| Message ID | 510d7b670f673a4662ed672b0ce3d9f75512b100.1552251427.git.lorenzo@kernel.org (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Felix Fietkau |
| Headers | show |
| Series | mt76: fix schedule while atomic in mt76x02_reset_state | expand |
On 2019-03-10 23:47, Lorenzo Bianconi wrote: > Fix following schedule while atomic mt76x02_reset_state > since synchronize_rcu is run inside a RCU section > > [44036.944222] mt76x2e 0000:06:00.0: MCU message 31 (seq 3) timed out > [44036.944281] BUG: sleeping function called from invalid context at kernel/rcu/tree_exp.h:818 > [44036.944284] in_atomic(): 1, irqs_disabled(): 0, pid: 28066, name: kworker/u4:1 > [44036.944287] INFO: lockdep is turned off. > [44036.944292] CPU: 1 PID: 28066 Comm: kworker/u4:1 Tainted: G W 5.0.0-rc7-wdn-t1+ #7 > [44036.944294] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009 > [44036.944305] Workqueue: phy1 mt76x02_wdt_work [mt76x02_lib] > [44036.944308] Call Trace: > [44036.944317] dump_stack+0x67/0x90 > [44036.944322] ___might_sleep.cold.88+0x9f/0xaf > [44036.944327] rcu_blocking_is_gp+0x13/0x50 > [44036.944330] synchronize_rcu+0x17/0x80 > [44036.944337] mt76_sta_state+0x138/0x1d0 [mt76] > [44036.944349] mt76x02_wdt_work+0x1c9/0x610 [mt76x02_lib] > [44036.944355] process_one_work+0x2a5/0x620 > [44036.944361] worker_thread+0x35/0x3e0 > [44036.944368] kthread+0x11c/0x140 > [44036.944376] ret_from_fork+0x3a/0x50 > [44036.944384] BUG: scheduling while atomic: kworker/u4:1/28066/0x00000002 > [44036.944387] INFO: lockdep is turned off. > [44036.944389] Modules linked in: cmac ctr ccm af_packet snd_hda_codec_hdmi > > Introduce __mt76_sta_remove in order to run sta_remove without holding dev->mutex. > Move __mt76_sta_remove outside RCU section in mt76x02_reset_state > > Fixes: e4ebb8b403d1 ("mt76: mt76x2: implement full device restart on watchdog reset") > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c > index 6a34a6afcfe4..898afcbcdf52 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c > +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c > @@ -419,6 +419,7 @@ static void mt76x02_key_sync(struct ieee80211_hw *hw, struct ieee80211_vif *vif, > mt76x02_mac_wcid_sync_pn(dev, wcid->idx, key); > } > > +/* need to run with mt76.mutex held */ > static void mt76x02_reset_state(struct mt76x02_dev *dev) You can replace that comment with a call to lockdep_assert_held in the function. > @@ -426,11 +427,11 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev) > clear_bit(MT76_STATE_RUNNING, &dev->mt76.state); > > rcu_read_lock(); > - > ieee80211_iter_keys_rcu(dev->mt76.hw, NULL, mt76x02_key_sync, NULL); > + rcu_read_unlock(); > > for (i = 0; i < ARRAY_SIZE(dev->mt76.wcid); i++) { > - struct mt76_wcid *wcid = rcu_dereference(dev->mt76.wcid[i]); > + struct mt76_wcid *wcid = dev->mt76.wcid[i]; This should use rcu_dereference_protected() instead of accessing the pointer directly. Thanks, - Felix
> On 2019-03-10 23:47, Lorenzo Bianconi wrote: > > Fix following schedule while atomic mt76x02_reset_state > > since synchronize_rcu is run inside a RCU section > > > > [44036.944222] mt76x2e 0000:06:00.0: MCU message 31 (seq 3) timed out > > [44036.944281] BUG: sleeping function called from invalid context at kernel/rcu/tree_exp.h:818 > > [44036.944284] in_atomic(): 1, irqs_disabled(): 0, pid: 28066, name: kworker/u4:1 > > [44036.944287] INFO: lockdep is turned off. > > [44036.944292] CPU: 1 PID: 28066 Comm: kworker/u4:1 Tainted: G W 5.0.0-rc7-wdn-t1+ #7 > > [44036.944294] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009 > > [44036.944305] Workqueue: phy1 mt76x02_wdt_work [mt76x02_lib] > > [44036.944308] Call Trace: > > [44036.944317] dump_stack+0x67/0x90 > > [44036.944322] ___might_sleep.cold.88+0x9f/0xaf > > [44036.944327] rcu_blocking_is_gp+0x13/0x50 > > [44036.944330] synchronize_rcu+0x17/0x80 > > [44036.944337] mt76_sta_state+0x138/0x1d0 [mt76] > > [44036.944349] mt76x02_wdt_work+0x1c9/0x610 [mt76x02_lib] > > [44036.944355] process_one_work+0x2a5/0x620 > > [44036.944361] worker_thread+0x35/0x3e0 > > [44036.944368] kthread+0x11c/0x140 > > [44036.944376] ret_from_fork+0x3a/0x50 > > [44036.944384] BUG: scheduling while atomic: kworker/u4:1/28066/0x00000002 > > [44036.944387] INFO: lockdep is turned off. > > [44036.944389] Modules linked in: cmac ctr ccm af_packet snd_hda_codec_hdmi > > > > Introduce __mt76_sta_remove in order to run sta_remove without holding dev->mutex. > > Move __mt76_sta_remove outside RCU section in mt76x02_reset_state > > > > Fixes: e4ebb8b403d1 ("mt76: mt76x2: implement full device restart on watchdog reset") > > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > > diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c > > index 6a34a6afcfe4..898afcbcdf52 100644 > > --- a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c > > +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c > > @@ -419,6 +419,7 @@ static void mt76x02_key_sync(struct ieee80211_hw *hw, struct ieee80211_vif *vif, > > mt76x02_mac_wcid_sync_pn(dev, wcid->idx, key); > > } > > > > +/* need to run with mt76.mutex held */ > > static void mt76x02_reset_state(struct mt76x02_dev *dev) > You can replace that comment with a call to lockdep_assert_held in the > function. > > > @@ -426,11 +427,11 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev) > > clear_bit(MT76_STATE_RUNNING, &dev->mt76.state); > > > > rcu_read_lock(); > > - > > ieee80211_iter_keys_rcu(dev->mt76.hw, NULL, mt76x02_key_sync, NULL); > > + rcu_read_unlock(); > > > > for (i = 0; i < ARRAY_SIZE(dev->mt76.wcid); i++) { > > - struct mt76_wcid *wcid = rcu_dereference(dev->mt76.wcid[i]); > > + struct mt76_wcid *wcid = dev->mt76.wcid[i]; > This should use rcu_dereference_protected() instead of accessing the > pointer directly. > ack, I will fix them in v2. Regards, Lorenzo > Thanks, > > - Felix
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c index a033745adb2f..bde52943ecaf 100644 --- a/drivers/net/wireless/mediatek/mt76/mac80211.c +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c @@ -679,19 +679,15 @@ mt76_sta_add(struct mt76_dev *dev, struct ieee80211_vif *vif, return ret; } -static void -mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif, - struct ieee80211_sta *sta) +void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif, + struct ieee80211_sta *sta) { struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv; - int idx = wcid->idx; - int i; + int i, idx = wcid->idx; rcu_assign_pointer(dev->wcid[idx], NULL); synchronize_rcu(); - mutex_lock(&dev->mutex); - if (dev->drv->sta_remove) dev->drv->sta_remove(dev, vif, sta); @@ -699,7 +695,15 @@ mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif, for (i = 0; i < ARRAY_SIZE(sta->txq); i++) mt76_txq_remove(dev, sta->txq[i]); mt76_wcid_free(dev->wcid_mask, idx); +} +EXPORT_SYMBOL_GPL(__mt76_sta_remove); +static void +mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif, + struct ieee80211_sta *sta) +{ + mutex_lock(&dev->mutex); + __mt76_sta_remove(dev, vif, sta); mutex_unlock(&dev->mutex); } diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h index 477027bb9aaf..eb72e4bf3db6 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76.h +++ b/drivers/net/wireless/mediatek/mt76/mt76.h @@ -697,6 +697,8 @@ int mt76_sta_state(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct ieee80211_sta *sta, enum ieee80211_sta_state old_state, enum ieee80211_sta_state new_state); +void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif, + struct ieee80211_sta *sta); struct ieee80211_sta *mt76_rx_convert(struct sk_buff *skb); diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c index 6a34a6afcfe4..898afcbcdf52 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c @@ -419,6 +419,7 @@ static void mt76x02_key_sync(struct ieee80211_hw *hw, struct ieee80211_vif *vif, mt76x02_mac_wcid_sync_pn(dev, wcid->idx, key); } +/* need to run with mt76.mutex held */ static void mt76x02_reset_state(struct mt76x02_dev *dev) { int i; @@ -426,11 +427,11 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev) clear_bit(MT76_STATE_RUNNING, &dev->mt76.state); rcu_read_lock(); - ieee80211_iter_keys_rcu(dev->mt76.hw, NULL, mt76x02_key_sync, NULL); + rcu_read_unlock(); for (i = 0; i < ARRAY_SIZE(dev->mt76.wcid); i++) { - struct mt76_wcid *wcid = rcu_dereference(dev->mt76.wcid[i]); + struct mt76_wcid *wcid = dev->mt76.wcid[i]; struct mt76x02_sta *msta; struct ieee80211_sta *sta; struct ieee80211_vif *vif; @@ -445,13 +446,10 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev) priv = msta->vif; vif = container_of(priv, struct ieee80211_vif, drv_priv); - mt76_sta_state(dev->mt76.hw, vif, sta, - IEEE80211_STA_NONE, IEEE80211_STA_NOTEXIST); + __mt76_sta_remove(&dev->mt76, vif, sta); memset(msta, 0, sizeof(*msta)); } - rcu_read_unlock(); - dev->vif_mask = 0; dev->beacon_mask = 0; } @@ -471,11 +469,11 @@ static void mt76x02_watchdog_reset(struct mt76x02_dev *dev) for (i = 0; i < ARRAY_SIZE(dev->mt76.napi); i++) napi_disable(&dev->mt76.napi[i]); + mutex_lock(&dev->mt76.mutex); + if (restart) mt76x02_reset_state(dev); - mutex_lock(&dev->mt76.mutex); - if (dev->beacon_mask) mt76_clear(dev, MT_BEACON_TIME_CFG, MT_BEACON_TIME_CFG_BEACON_TX |
Fix following schedule while atomic mt76x02_reset_state since synchronize_rcu is run inside a RCU section [44036.944222] mt76x2e 0000:06:00.0: MCU message 31 (seq 3) timed out [44036.944281] BUG: sleeping function called from invalid context at kernel/rcu/tree_exp.h:818 [44036.944284] in_atomic(): 1, irqs_disabled(): 0, pid: 28066, name: kworker/u4:1 [44036.944287] INFO: lockdep is turned off. [44036.944292] CPU: 1 PID: 28066 Comm: kworker/u4:1 Tainted: G W 5.0.0-rc7-wdn-t1+ #7 [44036.944294] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009 [44036.944305] Workqueue: phy1 mt76x02_wdt_work [mt76x02_lib] [44036.944308] Call Trace: [44036.944317] dump_stack+0x67/0x90 [44036.944322] ___might_sleep.cold.88+0x9f/0xaf [44036.944327] rcu_blocking_is_gp+0x13/0x50 [44036.944330] synchronize_rcu+0x17/0x80 [44036.944337] mt76_sta_state+0x138/0x1d0 [mt76] [44036.944349] mt76x02_wdt_work+0x1c9/0x610 [mt76x02_lib] [44036.944355] process_one_work+0x2a5/0x620 [44036.944361] worker_thread+0x35/0x3e0 [44036.944368] kthread+0x11c/0x140 [44036.944376] ret_from_fork+0x3a/0x50 [44036.944384] BUG: scheduling while atomic: kworker/u4:1/28066/0x00000002 [44036.944387] INFO: lockdep is turned off. [44036.944389] Modules linked in: cmac ctr ccm af_packet snd_hda_codec_hdmi Introduce __mt76_sta_remove in order to run sta_remove without holding dev->mutex. Move __mt76_sta_remove outside RCU section in mt76x02_reset_state Fixes: e4ebb8b403d1 ("mt76: mt76x2: implement full device restart on watchdog reset") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> --- drivers/net/wireless/mediatek/mt76/mac80211.c | 18 +++++++++++------- drivers/net/wireless/mediatek/mt76/mt76.h | 2 ++ .../net/wireless/mediatek/mt76/mt76x02_mmio.c | 14 ++++++-------- 3 files changed, 19 insertions(+), 15 deletions(-)