linux-kernel - RE: [PATCH rtw-next 5/6] wifi: rtw89: process TX wait skbs for USB via C2H handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c2c40bed311c4f05948cf2541c64ea30@realtek.com>
Date: Thu, 25 Sep 2025 03:39:14 +0000
From: Ping-Ke Shih <pkshih@...ltek.com>
To: Fedor Pchelkin <pchelkin@...ras.ru>,
        Bitterblue Smith
	<rtl8821cerfe2@...il.com>
CC: Zong-Zhe Yang <kevin_yang@...ltek.com>,
        Bernie Huang
	<phhuang@...ltek.com>,
        "linux-wireless@...r.kernel.org"
	<linux-wireless@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "lvc-project@...uxtesting.org"
	<lvc-project@...uxtesting.org>
Subject: RE: [PATCH rtw-next 5/6] wifi: rtw89: process TX wait skbs for USB via C2H handler

Fedor Pchelkin <pchelkin@...ras.ru> wrote:
> TX wait skbs need to be completed when they are done.  PCIe part does this
> inside rtw89_pci_tx_status() during RPP processing.  Other HCIs use a
> mechanism based on C2H firmware messages.
> 
> Store a sequence number in a TX wait object so that it'll be possible to
> identify completed items inside C2H handler.  No need to add the
> corresponding skb to the &txcb->tx_ack_queue on USB part.
> 
> Found by Linux Verification Center (linuxtesting.org).
> 
> Signed-off-by: Fedor Pchelkin <pchelkin@...ras.ru>

[...]

> diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
> index 831e53aedccc..79409eb4d028 100644
> --- a/drivers/net/wireless/realtek/rtw89/mac.c
> +++ b/drivers/net/wireless/realtek/rtw89/mac.c
> @@ -5477,6 +5477,7 @@ rtw89_mac_c2h_tx_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len)
>  {
>         u8 sw_define = RTW89_GET_MAC_C2H_TX_RPT_SW_DEFINE(c2h->data);
>         u8 tx_status = RTW89_GET_MAC_C2H_TX_RPT_TX_STATE(c2h->data);
> +       struct rtw89_tx_wait_info *wait;
>         struct sk_buff *cur, *tmp;
>         unsigned long flags;
>         u8 *n;
> @@ -5485,6 +5486,16 @@ rtw89_mac_c2h_tx_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len)
>                     "C2H TX RPT: sn %d, tx_status %d\n",
>                     sw_define, tx_status);
> 
> +       rcu_read_lock();
> +       list_for_each_entry_rcu(wait, &rtwdev->tx_waits, list) {
> +               if (wait->sn == sw_define) {
> +                       wait->tx_done = tx_status == RTW89_TX_DONE;
> +                       complete_all(&wait->completion);
> +                       break;
> +               }
> +       }
> +       rcu_read_unlock();
> +

Since we can get 'wait' from RTW89_TX_SKB_CB(), can we just use
rtwdev->tx_rpt_queue?

Also, call rtw89_core_tx_wait_complete() to complete wait?

>         spin_lock_irqsave(&rtwdev->tx_rpt_queue.lock, flags);
>         skb_queue_walk_safe(&rtwdev->tx_rpt_queue, cur, tmp) {
>                 n = (u8 *)RTW89_TX_SKB_CB(cur)->hci_priv;