diff options
| author | Meenakshi Venkataraman <meenakshi.venkataraman@intel.com> | 2012-04-30 16:28:09 -0700 |
|---|---|---|
| committer | Wey-Yi Guy <wey-yi.w.guy@intel.com> | 2012-05-02 08:06:59 -0700 |
| commit | 1a8bc78860eb21cc0db647ff891ba8afbf070b91 (patch) | |
| tree | c226f274147e380fcaa2b37c47e28b3a82e4b3fb | |
| parent | e2899726a844dfd25094fd992905640a6eab9787 (diff) | |
| download | iwlwifi-1a8bc78860eb21cc0db647ff891ba8afbf070b91.tar.gz | |
iwlwifi: fix a potential race in receive buffer allocation
The driver can potentially unmap pages that
have not been mapped yet. Fix this race
condition.
Cc: stable@vger.kernel.org
Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| -rw-r--r-- | drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c index 45d8ca96c69502..8483e8aa63a1ad 100644 --- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c +++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c @@ -313,7 +313,6 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority) spin_unlock_irqrestore(&rxq->lock, flags); BUG_ON(rxb->page); - rxb->page = page; /* Get physical address of the RB */ rxb->page_dma = dma_map_page(trans->dev, page, 0, PAGE_SIZE << trans_pcie->rx_page_order, @@ -323,6 +322,9 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority) /* and also 256 byte aligned! */ BUG_ON(rxb->page_dma & DMA_BIT_MASK(8)); + /* Page *must* be mapped before before updating the rxb. */ + rxb->page = page; + spin_lock_irqsave(&rxq->lock, flags); list_add_tail(&rxb->list, &rxq->rx_free); |