res_free(bnad, res_info);
}
@@ -1932,12 +1932,13 @@ bnad_setup_rx(struct bnad *bnad, u32 rx_id)
spin_lock_irqsave(&bnad->bna_lock, flags);
rx = bna_rx_create(&bnad->bna, bnad, rx_config, &rx_cbfn, res_info,
rx_info);
- spin_unlock_irqrestore(&bnad->bna_lock, flags);
if (!rx) {
err = -ENOMEM;
+ spin_unlock_irqrestore(&bnad->bna_lock, flags);
goto err_return;
}
rx_info->rx = rx;
+ spin_unlock_irqrestore(&bnad->bna_lock, flags);
/*
* Init NAPI, so that state is set to NAPI_STATE_SCHED,
--
1.7.1
next prev parent reply other threads:[~2011-09-17 1:07 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-09-17 1:06 [net-next 1/3] bna: Semaphore Lock Fix Rasesh Mody
2011-09-17 1:06 ` [net-next 2/3] bna: Set Ring Param Fix Rasesh Mody
2011-09-17 4:48 ` David Miller
2011-09-17 1:06 ` Rasesh Mody [this message]
2011-09-17 4:48 ` [net-next 3/3] bna: Eliminate Small Race Condition Window in RX Path David Miller
2011-09-17 4:48 ` [net-next 1/3] bna: Semaphore Lock Fix David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1316221608-21392-3-git-send-email-rmody@brocade.com \
--to=rmody@brocade.com \
--cc=adapter_linux_open_src_team@brocade.com \
--cc=davem@davemloft.net \
--cc=gkaraje@brocade.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).