Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 09bdb650 authored by Douglas Anderson's avatar Douglas Anderson Committed by Kalle Valo
Browse files

mwifiex: Add locking to mwifiex_11n_delba 



The mwifiex_11n_delba() function walked the rx_reorder_tbl_ptr without
holding the lock, which was an obvious violation.

Grab the lock.

NOTE: we hold the lock while calling mwifiex_send_delba().  There's also
several callers in 11n_rxreorder.c that hold the lock and the comments
in the struct sound just like very other list/lock pair -- as if the
lock should definitely be help for all operations like this.

Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
Signed-off-by: default avatarBrian Norris <briannorris@chromium.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 90ad0be8

drivers/net/wireless/marvell/mwifiex/11n.c

+6 −2
Original line number Original line Diff line number Diff line
@@ -653,11 +653,13 @@ int mwifiex_send_delba(struct mwifiex_private *priv, int tid, u8 *peer_mac, 
void mwifiex_11n_delba(struct mwifiex_private *priv, int tid)

void mwifiex_11n_delba(struct mwifiex_private *priv, int tid)

{

{

	struct mwifiex_rx_reorder_tbl *rx_reor_tbl_ptr;

	struct mwifiex_rx_reorder_tbl *rx_reor_tbl_ptr;

	unsigned long flags;





	spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);

	if (list_empty(&priv->rx_reorder_tbl_ptr)) {

	if (list_empty(&priv->rx_reorder_tbl_ptr)) {

		dev_dbg(priv->adapter->dev,

		dev_dbg(priv->adapter->dev,

			"mwifiex_11n_delba: rx_reorder_tbl_ptr empty\n");

			"mwifiex_11n_delba: rx_reorder_tbl_ptr empty\n");

		return;

		goto exit;

	}

	}





	list_for_each_entry(rx_reor_tbl_ptr, &priv->rx_reorder_tbl_ptr, list) {

	list_for_each_entry(rx_reor_tbl_ptr, &priv->rx_reorder_tbl_ptr, list) {
@@ -666,9 +668,11 @@ void mwifiex_11n_delba(struct mwifiex_private *priv, int tid) 
				"Send delba to tid=%d, %pM\n",

				"Send delba to tid=%d, %pM\n",

				tid, rx_reor_tbl_ptr->ta);

				tid, rx_reor_tbl_ptr->ta);

			mwifiex_send_delba(priv, tid, rx_reor_tbl_ptr->ta, 0);

			mwifiex_send_delba(priv, tid, rx_reor_tbl_ptr->ta, 0);

			return;

			goto exit;

		}

		}

	}

	}

exit:

	spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);

}

}





/*

/*