Home Explore Help
Register Sign In
wareck
/
openwrt_chaos_calmer
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Branch: master
Branches Tags
openwrt_chaos_c...
/
package
/
kernel
/
mac80211
/
patches
/
351-0031-brcmfmac-Check-rtnl_lock-is-locked-when-removing-int.patch

351-0031-brcmfmac-Check-rtnl_lock-is-locked-when-removing-int.patch 5.3 KB
Permalink History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111 
  1. From 15dacf880e49ce3ecee05eb1a0c6b8e363dbacdc Mon Sep 17 00:00:00 2001
    2. 

  2. From: "mhiramat@kernel.org" <mhiramat@kernel.org>
    3. 

  3. Date: Mon, 15 Aug 2016 18:40:57 +0900
    4. 

  4. Subject: [PATCH] brcmfmac: Check rtnl_lock is locked when removing interface
    5. 

  5. MIME-Version: 1.0
    6. 

  6. Content-Type: text/plain; charset=UTF-8
    7. 

  7. Content-Transfer-Encoding: 8bit
    8. 

  8. 

  9. Check rtnl_lock is locked in brcmf_p2p_ifp_removed() by passing
    10. 

  10. rtnl_locked flag. Actually the caller brcmf_del_if() checks whether
    11. 

  11. the rtnl_lock is locked, but doesn't pass it to brcmf_p2p_ifp_removed().
    12. 

  12. 

  13. Without this fix, wpa_supplicant goes softlockup with rtnl_lock
    14. 

  14. holding (this means all other process using netlink are locked up too)
    15. 

  15. 

  16. e.g.
    17. 

  17. [ 4495.876627] INFO: task wpa_supplicant:7307 blocked for more than 10 seconds.
    18. 

  18. [ 4495.876632]       Tainted: G        W       4.8.0-rc1+ #8
    19. 

  19. [ 4495.876635] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    20. 

  20. [ 4495.876638] wpa_supplicant  D ffff974c647b39a0     0  7307      1 0x00000000
    21. 

  21. [ 4495.876644]  ffff974c647b39a0 0000000000000000 ffff974c00000000 ffff974c7dc59c58
    22. 

  22. [ 4495.876651]  ffff974c6b7417c0 ffff974c645017c0 ffff974c647b4000 ffffffff86f16c08
    23. 

  23. [ 4495.876657]  ffff974c645017c0 0000000000000246 00000000ffffffff ffff974c647b39b8
    24. 

  24. [ 4495.876664] Call Trace:
    25. 

  25. [ 4495.876671]  [<ffffffff868aeccc>] schedule+0x3c/0x90
    26. 

  26. [ 4495.876676]  [<ffffffff868af065>] schedule_preempt_disabled+0x15/0x20
    27. 

  27. [ 4495.876682]  [<ffffffff868b0996>] mutex_lock_nested+0x176/0x3b0
    28. 

  28. [ 4495.876686]  [<ffffffff867a2067>] ? rtnl_lock+0x17/0x20
    29. 

  29. [ 4495.876690]  [<ffffffff867a2067>] rtnl_lock+0x17/0x20
    30. 

  30. [ 4495.876720]  [<ffffffffc0ae9a5d>] brcmf_p2p_ifp_removed+0x4d/0x70 [brcmfmac]
    31. 

  31. [ 4495.876741]  [<ffffffffc0aebde6>] brcmf_remove_interface+0x196/0x1b0 [brcmfmac]
    32. 

  32. [ 4495.876760]  [<ffffffffc0ae9901>] brcmf_p2p_del_vif+0x111/0x220 [brcmfmac]
    33. 

  33. [ 4495.876777]  [<ffffffffc0adefab>] brcmf_cfg80211_del_iface+0x21b/0x270 [brcmfmac]
    34. 

  34. [ 4495.876820]  [<ffffffffc097b39e>] nl80211_del_interface+0xfe/0x3a0 [cfg80211]
    35. 

  35. [ 4495.876825]  [<ffffffff867ca335>] genl_family_rcv_msg+0x1b5/0x370
    36. 

  36. [ 4495.876832]  [<ffffffff860e5d8d>] ? trace_hardirqs_on+0xd/0x10
    37. 

  37. [ 4495.876836]  [<ffffffff867ca56d>] genl_rcv_msg+0x7d/0xb0
    38. 

  38. [ 4495.876839]  [<ffffffff867ca4f0>] ? genl_family_rcv_msg+0x370/0x370
    39. 

  39. [ 4495.876846]  [<ffffffff867c9a47>] netlink_rcv_skb+0x97/0xb0
    40. 

  40. [ 4495.876849]  [<ffffffff867ca168>] genl_rcv+0x28/0x40
    41. 

  41. [ 4495.876854]  [<ffffffff867c93c3>] netlink_unicast+0x1d3/0x2f0
    42. 

  42. [ 4495.876860]  [<ffffffff867c933b>] ? netlink_unicast+0x14b/0x2f0
    43. 

  43. [ 4495.876866]  [<ffffffff867c97cb>] netlink_sendmsg+0x2eb/0x3a0
    44. 

  44. [ 4495.876870]  [<ffffffff8676dad8>] sock_sendmsg+0x38/0x50
    45. 

  45. [ 4495.876874]  [<ffffffff8676e4df>] ___sys_sendmsg+0x27f/0x290
    46. 

  46. [ 4495.876882]  [<ffffffff8628b935>] ? mntput_no_expire+0x5/0x3f0
    47. 

  47. [ 4495.876888]  [<ffffffff8628b9be>] ? mntput_no_expire+0x8e/0x3f0
    48. 

  48. [ 4495.876894]  [<ffffffff8628b935>] ? mntput_no_expire+0x5/0x3f0
    49. 

  49. [ 4495.876899]  [<ffffffff8628bd44>] ? mntput+0x24/0x40
    50. 

  50. [ 4495.876904]  [<ffffffff86267830>] ? __fput+0x190/0x200
    51. 

  51. [ 4495.876909]  [<ffffffff8676f125>] __sys_sendmsg+0x45/0x80
    52. 

  52. [ 4495.876914]  [<ffffffff8676f172>] SyS_sendmsg+0x12/0x20
    53. 

  53. [ 4495.876918]  [<ffffffff868b5680>] entry_SYSCALL_64_fastpath+0x23/0xc1
    54. 

  54. [ 4495.876924]  [<ffffffff860e2b8f>] ? trace_hardirqs_off_caller+0x1f/0xc0
    55. 

  55. 

  56. Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
    57. 

  57. Acked-by: Rafał Miłecki <rafal@milecki.pl>
    58. 

  58. Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    59. 

  59. ---
    60. 

  60.  drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +-
    61. 

  61.  drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c  | 8 +++++---
    62. 

  62.  drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h  | 2 +-
    63. 

  63.  3 files changed, 7 insertions(+), 5 deletions(-)
    64. 

  64. 

  65. --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
    66. 

  66. +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
    67. 

  67. @@ -743,7 +743,7 @@ static void brcmf_del_if(struct brcmf_pu
    68. 

  68.  		 * serious troublesome side effects. The p2p module will clean
    69. 

  69.  		 * up the ifp if needed.
    70. 

  70.  		 */
    71. 

  71. -		brcmf_p2p_ifp_removed(ifp);
    72. 

  72. +		brcmf_p2p_ifp_removed(ifp, rtnl_locked);
    73. 

  73.  		kfree(ifp);
    74. 

  74.  	}
    75. 

  75.  }
    76. 

  76. --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
    77. 

  77. +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
    78. 

  78. @@ -2299,7 +2299,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
    79. 

  79.  	return err;
    80. 

  80.  }
    81. 

  81.  
    82. 

  82. -void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
    83. 

  83. +void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked)
    84. 

  84.  {
    85. 

  85.  	struct brcmf_cfg80211_info *cfg;
    86. 

  86.  	struct brcmf_cfg80211_vif *vif;
    87. 

  87. @@ -2308,9 +2308,11 @@ void brcmf_p2p_ifp_removed(struct brcmf_
    88. 

  88.  	vif = ifp->vif;
    89. 

  89.  	cfg = wdev_to_cfg(&vif->wdev);
    90. 

  90.  	cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
    91. 

  91. -	rtnl_lock();
    92. 

  92. +	if (!rtnl_locked)
    93. 

  93. +		rtnl_lock();
    94. 

  94.  	cfg80211_unregister_wdev(&vif->wdev);
    95. 

  95. -	rtnl_unlock();
    96. 

  96. +	if (!rtnl_locked)
    97. 

  97. +		rtnl_unlock();
    98. 

  98.  	brcmf_free_vif(vif);
    99. 

  99.  }
    100. 

  100.  
    101. 

  101. --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
    102. 

  102. +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
    103. 

  103. @@ -155,7 +155,7 @@ struct wireless_dev *brcmf_p2p_add_vif(s
    104. 

  104.  int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev);
    105. 

  105.  int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
    106. 

  106.  		       enum brcmf_fil_p2p_if_types if_type);
    107. 

  107. -void brcmf_p2p_ifp_removed(struct brcmf_if *ifp);
    108. 

  108. +void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked);
    109. 

  109.  int brcmf_p2p_start_device(struct wiphy *wiphy, struct wireless_dev *wdev);
    110. 

  110.  void brcmf_p2p_stop_device(struct wiphy *wiphy, struct wireless_dev *wdev);
    111. 

  111.  int brcmf_p2p_scan_prep(struct wiphy *wiphy,
    112.