From bhaktipriya96 at gmail.com  Sat Jun  4 06:59:01 2016
From: bhaktipriya96 at gmail.com (Bhaktipriya Shridhar)
Date: Sat, 4 Jun 2016 19:29:01 +0530
Subject: [PATCH] net: wireless: marvell: libertas: Remove create_workqueue
Message-ID: <20160604135901.GA29897@Karyakshetra>

alloc_workqueue replaces deprecated create_workqueue().

In if_sdio.c, the workqueue card->workqueue has workitem
&card->packet_worker, which is mapped to if_sdio_host_to_card_worker.
The workitem is involved in sending packets to firmware.
Forward progress under memory pressure is a requirement here.

In if_spi.c, the workqueue card->workqueue has workitem
&card->packet_worker, which is mapped to if_spi_host_to_card_worker.
The workitem is involved in sending command packets from the host.
Forward progress under memory pressure is a requirement here.

Dedicated workqueues have been used in both cases since the workitems
on the workqueues are involved in normal device operation with
WQ_MEM_RECLAIM set to gurantee forward progress under memory pressure.
Since there are only a fixed number of work items, explicit concurrency
limit is unnecessary.

flush_workqueue is unnecessary since destroy_workqueue() itself calls
drain_workqueue() which flushes repeatedly till the workqueue
becomes empty. Hence the calls to flush_workqueue() before
destroy_workqueue() have been dropped.

Signed-off-by: Bhaktipriya Shridhar <bhaktipriya96 at gmail.com>
---
 drivers/net/wireless/marvell/libertas/if_sdio.c | 3 +--
 drivers/net/wireless/marvell/libertas/if_spi.c  | 4 +---
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c
index 13eae9f..47f4a14 100644
--- a/drivers/net/wireless/marvell/libertas/if_sdio.c
+++ b/drivers/net/wireless/marvell/libertas/if_sdio.c
@@ -1228,7 +1228,7 @@ static int if_sdio_probe(struct sdio_func *func,
 	}

 	spin_lock_init(&card->lock);
-	card->workqueue = create_workqueue("libertas_sdio");
+	card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0);
 	INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker);
 	init_waitqueue_head(&card->pwron_waitq);

@@ -1326,7 +1326,6 @@ static void if_sdio_remove(struct sdio_func *func)
 	lbs_stop_card(card->priv);
 	lbs_remove_card(card->priv);

-	flush_workqueue(card->workqueue);
 	destroy_workqueue(card->workqueue);

 	while (card->packets) {
diff --git a/drivers/net/wireless/marvell/libertas/if_spi.c b/drivers/net/wireless/marvell/libertas/if_spi.c
index 82c0796..c3a53cd 100644
--- a/drivers/net/wireless/marvell/libertas/if_spi.c
+++ b/drivers/net/wireless/marvell/libertas/if_spi.c
@@ -1180,7 +1180,7 @@ static int if_spi_probe(struct spi_device *spi)
 	priv->fw_ready = 1;

 	/* Initialize interrupt handling stuff. */
-	card->workqueue = create_workqueue("libertas_spi");
+	card->workqueue = alloc_workqueue("libertas_spi", WQ_MEM_RECLAIM, 0);
 	INIT_WORK(&card->packet_work, if_spi_host_to_card_worker);
 	INIT_WORK(&card->resume_work, if_spi_resume_worker);

@@ -1208,7 +1208,6 @@ static int if_spi_probe(struct spi_device *spi)
 release_irq:
 	free_irq(spi->irq, card);
 terminate_workqueue:
-	flush_workqueue(card->workqueue);
 	destroy_workqueue(card->workqueue);
 	lbs_remove_card(priv); /* will call free_netdev */
 free_card:
@@ -1235,7 +1234,6 @@ static int libertas_spi_remove(struct spi_device *spi)
 	lbs_remove_card(priv); /* will call free_netdev */

 	free_irq(spi->irq, card);
-	flush_workqueue(card->workqueue);
 	destroy_workqueue(card->workqueue);
 	if (card->pdata->teardown)
 		card->pdata->teardown(spi);
--
2.1.4



From kvalo at codeaurora.org  Sat Jun  4 07:29:20 2016
From: kvalo at codeaurora.org (Kalle Valo)
Date: Sat, 04 Jun 2016 17:29:20 +0300
Subject: [PATCH] net: wireless: marvell: libertas: Remove create_workqueue
In-Reply-To: <20160604135901.GA29897@Karyakshetra> (Bhaktipriya Shridhar's
 message of "Sat, 4 Jun 2016 19:29:01 +0530")
References: <20160604135901.GA29897@Karyakshetra>
Message-ID: <87h9d9t4cf.fsf@kamboji.qca.qualcomm.com>

Bhaktipriya Shridhar <bhaktipriya96 at gmail.com> writes:

> alloc_workqueue replaces deprecated create_workqueue().
>
> In if_sdio.c, the workqueue card->workqueue has workitem
> &card->packet_worker, which is mapped to if_sdio_host_to_card_worker.
> The workitem is involved in sending packets to firmware.
> Forward progress under memory pressure is a requirement here.
>
> In if_spi.c, the workqueue card->workqueue has workitem
> &card->packet_worker, which is mapped to if_spi_host_to_card_worker.
> The workitem is involved in sending command packets from the host.
> Forward progress under memory pressure is a requirement here.
>
> Dedicated workqueues have been used in both cases since the workitems
> on the workqueues are involved in normal device operation with
> WQ_MEM_RECLAIM set to gurantee forward progress under memory pressure.
> Since there are only a fixed number of work items, explicit concurrency
> limit is unnecessary.
>
> flush_workqueue is unnecessary since destroy_workqueue() itself calls
> drain_workqueue() which flushes repeatedly till the workqueue
> becomes empty. Hence the calls to flush_workqueue() before
> destroy_workqueue() have been dropped.
>
> Signed-off-by: Bhaktipriya Shridhar <bhaktipriya96 at gmail.com>

"libertas:" as a prefix is enough, no need to put the full path to the
title. I can fix that this time.

You can actually check yourself what prefix is commonly used in a
particular file or directory:

$ git log --oneline --no-merges -10 drivers/net/wireless/marvell/libertas/
57fbcce37be7 cfg80211: remove enum ieee80211_band
3691ac4a9c95 libertas: fix an error code in probe
143e49458424 libertas: add an cfg80211 interface for powersaving
0b8802dc5f59 libertas: fix ps-mode related removal problems
fada24a54770 libertas: go back to ps mode without commands pending
57954b94cad7 libertas: do not confirm sleep if commands are pending
fae4f9f78ab1 libertas: check whether bus can do more than polling
0a7701b4defc libertas: fix pointer bugs for PS_MODE commands
6d91ff7acc90 libertas: cleanup a variable name
0a38c8e1b592 libertas: check for NULL before use
$
-- 
Kalle Valo


From bhaktipriya96 at gmail.com  Sat Jun  4 07:32:39 2016
From: bhaktipriya96 at gmail.com (Bhaktipriya Shridhar)
Date: Sat, 4 Jun 2016 20:02:39 +0530
Subject: [PATCH] net: wireless: marvell: libertas: Remove create_workqueue
In-Reply-To: <87h9d9t4cf.fsf@kamboji.qca.qualcomm.com>
References: <20160604135901.GA29897@Karyakshetra>
 <87h9d9t4cf.fsf@kamboji.qca.qualcomm.com>
Message-ID: <CAFNHFT8fptZ54PK=0_WwqgGwMuKN+OVOiwWHoh4YuzydLxig6Q@mail.gmail.com>

On Sat, Jun 4, 2016 at 7:59 PM, Kalle Valo <kvalo at codeaurora.org> wrote:
>
> $ git log --oneline --no-merges -10

Sure. Will keep that in mind.

Thanks,
Bhaktipriya


From tj at kernel.org  Sun Jun  5 03:22:38 2016
From: tj at kernel.org (Tejun Heo)
Date: Sun, 5 Jun 2016 06:22:38 -0400
Subject: [PATCH] net: wireless: marvell: libertas: Remove create_workqueue
In-Reply-To: <20160604135901.GA29897@Karyakshetra>
References: <20160604135901.GA29897@Karyakshetra>
Message-ID: <20160605102238.GA31708@htj.duckdns.org>

On Sat, Jun 04, 2016 at 07:29:01PM +0530, Bhaktipriya Shridhar wrote:
> alloc_workqueue replaces deprecated create_workqueue().
> 
> In if_sdio.c, the workqueue card->workqueue has workitem
> &card->packet_worker, which is mapped to if_sdio_host_to_card_worker.
> The workitem is involved in sending packets to firmware.
> Forward progress under memory pressure is a requirement here.
> 
> In if_spi.c, the workqueue card->workqueue has workitem
> &card->packet_worker, which is mapped to if_spi_host_to_card_worker.
> The workitem is involved in sending command packets from the host.
> Forward progress under memory pressure is a requirement here.
> 
> Dedicated workqueues have been used in both cases since the workitems
> on the workqueues are involved in normal device operation with
> WQ_MEM_RECLAIM set to gurantee forward progress under memory pressure.
> Since there are only a fixed number of work items, explicit concurrency
> limit is unnecessary.
> 
> flush_workqueue is unnecessary since destroy_workqueue() itself calls
> drain_workqueue() which flushes repeatedly till the workqueue
> becomes empty. Hence the calls to flush_workqueue() before
> destroy_workqueue() have been dropped.
> 
> Signed-off-by: Bhaktipriya Shridhar <bhaktipriya96 at gmail.com>

Acked-by: Tejun Heo <tj at kernel.org>

Thanks.

-- 
tejun


From andrianov at ispras.ru  Tue Jun  7 02:30:12 2016
From: andrianov at ispras.ru (Pavel Andrianov)
Date: Tue, 07 Jun 2016 13:30:12 +0400
Subject: [ldv-project] [net] libertas: potential race condition
Message-ID: <57569424.9040906@ispras.ru>

Hi!

There is a potential race condition in 
drivers/net/wireless/libertas/libertas.ko.
In the function lbs_hard_start_xmit(..), line 159, a socket buffer is 
written to priv->current_skb with a spin_lock protection.
In the function lbs_mac_event_disconnected(..), lines 50-51, the field 
current_skb is cleaned. There is no protection used. The corresponding 
handlers are activated at the same time in lbs_start_card(..) and then 
may be executed simultaneously. Note, there are two structures 
lbs_netdev_ops and mesh_netdev_ops, which have the target handler 
lbs_hard_start_xmit.
Is it a real race or I have missed something?

-- 
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov at ispras.ru



From dcbw at redhat.com  Tue Jun  7 07:39:55 2016
From: dcbw at redhat.com (Dan Williams)
Date: Tue, 07 Jun 2016 09:39:55 -0500
Subject: [ldv-project] [net] libertas: potential race condition
In-Reply-To: <57569424.9040906@ispras.ru>
References: <57569424.9040906@ispras.ru>
Message-ID: <1465310395.29158.2.camel@redhat.com>

On Tue, 2016-06-07 at 13:30 +0400, Pavel Andrianov wrote:
> Hi!
> 
> There is a potential race condition in?
> drivers/net/wireless/libertas/libertas.ko.
> In the function lbs_hard_start_xmit(..), line 159, a socket buffer
> is?
> written to priv->current_skb with a spin_lock protection.
> In the function lbs_mac_event_disconnected(..), lines 50-51, the
> field?
> current_skb is cleaned. There is no protection used. The
> corresponding?
> handlers are activated at the same time in lbs_start_card(..) and
> then?
> may be executed simultaneously. Note, there are two structures?
> lbs_netdev_ops and mesh_netdev_ops, which have the target handler?
> lbs_hard_start_xmit.
> Is it a real race or I have missed something?

Yeah, it looks like it should be grabbing priv->driver_lock before
clearing priv->currenttxskb in?lbs_mac_event_disconnected(). ?Care to
submit a patch after testing? ?Do you have any of that hardware?

Dan


From andrianov at ispras.ru  Tue Jun  7 07:54:23 2016
From: andrianov at ispras.ru (Pavel Andrianov)
Date: Tue, 07 Jun 2016 18:54:23 +0400
Subject: [ldv-project] [net] libertas: potential race condition
In-Reply-To: <1465310395.29158.2.camel@redhat.com>
References: <57569424.9040906@ispras.ru> <1465310395.29158.2.camel@redhat.com>
Message-ID: <5756E01F.6080107@ispras.ru>

07.06.2016 18:39, Dan Williams ?????:
> On Tue, 2016-06-07 at 13:30 +0400, Pavel Andrianov wrote:
>> Hi!
>>
>> There is a potential race condition in
>> drivers/net/wireless/libertas/libertas.ko.
>> In the function lbs_hard_start_xmit(..), line 159, a socket buffer
>> is
>> written to priv->current_skb with a spin_lock protection.
>> In the function lbs_mac_event_disconnected(..), lines 50-51, the
>> field
>> current_skb is cleaned. There is no protection used. The
>> corresponding
>> handlers are activated at the same time in lbs_start_card(..) and
>> then
>> may be executed simultaneously. Note, there are two structures
>> lbs_netdev_ops and mesh_netdev_ops, which have the target handler
>> lbs_hard_start_xmit.
>> Is it a real race or I have missed something?
> Yeah, it looks like it should be grabbing priv->driver_lock before
> clearing priv->currenttxskb in lbs_mac_event_disconnected().  Care to
> submit a patch after testing?  Do you have any of that hardware?
>
> Dan
I have no that hardware and I have some doubts about the simple fix, 
you've suggested. For instance, in lbs_hard_start_xmit the lock is 
acquired twice and the priv->tx_pending_len can be modified also by 
lbs_mac_event_disconnected (even if spin_lock will be added to 
lbs_mac_event_disconnected). Moreover, the function lbs_send_tx_feedback 
also cleaned priv->currenttxskb, but it happens also without any 
protection. Thus, the fix has to be more complicated, and I have no 
ideas about it.

-- 
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov at ispras.ru



From quozl at laptop.org  Tue Jun  7 15:51:14 2016
From: quozl at laptop.org (James Cameron)
Date: Wed, 8 Jun 2016 08:51:14 +1000
Subject: [ldv-project] [net] libertas: potential race condition
In-Reply-To: <1465310395.29158.2.camel@redhat.com>
References: <57569424.9040906@ispras.ru> <1465310395.29158.2.camel@redhat.com>
Message-ID: <20160607225114.GA21437@us.netrek.org>

On Tue, Jun 07, 2016 at 09:39:55AM -0500, Dan Williams wrote:
> On Tue, 2016-06-07 at 13:30 +0400, Pavel Andrianov wrote:
> > Hi!
> > 
> > There is a potential race condition in?
> > drivers/net/wireless/libertas/libertas.ko.
> > In the function lbs_hard_start_xmit(..), line 159, a socket buffer
> > is?
> > written to priv->current_skb with a spin_lock protection.
> > In the function lbs_mac_event_disconnected(..), lines 50-51, the
> > field?
> > current_skb is cleaned. There is no protection used. The
> > corresponding?
> > handlers are activated at the same time in lbs_start_card(..) and
> > then?
> > may be executed simultaneously. Note, there are two structures?
> > lbs_netdev_ops and mesh_netdev_ops, which have the target handler?
> > lbs_hard_start_xmit.
> > Is it a real race or I have missed something?
> 
> Yeah, it looks like it should be grabbing priv->driver_lock before
> clearing priv->currenttxskb in?lbs_mac_event_disconnected(). ?Care to
> submit a patch after testing? ?Do you have any of that hardware?

I've hardware, with serial console.

Can test any patch, on USB (8388) or SDIO (8686).

-- 
James Cameron
http://quozl.netrek.org/


From andrianov at ispras.ru  Tue Jun 14 06:16:11 2016
From: andrianov at ispras.ru (Pavel Andrianov)
Date: Tue, 14 Jun 2016 17:16:11 +0400
Subject: [ldv-project] [net] libertas: potential race condition
In-Reply-To: <20160607225114.GA21437@us.netrek.org>
References: <57569424.9040906@ispras.ru> <1465310395.29158.2.camel@redhat.com>
 <20160607225114.GA21437@us.netrek.org>
Message-ID: <5760039B.4050902@ispras.ru>

08.06.2016 02:51, James Cameron ?????:
> On Tue, Jun 07, 2016 at 09:39:55AM -0500, Dan Williams wrote:
>> On Tue, 2016-06-07 at 13:30 +0400, Pavel Andrianov wrote:
>>> Hi!
>>>
>>> There is a potential race condition in
>>> drivers/net/wireless/libertas/libertas.ko.
>>> In the function lbs_hard_start_xmit(..), line 159, a socket buffer
>>> is
>>> written to priv->current_skb with a spin_lock protection.
>>> In the function lbs_mac_event_disconnected(..), lines 50-51, the
>>> field
>>> current_skb is cleaned. There is no protection used. The
>>> corresponding
>>> handlers are activated at the same time in lbs_start_card(..) and
>>> then
>>> may be executed simultaneously. Note, there are two structures
>>> lbs_netdev_ops and mesh_netdev_ops, which have the target handler
>>> lbs_hard_start_xmit.
>>> Is it a real race or I have missed something?
>> Yeah, it looks like it should be grabbing priv->driver_lock before
>> clearing priv->currenttxskb in lbs_mac_event_disconnected().  Care to
>> submit a patch after testing?  Do you have any of that hardware?
> I've hardware, with serial console.
>
> Can test any patch, on USB (8388) or SDIO (8686).
>
Hi!

I've prepare the patch for this issue. Could you test it?

Thank you.

-- 
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov at ispras.ru

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-libertas-Add-spinlock-to-avoid-race-condition.patch
Type: text/x-patch
Size: 1329 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/libertas-dev/attachments/20160614/c8edd103/attachment.bin>

From quozl at laptop.org  Tue Jun 14 17:46:55 2016
From: quozl at laptop.org (James Cameron)
Date: Wed, 15 Jun 2016 10:46:55 +1000
Subject: [ldv-project] [net] libertas: potential race condition
In-Reply-To: <5760039B.4050902@ispras.ru>
References: <57569424.9040906@ispras.ru> <1465310395.29158.2.camel@redhat.com>
 <20160607225114.GA21437@us.netrek.org> <5760039B.4050902@ispras.ru>
Message-ID: <20160615004655.GE5852@us.netrek.org>

On Tue, Jun 14, 2016 at 05:16:11PM +0400, Pavel Andrianov wrote:
> 08.06.2016 02:51, James Cameron ?????:
> >On Tue, Jun 07, 2016 at 09:39:55AM -0500, Dan Williams wrote:
> >>On Tue, 2016-06-07 at 13:30 +0400, Pavel Andrianov wrote:
> >>>Hi!
> >>>
> >>>There is a potential race condition in
> >>>drivers/net/wireless/libertas/libertas.ko.
> >>>In the function lbs_hard_start_xmit(..), line 159, a socket buffer
> >>>is
> >>>written to priv->current_skb with a spin_lock protection.
> >>>In the function lbs_mac_event_disconnected(..), lines 50-51, the
> >>>field
> >>>current_skb is cleaned. There is no protection used. The
> >>>corresponding
> >>>handlers are activated at the same time in lbs_start_card(..) and
> >>>then
> >>>may be executed simultaneously. Note, there are two structures
> >>>lbs_netdev_ops and mesh_netdev_ops, which have the target handler
> >>>lbs_hard_start_xmit.
> >>>Is it a real race or I have missed something?
> >>Yeah, it looks like it should be grabbing priv->driver_lock before
> >>clearing priv->currenttxskb in lbs_mac_event_disconnected().  Care to
> >>submit a patch after testing?  Do you have any of that hardware?
> >I've hardware, with serial console.
> >
> >Can test any patch, on USB (8388) or SDIO (8686).
> >
> Hi!
> 
> I've prepare the patch for this issue. Could you test it?
> 
> Thank you.

Tested on OLPC XO-1 (usb8388) and XO-1.5 (sd8686) with v4.7-rc3.

Confirmed that lbs_mac_event_disconnected is being called on the
station when hostapd on access point is given SIGHUP.

Longer duration test was;

- SSH to station and run "top -d 0.2",

- send SIGHUP every six seconds, for 300 cycles,

You may add my;

Tested-by: James Cameron <quozl at laptop.org>

-- 
James Cameron
http://quozl.netrek.org/


From andrianov at ispras.ru  Wed Jun 15 04:34:03 2016
From: andrianov at ispras.ru (Pavel Andrianov)
Date: Wed, 15 Jun 2016 15:34:03 +0400
Subject: [PATCH] libertas: Add spinlock to avoid race condition
Message-ID: <1465990443-19738-1-git-send-email-andrianov@ispras.ru>

lbs_mac_event_disconnected may free priv->currenttxskb
while lbs_hard_start_xmit accesses to it.
The patch adds a spinlock for mutual exclusion.

Tested on OLPC XO-1 (usb8388) and XO-1.5 (sd8686) with v4.7-rc3.

Confirmed that lbs_mac_event_disconnected is being called on the
station when hostapd on access point is given SIGHUP.

Signed-off-by: Pavel <andrianov at ispras.ru>
Tested-by: James Cameron <quozl at laptop.org>
---
 drivers/net/wireless/marvell/libertas/cmdresp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/marvell/libertas/cmdresp.c b/drivers/net/wireless/marvell/libertas/cmdresp.c
index c95bf6d..c67ae07 100644
--- a/drivers/net/wireless/marvell/libertas/cmdresp.c
+++ b/drivers/net/wireless/marvell/libertas/cmdresp.c
@@ -27,6 +27,8 @@
 void lbs_mac_event_disconnected(struct lbs_private *priv,
 				bool locally_generated)
 {
+	unsigned long flags;
+
 	if (priv->connect_status != LBS_CONNECTED)
 		return;
 
@@ -46,9 +48,11 @@ void lbs_mac_event_disconnected(struct lbs_private *priv,
 	netif_carrier_off(priv->dev);
 
 	/* Free Tx and Rx packets */
+	spin_lock_irqsave(&priv->driver_lock, flags);
 	kfree_skb(priv->currenttxskb);
 	priv->currenttxskb = NULL;
 	priv->tx_pending_len = 0;
+	spin_unlock_irqrestore(&priv->driver_lock, flags);
 
 	priv->connect_status = LBS_DISCONNECTED;
 
-- 
1.7.11.7



From vaishali.thakkar at oracle.com  Wed Jun 15 06:01:39 2016
From: vaishali.thakkar at oracle.com (Vaishali Thakkar)
Date: Wed, 15 Jun 2016 18:31:39 +0530
Subject: [PATCH] libertas: Add spinlock to avoid race condition
In-Reply-To: <1465990443-19738-1-git-send-email-andrianov@ispras.ru>
References: <1465990443-19738-1-git-send-email-andrianov@ispras.ru>
Message-ID: <576151B3.9040802@oracle.com>



On Wednesday 15 June 2016 05:04 PM, Pavel Andrianov wrote:
> lbs_mac_event_disconnected may free priv->currenttxskb
> while lbs_hard_start_xmit accesses to it.
> The patch adds a spinlock for mutual exclusion.
> 
> Tested on OLPC XO-1 (usb8388) and XO-1.5 (sd8686) with v4.7-rc3.
> 
> Confirmed that lbs_mac_event_disconnected is being called on the
> station when hostapd on access point is given SIGHUP.
> 
> Signed-off-by: Pavel <andrianov at ispras.ru>
> Tested-by: James Cameron <quozl at laptop.org>

Looks good to me.

Acked-by: Vaishali Thakkar <vaishali.thakkar at oracle.com>

> ---
>  drivers/net/wireless/marvell/libertas/cmdresp.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/net/wireless/marvell/libertas/cmdresp.c b/drivers/net/wireless/marvell/libertas/cmdresp.c
> index c95bf6d..c67ae07 100644
> --- a/drivers/net/wireless/marvell/libertas/cmdresp.c
> +++ b/drivers/net/wireless/marvell/libertas/cmdresp.c
> @@ -27,6 +27,8 @@
>  void lbs_mac_event_disconnected(struct lbs_private *priv,
>  				bool locally_generated)
>  {
> +	unsigned long flags;
> +
>  	if (priv->connect_status != LBS_CONNECTED)
>  		return;
>  
> @@ -46,9 +48,11 @@ void lbs_mac_event_disconnected(struct lbs_private *priv,
>  	netif_carrier_off(priv->dev);
>  
>  	/* Free Tx and Rx packets */
> +	spin_lock_irqsave(&priv->driver_lock, flags);
>  	kfree_skb(priv->currenttxskb);
>  	priv->currenttxskb = NULL;
>  	priv->tx_pending_len = 0;
> +	spin_unlock_irqrestore(&priv->driver_lock, flags);
>  
>  	priv->connect_status = LBS_DISCONNECTED;
>  
> 

-- 
Vaishali


From kvalo at codeaurora.org  Thu Jun 16 08:22:46 2016
From: kvalo at codeaurora.org (Kalle Valo)
Date: Thu, 16 Jun 2016 15:22:46 +0000 (UTC)
Subject: libertas: Remove create_workqueue
In-Reply-To: <20160604135901.GA29897@Karyakshetra>
Message-ID: <20160616152246.9530D6144B@smtp.codeaurora.org>

Bhaktipriya Shridhar <bhaktipriya96 at gmail.com> wrote:
> alloc_workqueue replaces deprecated create_workqueue().
> 
> In if_sdio.c, the workqueue card->workqueue has workitem
> &card->packet_worker, which is mapped to if_sdio_host_to_card_worker.
> The workitem is involved in sending packets to firmware.
> Forward progress under memory pressure is a requirement here.
> 
> In if_spi.c, the workqueue card->workqueue has workitem
> &card->packet_worker, which is mapped to if_spi_host_to_card_worker.
> The workitem is involved in sending command packets from the host.
> Forward progress under memory pressure is a requirement here.
> 
> Dedicated workqueues have been used in both cases since the workitems
> on the workqueues are involved in normal device operation with
> WQ_MEM_RECLAIM set to gurantee forward progress under memory pressure.
> Since there are only a fixed number of work items, explicit concurrency
> limit is unnecessary.
> 
> flush_workqueue is unnecessary since destroy_workqueue() itself calls
> drain_workqueue() which flushes repeatedly till the workqueue
> becomes empty. Hence the calls to flush_workqueue() before
> destroy_workqueue() have been dropped.
> 
> Signed-off-by: Bhaktipriya Shridhar <bhaktipriya96 at gmail.com>
> Acked-by: Tejun Heo <tj at kernel.org>

Thanks, 1 patch applied to wireless-drivers-next.git:

f9f905b00b87 libertas: Remove create_workqueue

-- 
Sent by pwcli
https://patchwork.kernel.org/patch/9154703/



From kvalo at codeaurora.org  Wed Jun 29 08:47:12 2016
From: kvalo at codeaurora.org (Kalle Valo)
Date: Wed, 29 Jun 2016 15:47:12 +0000 (UTC)
Subject: libertas: Add spinlock to avoid race condition
In-Reply-To: <1465990443-19738-1-git-send-email-andrianov@ispras.ru>
Message-ID: <20160629154712.73F4B613A6@smtp.codeaurora.org>

Pavel Andrianov <andrianov at ispras.ru> wrote:
> lbs_mac_event_disconnected may free priv->currenttxskb
> while lbs_hard_start_xmit accesses to it.
> The patch adds a spinlock for mutual exclusion.
> 
> Tested on OLPC XO-1 (usb8388) and XO-1.5 (sd8686) with v4.7-rc3.
> 
> Confirmed that lbs_mac_event_disconnected is being called on the
> station when hostapd on access point is given SIGHUP.
> 
> Signed-off-by: Pavel <andrianov at ispras.ru>
> Tested-by: James Cameron <quozl at laptop.org>
> Acked-by: Vaishali Thakkar <vaishali.thakkar at oracle.com>

Thanks, 1 patch applied to wireless-drivers-next.git:

f52b041aed77 libertas: Add spinlock to avoid race condition

-- 
Sent by pwcli
https://patchwork.kernel.org/patch/9178477/



