linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Miaoqing Pan <miaoqing@codeaurora.org>,
	Brian Norris <briannorris@chromium.org>,
	Kalle Valo <kvalo@codeaurora.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 28/41] ath10k: fix wmi mgmt tx queue full due to race condition
Date: Fri,  5 Mar 2021 13:22:35 +0100	[thread overview]
Message-ID: <20210305120852.674704445@linuxfoundation.org> (raw)
In-Reply-To: <20210305120851.255002428@linuxfoundation.org>

From: Miaoqing Pan <miaoqing@codeaurora.org>

[ Upstream commit b55379e343a3472c35f4a1245906db5158cab453 ]

Failed to transmit wmi management frames:

[84977.840894] ath10k_snoc a000000.wifi: wmi mgmt tx queue is full
[84977.840913] ath10k_snoc a000000.wifi: failed to transmit packet, dropping: -28
[84977.840924] ath10k_snoc a000000.wifi: failed to submit frame: -28
[84977.840932] ath10k_snoc a000000.wifi: failed to transmit frame: -28

This issue is caused by race condition between skb_dequeue and
__skb_queue_tail. The queue of ‘wmi_mgmt_tx_queue’ is protected by a
different lock: ar->data_lock vs list->lock, the result is no protection.
So when ath10k_mgmt_over_wmi_tx_work() and ath10k_mac_tx_wmi_mgmt()
running concurrently on different CPUs, there appear to be a rare corner
cases when the queue length is 1,

  CPUx (skb_deuque)			CPUy (__skb_queue_tail)
					next=list
					prev=list
  struct sk_buff *skb = skb_peek(list);	WRITE_ONCE(newsk->next, next);
  WRITE_ONCE(list->qlen, list->qlen - 1);WRITE_ONCE(newsk->prev, prev);
  next       = skb->next;		WRITE_ONCE(next->prev, newsk);
  prev       = skb->prev;		WRITE_ONCE(prev->next, newsk);
  skb->next  = skb->prev = NULL;	list->qlen++;
  WRITE_ONCE(next->prev, prev);
  WRITE_ONCE(prev->next, next);

If the instruction ‘next = skb->next’ is executed before
‘WRITE_ONCE(prev->next, newsk)’, newsk will be lost, as CPUx get the
old ‘next’ pointer, but the length is still added by one. The final
result is the length of the queue will reach the maximum value but
the queue is empty.

So remove ar->data_lock, and use 'skb_queue_tail' instead of
'__skb_queue_tail' to prevent the potential race condition. Also switch
to use skb_queue_len_lockless, in case we queue a few SKBs simultaneously.

Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.1.c2-00033-QCAHLSWMTPLZ-1

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1608618887-8857-1-git-send-email-miaoqing@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 8b3fe88d1c4e..564181bb0906 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3452,23 +3452,16 @@ bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar)
 static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb)
 {
 	struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
-	int ret = 0;
-
-	spin_lock_bh(&ar->data_lock);
 
-	if (skb_queue_len(q) == ATH10K_MAX_NUM_MGMT_PENDING) {
+	if (skb_queue_len_lockless(q) >= ATH10K_MAX_NUM_MGMT_PENDING) {
 		ath10k_warn(ar, "wmi mgmt tx queue is full\n");
-		ret = -ENOSPC;
-		goto unlock;
+		return -ENOSPC;
 	}
 
-	__skb_queue_tail(q, skb);
+	skb_queue_tail(q, skb);
 	ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work);
 
-unlock:
-	spin_unlock_bh(&ar->data_lock);
-
-	return ret;
+	return 0;
 }
 
 static enum ath10k_mac_tx_path
-- 
2.30.1




  parent reply	other threads:[~2021-03-05 12:42 UTC|newest]

Thread overview: 47+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-05 12:22 [PATCH 4.9 00/41] 4.9.260-rc1 review Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 01/41] futex: Cleanup variable names for futex_top_waiter() Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 02/41] futex: Cleanup refcounting Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 03/41] futex: Pull rt_mutex_futex_unlock() out from under hb->lock Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 04/41] futex: Futex_unlock_pi() determinism Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 05/41] futex: Fix pi_state->owner serialization Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 06/41] futex: Fix more put_pi_state() vs. exit_pi_state_list() races Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 07/41] futex: Dont enable IRQs unconditionally in put_pi_state() Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 08/41] net: usb: qmi_wwan: support ZTE P685M modem Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 09/41] arm: kprobes: Allow to handle reentered kprobe on single-stepping Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 10/41] scripts: use pkg-config to locate libcrypto Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 11/41] scripts: set proper OpenSSL include dir also for sign-file Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 12/41] hugetlb: fix update_and_free_page contig page struct assumption Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 13/41] printk: fix deadlock when kernel panic Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 14/41] arm64: Remove redundant mov from LL/SC cmpxchg Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 15/41] arm64: Avoid redundant type conversions in xchg() and cmpxchg() Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 16/41] arm64: cmpxchg: Use "K" instead of "L" for ll/sc immediate constraint Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 17/41] arm64: Use correct ll/sc atomic constraints Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 18/41] JFS: more checks for invalid superblock Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 19/41] xfs: Fix assert failure in xfs_setattr_size() Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 20/41] smackfs: restrict bytes count in smackfs write functions Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 21/41] net: fix up truesize of cloned skb in skb_prepare_for_shift() Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 22/41] mm/hugetlb.c: fix unnecessary address expansion of pmd sharing Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 23/41] staging: fwserial: Fix error handling in fwserial_create Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 24/41] x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 25/41] vt/consolemap: do font sum unsigned Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 26/41] wlcore: Fix command execute failure 19 for wl12xx Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 27/41] pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() Greg Kroah-Hartman
2021-03-05 12:22 ` Greg Kroah-Hartman [this message]
2021-03-05 12:22 ` [PATCH 4.9 29/41] x86/build: Treat R_386_PLT32 relocation as R_386_PC32 Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 30/41] Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 31/41] staging: most: sound: add sanity check for function argument Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 32/41] media: uvcvideo: Allow entities with no pads Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 33/41] scsi: iscsi: Restrict sessions and handles to admin capabilities Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 34/41] sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 35/41] scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 36/41] scsi: iscsi: Verify lengths on passthrough PDUs Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 37/41] Xen/gnttab: handle p2m update errors on a per-slot basis Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 38/41] xen-netback: respect gnttab_map_refs()s return value Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 39/41] zsmalloc: account the number of compacted pages correctly Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 40/41] swap: fix swapfile read/write offset Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.9 41/41] media: v4l: ioctl: Fix memory leak in video_usercopy Greg Kroah-Hartman
2021-03-06  5:16 ` [PATCH 4.9 00/41] 4.9.260-rc1 review Florian Fainelli
2021-03-06 16:29 ` Guenter Roeck
2021-03-06 16:30 ` Guenter Roeck
2021-03-07  2:26 ` Naresh Kamboju
2021-03-12 20:24 ` Florian Fainelli

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210305120852.674704445@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=briannorris@chromium.org \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=miaoqing@codeaurora.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).