netdev - Re: [PATCH 2/3] b43: Fix oops if firmware is not available

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 12 Jan 2014 03:27:31 +0000
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Larry Finger <Larry.Finger@...inger.net>
Cc:	linville@...driver.com, linux-wireless@...r.kernel.org,
	netdev@...r.kernel.org, Stable <stable@...r.kernel.org>
Subject: Re: [PATCH 2/3] b43: Fix oops if firmware is not available

On Sat, 2014-01-11 at 13:48 -0600, Larry Finger wrote:
> On openSUSE systems, the script that installs the firmware for b43 also
> unloads and reloads the driver. When the firmware was not previously
> available, the driver has stalled at a wait_for_completion(). When the
> unload routine releases that hold, the driver encounters structures
> that have already been deleted and generates a fatal condition. When
> the user does a manual restart, the file system cleanup frequently
> results in the firmware files being deleted and the user is never able
> to install the firmware. The fix is to change the wait_for_completion()
> with a wait_for_completion_timeout() with a 60 second wait period.
> 
> There is a potential race condition; however, the chances that less
> than a minute has elapsed between the initial driver load and a
> subsequent unload is very unlikely.

A minute-long race is 'unlikely' to be hit?  Seriously?!

Ben.

> This patch also fixes a typo in a comment.
> 
> Signed-off-by: Larry Finger <Larry.Finger@...inger.net>
> Cc: Stable <stable@...r.kernel.org>
> ---
>  drivers/net/wireless/b43/main.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
> index 86b2030..5ce9ecb 100644
> --- a/drivers/net/wireless/b43/main.c
> +++ b/drivers/net/wireless/b43/main.c
> @@ -2150,12 +2150,13 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
>  			pr_err("Unable to load firmware\n");
>  			return err;
>  		}
> -		/* stall here until fw ready */
> -		wait_for_completion(&ctx->fw_load_complete);
> +		/* stall here until fw ready or 60 sec elapses */
> +		wait_for_completion_timeout(&ctx->fw_load_complete,
> +					    msecs_to_jiffies(60000));
>  		if (ctx->blob)
>  			goto fw_ready;
>  	/* On some ARM systems, the async request will fail, but the next sync
> -	 * request works. For this reason, we dall through here
> +	 * request works. For this reason, we fall through here
>  	 */
>  	}
>  	err = request_firmware(&ctx->blob, ctx->fwname,

-- 
Ben Hutchings
Quantity is no substitute for quality, but it's the only one we've got.

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)