xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hyperv: Move wait completion msg code into rndis_filter_halt_device()

Browse Source 
We need to wait for send_completion msg before put_rndis_request() at
the end of rndis_filter_halt_device(). Otherwise, netvsc_send_completion()
may reference freed memory which is overwritten, and cause panic.

Reported-by: Long Li <longli@microsoft.com>
Reported-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Haiyang Zhang
2012-08-03 09:32:18 +00:00
committed by David S. Miller
parent 2207b60ffb
commit ae9e63bb2c
2 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/net/hyperv/netvsc.c
View File

@@ -383,13 +383,6 @@ int netvsc_device_remove(struct hv_device *device)
unsigned long flags;
net_device = hv_get_drvdata(device);
spin_lock_irqsave(&device->channel->inbound_lock, flags);
net_device->destroy = true;
spin_unlock_irqrestore(&device->channel->inbound_lock, flags);
/* Wait for all send completions */
wait_event(net_device->wait_drain,
atomic_read(&net_device->num_outstanding_sends) == 0);
netvsc_disconnect_vsp(net_device);