On 26 May 2014 11:40, Kalle Valo <kvalo@xxxxxxxxxxxxxxxx> wrote:
> Michal Kazior <michal.kazior@xxxxxxxxx> writes:
>
>> This makes sure no further tx requests are
>> submitted to HTT before driver teardown.
>>
>> This should prevent invalid pointer/NULL
>> dereference on htt tx pool in ath10k_htt_tx() in
>> some cases of heavy traffic.
>>
>> Reported-By: Ben Greear <greearb@xxxxxxxxxxxxxxx>
>> Signed-off-by: Michal Kazior <michal.kazior@xxxxxxxxx>
>> ---
>> drivers/net/wireless/ath/ath10k/mac.c | 30 ++++++++++++++++++++++++------
>> 1 file changed, 24 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
>> index b5d75b8..577a3a5 100644
>> --- a/drivers/net/wireless/ath/ath10k/mac.c
>> +++ b/drivers/net/wireless/ath/ath10k/mac.c
>> @@ -2289,6 +2289,21 @@ static void ath10k_tx(struct ieee80211_hw *hw,
>> /*
>> * Initialize various parameters with default vaules.
>> */
>> +static void ath10k_drain_tx(struct ath10k *ar)
>> +{
>> + /* workers can hold conf_mutex -- avoid deadlock */
>> + WARN_ON(lockdep_is_held(&ar->conf_mutex));
>
> Based on the discussion I modified the function to this now. Are you ok
> with that?
>
> /* Must not be called with conf_mutex held as workers can use that also. */
> static void ath10k_drain_tx(struct ath10k *ar)
> {
> /* make sure rcu-protected mac80211 tx path itself is drained */
> synchronize_net();
>
> ath10k_offchan_tx_purge(ar);
> ath10k_mgmt_over_wmi_tx_purge(ar);
>
> cancel_work_sync(&ar->offchan_tx_work);
> cancel_work_sync(&ar->wmi_mgmt_tx_work);
> }
>
> Full patch:
>
> https://github.com/kvalo/ath/commit/e3c513cd03802e75802a6ce5efbadaa0dbf04b27
Looks good, thanks!
Michał
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
