Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c29a380e authored by Michal Kazior's avatar Michal Kazior Committed by Kalle Valo
Browse files

ath10k: prevent endless pci rx loop 



It was possible to enter an endless loop while
processing a single pci copy engine pipe. This
could effectively render ath10k incapable of
responding to any requests.

An example case when this could happen is when
firmware generates a lot of events, e.g. spectral
scan phyerr via WMI.

Reported-by: default avatarJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: default avatarMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
parent c21c64d1

drivers/net/wireless/ath/ath10k/pci.c

+9 −8
Original line number Diff line number Diff line
@@ -726,18 +726,12 @@ static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state) 
	unsigned int nbytes, max_nbytes;

	unsigned int transfer_id;

	unsigned int flags;

	int err;

	int err, num_replenish = 0;



	while (ath10k_ce_completed_recv_next(ce_state, &transfer_context,

					     &ce_data, &nbytes, &transfer_id,

					     &flags) == 0) {

		err = ath10k_pci_post_rx_pipe(pipe_info, 1);

		if (unlikely(err)) {

			/* FIXME: retry */

			ath10k_warn("failed to replenish CE rx ring %d: %d\n",

				    pipe_info->pipe_num, err);

		}



		num_replenish++;

		skb = transfer_context;

		max_nbytes = skb->len + skb_tailroom(skb);

		dma_unmap_single(ar->dev, ATH10K_SKB_CB(skb)->paddr,
@@ -753,6 +747,13 @@ static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state) 
		skb_put(skb, nbytes);

		cb->rx_completion(ar, skb, pipe_info->pipe_num);

	}



	err = ath10k_pci_post_rx_pipe(pipe_info, num_replenish);

	if (unlikely(err)) {

		/* FIXME: retry */

		ath10k_warn("failed to replenish CE rx ring %d (%d bufs): %d\n",

			    pipe_info->pipe_num, num_replenish, err);

	}

}



static int ath10k_pci_hif_tx_sg(struct ath10k *ar, u8 pipe_id,