From patchwork Wed Nov 28 14:39:55 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Pundir X-Patchwork-Id: 152290 Delivered-To: patch@linaro.org Received: by 2002:a2e:299d:0:0:0:0:0 with SMTP id p29-v6csp1170583ljp; Wed, 28 Nov 2018 06:40:12 -0800 (PST) X-Google-Smtp-Source: AFSGD/VBpjYx0sBtWpNdrgdcEQrwLaiiPup63U3rLycQPZlkU7dh1zJADA5VHic68wWmW3Dfeo4H X-Received: by 2002:a17:902:34a:: with SMTP id 68mr29102247pld.268.1543416012554; Wed, 28 Nov 2018 06:40:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1543416012; cv=none; d=google.com; s=arc-20160816; b=sjCar0d6Oety7v+OaYGGMoUVOLAYYC0TioqlQznvONN6VnThe+JL4bWnWOHGCRW3Nb zvuk8+T0LEstx6wL9Phy6fXiuGQW0yotPTmms+cZhXVxGYRpG9FGGHUKSQROofKs38Al Ed+lVEYXFSQa+VF3bXsritvc8M6oyLSJXoXtjARugN83eDK3NEyCqkQ7NBFSYJ48SsvJ dbmIhumIB/wJA9/JUzug7LIno8t1mBLdRt0yASrcJD0F0vqshJO2Aj7G3VqnLrJtHkAZ Mudz8+tDkz0Lu5LshWFjP8JQFoBBwRu9hH0yquaxMYyEfI5X2VP197Y7QtHxUVYQ0YjG EqdQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature; bh=9+BO1vkaNAN3CiF20VlUdWRa39/+DjLfHZpZJY6bEfs=; b=v7mtZActe6jq2DbIrHbqlVYKgwUrqcBHhLoH60DMRIhbgcfLO/CDUQr0pgTamMLXU7 w07Z3COWAFndFFLegKK47rWK5yufTA5omWLX/fsIV/jMXq+1UORHhsgo9e9lCrVjHuz3 YRNvhkIv1DqUc7MOnLjtz0MCHtOes2a37X5kr0DagtTE/8UL+w5gojSICmbk+PwQ4WjZ sD0Uco3/9VRvMogJfH1ldxgJo3na8y/7IHcX8HkJTc7mDUTCzww5UUoyWFKxQihzlF8s jOeCH3HqZrObhr6E6+1j8i0VGQiiCE3GiQCe445OGkZAVtTqFMMdzV2tgg388Xhi+HJb mENg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fth6L0ZG; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id i67si5274274pfc.148.2018.11.28.06.40.12; Wed, 28 Nov 2018 06:40:12 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fth6L0ZG; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728251AbeK2BmE (ORCPT + 15 others); Wed, 28 Nov 2018 20:42:04 -0500 Received: from mail-pl1-f196.google.com ([209.85.214.196]:42208 "EHLO mail-pl1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727941AbeK2BmE (ORCPT ); Wed, 28 Nov 2018 20:42:04 -0500 Received: by mail-pl1-f196.google.com with SMTP id x21-v6so17461125pln.9 for ; Wed, 28 Nov 2018 06:40:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=9+BO1vkaNAN3CiF20VlUdWRa39/+DjLfHZpZJY6bEfs=; b=fth6L0ZGrwqhO0TlpjW792UCJltFFUaJaXDXCal+okLBMmDH8tXo+jmp9mrylHONSf iEzy1CKyI+JAEoliaCkxoJy3Vw/eKiVF0DW8SqcTStuiKwf5RsEulCG62JkH3gG+UnUy cKXgCS4u1A5PuaTWFWpzhgrZoMHY4vzTN23DQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=9+BO1vkaNAN3CiF20VlUdWRa39/+DjLfHZpZJY6bEfs=; b=JOSt99lD5JLaCIzuIYSUGJrf+Xew1BvzBSElKh00OD3PNZaasTJbPKbNigYjzMx9Wz 5XXEa9thU8Z6zR18ra/qBvTmwBhReeqAETGkkmXDIdqmCR8N7bN5//X6bjofn72qwVwt z4PiBH5e+hx8Tu4eLkjuyh3clzSaxzV6qPq8K+evwDlBhvpwdmdWNnhIKWvMWjZGhlmD X5ZqaXMkOu2c9w2FcKoQ9ozmtw3zU4LIppnFtBQb09i6+q+V18AA7mZlb/Wy/xQr0Dc3 499rNqM/AGi+jXW4OtcqMlWvlZ0KRqQ8TYP95G9UXTvshnrVgXpGhCjvhjo1Ghh89P4l Jrjw== X-Gm-Message-State: AA+aEWZM/pQzHRB5ZeaCfN20pplbk0lBm8nfGI/m5DBa3h0q7x+MaVzJ +H+UL6E5MjyPffEotDFlA+3nqQ== X-Received: by 2002:a17:902:e18d:: with SMTP id cd13mr34358606plb.262.1543416010931; Wed, 28 Nov 2018 06:40:10 -0800 (PST) Received: from localhost.localdomain ([49.207.53.6]) by smtp.gmail.com with ESMTPSA id b26sm24227637pfe.91.2018.11.28.06.40.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 28 Nov 2018 06:40:10 -0800 (PST) From: Amit Pundir To: Greg KH Cc: Stable , Vasanthakumar Thiagarajan , Kalle Valo Subject: [PATCH for-4.9.y 01/10] ath10k: fix kernel panic due to race in accessing arvif list Date: Wed, 28 Nov 2018 20:09:55 +0530 Message-Id: <1543416004-1547-2-git-send-email-amit.pundir@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1543416004-1547-1-git-send-email-amit.pundir@linaro.org> References: <1543416004-1547-1-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vasanthakumar Thiagarajan commit ebaa4b1620bf69f2bc43cb45ea85fbafdaec23c3 upstream. arvifs list is traversed within data_lock spin_lock in tasklet context to fill channel information from the corresponding vif. This means any access to arvifs list for add/del operations should also be protected with the same spin_lock to avoid the race. Fix this by performing list add/del on arvfis within the data_lock. This could fix kernel panic something like the below. LR is at ath10k_htt_rx_pktlog_completion_handler+0x100/0xb6c [ath10k_core] PC is at ath10k_htt_rx_pktlog_completion_handler+0x1c0/0xb6c [ath10k_core] Internal error: Oops: 17 [#1] PREEMPT SMP ARM [] (ath10k_htt_rx_pktlog_completion_handler+0x2f4/0xb6c [ath10k_core]) [] (ath10k_htt_txrx_compl_task+0x8b4/0x1188 [ath10k_core]) [] (tasklet_action+0x8c/0xec) [] (__do_softirq+0xdc/0x208) [] (irq_exit+0x84/0xe0) [] (__handle_domain_irq+0x80/0xa0) [] (gic_handle_irq+0x38/0x5c) [] (__irq_svc+0x40/0x74) (gdb) list *(ath10k_htt_rx_pktlog_completion_handler+0x1c0) 0x136c0 is in ath10k_htt_rx_h_channel (drivers/net/wireless/ath/ath10k/htt_rx.c:769) 764 struct cfg80211_chan_def def; 765 766 lockdep_assert_held(&ar->data_lock); 767 768 list_for_each_entry(arvif, &ar->arvifs, list) { 769 if (arvif->vdev_id == vdev_id && 770 ath10k_mac_vif_chan(arvif->vif, &def) == 0) 771 return def.chan; 772 } 773 Signed-off-by: Vasanthakumar Thiagarajan Signed-off-by: Kalle Valo Signed-off-by: Amit Pundir --- drivers/net/wireless/ath/ath10k/mac.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.7.4 diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c index 5fe6841b8889..fb632a454fc2 100644 --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c @@ -4967,7 +4967,9 @@ static int ath10k_add_interface(struct ieee80211_hw *hw, } ar->free_vdev_map &= ~(1LL << arvif->vdev_id); + spin_lock_bh(&ar->data_lock); list_add(&arvif->list, &ar->arvifs); + spin_unlock_bh(&ar->data_lock); /* It makes no sense to have firmware do keepalives. mac80211 already * takes care of this with idle connection polling. @@ -5118,7 +5120,9 @@ static int ath10k_add_interface(struct ieee80211_hw *hw, err_vdev_delete: ath10k_wmi_vdev_delete(ar, arvif->vdev_id); ar->free_vdev_map |= 1LL << arvif->vdev_id; + spin_lock_bh(&ar->data_lock); list_del(&arvif->list); + spin_unlock_bh(&ar->data_lock); err: if (arvif->beacon_buf) { @@ -5164,7 +5168,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw, arvif->vdev_id, ret); ar->free_vdev_map |= 1LL << arvif->vdev_id; + spin_lock_bh(&ar->data_lock); list_del(&arvif->list); + spin_unlock_bh(&ar->data_lock); if (arvif->vdev_type == WMI_VDEV_TYPE_AP || arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {