From: Kalle Valo <kvalo@codeaurora.org>
To: Ramon Fried <rfried@codeaurora.org>
Cc: k.eugene.e@gmail.com, wcn36xx@lists.infradead.org,
linux-wireless@vger.kernel.org,
Loic Poulain <loic.poulain@linaro.org>,
Ramon Fried <rfried@codeaurora.org>
Subject: Re: wcn36xx: Fix firmware crash due to corrupted buffer address
Date: Thu, 29 Mar 2018 08:57:50 +0000 (UTC) [thread overview]
Message-ID: <20180329085750.BE73F602BA@smtp.codeaurora.org> (raw)
In-Reply-To: <20180315113133.28791-1-rfried@codeaurora.org>
Ramon Fried <rfried@codeaurora.org> wrote:
> wcn36xx_start_tx function retrieves the buffer descriptor from the
> channel control queue to start filling tx buffer information. However,
> nothing prevents this same buffer to be concurrently accessed in a
> concurent tx call, leading to potential buffer coruption and firmware
> crash (observed during iperf test). The channel control queue should
> only be accessed and updated with the channel lock.
>
> Fix this issue by using a local buffer descriptor which will be copied
> in the thread-safe wcn36xx_dxe_tx_frame.
>
> Note that buffer descriptor size is few bytes so the introduced copy
> overhead is insignificant. Moreover, this allows to keep the locked
> section minimal.
>
> Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
> Signed-off-by: Ramon Fried <rfried@codeaurora.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
e5f9908155c9 wcn36xx: Fix firmware crash due to corrupted buffer address
--
https://patchwork.kernel.org/patch/10284261/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
prev parent reply other threads:[~2018-03-29 8:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-15 11:31 [PATCH] wcn36xx: Fix firmware crash due to corrupted buffer address Ramon Fried
2018-03-29 8:57 ` Kalle Valo [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180329085750.BE73F602BA@smtp.codeaurora.org \
--to=kvalo@codeaurora.org \
--cc=k.eugene.e@gmail.com \
--cc=linux-wireless@vger.kernel.org \
--cc=loic.poulain@linaro.org \
--cc=rfried@codeaurora.org \
--cc=wcn36xx@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.