On Thu, May 03, 2012 at 02:09:24PM -0700, Wey-Yi Guy wrote: > From: Meenakshi Venkataraman <meenakshi.venkataraman@xxxxxxxxx> > > The driver can potentially unmap pages that > have not been mapped yet. Fix this race > condition. > > Cc: stable@xxxxxxxxxxxxxxx > Reported-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx> > Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@xxxxxxxxx> > Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@xxxxxxxxx> > --- > this patch will be also available from wireless branch on > git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi.git > > drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | 4 +++- > 1 files changed, 3 insertions(+), 1 deletions(-) > > diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c > index aa7aea1..173275f 100644 > --- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c > +++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c > @@ -310,7 +310,6 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority) > spin_unlock_irqrestore(&rxq->lock, flags); > > BUG_ON(rxb->page); > - rxb->page = page; > /* Get physical address of the RB */ > rxb->page_dma = dma_map_page(trans->dev, page, 0, > PAGE_SIZE << hw_params(trans).rx_page_order, > @@ -320,6 +319,9 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority) > /* and also 256 byte aligned! */ > BUG_ON(rxb->page_dma & DMA_BIT_MASK(8)); > > + /* Page *must* be mapped before before updating the rxb. */ > + rxb->page = page; > + > spin_lock_irqsave(&rxq->lock, flags); > > list_add_tail(&rxb->list, &rxq->rx_free); This patch make no sense. Nothing stops compiler or CPU to write ->page into memory before ->page_dma . Stanislaw -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
