From patchwork Sun May 14 09:15:55 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Greenman, Gregory" X-Patchwork-Id: 683329 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1138C7EE22 for ; Sun, 14 May 2023 09:16:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236245AbjENJQz (ORCPT ); Sun, 14 May 2023 05:16:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42228 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231493AbjENJQx (ORCPT ); Sun, 14 May 2023 05:16:53 -0400 Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A0D0526A1 for ; Sun, 14 May 2023 02:16:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1684055801; x=1715591801; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=gHwl5mHyrmf5x4sroIPFNsvY/8uI6XoD0IuFvaHp6t4=; b=ehQc2P5TY/wuFKmxxzgfTOgAW0KPJlul+PlaVDBHvrSjdLGk3OJncxqI BQySz7R2YUslp6UulwF3le5pKdLQ3I7dxG9eD4lDfoSoOYHSOA2833CX/ ChIZkzEFrHR9PFSEfmZ5+3yKSfI71BNNwXG6PGQ6WmLGzmW0k/KpzCTd1 RX7Dbn34KKg+RRzjCD7BDa9yVyDKdblOsCRKoAHOEkMKIDjWeAp4yy+td JXL5KIRS2zU4saJBKvwNt5oTh6qi4pAIfLSLsTBvRmKlzavafy0+7RdZr Lc8hVXgio7OxH2Q69xdfwbsbByNBEagGM2MCoBN71w547PsMZ1t4wMUCx w==; X-IronPort-AV: E=McAfee;i="6600,9927,10709"; a="340366871" X-IronPort-AV: E=Sophos;i="5.99,274,1677571200"; d="scan'208";a="340366871" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 May 2023 02:16:41 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10709"; a="731300487" X-IronPort-AV: E=Sophos;i="5.99,274,1677571200"; d="scan'208";a="731300487" Received: from seran-mobl1.ger.corp.intel.com (HELO ggreenma-mobl2.lan) ([10.214.239.223]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 May 2023 02:16:39 -0700 From: gregory.greenman@intel.com To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Ariel Malamud , Gregory Greenman Subject: [PATCH wireless 12/12] wifi: iwlwifi: mvm: Add locking to the rate read flow Date: Sun, 14 May 2023 12:15:55 +0300 Message-Id: <20230514120631.b52c9ed5c379.I15290b78e0d966c1b68278263776ca9de841d5fe@changeid> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20230514091555.168392-1-gregory.greenman@intel.com> References: <20230514091555.168392-1-gregory.greenman@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Ariel Malamud The rs_drv_get_rate flow reads the lq_sta to return the optimal rate for tx frames. This read flow is not protected thereby leaving a small window, a few instructions wide, open to contention by an asynchronous rate update. Indeed this race condition was hit and the update occurred in the middle of the read. Fix this by locking the lq_sta struct during read. Signed-off-by: Ariel Malamud Signed-off-by: Gregory Greenman --- drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c index a4c1e3bf4ff1..23266d0c9ce4 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c @@ -2691,6 +2691,8 @@ static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta, return; lq_sta = mvm_sta; + + spin_lock(&lq_sta->pers.lock); iwl_mvm_hwrate_to_tx_rate_v1(lq_sta->last_rate_n_flags, info->band, &info->control.rates[0]); info->control.rates[0].count = 1; @@ -2705,6 +2707,7 @@ static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta, iwl_mvm_hwrate_to_tx_rate_v1(last_ucode_rate, info->band, &txrc->reported_rate); } + spin_unlock(&lq_sta->pers.lock); } static void *rs_drv_alloc_sta(void *mvm_rate, struct ieee80211_sta *sta,