No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Miaoqing Pan e37674e1a4 ath10k: fix wmi mgmt tx queue full due to race condition
[ Upstream commit b55379e343a3472c35f4a1245906db5158cab453 ]

Failed to transmit wmi management frames:

[84977.840894] ath10k_snoc a000000.wifi: wmi mgmt tx queue is full
[84977.840913] ath10k_snoc a000000.wifi: failed to transmit packet, dropping: -28
[84977.840924] ath10k_snoc a000000.wifi: failed to submit frame: -28
[84977.840932] ath10k_snoc a000000.wifi: failed to transmit frame: -28

This issue is caused by race condition between skb_dequeue and
__skb_queue_tail. The queue of ‘wmi_mgmt_tx_queue’ is protected by a
different lock: ar->data_lock vs list->lock, the result is no protection.
So when ath10k_mgmt_over_wmi_tx_work() and ath10k_mac_tx_wmi_mgmt()
running concurrently on different CPUs, there appear to be a rare corner
cases when the queue length is 1,

  CPUx (skb_deuque)			CPUy (__skb_queue_tail)
					next=list
					prev=list
  struct sk_buff *skb = skb_peek(list);	WRITE_ONCE(newsk->next, next);
  WRITE_ONCE(list->qlen, list->qlen - 1);WRITE_ONCE(newsk->prev, prev);
  next       = skb->next;		WRITE_ONCE(next->prev, newsk);
  prev       = skb->prev;		WRITE_ONCE(prev->next, newsk);
  skb->next  = skb->prev = NULL;	list->qlen++;
  WRITE_ONCE(next->prev, prev);
  WRITE_ONCE(prev->next, next);

If the instruction ‘next = skb->next’ is executed before
‘WRITE_ONCE(prev->next, newsk)’, newsk will be lost, as CPUx get the
old ‘next’ pointer, but the length is still added by one. The final
result is the length of the queue will reach the maximum value but
the queue is empty.

So remove ar->data_lock, and use 'skb_queue_tail' instead of
'__skb_queue_tail' to prevent the potential race condition. Also switch
to use skb_queue_len_lockless, in case we queue a few SKBs simultaneously.

Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.1.c2-00033-QCAHLSWMTPLZ-1

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1608618887-8857-1-git-send-email-miaoqing@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-03-07 12:20:45 +01:00
arch x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk 2021-03-07 12:20:44 +01:00
block blk-settings: align max_sectors on "logical_block_size" boundary 2021-03-04 10:26:40 +01:00
certs certs: Fix blacklist flag type confusion 2021-03-04 10:26:29 +01:00
crypto crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key() 2021-03-04 10:26:25 +01:00
Documentation dt-bindings: net: btusb: DT fix s/interrupt-name/interrupt-names/ 2021-03-07 12:20:43 +01:00
drivers ath10k: fix wmi mgmt tx queue full due to race condition 2021-03-07 12:20:45 +01:00
fs xfs: Fix assert failure in xfs_setattr_size() 2021-03-07 12:20:42 +01:00
include net: fix dev_ifsioc_locked() race condition 2021-03-07 12:20:43 +01:00
init fgraph: Initialize tracing_graph_pause at task creation 2021-02-10 09:25:29 +01:00
ipc
kernel printk: fix deadlock when kernel panic 2021-03-04 10:26:50 +01:00
lib udp: fix skb_copy_and_csum_datagram with odd segment sizes 2021-02-17 10:35:19 +01:00
LICENSES
mm mm/hugetlb.c: fix unnecessary address expansion of pmd sharing 2021-03-07 12:20:43 +01:00
net pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() 2021-03-07 12:20:44 +01:00
samples samples: bpf: Fix lwt_len_hist reusing previous BPF map 2020-12-30 11:51:12 +01:00
scripts scripts/recordmcount.pl: support big endian for ARCH sh 2021-02-26 10:10:28 +01:00
security smackfs: restrict bytes count in smackfs write functions 2021-03-07 12:20:42 +01:00
sound ALSA: hda/realtek: modify EAPD in the ALC886 2021-03-04 10:26:42 +01:00
tools perf test: Fix unaligned access in sample parsing test 2021-03-04 10:26:35 +01:00
usr
virt KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped() 2021-02-26 10:10:28 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.102 2021-03-04 10:26:54 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.