Re: [PATCH wireless] wifi: mt76: fix crash with WED rx support enabled

[Lorenzo Bianconi <lorenzo@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 2431 bytes --]

> If WED rx is enabled, rx buffers are added to a buffer pool that can be
> filled from multiple page pools. Because buffers freed from rx poll are
> not guaranteed to belong to the processed queue's page pool, lockless
> caching must not be used in this case.

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>

> 
> Cc: stable@vger.kernel.org
> Fixes: 2f5c3c77fc9b ("wifi: mt76: switch to page_pool allocator")
> Signed-off-by: Felix Fietkau <nbd@nbd.name>
> ---
>  drivers/net/wireless/mediatek/mt76/dma.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
> index 511fe7e6e744..68ad915203aa 100644
> --- a/drivers/net/wireless/mediatek/mt76/dma.c
> +++ b/drivers/net/wireless/mediatek/mt76/dma.c
> @@ -783,7 +783,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
>  
>  static void
>  mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
> -		  int len, bool more, u32 info)
> +		  int len, bool more, u32 info, bool allow_direct)
>  {
>  	struct sk_buff *skb = q->rx_head;
>  	struct skb_shared_info *shinfo = skb_shinfo(skb);
> @@ -795,7 +795,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
>  
>  		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
>  	} else {
> -		mt76_put_page_pool_buf(data, true);
> +		mt76_put_page_pool_buf(data, allow_direct);
>  	}
>  
>  	if (more)
> @@ -815,6 +815,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
>  	struct sk_buff *skb;
>  	unsigned char *data;
>  	bool check_ddone = false;
> +	bool allow_direct = !mt76_queue_is_wed_rx(q);
>  	bool more;
>  
>  	if (IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED) &&
> @@ -855,7 +856,8 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
>  		}
>  
>  		if (q->rx_head) {
> -			mt76_add_fragment(dev, q, data, len, more, info);
> +			mt76_add_fragment(dev, q, data, len, more, info,
> +					  allow_direct);
>  			continue;
>  		}
>  
> @@ -884,7 +886,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
>  		continue;
>  
>  free_frag:
> -		mt76_put_page_pool_buf(data, true);
> +		mt76_put_page_pool_buf(data, allow_direct);
>  	}
>  
>  	mt76_dma_rx_fill(dev, q, true);
> -- 
> 2.41.0
> 
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]