diff options
| author | Christian Lamparter <chunkeey@web.de> | 2008-12-09 15:14:37 +0100 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2008-12-12 14:01:39 -0500 |
| commit | dd397dc9dddfa2149a1bbc9e52ac7d5630737cec (patch) | |
| tree | e96caebf6081bbeb70bc8407342989c0bbda4fbf /drivers/net/wireless/p54/p54usb.h | |
| parent | a07d3619faeea3f540dd55f86685136f8928b4ad (diff) | |
p54usb: rewriting rx/tx routines to make use of usb_anchor's facilities
Alan Stern found several flaws in p54usb's implementation and annotated:
"usb_kill_urb() and similar routines do not expect an URB's completion
routine to deallocate it. This is almost obvious -- if the URB is deallocated
before the completion routine returns then there's no way for usb_kill_urb
to detect when the URB actually is complete."
This patch addresses all known limitations in the old implementation and fixes
khub's "use-after-freed" hang, when SLUB debug's poisoning option is enabled.
Signed-off-by: Christian Lamparter <chunkeey@web.de>
Cc: stable@kernel.org
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/p54/p54usb.h')
| -rw-r--r-- | drivers/net/wireless/p54/p54usb.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wireless/p54/p54usb.h b/drivers/net/wireless/p54/p54usb.h index 5b8fe91379c..54ee738bf2a 100644 --- a/drivers/net/wireless/p54/p54usb.h +++ b/drivers/net/wireless/p54/p54usb.h @@ -133,6 +133,7 @@ struct p54u_priv { spinlock_t lock; struct sk_buff_head rx_queue; + struct usb_anchor submitted; }; #endif /* P54USB_H */ |