releases/4.4.160/ath10k-protect-ath10k_htt_rx_ring_free-with-rx_ring.lock.patch

   1 From foo@baz Sat Sep 29 04:30:43 PDT 2018
   2 From: Ben Greear <greearb@candelatech.com>
   3 Date: Mon, 18 Jun 2018 17:00:56 +0300
   4 Subject: ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock
   5
   6 From: Ben Greear <greearb@candelatech.com>
   7
   8 [ Upstream commit 168f75f11fe68455e0d058a818ebccfc329d8685 ]
   9
  10 While debugging driver crashes related to a buggy firmware
  11 crashing under load, I noticed that ath10k_htt_rx_ring_free
  12 could be called without being under lock.  I'm not sure if this
  13 is the root cause of the crash or not, but it seems prudent to
  14 protect it.
  15
  16 Originally tested on 4.16+ kernel with ath10k-ct 10.4 firmware
  17 running on 9984 NIC.
  18
  19 Signed-off-by: Ben Greear <greearb@candelatech.com>
  20 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  21 Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23 ---
  24  drivers/net/wireless/ath/ath10k/htt_rx.c |    5 ++++-
  25  1 file changed, 4 insertions(+), 1 deletion(-)
  26
  27 --- a/drivers/net/wireless/ath/ath10k/htt_rx.c
  28 +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
  29 @@ -212,11 +212,12 @@ int ath10k_htt_rx_ring_refill(struct ath
  30         spin_lock_bh(&htt->rx_ring.lock);
  31         ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
  32                                               htt->rx_ring.fill_cnt));
  33 -       spin_unlock_bh(&htt->rx_ring.lock);
  34
  35         if (ret)
  36                 ath10k_htt_rx_ring_free(htt);
  37
  38 +       spin_unlock_bh(&htt->rx_ring.lock);
  39 +
  40         return ret;
  41  }
  42
  43 @@ -230,7 +231,9 @@ void ath10k_htt_rx_free(struct ath10k_ht
  44         skb_queue_purge(&htt->rx_compl_q);
  45         skb_queue_purge(&htt->rx_in_ord_compl_q);
  46
  47 +       spin_lock_bh(&htt->rx_ring.lock);
  48         ath10k_htt_rx_ring_free(htt);
  49 +       spin_unlock_bh(&htt->rx_ring.lock);
  50
  51         dma_free_coherent(htt->ar->dev,
  52                           (htt->rx_ring.size *