Forwarded: Re: [syzbot] [wireless?] [usb?] WARNING in __carl9170_tx_process_status

[syzbot <syzbot+381102a7292a374fe8a7@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [wireless?] [usb?] WARNING in __carl9170_tx_process_status
Author: malayarout91@gmail.com

Hi,

Please test the following patch.

#syz test

diff --git a/drivers/net/wireless/ath/carl9170/tx.c
b/drivers/net/wireless/ath/carl9170/tx.c
index 59caf1e4b158..b5a028abe4c6 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -514,8 +514,9 @@ static struct sk_buff
*carl9170_get_queued_skb(struct ar9170 *ar, u8 cookie,
                                               struct sk_buff_head *queue)
 {
        struct sk_buff *skb;
+       unsigned long flags;

-       spin_lock_bh(&queue->lock);
+       spin_lock_irqsave(&queue->lock, flags);
        skb_queue_walk(queue, skb) {
                struct _carl9170_tx_superframe *txc = (void *) skb->data;

@@ -523,12 +524,12 @@ static struct sk_buff
*carl9170_get_queued_skb(struct ar9170 *ar, u8 cookie,
                        continue;

                __skb_unlink(skb, queue);
-               spin_unlock_bh(&queue->lock);
+               spin_unlock_irqrestore(&queue->lock, flags);

                carl9170_release_dev_space(ar, skb);
                return skb;
        }
-       spin_unlock_bh(&queue->lock);
+       spin_unlock_irqrestore(&queue->lock, flags);

        return NULL;
 }