Commit 5b8ccdfb authored by Felix Fietkau's avatar Felix Fietkau
Browse files

wifi: mt76: add missing locking to protect against concurrent rx/status calls 



According to the documentation, ieee80211_rx_list must not run concurrently
with ieee80211_tx_status (or its variants).

Cc: stable@vger.kernel.org
Fixes: 88046b2c ("mt76: add support for reporting tx status with skb")
Reported-by: default avatarBrian Coverstone <brian@mainsequence.net>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 9e47dd9f

drivers/net/wireless/mediatek/mt76/dma.c

+2 −0
Original line number Diff line number Diff line
@@ -578,7 +578,9 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, 
free_skb:

	status.skb = tx_info.skb;

	hw = mt76_tx_status_get_hw(dev, tx_info.skb);

	spin_lock_bh(&dev->rx_lock);

	ieee80211_tx_status_ext(hw, &status);

	spin_unlock_bh(&dev->rx_lock);



	return ret;

}

drivers/net/wireless/mediatek/mt76/mt7603/mac.c

+4 −1
Original line number Diff line number Diff line
@@ -1279,8 +1279,11 @@ void mt7603_mac_add_txs(struct mt7603_dev *dev, void *data) 
	if (wcidx >= MT7603_WTBL_STA || !sta)

		goto out;



	if (mt7603_fill_txs(dev, msta, &info, txs_data))

	if (mt7603_fill_txs(dev, msta, &info, txs_data)) {

		spin_lock_bh(&dev->mt76.rx_lock);

		ieee80211_tx_status_noskb(mt76_hw(dev), sta, &info);

		spin_unlock_bh(&dev->mt76.rx_lock);

	}



out:

	rcu_read_unlock();

drivers/net/wireless/mediatek/mt76/mt7615/mac.c

+4 −1
Original line number Diff line number Diff line
@@ -1558,8 +1558,11 @@ static void mt7615_mac_add_txs(struct mt7615_dev *dev, void *data) 
	if (wcid->phy_idx && dev->mt76.phys[MT_BAND1])

		mphy = dev->mt76.phys[MT_BAND1];



	if (mt7615_fill_txs(dev, msta, &info, txs_data))

	if (mt7615_fill_txs(dev, msta, &info, txs_data)) {

		spin_lock_bh(&dev->mt76.rx_lock);

		ieee80211_tx_status_noskb(mphy->hw, sta, &info);

		spin_unlock_bh(&dev->mt76.rx_lock);

	}



out:

	rcu_read_unlock();

drivers/net/wireless/mediatek/mt76/mt76x02_mac.c

+4 −1
Original line number Diff line number Diff line
@@ -631,8 +631,11 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev, 


	mt76_tx_status_unlock(mdev, &list);



	if (!status.skb)

	if (!status.skb) {

		spin_lock_bh(&dev->mt76.rx_lock);

		ieee80211_tx_status_ext(mt76_hw(dev), &status);

		spin_unlock_bh(&dev->mt76.rx_lock);

	}



	if (!len)

		goto out;

drivers/net/wireless/mediatek/mt76/tx.c

+4 −0
Original line number Diff line number Diff line
@@ -77,7 +77,9 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list) 
		}



		hw = mt76_tx_status_get_hw(dev, skb);

		spin_lock_bh(&dev->rx_lock);

		ieee80211_tx_status_ext(hw, &status);

		spin_unlock_bh(&dev->rx_lock);

	}

	rcu_read_unlock();

}
@@ -263,7 +265,9 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff * 
	if (cb->pktid < MT_PACKET_ID_FIRST) {

		hw = mt76_tx_status_get_hw(dev, skb);

		status.sta = wcid_to_sta(wcid);

		spin_lock_bh(&dev->rx_lock);

		ieee80211_tx_status_ext(hw, &status);

		spin_unlock_bh(&dev->rx_lock);

		goto out;

	}