diff options
| author | Hamad Kadmany <hkadmany@codeaurora.org> | 2017-02-06 11:46:36 +0200 |
|---|---|---|
| committer | Hamad Kadmany <hkadmany@codeaurora.org> | 2017-02-06 11:46:36 +0200 |
| commit | 66c8f9ed278d4221be71a23b0f853c0ddd67679f (patch) | |
| tree | e59335b3a44661121a668be8e15cce0841d9c5c6 /drivers/net | |
| parent | 2e47ba9a64f870431dd7709f454ba51dca0f89e9 (diff) | |
wil6210: protect list of pending wmi events during flush
When flush is done, pending events list is manipulated
without taking the proper spinlock, which could lead to
memory corruption if list is manipulated by wmi worker
or by interrupt routine.
Change-Id: Iccbc65d94f837402c12d9794cfdde21339599a0b
CRs-Fixed: 2002638
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/wireless/ath/wil6210/wmi.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c index 09595349f24b..0bddc9d9c632 100644 --- a/drivers/net/wireless/ath/wil6210/wmi.c +++ b/drivers/net/wireless/ath/wil6210/wmi.c @@ -1721,14 +1721,19 @@ int wmi_abort_scan(struct wil6210_priv *wil) void wmi_event_flush(struct wil6210_priv *wil) { + ulong flags; struct pending_wmi_event *evt, *t; wil_dbg_wmi(wil, "%s()\n", __func__); + spin_lock_irqsave(&wil->wmi_ev_lock, flags); + list_for_each_entry_safe(evt, t, &wil->pending_wmi_ev, list) { list_del(&evt->list); kfree(evt); } + + spin_unlock_irqrestore(&wil->wmi_ev_lock, flags); } static bool wmi_evt_call_handler(struct wil6210_priv *wil, int id, |