crash in wcn36xx_dxe_tx_frame

[silverjam]

Issue by bcopeland from Friday Mar 07, 2014 at 14:55 GMT
Originally opened as https://github.com/cozybit/wcn36xx/issues/8

---

[ 29.886677] Unable to handle kernel NULL pointer dereference at virtual address 00000050
[ 29.887959] PC is at wcn36xx_dxe_tx_frame+0x278/0x3b4 [wcn36xx]

Code in question is:

 desc->src_addr_l = dma_map_single(NULL,
                                   ctl->skb->data,
                                   ctl->skb->len,
                                   DMA_TO_DEVICE);

 desc->dst_addr_l = ch->dxe_wq;
 desc->fr_len = ctl->skb->len;   <--- oops

So ctl->skb is NULL and some locking needs to be done here.

[bcopeland]

I have some locking fixes for this, basically spinlocking over all accesses to ctl, I just need to figure out how to do it in a little bit more lightweight fashion.