wimax: oops: wimax_dev_add() is the only one that can initialize the state (94c7f2d4) · Commits · 戴 / test

When a new wimax_dev is created, it's state has to be __WIMAX_ST_NULL until wimax_dev_add() is succesfully called. This allows calls into the stack that happen before said time to be rejected. Until now, the state was being set (by mistake) to UNINITIALIZED, which was allowing calls such as wimax_report_rfkill_hw() to go through even when a call to wimax_dev_add() had failed; that was causing an oops when touching uninitialized data. This situation is normal when the device starts reporting state before the whole initialization has been completed. It just has to be dealt with. Signed-off-by:

Inaky Perez-Gonzalez <inaky@linux.intel.com>

net/wimax/stack.c

+15 −2

Original line number	Diff line number	Diff line
		@@ -338,7 +338,20 @@ out:
		*/
		void wimax_state_change(struct wimax_dev *wimax_dev, enum wimax_st new_state)
		{
		/*
		* A driver cannot take the wimax_dev out of the
		* __WIMAX_ST_NULL state unless by calling wimax_dev_add(). If
		* the wimax_dev's state is still NULL, we ignore any request
		* to change its state because it means it hasn't been yet
		* registered.
		*
		* There is no need to complain about it, as routines that
		* call this might be shared from different code paths that
		* are called before or after wimax_dev_add() has done its
		* job.
		*/
		mutex_lock(&wimax_dev->mutex);
		if (wimax_dev->state > __WIMAX_ST_NULL)
		__wimax_state_change(wimax_dev, new_state);
		mutex_unlock(&wimax_dev->mutex);
		return;
		@@ -376,7 +389,7 @@ EXPORT_SYMBOL_GPL(wimax_state_get);
		void wimax_dev_init(struct wimax_dev *wimax_dev)
		{
		INIT_LIST_HEAD(&wimax_dev->id_table_node);
		__wimax_state_set(wimax_dev, WIMAX_ST_UNINITIALIZED);
		__wimax_state_set(wimax_dev, __WIMAX_ST_NULL);
		mutex_init(&wimax_dev->mutex);
		mutex_init(&wimax_dev->mutex_reset);
		}

Admin message