ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock

BugLink: https://bugs.launchpad.net/bugs/1836287
[ Upstream commit 168f75f11fe68455e0d058a818ebccfc329d8685 ]

While debugging driver crashes related to a buggy firmware
crashing under load, I noticed that ath10k_htt_rx_ring_free
could be called without being under lock.  I'm not sure if this
is the root cause of the crash or not, but it seems prudent to
protect it.

Originally tested on 4.16+ kernel with ath10k-ct 10.4 firmware
running on 9984 NIC.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 7d295ee715349d90128330975ebc9d81d5a19235..7aa57a3b7bfb1ffa835db52d09fdcf1a8c1d63ab 100644 (file)
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -215,11 +215,12 @@ int ath10k_htt_rx_ring_refill(struct ath10k *ar)
        spin_lock_bh(&htt->rx_ring.lock);
        ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
                                              htt->rx_ring.fill_cnt));
-       spin_unlock_bh(&htt->rx_ring.lock);
 
        if (ret)
                ath10k_htt_rx_ring_free(htt);
 
+       spin_unlock_bh(&htt->rx_ring.lock);
+
        return ret;
 }
 
@@ -231,7 +232,9 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
        skb_queue_purge(&htt->rx_in_ord_compl_q);
        skb_queue_purge(&htt->tx_fetch_ind_q);
 
+       spin_lock_bh(&htt->rx_ring.lock);
        ath10k_htt_rx_ring_free(htt);
+       spin_unlock_bh(&htt->rx_ring.lock);
 
        dma_free_coherent(htt->ar->dev,
                          (htt->rx_ring.size *