From 3a24934f065d23145f1c9c70da9f630c7a37795f Mon Sep 17 00:00:00 2001 From: Inaky Perez-Gonzalez Date: Thu, 20 May 2010 12:27:58 -0700 Subject: wimax/i2400m: fix bad race condition check in RX path The i2400m->rx_roq data structure is protected against race conditions with a reference count (i2400m->rx_roq_refcount); the pointer can be read-referenced under the i2400m->rx_lock spinlock. The code in i2400m_rx_edata() wasn't properly following access protocol, performing an invalid check on i2400m->rx_roq (which is cleared to NULL when the refcount drops to zero). As such, it was missing to detect when the data structure is no longer valid and oopsing with a NULL pointer dereference. This commit fixes said check by verifying, under the rx_lock spinlock, that i2400m->rx_roq is non-NULL and then increasing the reference count before dropping the spinlock. Signed-off-by: Inaky Perez-Gonzalez --- drivers/net/wimax/i2400m/rx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/net/wimax') diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c index c835ae8b89ce..6cd12d64fc7a 100644 --- a/drivers/net/wimax/i2400m/rx.c +++ b/drivers/net/wimax/i2400m/rx.c @@ -1033,12 +1033,12 @@ void i2400m_rx_edata(struct i2400m *i2400m, struct sk_buff *skb_rx, ro_sn = (reorder >> I2400M_RO_SN_SHIFT) & I2400M_RO_SN; spin_lock_irqsave(&i2400m->rx_lock, flags); - roq = &i2400m->rx_roq[ro_cin]; - if (roq == NULL) { + if (i2400m->rx_roq == NULL) { kfree_skb(skb); /* rx_roq is already destroyed */ spin_unlock_irqrestore(&i2400m->rx_lock, flags); goto error; } + roq = &i2400m->rx_roq[ro_cin]; kref_get(&i2400m->rx_roq_refcount); spin_unlock_irqrestore(&i2400m->rx_lock, flags); -- cgit v1.2.3-59-g8ed1b From a385a53e659b35ebee604889e21c40e5c336941f Mon Sep 17 00:00:00 2001 From: Inaky Perez-Gonzalez Date: Fri, 11 Jun 2010 11:51:20 -0700 Subject: wimax/i2400m: fix missing endian correction read in fw loader MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit i2400m_fw_hdr_check() was accessing hardware field bcf_hdr->module_type (little endian 32) without converting to host byte sex. Reported-by: Данилин Михаил Signed-off-by: Inaky Perez-Gonzalez --- drivers/net/wimax/i2400m/fw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/net/wimax') diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c index 3f283bff0ff7..11491354e5b5 100644 --- a/drivers/net/wimax/i2400m/fw.c +++ b/drivers/net/wimax/i2400m/fw.c @@ -1192,7 +1192,7 @@ int i2400m_fw_hdr_check(struct i2400m *i2400m, unsigned module_type, header_len, major_version, minor_version, module_id, module_vendor, date, size; - module_type = bcf_hdr->module_type; + module_type = le32_to_cpu(bcf_hdr->module_type); header_len = sizeof(u32) * le32_to_cpu(bcf_hdr->header_len); major_version = (le32_to_cpu(bcf_hdr->header_version) & 0xffff0000) >> 16; -- cgit v1.2.3-59-g8ed1b