A rcu read locked section is not allowed to sleep, and the rcu lock here isn't actually necessary, because we're holding dev->mutex. Fixes an issue when the tid work item is still running while freeing a station or stopping the aggregation session
Signed-off-by: Felix Fietkau <[email protected]> --- drivers/net/wireless/mediatek/mt76/agg-rx.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/agg-rx.c b/drivers/net/wireless/mediatek/mt76/agg-rx.c index 2276fd4e9ec3..b05d439dca3b 100644 --- a/drivers/net/wireless/mediatek/mt76/agg-rx.c +++ b/drivers/net/wireless/mediatek/mt76/agg-rx.c @@ -277,17 +277,13 @@ static void mt76_rx_aggr_shutdown(struct mt76_dev *dev, struct mt76_rx_tid *tid) void mt76_rx_aggr_stop(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno) { - struct mt76_rx_tid *tid; - - rcu_read_lock(); + struct mt76_rx_tid *tid = NULL; - tid = rcu_dereference(wcid->aggr[tidno]); + rcu_swap_protected(wcid->aggr[tidno], tid, + lockdep_is_held(&dev->mutex)); if (tid) { - rcu_assign_pointer(wcid->aggr[tidno], NULL); mt76_rx_aggr_shutdown(dev, tid); kfree_rcu(tid, rcu_head); } - - rcu_read_unlock(); } EXPORT_SYMBOL_GPL(mt76_rx_aggr_stop); -- 2.17.0
