From 026672d0997c911c9bef9aabe862884fc0add106 Mon Sep 17 00:00:00 2001 From: Pavel Machek Date: Fri, 2 May 2008 16:45:10 -0700 Subject: hci_usb.h: fix hard-to-trigger race If someone tries to _urb_unlink while _urb_queue_head is running, he'll see _urb->queue == NULL and fail to do any locking. Prevent that from happening by strategically placed barriers. Signed-off-by: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: David S. Miller --- drivers/bluetooth/hci_usb.h | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) (limited to 'drivers') diff --git a/drivers/bluetooth/hci_usb.h b/drivers/bluetooth/hci_usb.h index 414080a..1790cc8 100644 --- a/drivers/bluetooth/hci_usb.h +++ b/drivers/bluetooth/hci_usb.h @@ -70,7 +70,8 @@ static inline void _urb_queue_head(struct _urb_queue *q, struct _urb *_urb) { unsigned long flags; spin_lock_irqsave(&q->lock, flags); - list_add(&_urb->list, &q->head); _urb->queue = q; + /* _urb_unlink needs to know which spinlock to use, thus mb(). */ + _urb->queue = q; mb(); list_add(&_urb->list, &q->head); spin_unlock_irqrestore(&q->lock, flags); } @@ -78,19 +79,23 @@ static inline void _urb_queue_tail(struct _urb_queue *q, struct _urb *_urb) { unsigned long flags; spin_lock_irqsave(&q->lock, flags); - list_add_tail(&_urb->list, &q->head); _urb->queue = q; + /* _urb_unlink needs to know which spinlock to use, thus mb(). */ + _urb->queue = q; mb(); list_add_tail(&_urb->list, &q->head); spin_unlock_irqrestore(&q->lock, flags); } static inline void _urb_unlink(struct _urb *_urb) { - struct _urb_queue *q = _urb->queue; + struct _urb_queue *q; unsigned long flags; - if (q) { - spin_lock_irqsave(&q->lock, flags); - list_del(&_urb->list); _urb->queue = NULL; - spin_unlock_irqrestore(&q->lock, flags); - } + + mb(); + q = _urb->queue; + /* If q is NULL, it will die at easy-to-debug NULL pointer dereference. + No need to BUG(). */ + spin_lock_irqsave(&q->lock, flags); + list_del(&_urb->list); _urb->queue = NULL; + spin_unlock_irqrestore(&q->lock, flags); } struct hci_usb { -- cgit v1.1