OrgACRN
/
acrn-kernel
mirror of https://github.com/projectacrn/acrn-kernel.git
1
0
Fork 0
Code Issues Releases Wiki Activity

wifi: mt76: add missing locking to protect against concurrent rx/status calls 

commit 5b8ccdfb94 upstream.

According to the documentation, ieee80211_rx_list must not run concurrently
with ieee80211_tx_status (or its variants).

Cc: stable@vger.kernel.org
Fixes: 88046b2c9f ("mt76: add support for reporting tx status with skb")
Reported-by: Brian Coverstone <brian@mainsequence.net>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Felix Fietkau 2023-04-14 14:10:54 +02:00 committed by Greg Kroah-Hartman
parent b9f6845a49
commit 1b0341e8fb
5 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/wireless/mediatek/mt76/dma.c
View File

@ -436,7 +436,9 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
free_skb:
status.skb = tx_info.skb;
hw = mt76_tx_status_get_hw(dev, tx_info.skb);
spin_lock_bh(&dev->rx_lock);
ieee80211_tx_status_ext(hw, &status);
spin_unlock_bh(&dev->rx_lock);
return ret;
}

5
drivers/net/wireless/mediatek/mt76/mt7603/mac.c
View File

@ -1279,8 +1279,11 @@ void mt7603_mac_add_txs(struct mt7603_dev *dev, void *data)
if (wcidx >= MT7603_WTBL_STA || !sta)
goto out;
if (mt7603_fill_txs(dev, msta, &info, txs_data))
if (mt7603_fill_txs(dev, msta, &info, txs_data)) {
spin_lock_bh(&dev->mt76.rx_lock);
ieee80211_tx_status_noskb(mt76_hw(dev), sta, &info);
spin_unlock_bh(&dev->mt76.rx_lock);
}
out:
rcu_read_unlock();

5
drivers/net/wireless/mediatek/mt76/mt7615/mac.c
View File

@ -1517,8 +1517,11 @@ static void mt7615_mac_add_txs(struct mt7615_dev *dev, void *data)
if (wcid->phy_idx && dev->mt76.phys[MT_BAND1])
mphy = dev->mt76.phys[MT_BAND1];
if (mt7615_fill_txs(dev, msta, &info, txs_data))
if (mt7615_fill_txs(dev, msta, &info, txs_data)) {
spin_lock_bh(&dev->mt76.rx_lock);
ieee80211_tx_status_noskb(mphy->hw, sta, &info);
spin_unlock_bh(&dev->mt76.rx_lock);
}
out:
rcu_read_unlock();

5
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
View File

@ -631,8 +631,11 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
mt76_tx_status_unlock(mdev, &list);
if (!status.skb)
if (!status.skb) {
spin_lock_bh(&dev->mt76.rx_lock);
ieee80211_tx_status_ext(mt76_hw(dev), &status);
spin_unlock_bh(&dev->mt76.rx_lock);
}
if (!len)
goto out;

4
drivers/net/wireless/mediatek/mt76/tx.c
View File

@ -77,7 +77,9 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
}
hw = mt76_tx_status_get_hw(dev, skb);
spin_lock_bh(&dev->rx_lock);
ieee80211_tx_status_ext(hw, &status);
spin_unlock_bh(&dev->rx_lock);
}
rcu_read_unlock();
}
@ -263,7 +265,9 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
if (cb->pktid < MT_PACKET_ID_FIRST) {
hw = mt76_tx_status_get_hw(dev, skb);
status.sta = wcid_to_sta(wcid);
spin_lock_bh(&dev->rx_lock);
ieee80211_tx_status_ext(hw, &status);
spin_unlock_bh(&dev->rx_lock);
goto out;
}