From 904e36e2c6e87c7b9138570ab19a97189cc58af3 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Date: Wed, 19 Sep 2018 22:26:11 +0200
Subject: [PATCH] mt76: usb: make rx page_frag_cache access atomic

Make rx page fragment access atomic in order to fix
the following crash that occasionally occurs if the
device is rebooted with the usb dongle connected

[ 2614.207939] BUG: Bad page state in process kworker/3:0  pfn:3ee9e8
[ 2614.207941] page:ffffe061cfba7a00 count:-1 mapcount:0 mapping:0000000000000000 index:0x0
[ 2614.207975] flags: 0x17ffc0000000000()
[ 2614.207994] raw: 017ffc0000000000 dead000000000100 dead000000000200 0000000000000000
[ 2614.207995] raw: 0000000000000000 0000000000000000 ffffffffffffffff 0000000000000000
[ 2614.207996] page dumped because: nonzero _count
[ 2614.208119] CPU: 3 PID: 7754 Comm: kworker/3:0 Tainted: G T 4.19.0-rc1-gfaedbfa17bec-dirty #3
[ 2614.208120] Hardware name:  /NUC5i5MYBE, BIOS MYBDWi5v.86A.0024.2015.0504.1120 05/04/2015
[ 2614.208124] Workqueue: usb_hub_wq hub_event
[ 2614.208125] Call Trace:
[ 2614.208129]  dump_stack+0x5c/0x7b
[ 2614.208133]  bad_page+0xbf/0x120
[ 2614.208135]  get_page_from_freelist+0xf5f/0x13e0
[ 2614.208137]  __alloc_pages_nodemask+0x12f/0xdd0
[ 2614.208144]  page_frag_alloc+0x84/0x140
[ 2614.208148]  mt76u_fill_rx_sg.isra.1+0x55/0x200 [mt76_usb]
[ 2614.208150]  mt76u_alloc_queues+0xaf/0x1e0 [mt76_usb]
[ 2614.208153]  mt76x2u_register_device+0xe4/0x1c0 [mt76x2u]
[ 2614.208155]  mt76x2u_probe+0x86/0xd0 [mt76x2u]
[ 2614.208158]  usb_probe_interface+0xe2/0x2a0
[ 2614.208159]  really_probe+0x1d1/0x2c0
[ 2614.208162]  driver_probe_device+0x4a/0xe0
[ 2614.208166]  bus_for_each_drv+0x72/0xb0
[ 2614.208167]  __device_attach+0xe5/0x140
[ 2614.208170]  bus_probe_device+0x85/0xa0
[ 2614.208172]  device_add+0x479/0x660
[ 2614.208174]  usb_set_configuration+0x537/0x850
[ 2614.208177]  generic_probe+0x23/0x70
[ 2614.208178]  really_probe+0x1d1/0x2c0
[ 2614.208181]  driver_probe_device+0x4a/0xe0
[ 2614.208184]  bus_for_each_drv+0x72/0xb0
[ 2614.208185]  __device_attach+0xe5/0x140
[ 2614.208187]  bus_probe_device+0x85/0xa0
[ 2614.208189]  device_add+0x479/0x660
[ 2614.208191]  usb_new_device+0x296/0x5e0
[ 2614.208193]  hub_event+0xf88/0x1340
[ 2614.208196]  process_one_work+0x16f/0x300
[ 2614.208198]  worker_thread+0x2b/0x390
[ 2614.208201]  kthread+0x106/0x120
[ 2614.208205]  ret_from_fork+0x35/0x40
[ 2614.208207] Disabling lock debugging due to kernel taint

Fixes: ("mt76: use a per rx queue page fragment cache")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
---
 drivers/net/wireless/mediatek/mt76/usb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index b3edd645b3c0..02206c2a6a1e 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -277,8 +277,10 @@ mt76u_fill_rx_sg(struct mt76_dev *dev, struct mt76u_buf *buf,
 {
    struct mt76_queue *q = &dev->q_rx[MT_RXQ_MAIN];
    struct urb *urb = buf->urb;
+   unsigned long flags;
    int i;

+   spin_lock_irqsave(&q->lock, flags);
    for (i = 0; i < nsgs; i++) {
        struct page *page;
        void *data;
@@ -292,6 +294,7 @@ mt76u_fill_rx_sg(struct mt76_dev *dev, struct mt76u_buf *buf,
        offset = data - page_address(page);
        sg_set_page(&urb->sg[i], page, sglen, offset);
    }
+   spin_unlock_irqrestore(&q->lock, flags);

    if (i < nsgs) {
        int j;
--
2.18.0