Re: [PATCH v2 3/3] pppoatm: protect against freeing of vcc
From: chas williams - CONTRACTOR <hidden>
Date: 2012-11-29 15:38:04
Also in:
lkml
On Wed, 28 Nov 2012 22:18:35 +0000 David Woodhouse [off-list ref] wrote:
quoted hunk ↗ jump to hunk
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c index 9851093..3720670 100644 --- a/drivers/atm/solos-pci.c +++ b/drivers/atm/solos-pci.c@@ -92,6 +92,7 @@ struct pkt_hdr { }; struct solos_skb_cb { + struct completion c; struct atm_vcc *vcc; uint32_t dma_addr; };@@ -881,11 +882,18 @@ static void pclose(struct atm_vcc *vcc) header->vci = cpu_to_le16(vcc->vci); header->type = cpu_to_le16(PKT_PCLOSE); + init_completion(&SKB_CB(skb)->c); + fpga_queue(card, SOLOS_CHAN(vcc->dev), skb, NULL); clear_bit(ATM_VF_ADDR, &vcc->flags); clear_bit(ATM_VF_READY, &vcc->flags);
you shouldnt clear ATM_VF_ADDR until the vpi/vci is actually closed and ready for reuse. at this point, it isnt. ATM_VF_READY should already be clear at this point but you should set it before you queue your PKT_CLOSE. these flags probably should be handled outside the drivers since the context for them is pretty clear. just another patch i never got around to writing... checking for ATM_VF_READY in find_vcc() is probably going to give you grief as well since ATM_VF_READY isnt entirely under your control. you need to be able to find the vcc until after pclose() is finished since your tasklet might have a few packets it is still processing?