diff options
| author | Dedy Lansky <qca_dlansky@qca.qualcomm.com> | 2014-09-10 16:34:40 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2014-09-11 15:27:37 -0400 |
| commit | 8c86f757b1c0a154cb8939b0fff3aaa1ff9b1910 (patch) | |
| tree | 48148c56f8c606ef183a7ee043a80fc3c27e7d14 | |
| parent | 871d8c4bbb0f23c29a21b63b1801071766f69b51 (diff) | |
wil6210: fix race condition of disconnect while BACK event
This race condition was causing double free of tid_ampdu_rx structures
Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/ath/wil6210/wmi.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c index 97909f0b3ef8..c71657bb8ce1 100644 --- a/drivers/net/wireless/ath/wil6210/wmi.c +++ b/drivers/net/wireless/ath/wil6210/wmi.c @@ -597,16 +597,18 @@ static void wmi_evt_ba_status(struct wil6210_priv *wil, int id, void *d, return; } + mutex_lock(&wil->mutex); + cid = wil->vring2cid_tid[evt->ringid][0]; if (cid >= WIL6210_MAX_CID) { wil_err(wil, "invalid CID %d for vring %d\n", cid, evt->ringid); - return; + goto out; } sta = &wil->sta[cid]; if (sta->status == wil_sta_unused) { wil_err(wil, "CID %d unused\n", cid); - return; + goto out; } wil_dbg_wmi(wil, "BACK for CID %d %pM\n", cid, sta->addr); @@ -618,6 +620,9 @@ static void wmi_evt_ba_status(struct wil6210_priv *wil, int id, void *d, sta->tid_rx[i] = wil_tid_ampdu_rx_alloc(wil, evt->agg_wsize, 0); } + +out: + mutex_unlock(&wil->mutex); } static const struct { |