archive mirror
 help / color / mirror / Atom feed
From: Kalle Valo <>
To: Miaoqing Pan <>
	Miaoqing Pan <>
Subject: Re: [PATCH v2] ath10k: fix wmi mgmt tx queue full due to race condition
Date: Thu, 28 Jan 2021 07:19:57 +0000 (UTC)	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

Miaoqing Pan <> wrote:

> Failed to transmit wmi management frames:
> [84977.840894] ath10k_snoc a000000.wifi: wmi mgmt tx queue is full
> [84977.840913] ath10k_snoc a000000.wifi: failed to transmit packet, dropping: -28
> [84977.840924] ath10k_snoc a000000.wifi: failed to submit frame: -28
> [84977.840932] ath10k_snoc a000000.wifi: failed to transmit frame: -28
> This issue is caused by race condition between skb_dequeue and
> __skb_queue_tail. The queue of ‘wmi_mgmt_tx_queue’ is protected by a
> different lock: ar->data_lock vs list->lock, the result is no protection.
> So when ath10k_mgmt_over_wmi_tx_work() and ath10k_mac_tx_wmi_mgmt()
> running concurrently on different CPUs, there appear to be a rare corner
> cases when the queue length is 1,
>   CPUx (skb_deuque)			CPUy (__skb_queue_tail)
> 					next=list
> 					prev=list
>   struct sk_buff *skb = skb_peek(list);	WRITE_ONCE(newsk->next, next);
>   WRITE_ONCE(list->qlen, list->qlen - 1);WRITE_ONCE(newsk->prev, prev);
>   next       = skb->next;		WRITE_ONCE(next->prev, newsk);
>   prev       = skb->prev;		WRITE_ONCE(prev->next, newsk);
>   skb->next  = skb->prev = NULL;	list->qlen++;
>   WRITE_ONCE(next->prev, prev);
>   WRITE_ONCE(prev->next, next);
> If the instruction ‘next = skb->next’ is executed before
> ‘WRITE_ONCE(prev->next, newsk)’, newsk will be lost, as CPUx get the
> old ‘next’ pointer, but the length is still added by one. The final
> result is the length of the queue will reach the maximum value but
> the queue is empty.
> So remove ar->data_lock, and use 'skb_queue_tail' instead of
> '__skb_queue_tail' to prevent the potential race condition. Also switch
> to use skb_queue_len_lockless, in case we queue a few SKBs simultaneously.
> Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.1.c2-00033-QCAHLSWMTPLZ-1
> Signed-off-by: Miaoqing Pan <>
> Reviewed-by: Brian Norris <>
> Signed-off-by: Kalle Valo <>

Patch applied to ath-next branch of ath.git, thanks.

b55379e343a3 ath10k: fix wmi mgmt tx queue full due to race condition


ath10k mailing list

      parent reply	other threads:[~2021-01-28  7:20 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-22  6:34 [PATCH v2] ath10k: fix wmi mgmt tx queue full due to race condition Miaoqing Pan
2020-12-22 18:26 ` Brian Norris
2021-01-28  7:19 ` Kalle Valo [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).