[5.10,053/142] mt7601u: fix rx buffer refcounting

From: Lorenzo Bianconi <lorenzo@kernel.org>

From: Lorenzo Bianconi <lorenzo@kernel.org>

commit d24c790577ef01bfa01da2b131313a38c843a634 upstream.

Fix the following crash due to erroneous page refcounting:

[   32.445919] BUG: Bad page state in process swapper/1  pfn:11f65a
[   32.447409] page:00000000938f0632 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x11f65a
[   32.449605] flags: 0x8000000000000000()
[   32.450421] raw: 8000000000000000 ffffffff825b0148 ffffea00045ae988 0000000000000000
[   32.451795] raw: 0000000000000000 0000000000000001 00000000ffffff7f 0000000000000000
[   32.452999] page dumped because: nonzero mapcount
[   32.453888] Modules linked in:
[   32.454492] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.11.0-rc2+ #1976
[   32.455695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-1.fc33 04/01/2014
[   32.457157] Call Trace:
[   32.457636]  <IRQ>
[   32.457993]  dump_stack+0x77/0x97
[   32.458576]  bad_page.cold+0x65/0x96
[   32.459198]  get_page_from_freelist+0x46a/0x11f0
[   32.460008]  __alloc_pages_nodemask+0x10a/0x2b0
[   32.460794]  mt7601u_rx_tasklet+0x651/0x720
[   32.461505]  tasklet_action_common.constprop.0+0x6b/0xd0
[   32.462343]  __do_softirq+0x152/0x46c
[   32.462928]  asm_call_irq_on_stack+0x12/0x20
[   32.463610]  </IRQ>
[   32.463953]  do_softirq_own_stack+0x5b/0x70
[   32.464582]  irq_exit_rcu+0x9f/0xe0
[   32.465028]  common_interrupt+0xae/0x1a0
[   32.465536]  asm_common_interrupt+0x1e/0x40
[   32.466071] RIP: 0010:default_idle+0x18/0x20
[   32.468981] RSP: 0018:ffffc90000077f00 EFLAGS: 00000246
[   32.469648] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
[   32.470550] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81aac3dd
[   32.471463] RBP: ffff88810022ab00 R08: 0000000000000001 R09: 0000000000000001
[   32.472335] R10: 0000000000000046 R11: 0000000000005aa0 R12: 0000000000000000
[   32.473235] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   32.474139]  ? default_idle_call+0x4d/0x200
[   32.474681]  default_idle_call+0x74/0x200
[   32.475192]  do_idle+0x1d5/0x250
[   32.475612]  cpu_startup_entry+0x19/0x20
[   32.476114]  secondary_startup_64_no_verify+0xb0/0xbb
[   32.476765] Disabling lock debugging due to kernel taint

Fixes: c869f77d6abb ("add mt7601u driver")
Co-developed-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/62b2380c8c2091834cfad05e1059b55f945bd114.1610643952.git.lorenzo@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mediatek/mt7601u/dma.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Message ID	20210202132959.909722510@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Felix Fietkau <nbd@nbd.name>, Lorenzo Bianconi <lorenzo@kernel.org>, Jakub Kicinski <kubakici@wp.pl>, Kalle Valo <kvalo@codeaurora.org> Subject: [PATCH 5.10 053/142] mt7601u: fix rx buffer refcounting Date: Tue, 2 Feb 2021 14:36:56 +0100 Message-Id: <20210202132959.909722510@linuxfoundation.org> In-Reply-To: <20210202132957.692094111@linuxfoundation.org> References: <20210202132957.692094111@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/142] nbd: freeze the queue while were adding connections [5.10,003/142] tty: avoid using vfs_iocb_iter_write() for redirected console writes [5.10,004/142] ACPI: sysfs: Prefer "compatible" modalias [5.10,005/142] ACPI: thermal: Do not call acpi_thermal_check() directly [5.10,006/142] kernel: kexec: remove the lock operation of system_transition_mutex [5.10,007/142] ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 [5.10,008/142] ALSA: hda/via: Apply the workaround generically for Clevo machines [5.10,009/142] parisc: Enable -mlong-calls gcc option by default when !CONFIG_MODULES [5.10,010/142] media: cec: add stm32 driver [5.10,011/142] media: cedrus: Fix H264 decoding [5.10,012/142] media: hantro: Fix reset_raw_fmt initialization [5.10,013/142] media: rc: fix timeout handling after switch to microsecond durations [5.10,014/142] media: rc: ite-cir: fix min_timeout calculation [5.10,015/142] media: rc: ensure that uevent can be read directly after rc device register [5.10,016/142] ARM: dts: tbs2910: rename MMC node aliases [5.10,017/142] ARM: dts: ux500: Reserve memory carveouts [5.10,018/142] ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming [5.10,019/142] wext: fix NULL-ptr-dereference with cfg80211s lack of commit() [5.10,020/142] x86/xen: avoid warning in Xen pv guest with CONFIG_AMD_MEM_ENCRYPT enabled [5.10,021/142] ASoC: AMD Renoir - refine DMI entries for some Lenovo products [5.10,022/142] Revert "drm/amdgpu/swsmu: drop set_fan_speed_percent (v2)" [5.10,023/142] drm/nouveau/kms/gk104-gp1xx: Fix > 64x64 cursors [5.10,024/142] drm/i915: Always flush the active worker before returning from the wait [5.10,025/142] drm/i915/gt: Always try to reserve GGTT address 0x0 [5.10,026/142] drivers/nouveau/kms/nv50-: Reject format modifiers for cursor planes [5.10,027/142] bcache: only check feature sets when sb->version >= BCACHE_SB_VERSION_CDEV_WITH_FE... [5.10,028/142] net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family [5.10,029/142] s390: uv: Fix sysfs max number of VCPUs reporting [5.10,030/142] s390/vfio-ap: No need to disable IRQ after queue reset [5.10,031/142] PM: hibernate: flush swap writer after marking [5.10,032/142] x86/entry: Emit a symbol for register restoring thunk [5.10,033/142] efi/apple-properties: Reinstate support for boolean properties [5.10,034/142] crypto: marvel/cesa - Fix tdma descriptor on 64-bit [5.10,035/142] drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs [5.10,036/142] drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] [5.10,037/142] btrfs: fix lockdep warning due to seqcount_mutex on 32bit arch [5.10,038/142] btrfs: fix possible free space tree corruption with online conversion [5.10,039/142] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] [5.10,040/142] KVM: x86/pmu: Fix UBSAN shift-out-of-bounds warning in intel_pmu_refresh() [5.10,041/142] KVM: arm64: Filter out v8.1+ events on v8.0 HW [5.10,042/142] KVM: nSVM: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit [5.10,043/142] KVM: x86: allow KVM_REQ_GET_NESTED_STATE_PAGES outside guest mode for VMX [5.10,044/142] KVM: nVMX: Sync unsyncd vmcs02 state to vmcs12 on migration [5.10,045/142] KVM: x86: get smi pending status correctly [5.10,046/142] KVM: Forbid the use of tagged userspace addresses for memslots [5.10,047/142] io_uring: fix wqe->lock/completion_lock deadlock [5.10,048/142] xen: Fix XenStore initialisation for XS_LOCAL [5.10,049/142] leds: trigger: fix potential deadlock with libata [5.10,050/142] arm64: dts: broadcom: Fix USB DMA address translation for Stingray [5.10,051/142] mt7601u: fix kernel crash unplugging the device [5.10,052/142] mt76: mt7663s: fix rx buffer refcounting [5.10,053/142] mt7601u: fix rx buffer refcounting [5.10,054/142] iwlwifi: Fix IWL_SUBDEVICE_NO_160 macro to use the correct bit. [5.10,055/142] drm/i915/gt: Clear CACHE_MODE prior to clearing residuals [5.10,056/142] drm/i915/pmu: Dont grab wakeref when enabling events [5.10,057/142] net/mlx5e: Fix IPSEC stats [5.10,058/142] ARM: dts: imx6qdl-kontron-samx6i: fix pwms for lcd-backlight [5.10,059/142] drm/nouveau/svm: fail NOUVEAU_SVM_INIT ioctl on unsupported devices [5.10,060/142] drm/vc4: Correct lbm size and calculation [5.10,061/142] drm/vc4: Correct POS1_SCL for hvs5 [5.10,062/142] drm/nouveau/dispnv50: Restore pushing of all data. [5.10,063/142] drm/i915: Check for all subplatform bits [5.10,064/142] drm/i915/selftest: Fix potential memory leak [5.10,065/142] uapi: fix big endian definition of ipv6_rpl_sr_hdr [5.10,066/142] KVM: Documentation: Fix spec for KVM_CAP_ENABLE_CAP_VM [5.10,067/142] tee: optee: replace might_sleep with cond_resched [5.10,068/142] xen-blkfront: allow discard-* nodes to be optional [5.10,069/142] blk-mq: test QUEUE_FLAG_HCTX_ACTIVE for sbitmap_shared in hctx_may_queue [5.10,070/142] clk: imx: fix Kconfig warning for i.MX SCU clk [5.10,071/142] clk: mmp2: fix build without CONFIG_PM [5.10,072/142] clk: qcom: gcc-sm250: Use floor ops for sdcc clks [5.10,073/142] ARM: imx: build suspend-imx6.S with arm instruction set [5.10,074/142] ARM: zImage: atags_to_fdt: Fix node names on added root nodes [5.10,075/142] netfilter: nft_dynset: add timeout extension to template [5.10,076/142] Revert "RDMA/mlx5: Fix devlink deadlock on net namespace deletion" [5.10,077/142] Revert "block: simplify set_init_blocksize" to regain lost performance [5.10,078/142] xfrm: Fix oops in xfrm_replay_advance_bmp [5.10,079/142] xfrm: fix disable_xfrm sysctl when used on xfrm interfaces [5.10,080/142] selftests: xfrm: fix test return value override issue in xfrm_policy.sh [5.10,081/142] xfrm: Fix wraparound in xfrm_policy_addr_delta() [5.10,082/142] arm64: dts: ls1028a: fix the offset of the reset register [5.10,083/142] ARM: imx: fix imx8m dependencies [5.10,084/142] ARM: dts: imx6qdl-kontron-samx6i: fix i2c_lcd/cam default status [5.10,085/142] ARM: dts: imx6qdl-sr-som: fix some cubox-i platforms [5.10,086/142] arm64: dts: imx8mp: Correct the gpio ranges of gpio3 [5.10,087/142] firmware: imx: select SOC_BUS to fix firmware build [5.10,088/142] RDMA/cxgb4: Fix the reported max_recv_sge value [5.10,089/142] ASoC: dt-bindings: lpass: Fix and common up lpass dai ids [5.10,090/142] ASoC: qcom: Fix incorrect volatile registers [5.10,091/142] ASoC: qcom: Fix broken support to MI2S TERTIARY and QUATERNARY [5.10,092/142] ASoC: qcom: lpass-ipq806x: fix bitwidth regmap field [5.10,093/142] spi: altera: Fix memory leak on error path [5.10,094/142] ASoC: Intel: Skylake: skl-topology: Fix OOPs ib skl_tplg_complete [5.10,095/142] powerpc/64s: prevent recursive replay_soft_interrupts causing superfluous interrupt [5.10,096/142] pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() [5.10,097/142] pNFS/NFSv4: Update the layout barrier when we schedule a layoutreturn [5.10,098/142] ASoC: SOF: Intel: soundwire: fix select/depend unmet dependencies [5.10,099/142] ASoC: qcom: lpass: Fix out-of-bounds DAI ID lookup [5.10,100/142] iwlwifi: pcie: avoid potential PNVM leaks [5.10,101/142] iwlwifi: pnvm: dont skip everything when not reloading [5.10,102/142] iwlwifi: pnvm: dont try to load after failures [5.10,103/142] iwlwifi: pcie: set LTR on more devices [5.10,104/142] iwlwifi: pcie: use jiffies for memory read spin time limit [5.10,105/142] iwlwifi: pcie: reschedule in long-running memory reads [5.10,106/142] mac80211: pause TX while changing interface type [5.10,107/142] ice: fix FDir IPv6 flexbyte [5.10,108/142] ice: Implement flow for IPv6 next header (extension header) [5.10,109/142] ice: update dev_addr in ice_set_mac_address even if HW filter exists [5.10,110/142] ice: Dont allow more channels than LAN MSI-X available [5.10,111/142] ice: Fix MSI-X vector fallback logic [5.10,112/142] i40e: acquire VSI pointer only after VF is initialized [5.10,113/142] igc: fix link speed advertising [5.10,114/142] net/mlx5: Fix memory leak on flow table creation error flow [5.10,115/142] net/mlx5e: E-switch, Fix rate calculation for overflow [5.10,116/142] net/mlx5e: free page before return [5.10,117/142] net/mlx5e: Reduce tc unsupported key print level [5.10,118/142] net/mlx5: Maintain separate page trees for ECPF and PF functions [5.10,119/142] net/mlx5e: Disable hw-tc-offload when MLX5_CLS_ACT config is disabled [5.10,120/142] net/mlx5e: Fix CT rule + encap slow path offload and deletion [5.10,121/142] net/mlx5e: Correctly handle changing the number of queues when the interface is down [5.10,122/142] net/mlx5e: Revert parameters on errors when changing trust state without reset [5.10,123/142] net/mlx5e: Revert parameters on errors when changing MTU and LRO state without reset [5.10,124/142] net/mlx5: CT: Fix incorrect removal of tuple_nat_node from nat rhashtable [5.10,125/142] can: dev: prevent potential information leak in can_fill_info() [5.10,126/142] ACPI/IORT: Do not blindly trust DMA masks from firmware [5.10,127/142] of/device: Update dma_range_map only when dev has valid dma-ranges [5.10,128/142] iommu/amd: Use IVHD EFR for early initialization of IOMMU features [5.10,129/142] iommu/vt-d: Correctly check addr alignment in qi_flush_dev_iotlb_pasid() [5.10,130/142] nvme-multipath: Early exit if no path is available [5.10,131/142] selftests: forwarding: Specify interface when invoking mausezahn [5.10,132/142] rxrpc: Fix memory leak in rxrpc_lookup_local [5.10,133/142] NFC: fix resource leak when target index is invalid [5.10,134/142] NFC: fix possible resource leak [5.10,135/142] ASoC: mediatek: mt8183-da7219: ignore TDM DAI link by default [5.10,136/142] ASoC: mediatek: mt8183-mt6358: ignore TDM DAI link by default [5.10,137/142] ASoC: topology: Properly unregister DAI on removal [5.10,138/142] ASoC: topology: Fix memory corruption in soc_tplg_denum_create_values() [5.10,139/142] scsi: qla2xxx: Fix description for parameter ql2xenforce_iocb_limit [5.10,140/142] team: protect features update by RCU to avoid deadlock [5.10,141/142] tcp: make TCP_USER_TIMEOUT accurate for zero window probes [5.10,142/142] tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN

[5.10,053/142] mt7601u: fix rx buffer refcounting

Commit Message

Patch