[ath9k-devel] [PATCH] ath10k: serialize CE completions properly

[Kalle Valo <kvalo@qca.qualcomm.com>]

Michal Kazior <michal.kazior@tieto.com> writes:

> This fixes memory leak when doing heavy TX.
>
> ath10k_pci_check_process_ce() was checking
> `compl_processing` and would call
> ath10k_pci_process_ce() if its false. The
> ath10k_pci_process_ce() would then set it to true
> if there's at least one completion. The lock
> protecting the variable is not held between
> checking and setting the variable, meaning it is a
> possible race condition.
>
> If we then assume ath10k_pci_process_ce() is
> called simultaneusly from different contexts we
> have a race. And apparently this was possible:
>
> ath10k_pci_check_process_ce() was called from
> ath10k_ce_per_engine_service(). This in turn could
> be called either from multiple tasklets (MSI-X) or
> a tasklet (MSI, Legacy INTR) or
> ath10k_htc_send_complete_check().
>
> The race itself would cause corruption of
> htt.refcount (ath10k_skb_cb) and we'd leak
> multiple skbuffs per tx.
>
> Signed-off-by: Michal Kazior <michal.kazior@tieto.com>

Thanks, applied.

-- 
Kalle Valo