Skip to content

Commit

Permalink
p54usb: rewriting rx/tx routines to make use of usb_anchor's facilities
Browse files Browse the repository at this point in the history 
Alan Stern found several flaws in p54usb's implementation and annotated:
"usb_kill_urb() and similar routines do not expect an URB's completion
routine to deallocate it.  This is almost obvious -- if the URB is deallocated
before the completion routine returns then there's no way for usb_kill_urb
to detect when the URB actually is complete."

This patch addresses all known limitations in the old implementation and fixes
khub's "use-after-freed" hang, when SLUB debug's poisoning option is enabled.

Signed-off-by: Christian Lamparter <chunkeey@web.de>
Cc: stable@kernel.org
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
  • Loading branch information
Christian Lamparter authored and John W. Linville committed Dec 12, 2008
1 parent a07d361 commit dd397dc
Show file tree
Hide file tree
Showing 2 changed files with 102 additions and 50 deletions.
151 changes: 101 additions & 50 deletions drivers/net/wireless/p54/p54usb.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -86,13 +86,13 @@ static void p54u_rx_cb(struct urb *urb)
struct ieee80211_hw *dev = info->dev;
struct p54u_priv *priv = dev->priv;

skb_unlink(skb, &priv->rx_queue);

if (unlikely(urb->status)) {
info->urb = NULL;
usb_free_urb(urb);
dev_kfree_skb_irq(skb);
return;
}

skb_unlink(skb, &priv->rx_queue);
skb_put(skb, urb->actual_length);

if (priv->hw_type == P54U_NET2280)
Expand All @@ -105,7 +105,6 @@ static void p54u_rx_cb(struct urb *urb)
if (p54_rx(dev, skb)) {
skb = dev_alloc_skb(priv->common.rx_mtu + 32);
if (unlikely(!skb)) {
usb_free_urb(urb);
/* TODO check rx queue length and refill *somewhere* */
return;
}
Expand All @@ -115,7 +114,6 @@ static void p54u_rx_cb(struct urb *urb)
info->dev = dev;
urb->transfer_buffer = skb_tail_pointer(skb);
urb->context = skb;
skb_queue_tail(&priv->rx_queue, skb);
} else {
if (priv->hw_type == P54U_NET2280)
skb_push(skb, priv->common.tx_hdr_len);
Expand All @@ -130,11 +128,14 @@ static void p54u_rx_cb(struct urb *urb)
WARN_ON(1);
urb->transfer_buffer = skb_tail_pointer(skb);
}

skb_queue_tail(&priv->rx_queue, skb);
}

usb_submit_urb(urb, GFP_ATOMIC);
skb_queue_tail(&priv->rx_queue, skb);
usb_anchor_urb(urb, &priv->submitted);
if (usb_submit_urb(urb, GFP_ATOMIC)) {
skb_unlink(skb, &priv->rx_queue);
usb_unanchor_urb(urb);
dev_kfree_skb_irq(skb);
}
}

static void p54u_tx_reuse_skb_cb(struct urb *urb)
Expand All @@ -144,18 +145,6 @@ static void p54u_tx_reuse_skb_cb(struct urb *urb)
usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)))->priv;

skb_pull(skb, priv->common.tx_hdr_len);
usb_free_urb(urb);
}

static void p54u_tx_cb(struct urb *urb)
{
usb_free_urb(urb);
}

static void p54u_tx_free_cb(struct urb *urb)
{
kfree(urb->transfer_buffer);
usb_free_urb(urb);
}

static void p54u_tx_free_skb_cb(struct urb *urb)
Expand All @@ -165,25 +154,36 @@ static void p54u_tx_free_skb_cb(struct urb *urb)
usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));

p54_free_skb(dev, skb);
usb_free_urb(urb);
}

static void p54u_tx_dummy_cb(struct urb *urb) { }

static void p54u_free_urbs(struct ieee80211_hw *dev)
{
struct p54u_priv *priv = dev->priv;
usb_kill_anchored_urbs(&priv->submitted);
}

static int p54u_init_urbs(struct ieee80211_hw *dev)
{
struct p54u_priv *priv = dev->priv;
struct urb *entry;
struct urb *entry = NULL;
struct sk_buff *skb;
struct p54u_rx_info *info;
int ret = 0;

while (skb_queue_len(&priv->rx_queue) < 32) {
skb = __dev_alloc_skb(priv->common.rx_mtu + 32, GFP_KERNEL);
if (!skb)
break;
if (!skb) {
ret = -ENOMEM;
goto err;
}
entry = usb_alloc_urb(0, GFP_KERNEL);
if (!entry) {
kfree_skb(skb);
break;
ret = -ENOMEM;
goto err;
}

usb_fill_bulk_urb(entry, priv->udev,
usb_rcvbulkpipe(priv->udev, P54U_PIPE_DATA),
skb_tail_pointer(skb),
Expand All @@ -192,33 +192,33 @@ static int p54u_init_urbs(struct ieee80211_hw *dev)
info->urb = entry;
info->dev = dev;
skb_queue_tail(&priv->rx_queue, skb);
usb_submit_urb(entry, GFP_KERNEL);

usb_anchor_urb(entry, &priv->submitted);
ret = usb_submit_urb(entry, GFP_KERNEL);
if (ret) {
skb_unlink(skb, &priv->rx_queue);
usb_unanchor_urb(entry);
goto err;
}
usb_free_urb(entry);
entry = NULL;
}

return 0;
}

static void p54u_free_urbs(struct ieee80211_hw *dev)
{
struct p54u_priv *priv = dev->priv;
struct p54u_rx_info *info;
struct sk_buff *skb;

while ((skb = skb_dequeue(&priv->rx_queue))) {
info = (struct p54u_rx_info *) skb->cb;
if (!info->urb)
continue;

usb_kill_urb(info->urb);
kfree_skb(skb);
}
err:
usb_free_urb(entry);
kfree_skb(skb);
p54u_free_urbs(dev);
return ret;
}

static void p54u_tx_3887(struct ieee80211_hw *dev, struct sk_buff *skb,
int free_on_tx)
{
struct p54u_priv *priv = dev->priv;
struct urb *addr_urb, *data_urb;
int err = 0;

addr_urb = usb_alloc_urb(0, GFP_ATOMIC);
if (!addr_urb)
Expand All @@ -233,15 +233,31 @@ static void p54u_tx_3887(struct ieee80211_hw *dev, struct sk_buff *skb,
usb_fill_bulk_urb(addr_urb, priv->udev,
usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
&((struct p54_hdr *)skb->data)->req_id, 4,
p54u_tx_cb, dev);
p54u_tx_dummy_cb, dev);
usb_fill_bulk_urb(data_urb, priv->udev,
usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
skb->data, skb->len,
free_on_tx ? p54u_tx_free_skb_cb :
p54u_tx_reuse_skb_cb, skb);

usb_submit_urb(addr_urb, GFP_ATOMIC);
usb_submit_urb(data_urb, GFP_ATOMIC);
usb_anchor_urb(addr_urb, &priv->submitted);
err = usb_submit_urb(addr_urb, GFP_ATOMIC);
if (err) {
usb_unanchor_urb(addr_urb);
goto out;
}

usb_anchor_urb(addr_urb, &priv->submitted);
err = usb_submit_urb(data_urb, GFP_ATOMIC);
if (err)
usb_unanchor_urb(data_urb);

out:
usb_free_urb(addr_urb);
usb_free_urb(data_urb);

if (err)
p54_free_skb(dev, skb);
}

static __le32 p54u_lm87_chksum(const __le32 *data, size_t length)
Expand Down Expand Up @@ -281,7 +297,13 @@ static void p54u_tx_lm87(struct ieee80211_hw *dev, struct sk_buff *skb,
free_on_tx ? p54u_tx_free_skb_cb :
p54u_tx_reuse_skb_cb, skb);

usb_submit_urb(data_urb, GFP_ATOMIC);
usb_anchor_urb(data_urb, &priv->submitted);
if (usb_submit_urb(data_urb, GFP_ATOMIC)) {
usb_unanchor_urb(data_urb);
skb_pull(skb, sizeof(*hdr));
p54_free_skb(dev, skb);
}
usb_free_urb(data_urb);
}

static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb,
Expand All @@ -291,6 +313,7 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb,
struct urb *int_urb, *data_urb;
struct net2280_tx_hdr *hdr;
struct net2280_reg_write *reg;
int err = 0;

reg = kmalloc(sizeof(*reg), GFP_ATOMIC);
if (!reg)
Expand Down Expand Up @@ -320,15 +343,42 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb,

usb_fill_bulk_urb(int_urb, priv->udev,
usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV), reg, sizeof(*reg),
p54u_tx_free_cb, dev);
usb_submit_urb(int_urb, GFP_ATOMIC);
p54u_tx_dummy_cb, dev);

/*
* This flag triggers a code path in the USB subsystem that will
* free what's inside the transfer_buffer after the callback routine
* has completed.
*/
int_urb->transfer_flags |= URB_FREE_BUFFER;

usb_fill_bulk_urb(data_urb, priv->udev,
usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
skb->data, skb->len,
free_on_tx ? p54u_tx_free_skb_cb :
p54u_tx_reuse_skb_cb, skb);
usb_submit_urb(data_urb, GFP_ATOMIC);

usb_anchor_urb(int_urb, &priv->submitted);
err = usb_submit_urb(int_urb, GFP_ATOMIC);
if (err) {
usb_unanchor_urb(int_urb);
goto out;
}

usb_anchor_urb(data_urb, &priv->submitted);
err = usb_submit_urb(data_urb, GFP_ATOMIC);
if (err) {
usb_unanchor_urb(data_urb);
goto out;
}
out:
usb_free_urb(int_urb);
usb_free_urb(data_urb);

if (err) {
skb_pull(skb, sizeof(*hdr));
p54_free_skb(dev, skb);
}
}

static int p54u_write(struct p54u_priv *priv,
Expand Down Expand Up @@ -885,6 +935,7 @@ static int __devinit p54u_probe(struct usb_interface *intf,
goto err_free_dev;

skb_queue_head_init(&priv->rx_queue);
init_usb_anchor(&priv->submitted);

p54u_open(dev);
err = p54_read_eeprom(dev);
Expand Down
1 change: 1 addition & 0 deletions drivers/net/wireless/p54/p54usb.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,7 @@ struct p54u_priv {

spinlock_t lock;
struct sk_buff_head rx_queue;
struct usb_anchor submitted;
};

#endif /* P54USB_H */

0 comments on commit dd397dc

Please sign in to comment.