mirror of
https://git.yoctoproject.org/meta-ti
synced 2026-07-27 14:28:05 +00:00
Koen Kooi
7df8fc578b
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net> Signed-off-by: Denys Dmytriyenko <denys@ti.com>
64 lines
2.4 KiB
Diff
64 lines
2.4 KiB
Diff
From 50090beeab6611dbfccd8565bf6a6a97beddc6ee Mon Sep 17 00:00:00 2001
|
|
From: Stanislaw Gruszka <sgruszka@redhat.com>
|
|
Date: Thu, 8 Mar 2012 13:16:01 +0100
|
|
Subject: [PATCH 08/10] iwl3945: fix possible il->txq NULL pointer dereference
|
|
in delayed works
|
|
|
|
commit 210787e82a0ac1ffb5d7be1c796f0c51050849ad upstream.
|
|
|
|
On il3945_down procedure we free tx queue data and nullify il->txq
|
|
pointer. After that we drop mutex and then cancel delayed works. There
|
|
is possibility, that after drooping mutex and before the cancel, some
|
|
delayed work will start and crash while trying to send commands to
|
|
the device. For example, here is reported crash in
|
|
il3945_bg_reg_txpower_periodic():
|
|
https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10
|
|
|
|
Patch fix problem by adding il->txq check on works that send commands,
|
|
hence utilize tx queue.
|
|
|
|
Reported-by: Clemens Eisserer <linuxhippy@gmail.com>
|
|
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
|
|
Signed-off-by: John W. Linville <linville@tuxdriver.com>
|
|
---
|
|
drivers/net/wireless/iwlegacy/iwl-3945.c | 7 ++++---
|
|
drivers/net/wireless/iwlegacy/iwl3945-base.c | 2 +-
|
|
2 files changed, 5 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/drivers/net/wireless/iwlegacy/iwl-3945.c b/drivers/net/wireless/iwlegacy/iwl-3945.c
|
|
index f7c0a74..7d1aa7c 100644
|
|
--- a/drivers/net/wireless/iwlegacy/iwl-3945.c
|
|
+++ b/drivers/net/wireless/iwlegacy/iwl-3945.c
|
|
@@ -1870,11 +1870,12 @@ static void iwl3945_bg_reg_txpower_periodic(struct work_struct *work)
|
|
struct iwl_priv *priv = container_of(work, struct iwl_priv,
|
|
_3945.thermal_periodic.work);
|
|
|
|
- if (test_bit(STATUS_EXIT_PENDING, &priv->status))
|
|
- return;
|
|
-
|
|
mutex_lock(&priv->mutex);
|
|
+ if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL)
|
|
+ goto out;
|
|
+
|
|
iwl3945_reg_txpower_periodic(priv);
|
|
+out:
|
|
mutex_unlock(&priv->mutex);
|
|
}
|
|
|
|
diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
|
|
index 05f2ad1..b3d9f3f 100644
|
|
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
|
|
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
|
|
@@ -2513,7 +2513,7 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
|
|
container_of(data, struct iwl_priv, alive_start.work);
|
|
|
|
mutex_lock(&priv->mutex);
|
|
- if (test_bit(STATUS_EXIT_PENDING, &priv->status))
|
|
+ if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL)
|
|
goto out;
|
|
|
|
iwl3945_alive_start(priv);
|
|
--
|
|
1.7.9.4
|
|
|