All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] ath10k: Fix kernel panic due to race in accessing arvif list
@ 2016-10-10 14:21 ` Vasanthakumar Thiagarajan
  0 siblings, 0 replies; 4+ messages in thread
From: Vasanthakumar Thiagarajan @ 2016-10-10 14:21 UTC (permalink / raw)
  To: ath10k; +Cc: linux-wireless, Vasanthakumar Thiagarajan

arvifs list is traversed within data_lock spin_lock in tasklet
context to fill channel information from the corresponding vif.
This means any access to arvifs list for add/del operations
should also be protected with the same spin_lock to avoid the
race. Fix this by performing list add/del on arvfis within the
data_lock. This could fix kernel panic something like the below.

 LR is at ath10k_htt_rx_pktlog_completion_handler+0x100/0xb6c [ath10k_core]
 PC is at ath10k_htt_rx_pktlog_completion_handler+0x1c0/0xb6c [ath10k_core]
 Internal error: Oops: 17 [#1] PREEMPT SMP ARM
 [<bf4857f4>] (ath10k_htt_rx_pktlog_completion_handler+0x2f4/0xb6c [ath10k_core])
 [<bf487540>] (ath10k_htt_txrx_compl_task+0x8b4/0x1188 [ath10k_core])
 [<c00312d4>] (tasklet_action+0x8c/0xec)
 [<c00309a8>] (__do_softirq+0xdc/0x208)
 [<c0030d6c>] (irq_exit+0x84/0xe0)
 [<c005db04>] (__handle_domain_irq+0x80/0xa0)
 [<c00085c4>] (gic_handle_irq+0x38/0x5c)
 [<c0009640>] (__irq_svc+0x40/0x74)

(gdb) list *(ath10k_htt_rx_pktlog_completion_handler+0x1c0)
0x136c0 is in ath10k_htt_rx_h_channel (drivers/net/wireless/ath/ath10k/htt_rx.c:769)
764		struct cfg80211_chan_def def;
765
766		lockdep_assert_held(&ar->data_lock);
767
768		list_for_each_entry(arvif, &ar->arvifs, list) {
769			if (arvif->vdev_id == vdev_id &&
770			    ath10k_mac_vif_chan(arvif->vif, &def) == 0)
771				return def.chan;
772		}
773

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
---
 drivers/net/wireless/ath/ath10k/mac.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 2e5d2ca..691b7b5 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -4931,7 +4931,9 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 	}
 
 	ar->free_vdev_map &= ~(1LL << arvif->vdev_id);
+	spin_lock_bh(&ar->data_lock);
 	list_add(&arvif->list, &ar->arvifs);
+	spin_unlock_bh(&ar->data_lock);
 
 	/* It makes no sense to have firmware do keepalives. mac80211 already
 	 * takes care of this with idle connection polling.
@@ -5082,7 +5084,9 @@ err_peer_delete:
 err_vdev_delete:
 	ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
 	ar->free_vdev_map |= 1LL << arvif->vdev_id;
+	spin_lock_bh(&ar->data_lock);
 	list_del(&arvif->list);
+	spin_unlock_bh(&ar->data_lock);
 
 err:
 	if (arvif->beacon_buf) {
@@ -5128,7 +5132,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
 			    arvif->vdev_id, ret);
 
 	ar->free_vdev_map |= 1LL << arvif->vdev_id;
+	spin_lock_bh(&ar->data_lock);
 	list_del(&arvif->list);
+	spin_unlock_bh(&ar->data_lock);
 
 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
 	    arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
-- 
1.9.1

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [PATCH] ath10k: Fix kernel panic due to race in accessing arvif list
@ 2016-10-10 14:21 ` Vasanthakumar Thiagarajan
  0 siblings, 0 replies; 4+ messages in thread
From: Vasanthakumar Thiagarajan @ 2016-10-10 14:21 UTC (permalink / raw)
  To: ath10k; +Cc: Vasanthakumar Thiagarajan, linux-wireless

arvifs list is traversed within data_lock spin_lock in tasklet
context to fill channel information from the corresponding vif.
This means any access to arvifs list for add/del operations
should also be protected with the same spin_lock to avoid the
race. Fix this by performing list add/del on arvfis within the
data_lock. This could fix kernel panic something like the below.

 LR is at ath10k_htt_rx_pktlog_completion_handler+0x100/0xb6c [ath10k_core]
 PC is at ath10k_htt_rx_pktlog_completion_handler+0x1c0/0xb6c [ath10k_core]
 Internal error: Oops: 17 [#1] PREEMPT SMP ARM
 [<bf4857f4>] (ath10k_htt_rx_pktlog_completion_handler+0x2f4/0xb6c [ath10k_core])
 [<bf487540>] (ath10k_htt_txrx_compl_task+0x8b4/0x1188 [ath10k_core])
 [<c00312d4>] (tasklet_action+0x8c/0xec)
 [<c00309a8>] (__do_softirq+0xdc/0x208)
 [<c0030d6c>] (irq_exit+0x84/0xe0)
 [<c005db04>] (__handle_domain_irq+0x80/0xa0)
 [<c00085c4>] (gic_handle_irq+0x38/0x5c)
 [<c0009640>] (__irq_svc+0x40/0x74)

(gdb) list *(ath10k_htt_rx_pktlog_completion_handler+0x1c0)
0x136c0 is in ath10k_htt_rx_h_channel (drivers/net/wireless/ath/ath10k/htt_rx.c:769)
764		struct cfg80211_chan_def def;
765
766		lockdep_assert_held(&ar->data_lock);
767
768		list_for_each_entry(arvif, &ar->arvifs, list) {
769			if (arvif->vdev_id == vdev_id &&
770			    ath10k_mac_vif_chan(arvif->vif, &def) == 0)
771				return def.chan;
772		}
773

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
---
 drivers/net/wireless/ath/ath10k/mac.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 2e5d2ca..691b7b5 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -4931,7 +4931,9 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 	}
 
 	ar->free_vdev_map &= ~(1LL << arvif->vdev_id);
+	spin_lock_bh(&ar->data_lock);
 	list_add(&arvif->list, &ar->arvifs);
+	spin_unlock_bh(&ar->data_lock);
 
 	/* It makes no sense to have firmware do keepalives. mac80211 already
 	 * takes care of this with idle connection polling.
@@ -5082,7 +5084,9 @@ err_peer_delete:
 err_vdev_delete:
 	ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
 	ar->free_vdev_map |= 1LL << arvif->vdev_id;
+	spin_lock_bh(&ar->data_lock);
 	list_del(&arvif->list);
+	spin_unlock_bh(&ar->data_lock);
 
 err:
 	if (arvif->beacon_buf) {
@@ -5128,7 +5132,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
 			    arvif->vdev_id, ret);
 
 	ar->free_vdev_map |= 1LL << arvif->vdev_id;
+	spin_lock_bh(&ar->data_lock);
 	list_del(&arvif->list);
+	spin_unlock_bh(&ar->data_lock);
 
 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
 	    arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
-- 
1.9.1


_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: ath10k: Fix kernel panic due to race in accessing arvif list
  2016-10-10 14:21 ` Vasanthakumar Thiagarajan
@ 2016-10-13 14:21   ` Kalle Valo
  -1 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2016-10-13 14:21 UTC (permalink / raw)
  To: Vasanthakumar Thiagarajan
  Cc: ath10k, Vasanthakumar Thiagarajan, linux-wireless

Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com> wrote:
> arvifs list is traversed within data_lock spin_lock in tasklet
> context to fill channel information from the corresponding vif.
> This means any access to arvifs list for add/del operations
> should also be protected with the same spin_lock to avoid the
> race. Fix this by performing list add/del on arvfis within the
> data_lock. This could fix kernel panic something like the below.
> 
>  LR is at ath10k_htt_rx_pktlog_completion_handler+0x100/0xb6c [ath10k_core]
>  PC is at ath10k_htt_rx_pktlog_completion_handler+0x1c0/0xb6c [ath10k_core]
>  Internal error: Oops: 17 [#1] PREEMPT SMP ARM
>  [<bf4857f4>] (ath10k_htt_rx_pktlog_completion_handler+0x2f4/0xb6c [ath10k_core])
>  [<bf487540>] (ath10k_htt_txrx_compl_task+0x8b4/0x1188 [ath10k_core])
>  [<c00312d4>] (tasklet_action+0x8c/0xec)
>  [<c00309a8>] (__do_softirq+0xdc/0x208)
>  [<c0030d6c>] (irq_exit+0x84/0xe0)
>  [<c005db04>] (__handle_domain_irq+0x80/0xa0)
>  [<c00085c4>] (gic_handle_irq+0x38/0x5c)
>  [<c0009640>] (__irq_svc+0x40/0x74)
> 
> (gdb) list *(ath10k_htt_rx_pktlog_completion_handler+0x1c0)
> 0x136c0 is in ath10k_htt_rx_h_channel (drivers/net/wireless/ath/ath10k/htt_rx.c:769)
> 764		struct cfg80211_chan_def def;
> 765
> 766		lockdep_assert_held(&ar->data_lock);
> 767
> 768		list_for_each_entry(arvif, &ar->arvifs, list) {
> 769			if (arvif->vdev_id == vdev_id &&
> 770			    ath10k_mac_vif_chan(arvif->vif, &def) == 0)
> 771				return def.chan;
> 772		}
> 773
> 
> Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>

Patch applied to ath-next branch of ath.git, thanks.

ebaa4b1620bf ath10k: fix kernel panic due to race in accessing arvif list

-- 
https://patchwork.kernel.org/patch/9369573/

Documentation about submitting wireless patches and checking status
from patchwork:

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: ath10k: Fix kernel panic due to race in accessing arvif list
@ 2016-10-13 14:21   ` Kalle Valo
  0 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2016-10-13 14:21 UTC (permalink / raw)
  To: Vasanthakumar Thiagarajan; +Cc: linux-wireless, ath10k

Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com> wrote:
> arvifs list is traversed within data_lock spin_lock in tasklet
> context to fill channel information from the corresponding vif.
> This means any access to arvifs list for add/del operations
> should also be protected with the same spin_lock to avoid the
> race. Fix this by performing list add/del on arvfis within the
> data_lock. This could fix kernel panic something like the below.
> 
>  LR is at ath10k_htt_rx_pktlog_completion_handler+0x100/0xb6c [ath10k_core]
>  PC is at ath10k_htt_rx_pktlog_completion_handler+0x1c0/0xb6c [ath10k_core]
>  Internal error: Oops: 17 [#1] PREEMPT SMP ARM
>  [<bf4857f4>] (ath10k_htt_rx_pktlog_completion_handler+0x2f4/0xb6c [ath10k_core])
>  [<bf487540>] (ath10k_htt_txrx_compl_task+0x8b4/0x1188 [ath10k_core])
>  [<c00312d4>] (tasklet_action+0x8c/0xec)
>  [<c00309a8>] (__do_softirq+0xdc/0x208)
>  [<c0030d6c>] (irq_exit+0x84/0xe0)
>  [<c005db04>] (__handle_domain_irq+0x80/0xa0)
>  [<c00085c4>] (gic_handle_irq+0x38/0x5c)
>  [<c0009640>] (__irq_svc+0x40/0x74)
> 
> (gdb) list *(ath10k_htt_rx_pktlog_completion_handler+0x1c0)
> 0x136c0 is in ath10k_htt_rx_h_channel (drivers/net/wireless/ath/ath10k/htt_rx.c:769)
> 764		struct cfg80211_chan_def def;
> 765
> 766		lockdep_assert_held(&ar->data_lock);
> 767
> 768		list_for_each_entry(arvif, &ar->arvifs, list) {
> 769			if (arvif->vdev_id == vdev_id &&
> 770			    ath10k_mac_vif_chan(arvif->vif, &def) == 0)
> 771				return def.chan;
> 772		}
> 773
> 
> Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>

Patch applied to ath-next branch of ath.git, thanks.

ebaa4b1620bf ath10k: fix kernel panic due to race in accessing arvif list

-- 
https://patchwork.kernel.org/patch/9369573/

Documentation about submitting wireless patches and checking status
from patchwork:

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches


_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-10-13 14:22 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-10-10 14:21 [PATCH] ath10k: Fix kernel panic due to race in accessing arvif list Vasanthakumar Thiagarajan
2016-10-10 14:21 ` Vasanthakumar Thiagarajan
2016-10-13 14:21 ` Kalle Valo
2016-10-13 14:21   ` Kalle Valo

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.