mirror_ubuntu-kernels/drivers/net/wireless/ath
Mohammed Shafi Shajakhan 02a9e08d73 ath10k: Avoid potential page alloc BUG_ON in tx free path
'ath10k_htt_tx_free_cont_txbuf' and 'ath10k_htt_tx_free_cont_frag_desc'
have NULL pointer checks to avoid crash if they are called twice
but this is as of now not sufficient as these pointers are not assigned
to NULL once the contiguous DMA memory allocation is freed, fix this.
Though this may not be hit with the explicity check of state variable
'tx_mem_allocated' check, good to have this addressed as well.

Below BUG_ON is hit when the above scenario is simulated
with kernel debugging enabled

 page:f6d09a00 count:0 mapcount:-127 mapping:  (null)
index:0x0
 flags: 0x40000000()
 page dumped because: VM_BUG_ON_PAGE(page_ref_count(page)
== 0)
 ------------[ cut here ]------------
 kernel BUG at ./include/linux/mm.h:445!
 invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
 EIP is at put_page_testzero.part.88+0xd/0xf
 Call Trace:
  [<c118a2cc>] __free_pages+0x3c/0x40
  [<c118a30e>] free_pages+0x3e/0x50
  [<c10222b4>] dma_generic_free_coherent+0x24/0x30
  [<f8c1d9a8>] ath10k_htt_tx_free_cont_txbuf+0xf8/0x140

  [<f8c1e2a9>] ath10k_htt_tx_destroy+0x29/0xa0

  [<f8c143e0>] ath10k_core_destroy+0x60/0x80 [ath10k_core]
  [<f8acd7e9>] ath10k_pci_remove+0x79/0xa0 [ath10k_pci]
  [<c13ed7a8>] pci_device_remove+0x38/0xb0
  [<c14d3492>] __device_release_driver+0x72/0x100
  [<c14d36b7>] driver_detach+0x97/0xa0
  [<c14d29c0>] bus_remove_driver+0x40/0x80
  [<c14d427a>] driver_unregister+0x2a/0x60
  [<c13ec768>] pci_unregister_driver+0x18/0x70
  [<f8aced4f>] ath10k_pci_exit+0xd/0x2be [ath10k_pci]
  [<c1101e78>] SyS_delete_module+0x158/0x210
  [<c11b34f1>] ? __might_fault+0x41/0xa0
  [<c11b353b>] ? __might_fault+0x8b/0xa0
  [<c1001a4b>] do_fast_syscall_32+0x9b/0x1c0
  [<c178da34>] sysenter_past_esp+0x45/0x74

Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2016-12-15 11:17:52 +02:00
..
ar5523 net: wireless: ath: ar5523: ar5523: don't print error when allocating urb fails 2016-08-13 14:53:40 -07:00
ath5k ath5k: drop duplicate header vmalloc.h 2016-12-01 13:23:19 +02:00
ath6kl wireless-drivers-next patches for 4.10 2016-11-27 20:26:59 -05:00
ath9k ath9k: Turn ath_txq_lock/unlock() into static inlines. 2016-12-15 10:44:04 +02:00
ath10k ath10k: Avoid potential page alloc BUG_ON in tx free path 2016-12-15 11:17:52 +02:00
carl9170 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2016-10-05 10:11:24 -07:00
wcn36xx wcn36xx: Silence error about unsupported smd event 188 2016-07-08 17:04:40 +03:00
wil6210 wil6210: align to latest auto generated wmi.h 2016-12-01 13:20:41 +02:00
ath.h ath9k: add a helper to get the string representation of ath_bus_type 2016-11-15 16:55:37 +02:00
debug.c ath: Make ath_opmode_to_string understand OCB mode 2015-08-10 22:21:15 +03:00
dfs_pattern_detector.c ath: constify local structures 2016-09-14 20:01:39 +03:00
dfs_pattern_detector.h ath: use PRI value given by spec for fixed PRI 2015-09-27 15:50:30 +03:00
dfs_pri_detector.c ath: use PRI value given by spec for fixed PRI 2015-09-27 15:50:30 +03:00
dfs_pri_detector.h
hw.c
Kconfig ath: unify Kconfig with other vendors 2015-11-18 14:28:31 +02:00
key.c
main.c ath9k: add a helper to get the string representation of ath_bus_type 2016-11-15 16:55:37 +02:00
Makefile
reg.h
regd_common.h
regd.c ath: export alpha2 helper 2016-10-04 18:01:48 +03:00
regd.h ath: export alpha2 helper 2016-10-04 18:01:48 +03:00
spectral_common.h
trace.c
trace.h