• Loic Poulain's avatar
    wcn36xx: Fix tx_status mechanism · a9e79b11
    Loic Poulain authored
    This change fix the TX ack mechanism in various ways:
    
    - For NO_ACK tagged packets, we don't need to wait for TX_ACK indication
    and so are not subject to the single packet ack limitation. So we don't
    have to stop the tx queue, and can call the tx status callback as soon
    as DMA transfer has completed.
    
    - Fix skb ownership/reference. Only start status indication timeout
    once the DMA transfer has been completed. This avoids the skb to be
    both referenced in the DMA tx ring and by the tx_ack_skb pointer,
    preventing any use-after-free or double-free.
    
    - This adds a sanity (paranoia?) check on the skb tx ack pointer.
    
    - Resume TX queue if TX status tagged packet TX fails.
    
    Cc: stable@vger.kernel.org
    Fixes: fdf21cc3 ("wcn36xx: Add TX ack support")
    Signed-off-by: default avatarLoic Poulain <loic.poulain@linaro.org>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/1634567281-28997-1-git-send-email-loic.poulain@linaro.org
    a9e79b11
txrx.c 18.5 KB