This is a note to let you know that I've just added the patch titled
wifi: mt76: add missing locking to protect against concurrent rx/status calls
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
wifi-mt76-add-missing-locking-to-protect-against-concurrent-rx-status-calls.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 5b8ccdfb943f6a03c676d2ea816dd38c149e920b Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@xxxxxxxx>
Date: Fri, 14 Apr 2023 14:10:54 +0200
Subject: wifi: mt76: add missing locking to protect against concurrent rx/status calls
From: Felix Fietkau <nbd@xxxxxxxx>
commit 5b8ccdfb943f6a03c676d2ea816dd38c149e920b upstream.
According to the documentation, ieee80211_rx_list must not run concurrently
with ieee80211_tx_status (or its variants).
Cc: stable@xxxxxxxxxxxxxxx
Fixes: 88046b2c9f6d ("mt76: add support for reporting tx status with skb")
Reported-by: Brian Coverstone <brian@xxxxxxxxxxxxxxxx>
Signed-off-by: Felix Fietkau <nbd@xxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/net/wireless/mediatek/mt76/dma.c | 2 ++
drivers/net/wireless/mediatek/mt76/mt7603/mac.c | 5 ++++-
drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 5 ++++-
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 5 ++++-
drivers/net/wireless/mediatek/mt76/tx.c | 4 ++++
5 files changed, 18 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -434,7 +434,9 @@ free:
free_skb:
status.skb = tx_info.skb;
hw = mt76_tx_status_get_hw(dev, tx_info.skb);
+ spin_lock_bh(&dev->rx_lock);
ieee80211_tx_status_ext(hw, &status);
+ spin_unlock_bh(&dev->rx_lock);
return ret;
}
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
@@ -1284,8 +1284,11 @@ void mt7603_mac_add_txs(struct mt7603_de
if (wcidx >= MT7603_WTBL_STA || !sta)
goto out;
- if (mt7603_fill_txs(dev, msta, &info, txs_data))
+ if (mt7603_fill_txs(dev, msta, &info, txs_data)) {
+ spin_lock_bh(&dev->mt76.rx_lock);
ieee80211_tx_status_noskb(mt76_hw(dev), sta, &info);
+ spin_unlock_bh(&dev->mt76.rx_lock);
+ }
out:
rcu_read_unlock();
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
@@ -1496,8 +1496,11 @@ static void mt7615_mac_add_txs(struct mt
if (wcid->ext_phy && dev->mt76.phy2)
mphy = dev->mt76.phy2;
- if (mt7615_fill_txs(dev, msta, &info, txs_data))
+ if (mt7615_fill_txs(dev, msta, &info, txs_data)) {
+ spin_lock_bh(&dev->mt76.rx_lock);
ieee80211_tx_status_noskb(mphy->hw, sta, &info);
+ spin_unlock_bh(&dev->mt76.rx_lock);
+ }
out:
rcu_read_unlock();
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -631,8 +631,11 @@ void mt76x02_send_tx_status(struct mt76x
mt76_tx_status_unlock(mdev, &list);
- if (!status.skb)
+ if (!status.skb) {
+ spin_lock_bh(&dev->mt76.rx_lock);
ieee80211_tx_status_ext(mt76_hw(dev), &status);
+ spin_unlock_bh(&dev->mt76.rx_lock);
+ }
if (!len)
goto out;
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -68,7 +68,9 @@ mt76_tx_status_unlock(struct mt76_dev *d
status.sta = wcid_to_sta(wcid);
hw = mt76_tx_status_get_hw(dev, skb);
+ spin_lock_bh(&dev->rx_lock);
ieee80211_tx_status_ext(hw, &status);
+ spin_unlock_bh(&dev->rx_lock);
}
rcu_read_unlock();
}
@@ -229,7 +231,9 @@ void __mt76_tx_complete_skb(struct mt76_
if (!skb->prev) {
hw = mt76_tx_status_get_hw(dev, skb);
status.sta = wcid_to_sta(wcid);
+ spin_lock_bh(&dev->rx_lock);
ieee80211_tx_status_ext(hw, &status);
+ spin_unlock_bh(&dev->rx_lock);
goto out;
}
Patches currently in stable-queue which might be from nbd@xxxxxxxx are
queue-5.15/wifi-mt76-add-missing-locking-to-protect-against-concurrent-rx-status-calls.patch
queue-5.15/wifi-mt76-mt7921e-set-memory-space-enable-in-pci_command-if-unset.patch
