| Message ID | 1351225074-2078-1-git-send-email-hemantk@codeaurora.org |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Thursday 25 October 2012 21:17:54 Hemant Kumar wrote: > Driver anchors the tx urbs and defers the urb submission if > a transmit request comes when the interface is suspended. > Anchoring urb increments the urb reference count. These > deferred urbs are later accessed by calling usb_get_from_anchor() > for submission during interface resume. usb_get_from_anchor() > unanchors the urb but urb reference count remains same. > This causes the urb reference count to remain non-zero > after usb_free_urb() gets called and urb never gets freed. > Hence call usb_put_urb() after anchoring the urb to properly > balance the reference count for these deferred urbs. Also, > unanchor these deferred urbs during disconnect, to free them > up. Good catch. This needs to go into stable, too. > > Signed-off-by: Hemant Kumar <hemantk@codeaurora.org> Acked-by: Oliver Neukum <oneukum@suse.de> Regards Oliver -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Oliver Neukum <oneukum@suse.de> Date: Fri, 26 Oct 2012 09:39:16 +0200 > On Thursday 25 October 2012 21:17:54 Hemant Kumar wrote: >> Driver anchors the tx urbs and defers the urb submission if >> a transmit request comes when the interface is suspended. >> Anchoring urb increments the urb reference count. These >> deferred urbs are later accessed by calling usb_get_from_anchor() >> for submission during interface resume. usb_get_from_anchor() >> unanchors the urb but urb reference count remains same. >> This causes the urb reference count to remain non-zero >> after usb_free_urb() gets called and urb never gets freed. >> Hence call usb_put_urb() after anchoring the urb to properly >> balance the reference count for these deferred urbs. Also, >> unanchor these deferred urbs during disconnect, to free them >> up. > > Good catch. This needs to go into stable, too. >> >> Signed-off-by: Hemant Kumar <hemantk@codeaurora.org> > Acked-by: Oliver Neukum <oneukum@suse.de> Applied and queued up for -stable. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index 1867fe2..00b7598 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -1168,6 +1168,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb, usb_anchor_urb(urb, &dev->deferred); /* no use to process more packets */ netif_stop_queue(net); + usb_put_urb(urb); spin_unlock_irqrestore(&dev->txq.lock, flags); netdev_dbg(dev->net, "Delaying transmission for resumption\n"); goto deferred; @@ -1317,6 +1318,8 @@ void usbnet_disconnect (struct usb_interface *intf) cancel_work_sync(&dev->kevent); + usb_scuttle_anchored_urbs(&dev->deferred); + if (dev->driver_info->unbind) dev->driver_info->unbind (dev, intf);
Driver anchors the tx urbs and defers the urb submission if a transmit request comes when the interface is suspended. Anchoring urb increments the urb reference count. These deferred urbs are later accessed by calling usb_get_from_anchor() for submission during interface resume. usb_get_from_anchor() unanchors the urb but urb reference count remains same. This causes the urb reference count to remain non-zero after usb_free_urb() gets called and urb never gets freed. Hence call usb_put_urb() after anchoring the urb to properly balance the reference count for these deferred urbs. Also, unanchor these deferred urbs during disconnect, to free them up. Signed-off-by: Hemant Kumar <hemantk@codeaurora.org> --- drivers/net/usb/usbnet.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)