bna: Eliminate Small Race Condition Window in RX Path
authorRasesh Mody <rmody@brocade.com>
Fri, 16 Sep 2011 15:06:48 +0000 (15:06 +0000)
committerDavid S. Miller <davem@davemloft.net>
Sat, 17 Sep 2011 04:47:57 +0000 (00:47 -0400)
Change details:
 - In a continuous sequence of ifconfig up/down operations, there is a small
   window of race between bnad_set_rx_mode() and bnad_cleanup_rx() while the
   former tries to access rx_info->rx & the latter sets it to NULL. This race
   could lead to bna_rx_mode_set() being called with a NULL (rx_info->rx)
   pointer and a crash.
 - Hold bnad->bna_lock while setting / unsetting rx_info->rx in bnad_setup_rx()
   & bnad_cleanup_rx(), thereby eliminating the race described above.

Signed-off-by: Gurunatha Karaje <gkaraje@brocade.com>
Signed-off-by: Rasesh Mody <rmody@brocade.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/brocade/bna/bnad.c

index 33ab1f81c1c26c621508cbd1d50be5e4d1ff27d1..abca1399fe5104e611c171156f5451dc7569636b 100644 (file)
@@ -1875,10 +1875,10 @@ bnad_cleanup_rx(struct bnad *bnad, u32 rx_id)
 
        spin_lock_irqsave(&bnad->bna_lock, flags);
        bna_rx_destroy(rx_info->rx);
-       spin_unlock_irqrestore(&bnad->bna_lock, flags);
 
        rx_info->rx = NULL;
        rx_info->rx_id = 0;
+       spin_unlock_irqrestore(&bnad->bna_lock, flags);
 
        bnad_rx_res_free(bnad, res_info);
 }
@@ -1932,12 +1932,13 @@ bnad_setup_rx(struct bnad *bnad, u32 rx_id)
        spin_lock_irqsave(&bnad->bna_lock, flags);
        rx = bna_rx_create(&bnad->bna, bnad, rx_config, &rx_cbfn, res_info,
                        rx_info);
-       spin_unlock_irqrestore(&bnad->bna_lock, flags);
        if (!rx) {
                err = -ENOMEM;
+               spin_unlock_irqrestore(&bnad->bna_lock, flags);
                goto err_return;
        }
        rx_info->rx = rx;
+       spin_unlock_irqrestore(&bnad->bna_lock, flags);
 
        /*
         * Init NAPI, so that state is set to NAPI_STATE_SCHED,