From patchwork Wed Nov 28 17:29:00 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Pundir X-Patchwork-Id: 152330 Delivered-To: patch@linaro.org Received: by 2002:a2e:299d:0:0:0:0:0 with SMTP id p29-v6csp1364877ljp; Wed, 28 Nov 2018 09:29:18 -0800 (PST) X-Google-Smtp-Source: AFSGD/V//kDEFE6hqLizWyq0DidYIT4qJUdtE5yJc4t/nwrPUbTfJvyJcTy7xMPVxSC4CRIJ4GBy X-Received: by 2002:a62:1e87:: with SMTP id e129mr25360671pfe.221.1543426158450; Wed, 28 Nov 2018 09:29:18 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1543426158; cv=none; d=google.com; s=arc-20160816; b=X9XX9iPNdNf8Og8PJv9+OJiaEW5/WVJvx/x2U27N/a0OZogHLSipTRPXSyTlkROKUv 3wTwSFC7YIKAJgrf7pWCyGPPg/5m93PkiqCQ145Vj4TOKQLcQPDaAhNZxdSFXcNcYR3x IDBYgAivs2X6E/HuMCNItJjUTcJRcmUvJeo1nGiDfuyOSf5dFMtQsPz2cvwi/sJ3wa0+ kcp2YQlpy09oeqqcfyPr0Souw3qMxNBsQkLqadqoRBY45rhs9xjfu7zxvTJwHI87pLpL /2z/UrOFyY6KJZT+A7Dli4oZYSx+pfOScNHF/HvDTdZGWW20DE7ljVe0HARrP8Pr6nHk 2hKQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature; bh=HXbDkzvHACxxFWuSdEtN8zJk4C1wiKAxQmF16lEZPok=; b=ll6VbZwihVf9dzeCqA0sLOK/u0ImCQEosE9Ps7jCjZ32f99B+miQT9v9n2suaj4y0S zggS8RuOpTiHALPqFGZiWXnSXRIttMsxpFFukBfW1Ek9WA4SojI1XHdU8afjutc77Aj+ NzMzm99FkT9pzBSUtxDdZiAVhkXMmuTwOq8XBcnntro6bQqkgkId7oHDVgsKMTIxbbL/ b44WD/sCPvsjpgCjbuLNpH9SGdH86uD9ppnVknM1J+pxZqtgxiW0YIdZHfvWwcAQL9iW OXmz08Wjqcl6M+3I6pZ8zpMaFsYZMloMBkZbKLxHhQsM2EDBNSs0LOjrjWpJAR7wQrwy Z5Kg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=VnA9xtHg; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v16si4555330plo.182.2018.11.28.09.29.18; Wed, 28 Nov 2018 09:29:18 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=VnA9xtHg; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728569AbeK2Ebk (ORCPT + 15 others); Wed, 28 Nov 2018 23:31:40 -0500 Received: from mail-pg1-f194.google.com ([209.85.215.194]:45065 "EHLO mail-pg1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727867AbeK2Ebj (ORCPT ); Wed, 28 Nov 2018 23:31:39 -0500 Received: by mail-pg1-f194.google.com with SMTP id y4so9787658pgc.12 for ; Wed, 28 Nov 2018 09:29:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=HXbDkzvHACxxFWuSdEtN8zJk4C1wiKAxQmF16lEZPok=; b=VnA9xtHgOeqDsB83PH6kqzyGqTXgoYRZTgm6zjGRHE9wCybnmDM00GfpLcNPZ2DyZf yFR3lq1fewqwqbyOxiP1upIZwOChX9aenll6MSNSvoTvrYoJBp/QCl+OPSY1I9es6rTy h5QS9IXnNxjr8rosmca98Vrpl30tlUxGEEDrY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=HXbDkzvHACxxFWuSdEtN8zJk4C1wiKAxQmF16lEZPok=; b=nQQyAh0EyPTaOclV0SaFL2fIZpTLFJ9/2HgHkIiIC602AUIWWr2B1+QF6H2GtcLhFm k70hWa5WKUeQVLe0XL9c/I+I1MHgFYi64iYlLideIZjMNZqVM0ENJz6wNFZQ05lso+Ro +ftSTC/lu/+/C6eBD2RcCQnBTUT+k/4nLOPzhBZDGMOG0I3/iV9sN8eT99Kn6lTkPEDn WxgKUuY8mCvp9M6/krcf2eILyoYIER0F/K5d4c6Q+thrJltDhhGV4fzniuTHqki1VDZJ m70/5PfSqEqNFw0nHyI1NyLh7dN2uaMbNP/ATV+k8fGz1GZZ7agP6uvBcEyQr+38+ECs IR2g== X-Gm-Message-State: AA+aEWZFd9ygBDhwv0mkutVBG+8bEwERd/a/NTJE+zJuRtq/SrgZPczh yZeVpGhNyzDaQ7l+qPe+mLRckg== X-Received: by 2002:a63:8c2:: with SMTP id 185mr34484159pgi.26.1543426155979; Wed, 28 Nov 2018 09:29:15 -0800 (PST) Received: from localhost.localdomain ([49.207.53.6]) by smtp.gmail.com with ESMTPSA id 84sm13624360pfk.134.2018.11.28.09.29.13 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 28 Nov 2018 09:29:15 -0800 (PST) From: Amit Pundir To: Greg KH Cc: Stable , Vasanthakumar Thiagarajan , Kalle Valo Subject: [PATCH for-4.4.y 01/10] ath10k: fix kernel panic due to race in accessing arvif list Date: Wed, 28 Nov 2018 22:59:00 +0530 Message-Id: <1543426149-7269-2-git-send-email-amit.pundir@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1543426149-7269-1-git-send-email-amit.pundir@linaro.org> References: <1543426149-7269-1-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vasanthakumar Thiagarajan commit ebaa4b1620bf69f2bc43cb45ea85fbafdaec23c3 upstream. arvifs list is traversed within data_lock spin_lock in tasklet context to fill channel information from the corresponding vif. This means any access to arvifs list for add/del operations should also be protected with the same spin_lock to avoid the race. Fix this by performing list add/del on arvfis within the data_lock. This could fix kernel panic something like the below. LR is at ath10k_htt_rx_pktlog_completion_handler+0x100/0xb6c [ath10k_core] PC is at ath10k_htt_rx_pktlog_completion_handler+0x1c0/0xb6c [ath10k_core] Internal error: Oops: 17 [#1] PREEMPT SMP ARM [] (ath10k_htt_rx_pktlog_completion_handler+0x2f4/0xb6c [ath10k_core]) [] (ath10k_htt_txrx_compl_task+0x8b4/0x1188 [ath10k_core]) [] (tasklet_action+0x8c/0xec) [] (__do_softirq+0xdc/0x208) [] (irq_exit+0x84/0xe0) [] (__handle_domain_irq+0x80/0xa0) [] (gic_handle_irq+0x38/0x5c) [] (__irq_svc+0x40/0x74) (gdb) list *(ath10k_htt_rx_pktlog_completion_handler+0x1c0) 0x136c0 is in ath10k_htt_rx_h_channel (drivers/net/wireless/ath/ath10k/htt_rx.c:769) 764 struct cfg80211_chan_def def; 765 766 lockdep_assert_held(&ar->data_lock); 767 768 list_for_each_entry(arvif, &ar->arvifs, list) { 769 if (arvif->vdev_id == vdev_id && 770 ath10k_mac_vif_chan(arvif->vif, &def) == 0) 771 return def.chan; 772 } 773 Signed-off-by: Vasanthakumar Thiagarajan Signed-off-by: Kalle Valo Signed-off-by: Amit Pundir --- drivers/net/wireless/ath/ath10k/mac.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.7.4 diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c index 4644357d291a..398068ad0b62 100644 --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c @@ -4470,7 +4470,9 @@ static int ath10k_add_interface(struct ieee80211_hw *hw, } ar->free_vdev_map &= ~(1LL << arvif->vdev_id); + spin_lock_bh(&ar->data_lock); list_add(&arvif->list, &ar->arvifs); + spin_unlock_bh(&ar->data_lock); /* It makes no sense to have firmware do keepalives. mac80211 already * takes care of this with idle connection polling. @@ -4603,7 +4605,9 @@ err_peer_delete: err_vdev_delete: ath10k_wmi_vdev_delete(ar, arvif->vdev_id); ar->free_vdev_map |= 1LL << arvif->vdev_id; + spin_lock_bh(&ar->data_lock); list_del(&arvif->list); + spin_unlock_bh(&ar->data_lock); err: if (arvif->beacon_buf) { @@ -4647,7 +4651,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw, arvif->vdev_id, ret); ar->free_vdev_map |= 1LL << arvif->vdev_id; + spin_lock_bh(&ar->data_lock); list_del(&arvif->list); + spin_unlock_bh(&ar->data_lock); if (arvif->vdev_type == WMI_VDEV_TYPE_AP || arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {