linux-kernel - Re: [ 67/75] ipw2200: Fix race condition in the command completion acknowledge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1336401445.8274.319.camel@deadeye>
Date:	Mon, 07 May 2012 15:37:25 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Stanislav Yakovlev <stas.yakovlev@...il.com>,
	"John W. Linville" <linville@...driver.com>
Cc:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	torvalds@...ux-foundation.org, akpm@...ux-foundation.org,
	alan@...rguk.ukuu.org.uk, Greg KH <gregkh@...uxfoundation.org>
Subject: Re: [ 67/75] ipw2200: Fix race condition in the command completion
 acknowledge

On Fri, 2012-05-04 at 13:43 -0700, Greg KH wrote:
> 3.3-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Stanislav Yakovlev <stas.yakovlev@...il.com>
> 
> commit dd447319895d0c0af423e483d9b63f84f3f8869a upstream.
> 
> Driver incorrectly validates command completion: instead of waiting
> for a command to be acknowledged it continues execution.  Most of the
> time driver gets acknowledge of the command completion in a tasklet
> before it executes the next one. But sometimes it sends the next
> command before it gets acknowledge for the previous one. In such a
> case one of the following error messages appear in the log:
[...]
> +	now = jiffies;
> +	end = now + HOST_COMPLETE_TIMEOUT;
> +again:
>  	rc = wait_event_interruptible_timeout(priv->wait_command_queue,
>  					      !(priv->
>  						status & STATUS_HCMD_ACTIVE),
> -					      HOST_COMPLETE_TIMEOUT);
> +					      end - now);
> +	if (rc < 0) {
> +		now = jiffies;
> +		if (time_before(now, end))
> +			goto again;
> +		rc = 0;
> +	}
[...]

If you don't want the wait to be interrupted, use wait_event_timeout()
instead of this ridiculous loop!

Ben.

-- 
Ben Hutchings
Hoare's Law of Large Problems:
        Inside every large problem is a small problem struggling to get out.

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)