Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 031d10ee authored by Chr's avatar Chr Committed by John W. Linville
Browse files

p54: take tx_queue's lock in rx_frame_sent 



p54_rx_frame_sent will alter the tx_queue. Therefore we should hold
the lock to protect against concurrent p54_assign_address calls.

Signed-off-by: default avatarChristian Lamparter <chunkeey@web.de>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 154e3af1

drivers/net/wireless/p54/p54common.c

+7 −1
Original line number Original line Diff line number Diff line
@@ -432,7 +432,9 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb) 
	struct memrecord *range = NULL;

	struct memrecord *range = NULL;

	u32 freed = 0;

	u32 freed = 0;

	u32 last_addr = priv->rx_start;

	u32 last_addr = priv->rx_start;

	unsigned long flags;





	spin_lock_irqsave(&priv->tx_queue.lock, flags);

	while (entry != (struct sk_buff *)&priv->tx_queue) {

	while (entry != (struct sk_buff *)&priv->tx_queue) {

		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);

		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);

		range = (void *)info->driver_data;

		range = (void *)info->driver_data;
@@ -453,6 +455,8 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb) 




			last_addr = range->end_addr;

			last_addr = range->end_addr;

			__skb_unlink(entry, &priv->tx_queue);

			__skb_unlink(entry, &priv->tx_queue);

			spin_unlock_irqrestore(&priv->tx_queue.lock, flags);



			memset(&info->status, 0, sizeof(info->status));

			memset(&info->status, 0, sizeof(info->status));

			entry_hdr = (struct p54_control_hdr *) entry->data;

			entry_hdr = (struct p54_control_hdr *) entry->data;

			entry_data = (struct p54_tx_control_allocdata *) entry_hdr->data;

			entry_data = (struct p54_tx_control_allocdata *) entry_hdr->data;
@@ -470,12 +474,14 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb) 
			info->status.ack_signal = le16_to_cpu(payload->ack_rssi);

			info->status.ack_signal = le16_to_cpu(payload->ack_rssi);

			skb_pull(entry, sizeof(*hdr) + pad + sizeof(*entry_data));

			skb_pull(entry, sizeof(*hdr) + pad + sizeof(*entry_data));

			ieee80211_tx_status_irqsafe(dev, entry);

			ieee80211_tx_status_irqsafe(dev, entry);

			break;

			goto out;

		} else

		} else

			last_addr = range->end_addr;

			last_addr = range->end_addr;

		entry = entry->next;

		entry = entry->next;

	}

	}

	spin_unlock_irqrestore(&priv->tx_queue.lock, flags);





out:

	if (freed >= IEEE80211_MAX_RTS_THRESHOLD + 0x170 +

	if (freed >= IEEE80211_MAX_RTS_THRESHOLD + 0x170 +

	    sizeof(struct p54_control_hdr))

	    sizeof(struct p54_control_hdr))

		p54_wake_free_queues(dev);

		p54_wake_free_queues(dev);