• Inaky Perez-Gonzalez's avatar
    wimax/i2400m: fix bad race condition check in RX path · 3a24934f
    Inaky Perez-Gonzalez authored
    The i2400m->rx_roq data structure is protected against race conditions
    with a reference count (i2400m->rx_roq_refcount); the pointer can be
    read-referenced under the i2400m->rx_lock spinlock.
    
    The code in i2400m_rx_edata() wasn't properly following access
    protocol, performing an invalid check on i2400m->rx_roq (which is
    cleared to NULL when the refcount drops to zero). As such, it was
    missing to detect when the data structure is no longer valid and
    oopsing with a NULL pointer dereference.
    
    This commit fixes said check by verifying, under the rx_lock spinlock,
    that i2400m->rx_roq is non-NULL and then increasing the reference
    count before dropping the spinlock.
    Signed-off-by: default avatarInaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
    3a24934f
rx.c 42.8 KB