diff options
| author | Maya Erez <qca_merez@qca.qualcomm.com> | 2016-09-05 11:20:05 +0300 |
|---|---|---|
| committer | Maya Erez <merez@codeaurora.org> | 2016-09-18 17:50:36 +0300 |
| commit | dd2c4e67bf63d055ed058c3106459b6def329225 (patch) | |
| tree | ff8a645db0159e8eff603b0cc2557bc18df0e316 /drivers/net/wireless | |
| parent | f3d407b89bf12b1247680a7da3110595ddb1079c (diff) | |
wil6210: prevent usage of incorrect TX hwtail
txdata->enabled is used in order to determine if the TX vring
is valid. As the data transmit is handled in a different context,
in case txdata->enabled is set before vring->hwtail is updated,
an old or corrupted vring->hwtail can be used.
Protect setting of txdata->enabled and vring->hwtail to prevent a
case where TX vring start handling TX packets before setting
vring->hwtail.
Change-Id: Id17271823d167677a323dd1f52c7de4c6025b56e
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Git-commit: dc90506f145875b9d88160802cc5fe06a7c79dda
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
CRs-Fixed: 1063261
Signed-off-by: Maya Erez <merez@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/ath/wil6210/txrx.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c index f2f6a404d3d1..4c38520d4dd2 100644 --- a/drivers/net/wireless/ath/wil6210/txrx.c +++ b/drivers/net/wireless/ath/wil6210/txrx.c @@ -873,9 +873,12 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size, rc = -EINVAL; goto out_free; } - vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr); + spin_lock_bh(&txdata->lock); + vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr); txdata->enabled = 1; + spin_unlock_bh(&txdata->lock); + if (txdata->dot1x_open && (agg_wsize >= 0)) wil_addba_tx_request(wil, id, agg_wsize); @@ -950,9 +953,11 @@ int wil_vring_init_bcast(struct wil6210_priv *wil, int id, int size) rc = -EINVAL; goto out_free; } - vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr); + spin_lock_bh(&txdata->lock); + vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr); txdata->enabled = 1; + spin_unlock_bh(&txdata->lock); return 0; out_free: |