From: Prasanna S. Panchamukhi <prasannax.s.panchamukhi@intel.com>
Date: Tue, 13 Apr 2010 23:35:58 +0000 (-0700)
Subject: wimax i2400m: fix race condition while accessing rx_roq by using kref count
X-Git-Tag: v2.6.35-rc1~473^2~99^2~9
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d11a6e4495ee1fbb38b59bc88d49d050d3736929;p=pandora-kernel.git

wimax i2400m: fix race condition while accessing rx_roq by using kref count

This patch fixes the race condition when one thread tries to destroy
the memory allocated for rx_roq, while another thread still happen
to access rx_roq.
Such a race condition occurs when i2400m-sdio kernel module gets
unloaded, destroying the memory allocated for rx_roq while rx_roq
is accessed by i2400m_rx_edata(), as explained below:
$thread1                                $thread2
$ void i2400m_rx_edata()                $
$Access rx_roq[]                        $
$roq = &i2400m->rx_roq[ro_cin]          $
$ i2400m_roq_[reset/queue/update_ws]    $
$                                       $ void i2400m_rx_release();
$                                       $kfree(rx->roq);
$                                       $rx->roq = NULL;
$Oops! rx_roq is NULL

This patch fixes the race condition using refcount approach.

Signed-off-by: Prasanna S. Panchamukhi <prasannax.s.panchamukhi@intel.com>
---

Reading git-diff-tree failed