• Ming Lei's avatar
    usbnet: fix skb traversing races during unlink(v2) · 5b6e9bcd
    Ming Lei authored
    Commit 4231d47e(net/usbnet: avoid
    recursive locking in usbnet_stop()) fixes the recursive locking
    problem by releasing the skb queue lock before unlink, but may
    cause skb traversing races:
    	- after URB is unlinked and the queue lock is released,
    	the refered skb and skb->next may be moved to done queue,
    	even be released
    	- in skb_queue_walk_safe, the next skb is still obtained
    	by next pointer of the last skb
    	- so maybe trigger oops or other problems
    
    This patch extends the usage of entry->state to describe 'start_unlink'
    state, so always holding the queue(rx/tx) lock to change the state if
    the referd skb is in rx or tx queue because we need to know if the
    refered urb has been started unlinking in unlink_urbs.
    
    The other part of this patch is based on Huajun's patch:
    always traverse from head of the tx/rx queue to get skb which is
    to be unlinked but not been started unlinking.
    Signed-off-by: default avatarHuajun Li <huajun.li.lee@gmail.com>
    Signed-off-by: default avatarMing Lei <tom.leiming@gmail.com>
    Cc: Oliver Neukum <oneukum@suse.de>
    Cc: stable@kernel.org
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    5b6e9bcd
usbnet.c 42.3 KB