From: Eugene Shatokhin <eugene.shatokhin@xxxxxxxxxx> Date: Fri, 14 Aug 2015 19:58:36 +0300 > 2. The second race is on dev->flags. > > dev->flags is set to 0 here: > *0 usbnet_stop (usbnet.c:816) > /* deferred work (task, timer, softirq) must also stop. > * can't flush_scheduled_work() until we drop rtnl (later), > * else workers could deadlock; so make workers a NOP. > */ > dev->flags = 0; > del_timer_sync (&dev->delay); > tasklet_kill (&dev->bh); > > And here, the code clears EVENT_RX_KILL bit in dev->flags, which may > execute concurrently with the above operation: > *0 clear_bit (bitops.h:113, inlined) > *1 usbnet_bh (usbnet.c:1475) > /* restart RX again after disabling due to high error rate */ > clear_bit(EVENT_RX_KILL, &dev->flags); > > It seems, setting dev->flags to 0 is not necessarily atomic w.r.t. > clear_bit() and other bit operations with dev->flags. It is safer to > make it atomic and this way, make the race harmless. > > While at it, the checking of EVENT_NO_RUNTIME_PM bit of dev->flags in > usbnet_stop() was fixed too: the bit should be checked before dev->flags > is cleared. The fix for this is excessive. Instead of all of this madness, looping over expensive clear_bit() atomics, just do whatever it takes to make sure that usbnet_bh() is quiesced and cannot execute any more. Then you can safely clear dev->flags normally. -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
