1. 27 4月, 2010 2 次提交
    • S
      ath9k_htc: Simplify TX URB management · c11d8f89
      Sujith 提交于
      This patch simplifies URB management for transmission,
      by removing the 'FLUSH' variable (which is not needed,
      since we can determine if the URB has been killed by
      looking at the URB status), and also handling the STOP
      case properly.
      Signed-off-by: NSujith <Sujith.Manoharan@atheros.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      c11d8f89
    • H
      p54pci: fix regression from prevent stuck rx-ring on slow system · d4cde88c
      Hans de Goede 提交于
      This patch fixes a recently introduced use-after-free regression
      from "p54pci: prevent stuck rx-ring on slow system".
      
      Hans de Goede reported a use-after-free regression:
      >BUG: unable to handle kernel paging request at 6b6b6b6b
      >IP: [<e122284a>] p54p_check_tx_ring+0x84/0xb1 [p54pci]
      >*pde = 00000000
      >Oops: 0000 [#1] SMP
      >EIP: 0060:[<e122284a>] EFLAGS: 00010286 CPU: 0
      >EIP is at p54p_check_tx_ring+0x84/0xb1 [p54pci]
      >EAX: 6b6b6b6b EBX: df10b170 ECX: 00000003 EDX: 00000001
      >ESI: dc471500 EDI: d8acaeb0 EBP: c098be9c ESP: c098be84
      > DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
      >Process swapper (pid: 0, ti=c098a000 task=c09ccfe0 task.ti=c098a000)
      >Call Trace:
      > [<e1222b02>] ? p54p_tasklet+0xaa/0xb5 [p54pci]
      > [<c0440568>] ? tasklet_action+0x78/0xcb
      > [<c0440ed3>] ? __do_softirq+0xbc/0x173
      
      Quote from comment #17:
      "The problem is the innocent looking moving of the tx processing to
       after the rx processing in the tasklet. Quoting from the changelog:
        This patch does it the same way, except that it also prioritize
        rx data processing, simply because tx routines *can* wait.
      
       This is causing an issue with us referencing already freed memory,
       because some skb's we transmit, we immediately receive back, such
       as those for reading the eeprom (*) and getting stats.
      
       What can happen because of the moving of the tx processing to after
       the rx processing is that when the tasklet first runs after doing a
       special skb tx (such as eeprom) we've already received the answer
       to it.
      
       Then the rx processing ends up calling p54_find_and_unlink_skb to
       find the matching tx skb for the just received special rx skb and
       frees the tx skb.
      
       Then after the processing of the rx skb answer, and thus freeing
       the tx skb, we go process the completed tx ring entires, and then
       dereference the free-ed skb, to see if it should free free-ed by
       p54p_check_tx_ring()."
      
      Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623Bug-Identified-by: NHans de Goede <hdegoede@redhat.com>
      Signed-off-by: NHans de Goede <hdegoede@redhat.com>
      Signed-off-by: NChristian Lamparter <chunkeey@googlemail.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      d4cde88c
  2. 22 4月, 2010 2 次提交
  3. 20 4月, 2010 15 次提交
  4. 17 4月, 2010 21 次提交