diff options
| author | Linas Vepstas <linas@austin.ibm.com> | 2007-02-20 16:41:03 -0600 |
|---|---|---|
| committer | Jeff Garzik <jeff@garzik.org> | 2007-02-27 04:16:03 -0500 |
| commit | d9c199ee781fa874e6feb4c56ae3d0e19f7f82a6 (patch) | |
| tree | 6f4975a6b8f8aa00dc2d6cf6463a385f9d736a2c /drivers/net/spider_net.c | |
| parent | 4cb6f9e57d5d7c26d08809c1ce6310c8a7dc96d2 (diff) | |
spidernet: fix racy double-free of skb
It appears that under certain circumstances, a race will result
in a double-free of an skb. This patch null's out the skb pointer
upon the skb free, avoiding the inadvertent deref of bogus data.
The next patch fixes the actual race.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com>
Cc: Jens Osterkamp <Jens.Osterkamp@de.ibm.com>
Cc: Kou Ishizaki <kou.ishizaki@toshiba.co.jp>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net/spider_net.c')
| -rw-r--r-- | drivers/net/spider_net.c | 23 |
1 files changed, 15 insertions, 8 deletions
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c index 10f9e29c1bbf..15b0bcaec467 100644 --- a/drivers/net/spider_net.c +++ b/drivers/net/spider_net.c @@ -396,10 +396,11 @@ spider_net_free_rx_chain_contents(struct spider_net_card *card) descr = card->rx_chain.head; do { if (descr->skb) { - dev_kfree_skb(descr->skb); pci_unmap_single(card->pdev, descr->hwdescr->buf_addr, SPIDER_NET_MAX_FRAME, PCI_DMA_BIDIRECTIONAL); + dev_kfree_skb(descr->skb); + descr->skb = NULL; } descr = descr->next; } while (descr != card->rx_chain.head); @@ -453,6 +454,7 @@ spider_net_prepare_rx_descr(struct spider_net_card *card, SPIDER_NET_MAX_FRAME, PCI_DMA_FROMDEVICE); if (pci_dma_mapping_error(buf)) { dev_kfree_skb_any(descr->skb); + descr->skb = NULL; if (netif_msg_rx_err(card) && net_ratelimit()) pr_err("Could not iommu-map rx buffer\n"); card->spider_stats.rx_iommu_map_error++; @@ -682,6 +684,7 @@ static int spider_net_prepare_tx_descr(struct spider_net_card *card, struct sk_buff *skb) { + struct spider_net_descr_chain *chain = &card->tx_chain; struct spider_net_descr *descr; struct spider_net_hw_descr *hwdescr; dma_addr_t buf; @@ -696,10 +699,15 @@ spider_net_prepare_tx_descr(struct spider_net_card *card, return -ENOMEM; } - spin_lock_irqsave(&card->tx_chain.lock, flags); + spin_lock_irqsave(&chain->lock, flags); descr = card->tx_chain.head; + if (descr->next == chain->tail->prev) { + spin_unlock_irqrestore(&chain->lock, flags); + pci_unmap_single(card->pdev, buf, skb->len, PCI_DMA_TODEVICE); + return -ENOMEM; + } hwdescr = descr->hwdescr; - card->tx_chain.head = descr->next; + chain->head = descr->next; descr->skb = skb; hwdescr->buf_addr = buf; @@ -709,7 +717,7 @@ spider_net_prepare_tx_descr(struct spider_net_card *card, hwdescr->dmac_cmd_status = SPIDER_NET_DESCR_CARDOWNED | SPIDER_NET_DMAC_NOCS; - spin_unlock_irqrestore(&card->tx_chain.lock, flags); + spin_unlock_irqrestore(&chain->lock, flags); if (skb->protocol == htons(ETH_P_IP)) switch (skb->nh.iph->protocol) { @@ -838,6 +846,7 @@ spider_net_release_tx_chain(struct spider_net_card *card, int brutal) chain->tail = descr->next; hwdescr->dmac_cmd_status |= SPIDER_NET_DESCR_NOT_IN_USE; skb = descr->skb; + descr->skb = NULL; buf_addr = hwdescr->buf_addr; spin_unlock_irqrestore(&chain->lock, flags); @@ -903,13 +912,10 @@ spider_net_xmit(struct sk_buff *skb, struct net_device *netdev) { int cnt; struct spider_net_card *card = netdev_priv(netdev); - struct spider_net_descr_chain *chain = &card->tx_chain; spider_net_release_tx_chain(card, 0); - if ((chain->head->next == chain->tail->prev) || - (spider_net_prepare_tx_descr(card, skb) != 0)) { - + if (spider_net_prepare_tx_descr(card, skb) != 0) { card->netdev_stats.tx_dropped++; netif_stop_queue(netdev); return NETDEV_TX_BUSY; @@ -1127,6 +1133,7 @@ spider_net_decode_one_descr(struct spider_net_card *card) bad_desc: dev_kfree_skb_irq(descr->skb); + descr->skb = NULL; hwdescr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE; return 0; } |