Re: [PATCH] usb-gadget-ether: Prevent oops caused by error interrupt race

[David Brownell <david-b@pacbell.net>]

On Thursday 20 September 2007, Thomas Gleixner wrote:
> From: Benedikt Spranger <bene@linutronix.de>
> 
> An USB error interrupt (e.g. disconnect) nukes the pending requests for
> an ethernet gadget device asynchronously. This can race against
> eth_start_xmit(), where we end up dereferencing the list head itself.
> 
> The nuke code is serialized against eth_start_xmit via dev->req_lock,
> but we need to check the list for empty first instead of unconditionally
> accessing dev->tx_reqs.next.

Looks OK, although the comments are confusingly incorrect which
made it hard to see what this was doing:

 - There is no "nuke()" method in this driver, even comments
   don't use that term.

 - When "nuke" is used in the gadget stack, it means the way
   that controller drivers scrub out a queue of live requests
   queued to an endpoint ... *NOT* recycling memory that sits
   on a freelist, which is what's involved here.

 - Disconnect is *NOT* an error, it's a routine occurrence
   which can happen at essentially any time.

If you update the patch and comments accordingly, ACK.


> This is a long standing bug, which should be fixed in stable as well.
> 
> Signed-off-by: Benedikt Spranger <bene@linutronix.de>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> 
> diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
> index 593e235..f1d7c82 100644
> --- a/drivers/usb/gadget/ether.c
> +++ b/drivers/usb/gadget/ether.c
> @@ -1989,8 +1989,20 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
>  	}
>  
>  	spin_lock_irqsave(&dev->req_lock, flags);
> +	/*
> +	 * dev->tx_reqs may be empty due to an error interrupt which

Please reword:  "may be empty because disconnecting an
active device cleans out this freelist".  

> +	 * nuked all requests.
> +	 */
> +	if (list_empty(&dev->tx_reqs)) {
> +		netif_stop_queue(net);
> +		spin_unlock_irqrestore(&dev->req_lock, flags);
> +		return 1;
> +	}
> +
>  	req = container_of (dev->tx_reqs.next, struct usb_request, list);
>  	list_del (&req->list);
> +
> +	/* last request in list: stop queue */
>  	if (list_empty (&dev->tx_reqs))
>  		netif_stop_queue (net);
>  	spin_unlock_irqrestore(&dev->req_lock, flags);
> 
>