summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMarc Kleine-Budde <mkl@pengutronix.de>2021-05-05 14:32:27 +0300
committerMarc Kleine-Budde <mkl@pengutronix.de>2021-05-06 10:24:07 +0300
commite04b2cfe61072c7966e1a5fb73dd1feb30c206ed (patch)
tree75e4c665edffabc8bd7631af5dfbf797f4d3a580
parent03c427147b2d3e503af258711af4fc792b89b0af (diff)
downloadlinux-e04b2cfe61072c7966e1a5fb73dd1feb30c206ed.tar.xz
can: m_can: m_can_tx_work_queue(): fix tx_skb race condition
The m_can_start_xmit() function checks if the cdev->tx_skb is NULL and returns with NETDEV_TX_BUSY in case tx_sbk is not NULL. There is a race condition in the m_can_tx_work_queue(), where first the skb is send to the driver and then the case tx_sbk is set to NULL. A TX complete IRQ might come in between and wake the queue, which results in tx_skb not being cleared yet. Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework") Tested-by: Torin Cooper-Bennun <torin@maxiluxsystems.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
-rw-r--r--drivers/net/can/m_can/m_can.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 34073cd077e4..3cf6de21d19c 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -1562,6 +1562,8 @@ static netdev_tx_t m_can_tx_handler(struct m_can_classdev *cdev)
int i;
int putidx;
+ cdev->tx_skb = NULL;
+
/* Generate ID field for TX buffer Element */
/* Common to all supported M_CAN versions */
if (cf->can_id & CAN_EFF_FLAG) {
@@ -1678,7 +1680,6 @@ static void m_can_tx_work_queue(struct work_struct *ws)
tx_work);
m_can_tx_handler(cdev);
- cdev->tx_skb = NULL;
}
static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,