ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock
While debugging driver crashes related to a buggy firmware crashing under load, I noticed that ath10k_htt_rx_ring_free could be called without being under lock. I'm not sure if this is the root cause of the crash or not, but it seems prudent to protect it. Originally tested on 4.16+ kernel with ath10k-ct 10.4 firmware running on 9984 NIC. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
This commit is contained in:
parent
3f04950f32
commit
168f75f11f
drivers/net/wireless/ath/ath10k
|
@ -268,11 +268,12 @@ int ath10k_htt_rx_ring_refill(struct ath10k *ar)
|
|||
spin_lock_bh(&htt->rx_ring.lock);
|
||||
ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
|
||||
htt->rx_ring.fill_cnt));
|
||||
spin_unlock_bh(&htt->rx_ring.lock);
|
||||
|
||||
if (ret)
|
||||
ath10k_htt_rx_ring_free(htt);
|
||||
|
||||
spin_unlock_bh(&htt->rx_ring.lock);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
@ -284,7 +285,9 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
|
|||
skb_queue_purge(&htt->rx_in_ord_compl_q);
|
||||
skb_queue_purge(&htt->tx_fetch_ind_q);
|
||||
|
||||
spin_lock_bh(&htt->rx_ring.lock);
|
||||
ath10k_htt_rx_ring_free(htt);
|
||||
spin_unlock_bh(&htt->rx_ring.lock);
|
||||
|
||||
dma_free_coherent(htt->ar->dev,
|
||||
ath10k_htt_get_rx_ring_size(htt),
|
||||
|
|
Loading…
Reference in New Issue