From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794064509; b=iNQdLkmfOkJ3+QiORB50Lin7mW9TPL/jGZ4uNEzbYwy4qS4R0VNum6eczCAqwNZRCC82 Czjaf6kWGIQqcz6daxHcMM2ol1QPcT3zHxmji8TMGA+XhghtKZ9zgCZWo/GauU4zfcAR+ PtgSfm2zAuNzeH05nf/i1LPOKW4PgFSI1QggdILwWJ3fmI8A9JbrNONjgJ3XhUvc9o+yO QwVmJ/QNNMk/Jho4Jh0p1SoSo00MIlYtRpE9Pg3wSCN/zDJLfV8e4rc8ZkUlB7dyTKs5D MHQBTHvq1ZXJ8VDJkYjspHGHnRVdlfDH8LorKfkxvZQsaBlZWkT1hB0vJZ3cgg58epw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794064509; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=qpIaKGC8GvuQlyr/IKzaCsJARzCkDkf+VrxjTasKA8k=; b=NDeXY4vXPhMjwcyezb0wzvUBCEFPyPTpGqIlMblIXwqEW9rWvHDLfzWCfCQ1LLclu2yz 5ywhz1AXeXX4W+GkRtmjWaZBBHhIHhEWiTYYy4xi24CTdPafK6J/9BxiQWGH1Fae16mnP HcRSs28z9ibCirwQYm3Pr/RLGwixyAFXNwRiup65kYd1L4jkCaPFiNqjvZeAoOUXtkOnR QkbXek1ld6WLGFYH4tj4SDmeGfOnLc77TIjSsTMfI81a+gBb3T4QrggmQOT6AljJvfccN jJwJtILN50h68sKrFqWTC3piZFVWBY6MvExM3D+sz+IyuJvkyBuKgRm91PyMmu3dUzw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=TuGZbS9G; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 25ADF606CE4F; Sat, 7 Nov 2026 15:15:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=TuGZbS9G Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7FF561F0089F; Sat, 7 Nov 2026 15:15:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794064508; bh=qpIaKGC8GvuQlyr/IKzaCsJARzCkDkf+VrxjTasKA8k=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=TuGZbS9GOas4eNGztuiV/Mhk7HG1g+Cdqajxlz0PONfjj/nYItTH9+kZZvQUAdjyi NZLf4HQFtD9QPJRjxSHu0N6YVeoLQDHWshQfL+XKfhoOzUl1H2zXBCavYzFp/gh/Ra IsL9WYpaHlxiBQKW1gK6xz+2B9OuPbjYerOoSkCM= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Devin Wittmayer , Felix Fietkau , Sasha Levin Subject: [PATCH 7.3 0540/1257] wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path Date: Sat, 7 Nov 2026 08:47:16 -0500 Message-ID: <20261107134954.315119597@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Devin Wittmayer [ Upstream commit a7871a7ae5a8625f0ba0a89454ac734c383dd538 ] The USB and SDIO completion path reads a station pointer that RCU protects, without holding the read lock. Lockdep catches it on the first association: mt76.h:1305 suspicious rcu_dereference_check() usage! no locks held by mt76-usb-status/1254. mt7925_usb_sdio_tx_complete_skb+0x119/0x130 [mt7925_common] mt76_queue_tx_complete+0x27/0x60 [mt76] mt76u_status_worker+0xed/0x1e0 [mt76_usb] mt7925/mac.c:856 suspicious rcu_dereference_check() usage! mt7925_tx_check_aggr.part.0+0xc2/0xe0 [mt7925_common] mt7925_usb_sdio_tx_complete_skb+0xa0/0x130 [mt7925_common] mt7921 does the same, and warns once instead of twice because its aggregation check reads the default link directly. The DMA path makes the same reads but completes from softirq, so it stays quiet. Take the read lock around the lookup and the check. Tested on 7.2-rc5 with lockdep, fresh module load per arm, 4000 packets each and no change to the link: splats before after MT7925 Netgear A9000 2 0 MT7921 Alfa 1 0 mt7921e same kernel 0 0 Fixes: dc66a129adf1 ("wifi: mt76: add a wrapper for wcid access with validation") Fixes: c22769de2509 ("wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete") Cc: stable@vger.kernel.org Signed-off-by: Devin Wittmayer Link: https://patch.msgid.link/20261003233056.94497-1-lucid_duck@justthetip.ca Signed-off-by: Felix Fietkau Signed-off-by: Sasha Levin --- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 3 +++ drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c index e69978184f68c..ad1352ddf1fcc 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c @@ -831,11 +831,14 @@ void mt7921_usb_sdio_tx_complete_skb(struct mt76_dev *mdev, u16 idx; idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX); + + rcu_read_lock(); wcid = __mt76_wcid_ptr(mdev, idx); sta = wcid_to_sta(wcid); if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE))) mt76_connac2_tx_check_aggr(sta, txwi); + rcu_read_unlock(); skb_pull(e->skb, headroom); mt76_tx_complete_skb(mdev, e->wcid, e->skb); diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c index 3b82c9de26c5b..2e34e950e111d 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c @@ -1688,11 +1688,14 @@ void mt7925_usb_sdio_tx_complete_skb(struct mt76_dev *mdev, u16 idx; idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX); + + rcu_read_lock(); wcid = __mt76_wcid_ptr(mdev, idx); sta = wcid_to_sta(wcid); if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE))) mt7925_tx_check_aggr(sta, e->skb, wcid); + rcu_read_unlock(); skb_pull(e->skb, headroom); mt76_tx_complete_skb(mdev, e->wcid, e->skb); -- 2.53.0