wifi: mt76: add missing locking to protect against concurrent rx/status calls

commit 5b8ccdfb943f6a03c676d2ea816dd38c149e920b upstream.

According to the documentation, ieee80211_rx_list must not run concurrently
with ieee80211_tx_status (or its variants).

Cc: stable@vger.kernel.org
Fixes: 88046b2c9f6d ("mt76: add support for reporting tx status with skb")
Reported-by: Brian Coverstone <brian@mainsequence.net>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index d147dc698c9dbf8e1236cf654c4b78ed43bc99de..4b6cb3aee8487e00506f31cbf20807746fdacbfc 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -577,7 +577,9 @@ free:
 free_skb:
        status.skb = tx_info.skb;
        hw = mt76_tx_status_get_hw(dev, tx_info.skb);
+       spin_lock_bh(&dev->rx_lock);
        ieee80211_tx_status_ext(hw, &status);
+       spin_unlock_bh(&dev->rx_lock);
 
        return ret;
 }

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
index 70a7f84af0282517b6213a901db55c5b659e1033..12e0af52082a607e972b2ce5f234e6da66907c44 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
@@ -1279,8 +1279,11 @@ void mt7603_mac_add_txs(struct mt7603_dev *dev, void *data)
        if (wcidx >= MT7603_WTBL_STA || !sta)
                goto out;
 
-       if (mt7603_fill_txs(dev, msta, &info, txs_data))
+       if (mt7603_fill_txs(dev, msta, &info, txs_data)) {
+               spin_lock_bh(&dev->mt76.rx_lock);
                ieee80211_tx_status_noskb(mt76_hw(dev), sta, &info);
+               spin_unlock_bh(&dev->mt76.rx_lock);
+       }
 
 out:
        rcu_read_unlock();

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
index 51a968a6afdc9d17fdf290891f59ff2ccc6a0084..5c41ad5955f4b7e7495d4cab1a8f224b0c2bb19c 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
@@ -1530,8 +1530,11 @@ static void mt7615_mac_add_txs(struct mt7615_dev *dev, void *data)
        if (wcid->phy_idx && dev->mt76.phys[MT_BAND1])
                mphy = dev->mt76.phys[MT_BAND1];
 
-       if (mt7615_fill_txs(dev, msta, &info, txs_data))
+       if (mt7615_fill_txs(dev, msta, &info, txs_data)) {
+               spin_lock_bh(&dev->mt76.rx_lock);
                ieee80211_tx_status_noskb(mphy->hw, sta, &info);
+               spin_unlock_bh(&dev->mt76.rx_lock);
+       }
 
 out:
        rcu_read_unlock();

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index d3f74473e6fb039f323450077bd0a714bf5a77c4..3e41d809ade39c0e7c0698cec004e638a56a28d8 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -631,8 +631,11 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
 
        mt76_tx_status_unlock(mdev, &list);
 
-       if (!status.skb)
+       if (!status.skb) {
+               spin_lock_bh(&dev->mt76.rx_lock);
                ieee80211_tx_status_ext(mt76_hw(dev), &status);
+               spin_unlock_bh(&dev->mt76.rx_lock);
+       }
 
        if (!len)
                goto out;

diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 1f309d05380ad5fb6c266b6cc1e220bc691df986..b435aed6aff7de06841f0689936173e6464cfe1a 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -77,7 +77,9 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
                }
 
                hw = mt76_tx_status_get_hw(dev, skb);
+               spin_lock_bh(&dev->rx_lock);
                ieee80211_tx_status_ext(hw, &status);
+               spin_unlock_bh(&dev->rx_lock);
        }
        rcu_read_unlock();
 }
@@ -263,7 +265,9 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
        if (cb->pktid < MT_PACKET_ID_FIRST) {
                hw = mt76_tx_status_get_hw(dev, skb);
                status.sta = wcid_to_sta(wcid);
+               spin_lock_bh(&dev->rx_lock);
                ieee80211_tx_status_ext(hw, &status);
+               spin_unlock_bh(&dev->rx_lock);
                goto out;
        }