archive mirror
 help / color / mirror / Atom feed
From: Brian Norris <>
To: Johannes Berg <>
Cc: Maximilian Luz <>,,
	Marek Szyprowski <>,
	Kalle Valo <>,
	"David S. Miller" <>,
	Jakub Kicinski <>,, Amitkumar Karwar <>,
	Ganapathi Bhat <>,
	Xinming Hu <>
Subject: Re: [BUG] Deadlock in _cfg80211_unregister_wdev()
Date: Fri, 14 May 2021 19:44:38 -0700	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On Fri, May 14, 2021 at 10:26:25AM +0200, Johannes Berg wrote:
> If that's all not solving the issue then please try to resolve with gdb
> what line of code "cfg80211_netdev_notifier_call+0x12a" is, and please
> also clarify exactly what (upstream!) kernel you're using.

I can reproduce on v5.12 and v5.12.4 as well. With v5.12.4, I'm at:

1428			wiphy_lock(&rdev->wiphy);
5269		mutex_lock(&wiphy->mtx);


static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
					 unsigned long state, void *ptr)
		wiphy_lock(&rdev->wiphy);  <--- right here
		cfg80211_leave(rdev, wdev);

It would seem like _anyone_ that calls cfg80211_unregister_wdev() with
an interface up will hit this -- not unique to mwifiex. In fact, apart
from the fact that all his line numbers are wrong, Maximilian's original
email points out exactly where the deadlock is.
cfg80211_unregister_wdev() holds the wiphy lock, and the GOING_DOWN
notification also tries to grab it.

It does happen that in many other paths, you've already ensured that you
bring the interface down, so e.g., mac80211 drivers don't tend to hit
this. But I wouldn't be surprised if a few other cfg80211 drivers hit
this too.

The best solution I could figure was to do a similar lock dance done in
nl80211_del_interface() -- close the netdev without holding the wiphy
lock. I'll send out a patch shortly.


  parent reply	other threads:[~2021-05-15  2:44 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-13 23:07 [BUG] Deadlock in _cfg80211_unregister_wdev() Maximilian Luz
2021-05-14  8:26 ` Johannes Berg
2021-05-14 11:40   ` Maximilian Luz
2021-05-15  2:44   ` Brian Norris [this message]
2021-05-15 11:24     ` Maximilian Luz
2021-05-14 13:46 ` Maximilian Luz

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).