Muhammad Usama Anjum <Usama.Anjum@xxxxxxxxxxxxx> writes:
> On 9/17/24 4:09 PM, Felix Fietkau wrote:
>
>> If mcu_skb_prepare_msg is not implemented, incrementing skb refcount does not
>> work for mcu message retry. In some cases (e.g. on SDIO), shared skbs can trigger
>> a BUG_ON, crashing the system.
>> Fix this by only incrementing refcount if retry is actually supported.
>>
>> Fixes: 3688c18b65ae ("wifi: mt76: mt7915: retry mcu messages")
>> Reported-by: Nícolas F. R. A. Prado <nfraprado@xxxxxxxxxxxxx> #KernelCI
>> Tested-by: Alper Nebi Yasak <alpernebiyasak@xxxxxxxxx>
>> Signed-off-by: Felix Fietkau <nbd@xxxxxxxx>
>> ---
>> drivers/net/wireless/mediatek/mt76/mcu.c | 7 +++++--
>> 1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/net/wireless/mediatek/mt76/mcu.c b/drivers/net/wireless/mediatek/mt76/mcu.c
>> index 98da82b74094..3353012e8542 100644
>> --- a/drivers/net/wireless/mediatek/mt76/mcu.c
>> +++ b/drivers/net/wireless/mediatek/mt76/mcu.c
>> @@ -84,13 +84,16 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
>> mutex_lock(&dev->mcu.mutex);
>>
>> if (dev->mcu_ops->mcu_skb_prepare_msg) {
>> + orig_skb = skb;
>> ret = dev->mcu_ops->mcu_skb_prepare_msg(dev, skb, cmd, &seq);
>> if (ret < 0)
>> goto out;
>> }
>>
>> retry:
>> - orig_skb = skb_get(skb);
>> + /* orig skb might be needed for retry, mcu_skb_send_msg consumes it */
>> + if (orig_skb)
>> + skb_get(orig_skb);
>> ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb, cmd, &seq);
>> if (ret < 0)
>> goto out;
>> @@ -105,7 +108,7 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
>> do {
>> skb = mt76_mcu_get_response(dev, expires);
>> if (!skb && !test_bit(MT76_MCU_RESET, &dev->phy.state) &&
>> - retry++ < dev->mcu_ops->max_retry) {
>> + orig_skb && retry++ < dev->mcu_ops->max_retry) {
>> dev_err(dev->dev, "Retry message %08x (seq %d)\n",
>> cmd, seq);
>> skb = orig_skb;
> This patch is in next from 5 weeks. As 3688c18b65ae ("wifi: mt76: mt7915: retry mcu messages") is
> already in the mainline, why this fix hasn't been included in mainline? I thought fixes are included
> as soon as possible in mainline RCs. Am I missing something?
>
> Are we planning to include this fix in next release instead of current one?
The commit is now in wireless tree:
34b695481084 wifi: mt76: do not increase mcu skb refcount if retry is not supported
With good luck it will be in v6.12-rc5 but no guarantees.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
