diff options
| author | thompsa <thompsa@FreeBSD.org> | 2009-03-06 17:04:47 +0000 |
|---|---|---|
| committer | thompsa <thompsa@FreeBSD.org> | 2009-03-06 17:04:47 +0000 |
| commit | cfbd0f43120b3f525e9fc31179c96b4f2d0a0c01 (patch) | |
| tree | 41c88a256f20b5147a4c113007a2c82a7bc82b94 /sys/dev/usb | |
| parent | 84bab6f2a5f7b42982b7a5b58805d10cb9d29094 (diff) | |
| download | FreeBSD-src-cfbd0f43120b3f525e9fc31179c96b4f2d0a0c01.zip FreeBSD-src-cfbd0f43120b3f525e9fc31179c96b4f2d0a0c01.tar.gz | |
Ensure the cached rq pointer is still valid before waking up the address, the
zyd_cmd function may have timed out. It wouldnt cause a panic but could wakeup
someone.
Spotted by: HPS
Diffstat (limited to 'sys/dev/usb')
| -rw-r--r-- | sys/dev/usb/wlan/if_zyd.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/sys/dev/usb/wlan/if_zyd.c b/sys/dev/usb/wlan/if_zyd.c index 9eab351..fa9580a 100644 --- a/sys/dev/usb/wlan/if_zyd.c +++ b/sys/dev/usb/wlan/if_zyd.c @@ -796,10 +796,14 @@ zyd_intr_write_callback(struct usb2_xfer *xfer) switch (USB_GET_STATE(xfer)) { case USB_ST_TRANSFERRED: - rqp = xfer->priv_fifo; - DPRINTF(sc, ZYD_DEBUG_CMD, "command %p transferred\n", rqp); - if ((rqp->flags & ZYD_CMD_FLAG_READ) == 0) - wakeup(rqp); /* wakeup caller */ + DPRINTF(sc, ZYD_DEBUG_CMD, "command %p transferred\n", + xfer->priv_fifo); + STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) { + /* Ensure the cached rq pointer is still valid */ + if (rqp == xfer->priv_fifo && + (rqp->flags & ZYD_CMD_FLAG_READ) == 0) + wakeup(rqp); /* wakeup caller */ + } /* FALLTHROUGH */ case USB_ST_SETUP: |
