Skip to content
  • Prasanna S. Panchamukhi's avatar
    wimax i2400m: fix race condition while accessing rx_roq by using kref count · d11a6e44
    Prasanna S. Panchamukhi authored
    
    
    This patch fixes the race condition when one thread tries to destroy
    the memory allocated for rx_roq, while another thread still happen
    to access rx_roq.
    Such a race condition occurs when i2400m-sdio kernel module gets
    unloaded, destroying the memory allocated for rx_roq while rx_roq
    is accessed by i2400m_rx_edata(), as explained below:
    $thread1                                $thread2
    $ void i2400m_rx_edata()                $
    $Access rx_roq[]                        $
    $roq = &i2400m->rx_roq[ro_cin]          $
    $ i2400m_roq_[reset/queue/update_ws]    $
    $                                       $ void i2400m_rx_release();
    $                                       $kfree(rx->roq);
    $                                       $rx->roq = NULL;
    $Oops! rx_roq is NULL
    
    This patch fixes the race condition using refcount approach.
    
    Signed-off-by: default avatarPrasanna S. Panchamukhi <prasannax.s.panchamukhi@intel.com>
    d11a6e44