wil6210: fix race between xmit and Tx vring de-allocation

Use spinlock, this should not impact Tx as lock is always free
except for de-allocation.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index e37cab1c5a5384c9f5378544682e88f9d0531d17..85ecea2e6a674de51083d1da6448ca13a3fcff1d 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -671,6 +671,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
        }
 
        memset(txdata, 0, sizeof(*txdata));
+       spin_lock_init(&txdata->lock);
        vring->size = size;
        rc = wil_vring_alloc(wil, vring);
        if (rc)
@@ -718,8 +719,10 @@ void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
 
        wil_dbg_misc(wil, "%s() id=%d\n", __func__, id);
 
+       spin_lock_bh(&txdata->lock);
+       txdata->enabled = 0; /* no Tx can be in progress or start anew */
+       spin_unlock_bh(&txdata->lock);
        /* make sure NAPI won't touch this vring */
-       wil->vring_tx_data[id].enabled = 0;
        if (test_bit(wil_status_napi_en, wil->status))
                napi_synchronize(&wil->napi_tx);
 
@@ -935,8 +938,8 @@ static int wil_tx_desc_offload_cksum_set(struct wil6210_priv *wil,
        return 0;
 }
 
-static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
-                       struct sk_buff *skb)
+static int __wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
+                         struct sk_buff *skb)
 {
        struct device *dev = wil_to_dev(wil);
        struct vring_tx_desc dd, *d = ⅆ
@@ -952,6 +955,9 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
 
        wil_dbg_txrx(wil, "%s()\n", __func__);
 
+       if (unlikely(!txdata->enabled))
+               return -EINVAL;
+
        if (avail < 1 + nr_frags) {
                wil_err_ratelimited(wil,
                                    "Tx ring full. No space for %d fragments\n",
@@ -1050,6 +1056,19 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
        return -EINVAL;
 }
 
+static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
+                       struct sk_buff *skb)
+{
+       int vring_index = vring - wil->vring_tx;
+       struct vring_tx_data *txdata = &wil->vring_tx_data[vring_index];
+       int rc;
+
+       spin_lock(&txdata->lock);
+       rc = __wil_tx_vring(wil, vring, skb);
+       spin_unlock(&txdata->lock);
+       return rc;
+}
+
 netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 {
        struct wil6210_priv *wil = ndev_to_wil(ndev);

diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index 90dc24fb60f8699a3e132a0b52c77eceea16d8d8..94611568fc9ab3384128ebbe77d066ba16502985 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -385,6 +385,7 @@ struct vring_tx_data {
        u16 agg_timeout;
        u8 agg_amsdu;
        bool addba_in_progress; /* if set, agg_xxx is for request in progress */
+       spinlock_t lock;
 };
 
 enum { /* for wil6210_priv.status */