[PATCH net v2 1/2] mac802154: serialize and drain queued RX descriptors

[Xuanqiang Luo <xuanqiang.luo@linux.dev>]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

queue_work() coalesces attempts to queue an already pending work item.
The RX workers, however, consume only one descriptor per invocation. A
burst can therefore leave later descriptors queued until another frame
arrives, while the final descriptor may remain queued indefinitely.

The RX tasklet, workers, and scan cleanup also access the descriptor
lists without synchronization.

Protect both lists with a spinlock. Publish each descriptor and queue its
work while holding the lock. Remove each descriptor from the list before
processing it and, if another descriptor remains, queue the work again so
it runs after the current invocation.

Fixes: 57588c71177f ("mac802154: Handle passive scanning")
Fixes: d021d218f6d9 ("mac802154: Handle received BEACON_REQ")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
 net/mac802154/ieee802154_i.h |  2 ++
 net/mac802154/main.c         |  1 +
 net/mac802154/rx.c           | 32 ++++++++++++++++++++++++++------
 net/mac802154/scan.c         |  7 ++++++-
 4 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/net/mac802154/ieee802154_i.h b/net/mac802154/ieee802154_i.h
index 8f2bff268392b..096e6f0340dc7 100644
--- a/net/mac802154/ieee802154_i.h
+++ b/net/mac802154/ieee802154_i.h
@@ -74,6 +74,8 @@ struct ieee802154_local {
 	struct work_struct rx_beacon_work;
 	struct list_head rx_mac_cmd_list;
 	struct work_struct rx_mac_cmd_work;
+	/* Protects rx_beacon_list and rx_mac_cmd_list. */
+	spinlock_t rx_lists_lock;
 
 	/* Association */
 	struct ieee802154_pan_device *assoc_dev;
diff --git a/net/mac802154/main.c b/net/mac802154/main.c
index ea1efef3572ae..a6a976b0dea56 100644
--- a/net/mac802154/main.c
+++ b/net/mac802154/main.c
@@ -91,6 +91,7 @@ ieee802154_alloc_hw(size_t priv_data_len, const struct ieee802154_ops *ops)
 	INIT_LIST_HEAD(&local->interfaces);
 	INIT_LIST_HEAD(&local->rx_beacon_list);
 	INIT_LIST_HEAD(&local->rx_mac_cmd_list);
+	spin_lock_init(&local->rx_lists_lock);
 	mutex_init(&local->iflist_mtx);
 
 	tasklet_setup(&local->tasklet, ieee802154_tasklet_handler);
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index cd8f2a11920d0..26da20ea470ef 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -29,20 +29,38 @@ static int ieee802154_deliver_skb(struct sk_buff *skb)
 	return netif_receive_skb(skb);
 }
 
+static struct cfg802154_mac_pkt *
+mac802154_rx_dequeue(struct ieee802154_local *local,
+		     struct list_head *rx_list,
+		     struct work_struct *work)
+{
+	struct cfg802154_mac_pkt *mac_pkt;
+
+	spin_lock_bh(&local->rx_lists_lock);
+	mac_pkt = list_first_entry_or_null(rx_list,
+					   struct cfg802154_mac_pkt, node);
+	if (mac_pkt) {
+		list_del(&mac_pkt->node);
+		if (!list_empty(rx_list))
+			queue_work(local->mac_wq, work);
+	}
+	spin_unlock_bh(&local->rx_lists_lock);
+
+	return mac_pkt;
+}
+
 void mac802154_rx_beacon_worker(struct work_struct *work)
 {
 	struct ieee802154_local *local =
 		container_of(work, struct ieee802154_local, rx_beacon_work);
 	struct cfg802154_mac_pkt *mac_pkt;
 
-	mac_pkt = list_first_entry_or_null(&local->rx_beacon_list,
-					   struct cfg802154_mac_pkt, node);
+	mac_pkt = mac802154_rx_dequeue(local, &local->rx_beacon_list, work);
 	if (!mac_pkt)
 		return;
 
 	mac802154_process_beacon(local, mac_pkt->skb, mac_pkt->page, mac_pkt->channel);
 
-	list_del(&mac_pkt->node);
 	kfree_skb(mac_pkt->skb);
 	kfree(mac_pkt);
 }
@@ -76,8 +94,7 @@ void mac802154_rx_mac_cmd_worker(struct work_struct *work)
 	u8 mac_cmd;
 	int rc;
 
-	mac_pkt = list_first_entry_or_null(&local->rx_mac_cmd_list,
-					   struct cfg802154_mac_pkt, node);
+	mac_pkt = mac802154_rx_dequeue(local, &local->rx_mac_cmd_list, work);
 	if (!mac_pkt)
 		return;
 
@@ -123,7 +140,6 @@ void mac802154_rx_mac_cmd_worker(struct work_struct *work)
 	}
 
 out:
-	list_del(&mac_pkt->node);
 	kfree_skb(mac_pkt->skb);
 	kfree(mac_pkt);
 }
@@ -221,8 +237,10 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
 		mac_pkt->sdata = sdata;
 		mac_pkt->page = sdata->local->scan_page;
 		mac_pkt->channel = sdata->local->scan_channel;
+		spin_lock_bh(&sdata->local->rx_lists_lock);
 		list_add_tail(&mac_pkt->node, &sdata->local->rx_beacon_list);
 		queue_work(sdata->local->mac_wq, &sdata->local->rx_beacon_work);
+		spin_unlock_bh(&sdata->local->rx_lists_lock);
 		return NET_RX_SUCCESS;
 
 	case IEEE802154_FC_TYPE_MAC_CMD:
@@ -233,8 +251,10 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
 
 		mac_pkt->skb = skb_get(skb);
 		mac_pkt->sdata = sdata;
+		spin_lock_bh(&sdata->local->rx_lists_lock);
 		list_add_tail(&mac_pkt->node, &sdata->local->rx_mac_cmd_list);
 		queue_work(sdata->local->mac_wq, &sdata->local->rx_mac_cmd_work);
+		spin_unlock_bh(&sdata->local->rx_lists_lock);
 		return NET_RX_SUCCESS;
 
 	case IEEE802154_FC_TYPE_ACK:
diff --git a/net/mac802154/scan.c b/net/mac802154/scan.c
index 005338f89b75e..5fa98e001a8fb 100644
--- a/net/mac802154/scan.c
+++ b/net/mac802154/scan.c
@@ -105,8 +105,13 @@ static unsigned int mac802154_scan_get_channel_time(u8 duration_order,
 static void mac802154_flush_queued_beacons(struct ieee802154_local *local)
 {
 	struct cfg802154_mac_pkt *mac_pkt, *tmp;
+	LIST_HEAD(mac_pkt_list);
 
-	list_for_each_entry_safe(mac_pkt, tmp, &local->rx_beacon_list, node) {
+	spin_lock_bh(&local->rx_lists_lock);
+	list_splice_init(&local->rx_beacon_list, &mac_pkt_list);
+	spin_unlock_bh(&local->rx_lists_lock);
+
+	list_for_each_entry_safe(mac_pkt, tmp, &mac_pkt_list, node) {
 		list_del(&mac_pkt->node);
 		kfree_skb(mac_pkt->skb);
 		kfree(mac_pkt);
-- 
2.43.0