From: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Date: Thu, 20 May 2010 19:27:58 +0000 (-0700)
Subject: wimax/i2400m: fix bad race condition check in RX path
X-Git-Tag: v2.6.35-rc1~260^2~5^2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3a24934f065d23145f1c9c70da9f630c7a37795f;p=pandora-kernel.git

wimax/i2400m: fix bad race condition check in RX path

The i2400m->rx_roq data structure is protected against race conditions
with a reference count (i2400m->rx_roq_refcount); the pointer can be
read-referenced under the i2400m->rx_lock spinlock.

The code in i2400m_rx_edata() wasn't properly following access
protocol, performing an invalid check on i2400m->rx_roq (which is
cleared to NULL when the refcount drops to zero). As such, it was
missing to detect when the data structure is no longer valid and
oopsing with a NULL pointer dereference.

This commit fixes said check by verifying, under the rx_lock spinlock,
that i2400m->rx_roq is non-NULL and then increasing the reference
count before dropping the spinlock.

Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
---

Reading git-diff-tree failed