[PATCH] mt76: avoid possible infinite loop in mt76_tx_status_check
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: 2021-10-12 12:38:07
Subsystem:
mediatek mt76 wireless lan driver, the rest · Maintainers:
Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Linus Torvalds
Do not check status timestamp before DMA completion. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> --- drivers/net/wireless/mediatek/mt76/tx.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 1c4e6e4fa8fc..11719ef034d8 100644
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c@@ -169,9 +169,14 @@ mt76_tx_status_skb_get(struct mt76_dev *dev, struct mt76_wcid *wcid, int pktid, idr_for_each_entry(&wcid->pktid, skb, id) { struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb); - if (pktid >= 0 && !time_after(jiffies, cb->jiffies + - MT_TX_STATUS_SKB_TIMEOUT)) - continue; + if (pktid >= 0) { + if (!(cb->flags & MT_TX_CB_DMA_DONE)) + continue; + + if (!time_is_after_jiffies(cb->jiffies + + MT_TX_STATUS_SKB_TIMEOUT)) + continue; + } /* It has been too long since DMA_DONE, time out this packet * and stop waiting for TXS callback.
@@ -192,15 +197,12 @@ EXPORT_SYMBOL_GPL(mt76_tx_status_skb_get); void mt76_tx_status_check(struct mt76_dev *dev, bool flush) { + struct mt76_wcid *wcid, *tmp; struct sk_buff_head list; - struct mt76_wcid *wcid; mt76_tx_status_lock(dev, &list); - while (!list_empty(&dev->wcid_list)) { - wcid = list_first_entry(&dev->wcid_list, struct mt76_wcid, - list); + list_for_each_entry_safe(wcid, tmp, &dev->wcid_list, list) mt76_tx_status_skb_get(dev, wcid, flush ? -1 : 0, &list); - } mt76_tx_status_unlock(dev, &list); } EXPORT_SYMBOL_GPL(mt76_tx_status_check);
--
2.31.1