archive mirror
 help / color / mirror / Atom feed
From: Pavel Andrianov <>
To: Eugene Krasnikov <>
Cc: Kalle Valo <>,,,,,,
	Vaishali Thakkar <>
Subject: [ldv-project] [net] wcn36xx: potential race condition
Date: Tue, 14 Jun 2016 18:42:32 +0400	[thread overview]
Message-ID: <> (raw)


There is a potential race condition in 
drivers/net/wireless/ath/wcn36xx/wcn36xx.ko. In wcn36xx_tx -> 
wcn36xx_start_tx -> wcn36xx_set_tx_data 
there is a read of sta_priv->bss_dpu_desc_index and 
sta_priv->bss_sta_index. In wcn36xx_bss_info_changed -> 
wcn36xx_smd_config_bss -> wcn36xx_smd_config_bss_rsp 
there is a write to the same fields. It  seems that the handlers may be 
called in parallel and inconsistent data may be obtained.
The same problem is with sta_priv->sta_index and 

Is it a real bug? Is it enough to add mutex_lock to wcn36xx_set_tx_data?

Pavel Andrianov
Linux Verification Center, ISPRAS

                 reply	other threads:[~2016-06-14 15:46 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \
    --subject='Re: [ldv-project] [net] wcn36xx: potential race condition' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).