Re: SLUB Corruption from witin drivers/usb/core/devio.c

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 17 May 2012, Huajun Li wrote:

> On 05/15/12 07:55pm, Oncaphillis wrote:
> >On 05/16/2012 02:56 AM, Huajun Li wrote:
> >>Thanks for your reminder, and here is the draft patch for review:
> >
> >Didn't do the trck. I patched 3.3.4 .. Should i use  3.4-rc7 ?
> >
> 
> From 3.3.4 to 3.4-rc7, devio.c has no much changes, maybe this is
> not the root cause of your problem.
> 
> However, I think there still exists another race in destroy_async_on_interface(),

What race are you thinking of?

> @@ -491,21 +497,22 @@ static void destroy_async(struct dev_state *ps, struct list_head *list)
>  static void destroy_async_on_interface(struct dev_state *ps,
>  				       unsigned int ifnum)
>  {
> -	struct list_head *p, *q, hitlist;
> +	struct list_head *p, *q;
>  	unsigned long flags;
>  
> -	INIT_LIST_HEAD(&hitlist);
> +	INIT_LIST_HEAD(&ps->async_intf);
>  	spin_lock_irqsave(&ps->lock, flags);
>  	list_for_each_safe(p, q, &ps->async_pending)
>  		if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
> -			list_move_tail(p, &hitlist);
> +			list_move_tail(p, &ps->async_intf);
>  	spin_unlock_irqrestore(&ps->lock, flags);
> -	destroy_async(ps, &hitlist);
> +	destroy_async(ps, &ps->async_intf);
>  }

What difference does this make?

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux