diff options
| author |   Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> | 2010-05-20 12:27:58 -0700 |
|---|---|---|
| committer | Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> | 2010-05-20 12:27:58 -0700 |
| commit | 3a24934f065d23145f1c9c70da9f630c7a37795f (patch) | |
| tree | 0fac89df5f2749e21a45d2c07cf99d16e05ef2fc /tools/perf/util/scripting-engines/trace-event-python.c | |
| parent | wimax/i2400m: driver defaults to firmware v1.5 for i6x60 devices (diff) | |
| download | linux-dev-3a24934f065d23145f1c9c70da9f630c7a37795f.tar.xz linux-dev-3a24934f065d23145f1c9c70da9f630c7a37795f.zip | |
wimax/i2400m: fix bad race condition check in RX path
The i2400m->rx_roq data structure is protected against race conditions
with a reference count (i2400m->rx_roq_refcount); the pointer can be
read-referenced under the i2400m->rx_lock spinlock.
The code in i2400m_rx_edata() wasn't properly following access
protocol, performing an invalid check on i2400m->rx_roq (which is
cleared to NULL when the refcount drops to zero). As such, it was
missing to detect when the data structure is no longer valid and
oopsing with a NULL pointer dereference.
This commit fixes said check by verifying, under the rx_lock spinlock,
that i2400m->rx_roq is non-NULL and then increasing the reference
count before dropping the spinlock.
Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Diffstat (limited to 'tools/perf/util/scripting-engines/trace-event-python.c')
0 files changed, 0 insertions, 0 deletions