wil6210: prevent usage of incorrect TX hwtail

txdata->enabled is used in order to determine if the TX vring
is valid. As the data transmit is handled in a different context,
in case txdata->enabled is set before vring->hwtail is updated,
an old or corrupted vring->hwtail can be used.
Protect setting of txdata->enabled and vring->hwtail to prevent a
case where TX vring start handling TX packets before setting
vring->hwtail.

Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index f2f6a40..4c38520 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -873,9 +873,12 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                rc = -EINVAL;
                goto out_free;
        }
-       vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
 
+       spin_lock_bh(&txdata->lock);
+       vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
        txdata->enabled = 1;
+       spin_unlock_bh(&txdata->lock);
+
        if (txdata->dot1x_open && (agg_wsize >= 0))
                wil_addba_tx_request(wil, id, agg_wsize);
 
@@ -950,9 +953,11 @@ int wil_vring_init_bcast(struct wil6210_priv *wil, int id, int size)
                rc = -EINVAL;
                goto out_free;
        }
-       vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
 
+       spin_lock_bh(&txdata->lock);
+       vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
        txdata->enabled = 1;
+       spin_unlock_bh(&txdata->lock);
 
        return 0;
  out_free: