hci_usb.h: fix hard-to-trigger race

From: Pavel Machek
Date: Tue Apr 01 2008 - 10:04:29 EST



If someone tries to _urb_unlink while _urb_queue_head is running,
he'll see _urb->queue == NULL and fail to do any locking. Prevent that
from happening by strategically placed barriers.

Signed-off-by: Pavel Machek <pavel@xxxxxxx>

diff --git a/drivers/bluetooth/hci_usb.h b/drivers/bluetooth/hci_usb.h
index 414080a..1790cc8 100644
--- a/drivers/bluetooth/hci_usb.h
+++ b/drivers/bluetooth/hci_usb.h
@@ -70,7 +70,8 @@ static inline void _urb_queue_head(struc
{
unsigned long flags;
spin_lock_irqsave(&q->lock, flags);
- list_add(&_urb->list, &q->head); _urb->queue = q;
+ /* _urb_unlink needs to know which spinlock to use, thus mb(). */
+ _urb->queue = q; mb(); list_add(&_urb->list, &q->head);
spin_unlock_irqrestore(&q->lock, flags);
}

@@ -78,19 +79,23 @@ static inline void _urb_queue_tail(struc
{
unsigned long flags;
spin_lock_irqsave(&q->lock, flags);
- list_add_tail(&_urb->list, &q->head); _urb->queue = q;
+ /* _urb_unlink needs to know which spinlock to use, thus mb(). */
+ _urb->queue = q; mb(); list_add_tail(&_urb->list, &q->head);
spin_unlock_irqrestore(&q->lock, flags);
}

static inline void _urb_unlink(struct _urb *_urb)
{
- struct _urb_queue *q = _urb->queue;
+ struct _urb_queue *q;
unsigned long flags;
- if (q) {
- spin_lock_irqsave(&q->lock, flags);
- list_del(&_urb->list); _urb->queue = NULL;
- spin_unlock_irqrestore(&q->lock, flags);
- }
+
+ mb();
+ q = _urb->queue;
+ /* If q is NULL, it will die at easy-to-debug NULL pointer dereference.
+ No need to BUG(). */
+ spin_lock_irqsave(&q->lock, flags);
+ list_del(&_urb->list); _urb->queue = NULL;
+ spin_unlock_irqrestore(&q->lock, flags);
}

struct hci_usb {


--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/