diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2024-03-07 16:42:11 +0100 |
|---|---|---|
| committer | iwlwifi publisher <> | 2024-04-17 13:09:08 +0000 |
| commit | 2cb9ff545ac864a38fa7039670b4f303b04779c0 (patch) | |
| tree | 3889c55fe71095a57143dc52f68562c15b4aa56f | |
| parent | 40254ead258c06c89de12b6a55dcd8c417ada2da (diff) | |
| download | backport-iwlwifi-2cb9ff545ac864a38fa7039670b4f303b04779c0.tar.gz | |
[BUGFIX] wifi: iwlwifi: read txq->read_ptr under lock
If we read txq->read_ptr without lock, we can read the same
value twice, then obtain the lock, and reclaim from there
to two different places, but crucially reclaim the same
entry twice, resulting in the WARN_ONCE() a little later.
Fix that by reading txq->read_ptr under lock.
type=bugfix
fixes=I69ecae8a6b5e88fc11fe6d42959e696555f9ff02
ticket=jira:WIFI-317330
Change-Id: I978a7ca56c6bd6f1bf42c15aa923ba03366a840b
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-on: https://gerritwcs.ir.intel.com/c/iwlwifi-stack-dev/+/98119
automatic-review: iil_jenkins iil_jenkins <EC.GER.UNIX.IIL.JENKINS@INTEL.COM>
tested: iil_jenkins iil_jenkins <EC.GER.UNIX.IIL.JENKINS@INTEL.COM>
Tested-by: iil_jenkins iil_jenkins <EC.GER.UNIX.IIL.JENKINS@INTEL.COM>
Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
x-iwlwifi-stack-dev: 839954ab0a33728f9ec47f882fb17de04b2f8096
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/queue/tx.c | 2 | ||||
| -rw-r--r-- | versions | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/queue/tx.c b/drivers/net/wireless/intel/iwlwifi/queue/tx.c index e76f9f21bd..283c39743c 100644 --- a/drivers/net/wireless/intel/iwlwifi/queue/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/queue/tx.c @@ -1590,9 +1590,9 @@ void iwl_txq_reclaim(struct iwl_trans *trans, int txq_id, int ssn, return; tfd_num = iwl_txq_get_cmd_index(txq, ssn); - read_ptr = iwl_txq_get_cmd_index(txq, txq->read_ptr); spin_lock_bh(&txq->lock); + read_ptr = iwl_txq_get_cmd_index(txq, txq->read_ptr); if (!test_bit(txq_id, trans->txqs.queue_used)) { IWL_DEBUG_TX_QUEUES(trans, "Q %d inactive - ignoring idx %d\n", @@ -2,4 +2,4 @@ BACKPORTS_VERSION="(see git)" BACKPORTED_KERNEL_VERSION="(see git)" BACKPORTED_KERNEL_NAME="iwlwifi" BACKPORTS_BUILD_TSTAMP=__DATE__ \" \" __TIME__ -BACKPORTS_GIT_TRACKED="iwlwifi-stack-public:master:11995:441b91ae" +BACKPORTS_GIT_TRACKED="iwlwifi-stack-public:master:11996:839954ab" |