mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-29 05:55:02 +08:00
eb26cff148
There are 2 possible race conditions, both are solved by addition of memory barrier: 1. wil_tx_complete reads the swhead to determine if the vring is empty. In case the swhead was updated before the descriptor update was performed in __wil_tx_vring/__wil_tx_vring_tso, the completion loop will not end and as the DU bit may still be set from a previous run, this skb can be handled as completed before it was sent, which will lead to double free of the same SKB. 2. __wil_tx_vring/__wil_tx_vring_tso calculate the number of available descriptors according to the swtail. In case the swtail is updated before memset of ctx to zero is completed, we can handle this descriptor while later on ctx is zeroed. Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com> |
||
|---|---|---|
| .. | ||
| ar5523 | ||
| ath5k | ||
| ath6kl | ||
| ath9k | ||
| ath10k | ||
| carl9170 | ||
| wcn36xx | ||
| wil6210 | ||
| ath.h | ||
| debug.c | ||
| dfs_pattern_detector.c | ||
| dfs_pattern_detector.h | ||
| dfs_pri_detector.c | ||
| dfs_pri_detector.h | ||
| hw.c | ||
| Kconfig | ||
| key.c | ||
| main.c | ||
| Makefile | ||
| reg.h | ||
| regd_common.h | ||
| regd.c | ||
| regd.h | ||
| spectral_common.h | ||
| trace.c | ||
| trace.h | ||