On Thu, May 03, 2012 at 02:09:24PM -0700, Wey-Yi Guy wrote: > From: Meenakshi Venkataraman <[email protected]> > > The driver can potentially unmap pages that > have not been mapped yet. Fix this race > condition. > > Cc: [email protected] > Reported-by: Emmanuel Grumbach <[email protected]> > Signed-off-by: Meenakshi Venkataraman <[email protected]> > Signed-off-by: Wey-Yi Guy <[email protected]> > --- > this patch will be also available from wireless branch on > git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi.git > > drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | 4 +++- > 1 files changed, 3 insertions(+), 1 deletions(-) > > diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c > b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c > index aa7aea1..173275f 100644 > --- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c > +++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c > @@ -310,7 +310,6 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, > gfp_t priority) > spin_unlock_irqrestore(&rxq->lock, flags); > > BUG_ON(rxb->page); > - rxb->page = page; > /* Get physical address of the RB */ > rxb->page_dma = dma_map_page(trans->dev, page, 0, > PAGE_SIZE << hw_params(trans).rx_page_order, > @@ -320,6 +319,9 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, > gfp_t priority) > /* and also 256 byte aligned! */ > BUG_ON(rxb->page_dma & DMA_BIT_MASK(8)); > > + /* Page *must* be mapped before before updating the rxb. */ > + rxb->page = page; > + > spin_lock_irqsave(&rxq->lock, flags); > > list_add_tail(&rxb->list, &rxq->rx_free);
This patch make no sense. Nothing stops compiler or CPU to write ->page into memory before ->page_dma . Stanislaw -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
