linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sriram R <srirrama@codeaurora.org>,
	Kalle Valo <kvalo@codeaurora.org>,
	Sasha Levin <sashal@kernel.org>,
	ath11k@lists.infradead.org, linux-wireless@vger.kernel.org,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.7 091/274] ath11k: Avoid mgmt tx count underflow
Date: Mon,  8 Jun 2020 19:03:04 -0400	[thread overview]
Message-ID: <20200608230607.3361041-91-sashal@kernel.org> (raw)
In-Reply-To: <20200608230607.3361041-1-sashal@kernel.org>

From: Sriram R <srirrama@codeaurora.org>

[ Upstream commit 800113ff4b1d277c2b66ffc04d4d38f202a0d187 ]

The mgmt tx count reference is incremented/decremented on every mgmt tx and on
tx completion event from firmware.
In case of an unexpected mgmt tx completion event from firmware,
the counter would underflow. Avoid this by decrementing
only when the tx count is greater than 0.

Signed-off-by: Sriram R <srirrama@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1585567028-9242-1-git-send-email-srirrama@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 6fec62846279..73beca6d6b5f 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -3740,8 +3740,9 @@ static int wmi_process_mgmt_tx_comp(struct ath11k *ar, u32 desc_id,
 
 	ieee80211_tx_status_irqsafe(ar->hw, msdu);
 
-	WARN_ON_ONCE(atomic_read(&ar->num_pending_mgmt_tx) == 0);
-	atomic_dec(&ar->num_pending_mgmt_tx);
+	/* WARN when we received this event without doing any mgmt tx */
+	if (atomic_dec_if_positive(&ar->num_pending_mgmt_tx) < 0)
+		WARN_ON_ONCE(1);
 
 	return 0;
 }
-- 
2.25.1


  parent reply	other threads:[~2020-06-09  1:01 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20200608230607.3361041-1-sashal@kernel.org>
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 002/274] ath10k: Fix the race condition in firmware dump work queue Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 003/274] ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 004/274] ath9k: Fix use-after-free Write in ath9k_htc_rx_msg Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 005/274] ath9k: Fix use-after-free Read in htc_connect_service Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 031/274] ath10k: remove the max_sched_scan_reqs value Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 035/274] rtw88: fix an issue about leak system resources Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 044/274] mt76: mt7615: fix aid configuration in mt7615_mcu_wtbl_generic_tlv Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 058/274] ath11k: Fix some resource leaks in error path in 'ath11k_thermal_register()' Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 089/274] ath11k: fix error message to correctly report the command that failed Sasha Levin
2020-06-08 23:03 ` Sasha Levin [this message]
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 092/274] ath10k: fix kernel null pointer dereference Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 093/274] ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 094/274] ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 099/274] brcmfmac: fix wrong location to get firmware feature Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 113/274] ath10k: add flush tx packets for SDIO chip Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 125/274] ath11k: use GFP_ATOMIC under spin lock Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 156/274] ath10k: fix possible memory leak in ath10k_bmi_lz_data_large() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 157/274] ath11k: fix error return code in ath11k_dp_alloc() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 162/274] ath11k: fix kernel panic by freeing the msdu received with invalid length Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 163/274] ath9k_htc: Silence undersized packet warnings Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 164/274] libertas_tf: avoid a null dereference in pointer priv Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 179/274] iwlwifi: avoid debug max amsdu config overwriting itself Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 184/274] ath10k: Skip handling del_server during driver exit Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 185/274] ath10k: Remove msdu from idr when management pkt send fails Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 186/274] wcn36xx: Fix error handling path in 'wcn36xx_probe()' Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 190/274] mt76: mt7663: fix mt7615_mac_cca_stats_reset routine Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 191/274] mt76: mt7615: do not always reset the dfs state setting the channel Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 192/274] mt76: mt7622: fix DMA unmap length Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 193/274] mt76: mt7663: " Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 194/274] mt76: mt7615: fix mt7615_firmware_own for mt7663e Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 195/274] mt76: mt7615: fix mt7615_driver_own routine Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 196/274] mt76: avoid rx reorder buffer overflow Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 198/274] brcmfmac: fix WPA/WPA2-PSK 4-way handshake offload and SAE offload failures Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 210/274] rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup() Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 211/274] mwifiex: Fix memory corruption in dump_station Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 253/274] iwlwifi: mvm: fix aux station leak Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200608230607.3361041-91-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=ath11k@lists.infradead.org \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=srirrama@codeaurora.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).