[PATCH] ath10k: Fix crash due to tasklet race.

[Michal Kazior]

On 29 October 2013 22:38,  <greearb at candelatech.com> wrote:
> From: Ben Greear <greearb at candelatech.com>
>
> The tasklet can run after the rings have been cleaned up,
> so check for NULL before de-referencing the ring.
>
> Signed-off-by: Ben Greear <greearb at candelatech.com>
> ---
>  drivers/net/wireless/ath/ath10k/ce.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
> index d243f28..dfcfda9 100644
> --- a/drivers/net/wireless/ath/ath10k/ce.c
> +++ b/drivers/net/wireless/ath/ath10k/ce.c
> @@ -547,12 +547,18 @@ static int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
>         struct ath10k_ce_ring *src_ring = ce_state->src_ring;
>         u32 ctrl_addr = ce_state->ctrl_addr;
>         struct ath10k *ar = ce_state->ar;
> -       unsigned int nentries_mask = src_ring->nentries_mask;
> -       unsigned int sw_index = src_ring->sw_index;
> +       unsigned int nentries_mask;
> +       unsigned int sw_index;
>         struct ce_desc *sdesc, *sbase;
>         unsigned int read_index;
>         int ret;
>
> +       if (!src_ring)
> +               return -EIO;
> +
> +       nentries_mask = src_ring->nentries_mask;
> +       sw_index = src_ring->sw_index;
> +
>         if (src_ring->hw_index == sw_index) {
>                 /*
>                  * The SW completion index has caught up with the cached

I don't think this is a proper way to fix the problem. What should be
done is initialization clean up and some reordering to prevent this
from happening in the first place.


Michał