[PATCH net] wifi: mt76: sdio: Fix possible data race when dequeuing skb

[Thomas Fourier <fourier.thomas@gmail.com>]

The next entry of the queue is saved as a refenrence and immediately
removed from the list, before processing the skb. It can thus be
overwritten by the queuing function at the same time as .rx_skb() is
called.

Split mt76s_get_next_rx_entry() to get the tail, and once it is
processed, pop the element.

This patch was compile-tested only.

This patch depends on commit 16254fc51f7d ("mt76: sdio: fix use of q->head and q->tail").

Fixes: d39b52e31aa6 ("mt76: introduce mt76_sdio module")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
 drivers/net/wireless/mediatek/mt76/sdio.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
index 8bae77c761be..12ee781a62f4 100644
--- a/drivers/net/wireless/mediatek/mt76/sdio.c
+++ b/drivers/net/wireless/mediatek/mt76/sdio.c
@@ -371,14 +371,21 @@ mt76s_get_next_rx_entry(struct mt76_queue *q)
 	spin_lock_bh(&q->lock);
 	if (q->queued > 0) {
 		e = &q->entry[q->tail];
-		q->tail = (q->tail + 1) % q->ndesc;
-		q->queued--;
 	}
 	spin_unlock_bh(&q->lock);
 
 	return e;
 }
 
+static void
+mt76s_clear_next_rx_entry(struct mt76_queue *q)
+{
+	spin_lock_bh(&q->lock);
+	q->tail = (q->tail + 1) % q->ndesc;
+	q->queued--;
+	spin_unlock_bh(&q->lock);
+}
+
 static int
 mt76s_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
 {
@@ -397,6 +404,9 @@ mt76s_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
 
 		dev->drv->rx_skb(dev, MT_RXQ_MAIN, e->skb, NULL);
 		e->skb = NULL;
+
+		mt76s_clear_next_rx_entry(q);
+
 		nframes++;
 	}
 	if (qid == MT_RXQ_MAIN)
-- 
2.43.0