ath10k: Protect ath10k_htt_rx_ring_free with rx_ring.lock
diff mbox

Message ID 1528387897-6781-1-git-send-email-greearb@candelatech.com
State New
Headers show

Commit Message

Ben Greear June 7, 2018, 4:11 p.m. UTC
From: Ben Greear <greearb@candelatech.com>

While debugging driver crashes related to a buggy firmware
crashing under load, I noticed that ath10k_htt_rx_ring_free
could be called without being under lock.  I'm not sure if this
is the root cause of the crash or not, but it seems prudent to
protect it.

Signed-off-by: Ben Greear <greearb@candelatech.com>
---
 drivers/net/wireless/ath/ath10k/htt_rx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Kalle Valo June 14, 2018, 9:12 a.m. UTC | #1
Ben Greear <greearb@candelatech.com> wrote:

> From: Ben Greear <greearb@candelatech.com>
> 
> While debugging driver crashes related to a buggy firmware
> crashing under load, I noticed that ath10k_htt_rx_ring_free
> could be called without being under lock.  I'm not sure if this
> is the root cause of the crash or not, but it seems prudent to
> protect it.
> 
> Signed-off-by: Ben Greear <greearb@candelatech.com>

Failed to apply, please use ath.git master branch as the baseline. Also
document the tested hardware and firmware versions in the commit log.

https://wireless.wiki.kernel.org/en/users/drivers/ath10k/submittingpatches

error: patch failed: drivers/net/wireless/ath/ath10k/htt_rx.c:282
error: drivers/net/wireless/ath/ath10k/htt_rx.c: patch does not apply
stg import: Diff does not apply cleanly

Patch set to Changes Requested.

Patch
diff mbox

diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index d74901d..963ddc1 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -266,11 +266,12 @@  int ath10k_htt_rx_ring_refill(struct ath10k *ar)
 	spin_lock_bh(&htt->rx_ring.lock);
 	ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
 					      htt->rx_ring.fill_cnt));
-	spin_unlock_bh(&htt->rx_ring.lock);
 
 	if (ret)
 		ath10k_htt_rx_ring_free(htt);
 
+	spin_unlock_bh(&htt->rx_ring.lock);
+
 	return ret;
 }
 
@@ -282,7 +283,9 @@  void ath10k_htt_rx_free(struct ath10k_htt *htt)
 	skb_queue_purge(&htt->rx_in_ord_compl_q);
 	skb_queue_purge(&htt->tx_fetch_ind_q);
 
+	spin_lock_bh(&htt->rx_ring.lock);
 	ath10k_htt_rx_ring_free(htt);
+	spin_unlock_bh(&htt->rx_ring.lock);
 
 	dma_free_coherent(htt->ar->dev,
 			  htt->rx_ops->htt_get_rx_ring_size(htt),