CHROMIUM: gobi: Fix races in qc_deregister() once and for all.

drivers/net/usb/gobi/qcusbnet.c

 /* qcusbnet.c - gobi network device
  * Copyright (c) 2010, Code Aurora Forum. All rights reserved.
 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
  * only version 2 as published by the Free Software Foundation.
 
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
 
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  * 02110-1301, USA.
  */
 
 #include "structs.h"
 #include "qmidevice.h"
 #include "qmi.h"
 #include "qcusbnet.h"
 
 #define DRIVER_VERSION "1.0.110"
 #define DRIVER_AUTHOR "Qualcomm Innovation Center"
 #define DRIVER_DESC "QCUSBNet2k"
 
+static LIST_HEAD(qcusbnet_list);
+static DEFINE_MUTEX(qcusbnet_lock);
+
 int qcusbnet_debug;
 static struct class *devclass;
 
+static void free_dev(struct kref *ref)
+{
+        struct qcusbnet *dev = container_of(ref, struct qcusbnet, refcount);
+        list_del(&dev->node);
+        kfree(dev);
+}
+
+void qcusbnet_put(struct qcusbnet *dev)
+{
+        mutex_lock(&qcusbnet_lock);
+        kref_put(&dev->refcount, free_dev);
+        mutex_unlock(&qcusbnet_lock);
+}
+
+struct qcusbnet *qcusbnet_get(struct qcusbnet *key)
+{
+        /* Given a putative qcusbnet struct, return either the struct itself
+         * (with a ref taken) if the struct is still visible, or NULL if it's
+         * not. This prevents object-visibility races where someone is looking
+         * up an object as the last ref gets dropped; dropping the last ref and
+         * removing the object from the list are atomic with respect to getting
+         * a new ref. */
+        struct qcusbnet *entry = NULL;
+        mutex_lock(&qcusbnet_lock);
+        list_for_each_entry(entry, &qcusbnet_list, node) {
+                if (entry == key) {
+                        kref_get(&entry->refcount);
+                        mutex_unlock(&qcusbnet_lock);
+                        return entry;
+                }
+        }
+        mutex_unlock(&qcusbnet_lock);
+        return NULL;
+}
+
 int qc_suspend(struct usb_interface *iface, pm_message_t event)
 {
         struct usbnet *usbnet;
         struct qcusbnet *dev;
 
         if (!iface)
                 return -ENOMEM;
 
         usbnet = usb_get_intfdata(iface);
 
@@ skipping 132 matching lines @@
             out->desc.bEndpointAddress);
 
         return 0;
 }
 
 static void qcnet_unbind(struct usbnet *usbnet, struct usb_interface *iface)
 {
         struct qcusbnet *dev = (struct qcusbnet *)usbnet->data[0];
 
         netif_carrier_off(usbnet->net);
+        /* See the comments in qcusbnet_get() for an explanation of why we need

[Jason Glasgow, 2011/03/10 18:36:28]

comment should disappear.

[Elly Fong-Jones, 2011/03/10 19:15:46]

Done.

+         * this lock. */
         qc_deregister(dev);
 
+        usbnet->net->netdev_ops = NULL;

[Jason Glasgow, 2011/03/10 18:36:28]

still wrong.

[Elly Fong-Jones, 2011/03/10 19:15:46]

Done.

         kfree(usbnet->net->netdev_ops);
-        usbnet->net->netdev_ops = NULL;
-
-        kfree(dev);
+        /* drop the list's ref */
+        qcusbnet_put(dev);
 }
 
 static void qcnet_urbhook(struct urb *urb)
 {
         unsigned long flags;
         struct worker *worker = urb->context;
         if (!worker) {
                 DBG("bad context\n");
                 return;
         }
@@ skipping 384 matching lines @@
         usbnet->net->netdev_ops = netdevops;
 
         memset(&(dev->usbnet->net->stats), 0, sizeof(struct net_device_stats));
 
         dev->iface = iface;
         memset(&(dev->meid), '0', 14);
 
         DBG("Mac Address: %pM\n", dev->usbnet->net->dev_addr);
 
         dev->valid = false;
-        memset(&dev->qmi, 0, sizeof(struct qmidev));
+        memset(&dev->qmi, 0, sizeof(dev->qmi));
 
         dev->qmi.devclass = devclass;
 
+        kref_init(&dev->refcount);
+        INIT_LIST_HEAD(&dev->node);
         INIT_LIST_HEAD(&dev->qmi.clients);
         init_completion(&dev->worker.work);
         spin_lock_init(&dev->qmi.clients_lock);
 
         dev->down = 0;
         qc_setdown(dev, DOWN_NO_NDIS_CONNECTION);
         qc_setdown(dev, DOWN_NET_IFACE_STOPPED);
 
         status = qc_register(dev);
         if (status) {
                 qc_deregister(dev);
+        } else {
+                mutex_lock(&qcusbnet_lock);
+                /* Give our initial ref to the list */
+                list_add(&dev->node, &qcusbnet_list);
+                mutex_unlock(&qcusbnet_lock);
         }
 
         return status;
 }
 EXPORT_SYMBOL_GPL(qcnet_probe);
 
 static struct usb_driver qcusbnet = {
         .name       = "QCUSBNet2k",
         .id_table   = qc_vidpids,
         .probe      = qcnet_probe,
@@ skipping 22 matching lines @@
 }
 module_exit(modexit);
 
 MODULE_VERSION(DRIVER_VERSION);
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("Dual BSD/GPL");
 
 module_param(qcusbnet_debug, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(qcusbnet_debug, "Debugging enabled or not");