| Message ID | 20201211055613.9310-1-cjhuang@codeaurora.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 3597010630d0aa96f5778901e691c6068bb86318 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | ath11k: fix crash caused by NULL rx_channel | expand |
Carl Huang <cjhuang@codeaurora.org> wrote: > During connect and disconnect stress test, crashed happened > because ar->rx_channel is NULL. Fix it by checking whether > ar->rx_channel is NULL. > > Crash stack is as below: > RIP: 0010:ath11k_dp_rx_h_ppdu+0x110/0x230 [ath11k] > [ 5028.808963] ath11k_dp_rx_wbm_err+0x14a/0x360 [ath11k] > [ 5028.808970] ath11k_dp_rx_process_wbm_err+0x41c/0x520 [ath11k] > [ 5028.808978] ath11k_dp_service_srng+0x25e/0x2d0 [ath11k] > [ 5028.808982] ath11k_pci_ext_grp_napi_poll+0x23/0x80 [ath11k_pci] > [ 5028.808986] net_rx_action+0x27e/0x400 > [ 5028.808990] __do_softirq+0xfd/0x2bb > [ 5028.808993] irq_exit+0xa6/0xb0 > [ 5028.808995] do_IRQ+0x56/0xe0 > [ 5028.808997] common_interrupt+0xf/0xf > > Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 > > Signed-off-by: Carl Huang <cjhuang@codeaurora.org> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Patch applied to ath-current branch of ath.git, thanks. 3597010630d0 ath11k: fix crash caused by NULL rx_channel
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index 2bcaf23f..17c37e2 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -2295,6 +2295,7 @@ static void ath11k_dp_rx_h_ppdu(struct ath11k *ar, struct hal_rx_desc *rx_desc, { u8 channel_num; u32 center_freq; + struct ieee80211_channel *channel; rx_status->freq = 0; rx_status->rate_idx = 0; @@ -2315,9 +2316,12 @@ static void ath11k_dp_rx_h_ppdu(struct ath11k *ar, struct hal_rx_desc *rx_desc, rx_status->band = NL80211_BAND_5GHZ; } else { spin_lock_bh(&ar->data_lock); - rx_status->band = ar->rx_channel->band; - channel_num = - ieee80211_frequency_to_channel(ar->rx_channel->center_freq); + channel = ar->rx_channel; + if (channel) { + rx_status->band = channel->band; + channel_num = + ieee80211_frequency_to_channel(channel->center_freq); + } spin_unlock_bh(&ar->data_lock); ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "rx_desc: ", rx_desc, sizeof(struct hal_rx_desc));
During connect and disconnect stress test, crashed happened because ar->rx_channel is NULL. Fix it by checking whether ar->rx_channel is NULL. Crash stack is as below: RIP: 0010:ath11k_dp_rx_h_ppdu+0x110/0x230 [ath11k] [ 5028.808963] ath11k_dp_rx_wbm_err+0x14a/0x360 [ath11k] [ 5028.808970] ath11k_dp_rx_process_wbm_err+0x41c/0x520 [ath11k] [ 5028.808978] ath11k_dp_service_srng+0x25e/0x2d0 [ath11k] [ 5028.808982] ath11k_pci_ext_grp_napi_poll+0x23/0x80 [ath11k_pci] [ 5028.808986] net_rx_action+0x27e/0x400 [ 5028.808990] __do_softirq+0xfd/0x2bb [ 5028.808993] irq_exit+0xa6/0xb0 [ 5028.808995] do_IRQ+0x56/0xe0 [ 5028.808997] common_interrupt+0xf/0xf Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Signed-off-by: Carl Huang <cjhuang@codeaurora.org> --- drivers/net/wireless/ath/ath11k/dp_rx.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)