wil6210: missing reinit_completion in wmi_call
The code in wmi_call uses the wil->wmi_call completion
structure to wait for a reply.
In some scenarios, complete was called twice on the
completion structure. This happened mainly with a disconnect
event which can arrive both unsolicited and as a reply to
a disconnect request. In this case the completion structure
was left marked as "done" and the next wmi_call returned
immediately with a corrupted reply buffer. This caused
unexpected results including crashes.
Fix this by adding the missing call to reinit_completion.
Change-Id: I4de26881620dde4230d0a907bd0fd39bebe2bb3d
Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Git-commit: 4d4c4dc324b4444d40e9164834044feebaf2d72d
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
CRs-Fixed: 1105246
Signed-off-by: Maya Erez <merez@codeaurora.org>
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 1398b59..a0bc674 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -982,6 +982,7 @@
wil->reply_id = reply_id;
wil->reply_buf = reply;
wil->reply_size = reply_size;
+ reinit_completion(&wil->wmi_call);
spin_unlock(&wil->wmi_ev_lock);
rc = __wmi_send(wil, cmdid, buf, len);