3a24934f06
The i2400m->rx_roq data structure is protected against race conditions with a reference count (i2400m->rx_roq_refcount); the pointer can be read-referenced under the i2400m->rx_lock spinlock. The code in i2400m_rx_edata() wasn't properly following access protocol, performing an invalid check on i2400m->rx_roq (which is cleared to NULL when the refcount drops to zero). As such, it was missing to detect when the data structure is no longer valid and oopsing with a NULL pointer dereference. This commit fixes said check by verifying, under the rx_lock spinlock, that i2400m->rx_roq is non-NULL and then increasing the reference count before dropping the spinlock. Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> |
||
|---|---|---|
| .. | ||
| control.c | ||
| debug-levels.h | ||
| debugfs.c | ||
| driver.c | ||
| fw.c | ||
| i2400m-sdio.h | ||
| i2400m-usb.h | ||
| i2400m.h | ||
| Kconfig | ||
| Makefile | ||
| netdev.c | ||
| op-rfkill.c | ||
| rx.c | ||
| sdio-debug-levels.h | ||
| sdio-fw.c | ||
| sdio-rx.c | ||
| sdio-tx.c | ||
| sdio.c | ||
| sysfs.c | ||
| tx.c | ||
| usb-debug-levels.h | ||
| usb-fw.c | ||
| usb-notif.c | ||
| usb-rx.c | ||
| usb-tx.c | ||
| usb.c | ||