Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9a5d2bd9 authored by David Woodhouse's avatar David Woodhouse Committed by David S. Miller
Browse files

ppp: Fix race condition with queue start/stop 



Commit e675f0cc ("ppp: Don't stop and
restart queue on every TX packet") introduced a race condition which
could leave the net queue stopped even when the channel is no longer
busy. By calling netif_stop_queue() from ppp_start_xmit(), based on the
return value from ppp_xmit_process() but *after* all the locks have been
dropped, we could potentially do so *after* the channel has actually
finished transmitting and attempted to re-wake the queue.

Fix this by moving the netif_stop_queue() into ppp_xmit_process() under
the xmit lock. I hadn't done this previously, because it gets called
from other places than ppp_start_xmit(). But I now think it's the better
option. The net queue *should* be stopped if the channel becomes
congested due to writes from pppd, anyway.

Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1716a961

drivers/net/ppp/ppp_generic.c

+6 −9
Original line number Original line Diff line number Diff line
@@ -235,7 +235,7 @@ struct ppp_net { 
/* Prototypes. */

/* Prototypes. */

static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,

static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,

			struct file *file, unsigned int cmd, unsigned long arg);

			struct file *file, unsigned int cmd, unsigned long arg);

static int ppp_xmit_process(struct ppp *ppp);

static void ppp_xmit_process(struct ppp *ppp);

static void ppp_send_frame(struct ppp *ppp, struct sk_buff *skb);

static void ppp_send_frame(struct ppp *ppp, struct sk_buff *skb);

static void ppp_push(struct ppp *ppp);

static void ppp_push(struct ppp *ppp);

static void ppp_channel_push(struct channel *pch);

static void ppp_channel_push(struct channel *pch);
@@ -969,8 +969,7 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev) 
	put_unaligned_be16(proto, pp);

	put_unaligned_be16(proto, pp);





	skb_queue_tail(&ppp->file.xq, skb);

	skb_queue_tail(&ppp->file.xq, skb);

	if (!ppp_xmit_process(ppp))

	ppp_xmit_process(ppp);

		netif_stop_queue(dev);

	return NETDEV_TX_OK;

	return NETDEV_TX_OK;





 outf:

 outf:
@@ -1048,11 +1047,10 @@ static void ppp_setup(struct net_device *dev) 
 * Called to do any work queued up on the transmit side

 * Called to do any work queued up on the transmit side

 * that can now be done.

 * that can now be done.

 */

 */

static int

static void

ppp_xmit_process(struct ppp *ppp)

ppp_xmit_process(struct ppp *ppp)

{

{

	struct sk_buff *skb;

	struct sk_buff *skb;

	int ret = 0;





	ppp_xmit_lock(ppp);

	ppp_xmit_lock(ppp);

	if (!ppp->closing) {

	if (!ppp->closing) {
@@ -1062,13 +1060,12 @@ ppp_xmit_process(struct ppp *ppp) 
			ppp_send_frame(ppp, skb);

			ppp_send_frame(ppp, skb);

		/* If there's no work left to do, tell the core net

		/* If there's no work left to do, tell the core net

		   code that we can accept some more. */

		   code that we can accept some more. */

		if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq)) {

		if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq))

			netif_wake_queue(ppp->dev);

			netif_wake_queue(ppp->dev);

			ret = 1;

		else

		}

			netif_stop_queue(ppp->dev);

	}

	}

	ppp_xmit_unlock(ppp);

	ppp_xmit_unlock(ppp);

	return ret;

}

}





static inline struct sk_buff *

static inline struct sk_buff *