Oliver Neukum 2d4cf3d6f3 usbnet: include wait queue head in device structure ... [ Upstream commit 14a0d635d1 ] This fixes a race which happens by freeing an object on the stack. Quoting Julius: > The issue is > that it calls usbnet_terminate_urbs() before that, which temporarily > installs a waitqueue in dev->wait in order to be able to wait on the > tasklet to run and finish up some queues. The waiting itself looks > okay, but the access to 'dev->wait' is totally unprotected and can > race arbitrarily. I think in this case usbnet_bh() managed to succeed > it's dev->wait check just before usbnet_terminate_urbs() sets it back > to NULL. The latter then finishes and the waitqueue_t structure on its > stack gets overwritten by other functions halfway through the > wake_up() call in usbnet_bh(). The fix is to just not allocate the data structure on the stack. As dev->wait is abused as a flag it also takes a runtime PM change to fix this bug. Signed-off-by: Oliver Neukum <oneukum@suse.de> Reported-by: Grant Grundler <grundler@google.com> Tested-by: Grant Grundler <grundler@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-04-14 06:42:18 -07:00
..
acpi	ACPI / hotplug: Fix conflicted PCI bridge notify handlers	2013-12-04 10:57:04 -08:00
asm-generic	mm: fix TLB flush race between migration, and change_protection_range	2014-01-09 12:24:23 -08:00
clocksource	clocksource: arch_timer: use virtual counters	2014-01-09 12:24:26 -08:00
crypto	crypto: scatterwalk - Use sg_chain_ptr on chain entries	2013-12-11 22:36:29 -08:00
drm	drm/radeon: 0x9649 is SUMO2 not SUMO	2014-01-09 12:24:22 -08:00
dt-bindings
keys
linux	usbnet: include wait queue head in device structure	2014-04-14 06:42:18 -07:00
math-emu
media	media: v4l2: added missing mutex.h include to v4l2-ctrls.h	2013-09-26 17:18:26 -07:00
memory
misc
net	tcp: tcp_release_cb() should release socket ownership	2014-04-14 06:42:16 -07:00
pcmcia
ras
rdma
rxrpc
scsi	ore: Fix wrong math in allocation of per device BIO	2014-02-13 13:48:00 -08:00
sound	ALSA: memalloc.h - fix wrong truncation of dma_addr_t	2013-12-20 07:45:06 -08:00
target	iscsi/iser-target: Fix isert_conn->state hung shutdown issues	2014-03-23 21:38:21 -07:00
trace	tracing: Fix array size mismatch in format string	2014-03-31 09:58:12 -07:00
uapi	ALSA: compress: Fix 64bit ABI incompatibility	2013-12-20 07:45:06 -08:00
video	Merge branch 'fbdev-3.10-fixes' of git://gitorious.org/linux-omap-dss2/linux into linux-fbdev/for-3.10-fixes	2013-05-29 17:00:34 +08:00
xen	xenbus: delay xenbus frontend resume if xenstored is not running	2013-05-29 09:04:19 -04:00
Kbuild	UAPI: remove empty Kbuild files	2013-04-30 17:04:09 -07:00