samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wifi: iwlwifi: pcie: make sure to lock rxq->read

Browse Source 
[ Upstream commit 1cc2c48c4af81bed5ddbe9f2c9d6e20fa163acf9 ]

rxq->read is accessed without the rxq->lock in a few places,
Make sure to have the lock there.

Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Tested-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20250424153620.73725f207aaa.I1a3e4b6c5fd370e029fdacfcdc9ee335788afa98@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Miri Korenblit
2025-04-24 15:38:30 +03:00
committed by Greg Kroah-Hartman
parent 920fcc7adc
commit 2077cef44d
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/net/wireless/intel/iwlwifi/pcie/trans.c
View File

@@ -2701,6 +2701,8 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
for (i = 0; i < trans->num_rx_queues && pos < bufsz; i++) { for (i = 0; i < trans->num_rx_queues && pos < bufsz; i++) {
struct iwl_rxq *rxq = &trans_pcie->rxq[i]; struct iwl_rxq *rxq = &trans_pcie->rxq[i];
spin_lock_bh(&rxq->lock);
pos += scnprintf(buf + pos, bufsz - pos, "queue#: %2d\n", pos += scnprintf(buf + pos, bufsz - pos, "queue#: %2d\n",
i); i);
pos += scnprintf(buf + pos, bufsz - pos, "\tread: %u\n", pos += scnprintf(buf + pos, bufsz - pos, "\tread: %u\n",
@@ -2721,6 +2723,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
pos += scnprintf(buf + pos, bufsz - pos, pos += scnprintf(buf + pos, bufsz - pos,
"\tclosed_rb_num: Not Allocated\n"); "\tclosed_rb_num: Not Allocated\n");
} }
spin_unlock_bh(&rxq->lock);
} }
ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos); ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
kfree(buf); kfree(buf);
@@ -3385,8 +3388,11 @@ iwl_trans_pcie_dump_data(struct iwl_trans *trans,
/* Dump RBs is supported only for pre-9000 devices (1 queue) */ /* Dump RBs is supported only for pre-9000 devices (1 queue) */
struct iwl_rxq *rxq = &trans_pcie->rxq[0]; struct iwl_rxq *rxq = &trans_pcie->rxq[0];
/* RBs */ /* RBs */
spin_lock_bh(&rxq->lock);
num_rbs = iwl_get_closed_rb_stts(trans, rxq); num_rbs = iwl_get_closed_rb_stts(trans, rxq);
num_rbs = (num_rbs - rxq->read) & RX_QUEUE_MASK; num_rbs = (num_rbs - rxq->read) & RX_QUEUE_MASK;
spin_unlock_bh(&rxq->lock);
len += num_rbs * (sizeof(*data) + len += num_rbs * (sizeof(*data) +
sizeof(struct iwl_fw_error_dump_rb) + sizeof(struct iwl_fw_error_dump_rb) +
(PAGE_SIZE << trans_pcie->rx_page_order)); (PAGE_SIZE << trans_pcie->rx_page_order));