[PATCH net] usbnet: fix EVENT_RX_PAUSED race in usbnet_skb_return()

[Ömer Mete Kaya]

usbnet_resume_rx() uses local_bh_disable() to synchronize with
usbnet_skb_return(), but local_bh_disable() only affects the local CPU.
On SMP, usbnet_skb_return() on CPU0 can pass the test_bit() check while
CPU1 runs usbnet_resume_rx(), clears the flag and drains the queue,
leaving the skb stranded in rxq_pause until the next MTU change or
device stop.

Fix with a double-check pattern under rxq_pause.lock: normal RX avoids
the lock via an unlocked test_bit() fast path; on the slow path the lock
is taken and the flag rechecked before enqueuing. Move clear_bit() in
usbnet_resume_rx() under the same lock to make the flag and queue
transitions atomic.

Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change")
Signed-off-by: Ömer Mete Kaya <omermetekaya0@xxxxxxxxx>
---
 drivers/net/usb/usbnet.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 0288d89e1d13..5eba2cef8bac 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -329,13 +329,15 @@ void usbnet_skb_return(struct usbnet *dev, struct sk_buff *skb)
 	unsigned long flags;
 	int	status;

-	spin_lock_bh(&dev->rxq_pause.lock);
-	if (test_bit(EVENT_RX_PAUSED, &dev->flags)) {
-		__skb_queue_tail(&dev->rxq_pause, skb);
+	if (unlikely(test_bit(EVENT_RX_PAUSED, &dev->flags))) {
+		spin_lock_bh(&dev->rxq_pause.lock);
+		if (test_bit(EVENT_RX_PAUSED, &dev->flags)) {
+			__skb_queue_tail(&dev->rxq_pause, skb);
+			spin_unlock_bh(&dev->rxq_pause.lock);
+			return;
+		}
 		spin_unlock_bh(&dev->rxq_pause.lock);
-		return;
 	}
-	spin_unlock_bh(&dev->rxq_pause.lock);

 	/* only update if unset to allow minidriver rx_fixup override */
 	if (skb->protocol == 0)
--
2.55.0