Commit 1cc2c48c authored by Miri Korenblit's avatar Miri Korenblit Committed by Johannes Berg
Browse files

wifi: iwlwifi: pcie: make sure to lock rxq->read 



rxq->read is accessed without the rxq->lock in a few places,
Make sure to have the lock there.

Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Reviewed-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Tested-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20250424153620.73725f207aaa.I1a3e4b6c5fd370e029fdacfcdc9ee335788afa98@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 38f3ea72

drivers/net/wireless/intel/iwlwifi/pcie/trans.c

+6 −0
Original line number Diff line number Diff line
@@ -2934,6 +2934,8 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file, 
	for (i = 0; i < trans->num_rx_queues && pos < bufsz; i++) {

		struct iwl_rxq *rxq = &trans_pcie->rxq[i];



		spin_lock_bh(&rxq->lock);



		pos += scnprintf(buf + pos, bufsz - pos, "queue#: %2d\n",

				 i);

		pos += scnprintf(buf + pos, bufsz - pos, "\tread: %u\n",
@@ -2954,6 +2956,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file, 
			pos += scnprintf(buf + pos, bufsz - pos,

					 "\tclosed_rb_num: Not Allocated\n");

		}

		spin_unlock_bh(&rxq->lock);

	}

	ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);

	kfree(buf);
@@ -3654,8 +3657,11 @@ iwl_trans_pcie_dump_data(struct iwl_trans *trans, u32 dump_mask, 
		/* Dump RBs is supported only for pre-9000 devices (1 queue) */

		struct iwl_rxq *rxq = &trans_pcie->rxq[0];

		/* RBs */

		spin_lock_bh(&rxq->lock);

		num_rbs = iwl_get_closed_rb_stts(trans, rxq);

		num_rbs = (num_rbs - rxq->read) & RX_QUEUE_MASK;

		spin_unlock_bh(&rxq->lock);



		len += num_rbs * (sizeof(*data) +

				  sizeof(struct iwl_fw_error_dump_rb) +

				  (PAGE_SIZE << trans_pcie->rx_page_order));