| Message ID | 20220314215253.92658-1-dossche.niels@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | ath11k: acquire ab->base_lock in unassign when finding the peer by addr | expand |
On 3/16/22 07:13, Kalle Valo wrote: > Niels Dossche <dossche.niels@gmail.com> writes: > >> ath11k_peer_find_by_addr states via lockdep that ab->base_lock must be >> held when calling that function in order to protect the list. All >> callers except ath11k_mac_op_unassign_vif_chanctx have that lock >> acquired when calling ath11k_peer_find_by_addr. That lock is also not >> transitively held by a path towards ath11k_mac_op_unassign_vif_chanctx. >> The solution is to acquire the lock when calling >> ath11k_peer_find_by_addr inside ath11k_mac_op_unassign_vif_chanctx. >> >> Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") >> Signed-off-by: Niels Dossche <dossche.niels@gmail.com> > > On what hardware and firmware version did you test this? > Hi Kalle Thanks for your reply. I am currently working on a static analyser to detect missing locks. This was a reported case. I manually verified the report by looking at the code, so that I do not send wrong information or patches. After concluding that this seems to be a true positive, I created this patch. However, as I do not in fact have this particular hardware, I was unable to test it. Thanks
Niels Dossche <dossche.niels@gmail.com> writes: > On 3/16/22 07:13, Kalle Valo wrote: >> Niels Dossche <dossche.niels@gmail.com> writes: >> >>> ath11k_peer_find_by_addr states via lockdep that ab->base_lock must be >>> held when calling that function in order to protect the list. All >>> callers except ath11k_mac_op_unassign_vif_chanctx have that lock >>> acquired when calling ath11k_peer_find_by_addr. That lock is also not >>> transitively held by a path towards ath11k_mac_op_unassign_vif_chanctx. >>> The solution is to acquire the lock when calling >>> ath11k_peer_find_by_addr inside ath11k_mac_op_unassign_vif_chanctx. >>> >>> Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") >>> Signed-off-by: Niels Dossche <dossche.niels@gmail.com> >> >> On what hardware and firmware version did you test this? >> > > Thanks for your reply. > I am currently working on a static analyser to detect missing locks. > This was a reported case. I manually verified the report by looking > at the code, so that I do not send wrong information or patches. > After concluding that this seems to be a true positive, I created this patch. > However, as I do not in fact have this particular hardware, I was unable to test it. Ah, I didn't realise this. If you are using a tool to find errors in the code it's always a good idea to document that in the commit log. I'll add an edited version of what wrote you above in the commit log, ok?
Niels Dossche <dossche.niels@gmail.com> writes: > ath11k_peer_find_by_addr states via lockdep that ab->base_lock must be > held when calling that function in order to protect the list. All > callers except ath11k_mac_op_unassign_vif_chanctx have that lock > acquired when calling ath11k_peer_find_by_addr. That lock is also not > transitively held by a path towards ath11k_mac_op_unassign_vif_chanctx. > The solution is to acquire the lock when calling > ath11k_peer_find_by_addr inside ath11k_mac_op_unassign_vif_chanctx. > > Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") > Signed-off-by: Niels Dossche <dossche.niels@gmail.com> > --- > drivers/net/wireless/ath/ath11k/mac.c | 12 +++++++++--- > 1 file changed, 9 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c > index 07f499d5ec92..5db2333478a2 100644 > --- a/drivers/net/wireless/ath/ath11k/mac.c > +++ b/drivers/net/wireless/ath/ath11k/mac.c > @@ -7077,9 +7077,15 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw, > WARN_ON(!arvif->is_started); > > if (ab->hw_params.vdev_start_delay && > - arvif->vdev_type == WMI_VDEV_TYPE_MONITOR && > - ath11k_peer_find_by_addr(ab, ar->mac_addr)) > - ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr); > + arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) { > + struct ath11k_peer *peer; In the pending branch I moved the declaration to the beginning of the function and added this to the commit log: "I am currently working on a static analyser to detect missing locks and this was a reported case. I manually verified the report by looking at the code, but I do not have real hardware so this is compile tested only."
On 21/03/2022 11:45, Kalle Valo wrote: > Niels Dossche <dossche.niels@gmail.com> writes: > >> ath11k_peer_find_by_addr states via lockdep that ab->base_lock must be >> held when calling that function in order to protect the list. All >> callers except ath11k_mac_op_unassign_vif_chanctx have that lock >> acquired when calling ath11k_peer_find_by_addr. That lock is also not >> transitively held by a path towards ath11k_mac_op_unassign_vif_chanctx. >> The solution is to acquire the lock when calling >> ath11k_peer_find_by_addr inside ath11k_mac_op_unassign_vif_chanctx. >> >> Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") >> Signed-off-by: Niels Dossche <dossche.niels@gmail.com> >> --- >> drivers/net/wireless/ath/ath11k/mac.c | 12 +++++++++--- >> 1 file changed, 9 insertions(+), 3 deletions(-) >> >> diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c >> index 07f499d5ec92..5db2333478a2 100644 >> --- a/drivers/net/wireless/ath/ath11k/mac.c >> +++ b/drivers/net/wireless/ath/ath11k/mac.c >> @@ -7077,9 +7077,15 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw, >> WARN_ON(!arvif->is_started); >> >> if (ab->hw_params.vdev_start_delay && >> - arvif->vdev_type == WMI_VDEV_TYPE_MONITOR && >> - ath11k_peer_find_by_addr(ab, ar->mac_addr)) >> - ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr); >> + arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) { >> + struct ath11k_peer *peer; > > In the pending branch I moved the declaration to the beginning of the > function and added this to the commit log: > > "I am currently working on a static analyser to detect missing locks and > this was a reported case. I manually verified the report by looking at > the code, but I do not have real hardware so this is compile tested > only." > Sounds good to me. Thanks!
Niels Dossche <dossche.niels@gmail.com> wrote: > ath11k_peer_find_by_addr states via lockdep that ab->base_lock must be > held when calling that function in order to protect the list. All > callers except ath11k_mac_op_unassign_vif_chanctx have that lock > acquired when calling ath11k_peer_find_by_addr. That lock is also not > transitively held by a path towards ath11k_mac_op_unassign_vif_chanctx. > The solution is to acquire the lock when calling > ath11k_peer_find_by_addr inside ath11k_mac_op_unassign_vif_chanctx. > > I am currently working on a static analyser to detect missing locks and > this was a reported case. I manually verified the report by looking at > the code, but I do not have real hardware so this is compile tested > only. > > Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") > Signed-off-by: Niels Dossche <dossche.niels@gmail.com> > Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Patch applied to ath-next branch of ath.git, thanks. 2db80f93869d ath11k: acquire ab->base_lock in unassign when finding the peer by addr
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c index 07f499d5ec92..5db2333478a2 100644 --- a/drivers/net/wireless/ath/ath11k/mac.c +++ b/drivers/net/wireless/ath/ath11k/mac.c @@ -7077,9 +7077,15 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw, WARN_ON(!arvif->is_started); if (ab->hw_params.vdev_start_delay && - arvif->vdev_type == WMI_VDEV_TYPE_MONITOR && - ath11k_peer_find_by_addr(ab, ar->mac_addr)) - ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr); + arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) { + struct ath11k_peer *peer; + + spin_lock_bh(&ab->base_lock); + peer = ath11k_peer_find_by_addr(ab, ar->mac_addr); + spin_unlock_bh(&ab->base_lock); + if (peer) + ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr); + } if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) { ret = ath11k_mac_monitor_stop(ar);
ath11k_peer_find_by_addr states via lockdep that ab->base_lock must be held when calling that function in order to protect the list. All callers except ath11k_mac_op_unassign_vif_chanctx have that lock acquired when calling ath11k_peer_find_by_addr. That lock is also not transitively held by a path towards ath11k_mac_op_unassign_vif_chanctx. The solution is to acquire the lock when calling ath11k_peer_find_by_addr inside ath11k_mac_op_unassign_vif_chanctx. Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") Signed-off-by: Niels Dossche <dossche.niels@gmail.com> --- drivers/net/wireless/ath/ath11k/mac.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)