| Message ID | 23a1333dfb0367cc69e7177a2e373df0b6d42980.1612915444.git.skhan@linuxfoundation.org (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | ath10k fixes for warns | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch |
Shuah Khan <skhan@linuxfoundation.org> wrote: > ieee80211_find_sta_by_ifaddr() must be called under the RCU lock and > the resulting pointer is only valid under RCU lock as well. > > Fix ath10k_wmi_tlv_parse_peer_stats_info() to hold RCU lock before it > calls ieee80211_find_sta_by_ifaddr() and release it when the resulting > pointer is no longer needed. The log below shows the problem. > > While at it, fix ath10k_wmi_tlv_op_pull_peer_stats_info() to do the same. > > ============================= > WARNING: suspicious RCU usage > 5.11.0-rc7+ #20 Tainted: G W > ----------------------------- > include/linux/rhashtable.h:594 suspicious rcu_dereference_check() usage! > other info that might help us debug this: > rcu_scheduler_active = 2, debug_locks = 1 > no locks held by ksoftirqd/5/44. > > stack backtrace: > CPU: 5 PID: 44 Comm: ksoftirqd/5 Tainted: G W 5.11.0-rc7+ #20 > Hardware name: LENOVO 10VGCTO1WW/3130, BIOS M1XKT45A 08/21/2019 > Call Trace: > dump_stack+0x7d/0x9f > lockdep_rcu_suspicious+0xdb/0xe5 > __rhashtable_lookup+0x1eb/0x260 [mac80211] > ieee80211_find_sta_by_ifaddr+0x5b/0xc0 [mac80211] > ath10k_wmi_tlv_parse_peer_stats_info+0x3e/0x90 [ath10k_core] > ath10k_wmi_tlv_iter+0x6a/0xc0 [ath10k_core] > ? ath10k_wmi_tlv_op_pull_mgmt_tx_bundle_compl_ev+0xe0/0xe0 [ath10k_core] > ath10k_wmi_tlv_op_rx+0x5da/0xda0 [ath10k_core] > ? trace_hardirqs_on+0x54/0xf0 > ? ath10k_ce_completed_recv_next+0x4e/0x60 [ath10k_core] > ath10k_wmi_process_rx+0x1d/0x40 [ath10k_core] > ath10k_htc_rx_completion_handler+0x115/0x180 [ath10k_core] > ath10k_pci_process_rx_cb+0x149/0x1b0 [ath10k_pci] > ? ath10k_htc_process_trailer+0x2d0/0x2d0 [ath10k_core] > ? ath10k_pci_sleep.part.0+0x6a/0x80 [ath10k_pci] > ath10k_pci_htc_rx_cb+0x15/0x20 [ath10k_pci] > ath10k_ce_per_engine_service+0x61/0x80 [ath10k_core] > ath10k_ce_per_engine_service_any+0x7d/0xa0 [ath10k_core] > ath10k_pci_napi_poll+0x48/0x120 [ath10k_pci] > net_rx_action+0x136/0x500 > __do_softirq+0xc6/0x459 > ? smpboot_thread_fn+0x2b/0x1f0 > run_ksoftirqd+0x2b/0x60 > smpboot_thread_fn+0x116/0x1f0 > kthread+0x14b/0x170 > ? smpboot_register_percpu_thread+0xe0/0xe0 > ? __kthread_bind_mask+0x70/0x70 > ret_from_fork+0x22/0x30 > > Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Unlucky timing also on this one, it conflicts with a patch I applied yesterday: https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=ath-next&id=2615e3cdbd9c0e864f5906279c952a309871d225 Can you redo the patch to only change ath10k_wmi_event_tdls_peer()? error: patch failed: drivers/net/wireless/ath/ath10k/wmi-tlv.c:240 error: drivers/net/wireless/ath/ath10k/wmi-tlv.c: patch does not apply stg import: Diff does not apply cleanly Patch set to Changes Requested.
On 2/10/21 1:13 AM, Kalle Valo wrote: > Shuah Khan <skhan@linuxfoundation.org> wrote: > >> ieee80211_find_sta_by_ifaddr() must be called under the RCU lock and >> the resulting pointer is only valid under RCU lock as well. >> >> Fix ath10k_wmi_tlv_parse_peer_stats_info() to hold RCU lock before it >> calls ieee80211_find_sta_by_ifaddr() and release it when the resulting >> pointer is no longer needed. The log below shows the problem. >> >> While at it, fix ath10k_wmi_tlv_op_pull_peer_stats_info() to do the same. >> >> ============================= >> WARNING: suspicious RCU usage >> 5.11.0-rc7+ #20 Tainted: G W >> ----------------------------- >> include/linux/rhashtable.h:594 suspicious rcu_dereference_check() usage! >> other info that might help us debug this: >> rcu_scheduler_active = 2, debug_locks = 1 >> no locks held by ksoftirqd/5/44. >> >> stack backtrace: >> CPU: 5 PID: 44 Comm: ksoftirqd/5 Tainted: G W 5.11.0-rc7+ #20 >> Hardware name: LENOVO 10VGCTO1WW/3130, BIOS M1XKT45A 08/21/2019 >> Call Trace: >> dump_stack+0x7d/0x9f >> lockdep_rcu_suspicious+0xdb/0xe5 >> __rhashtable_lookup+0x1eb/0x260 [mac80211] >> ieee80211_find_sta_by_ifaddr+0x5b/0xc0 [mac80211] >> ath10k_wmi_tlv_parse_peer_stats_info+0x3e/0x90 [ath10k_core] >> ath10k_wmi_tlv_iter+0x6a/0xc0 [ath10k_core] >> ? ath10k_wmi_tlv_op_pull_mgmt_tx_bundle_compl_ev+0xe0/0xe0 [ath10k_core] >> ath10k_wmi_tlv_op_rx+0x5da/0xda0 [ath10k_core] >> ? trace_hardirqs_on+0x54/0xf0 >> ? ath10k_ce_completed_recv_next+0x4e/0x60 [ath10k_core] >> ath10k_wmi_process_rx+0x1d/0x40 [ath10k_core] >> ath10k_htc_rx_completion_handler+0x115/0x180 [ath10k_core] >> ath10k_pci_process_rx_cb+0x149/0x1b0 [ath10k_pci] >> ? ath10k_htc_process_trailer+0x2d0/0x2d0 [ath10k_core] >> ? ath10k_pci_sleep.part.0+0x6a/0x80 [ath10k_pci] >> ath10k_pci_htc_rx_cb+0x15/0x20 [ath10k_pci] >> ath10k_ce_per_engine_service+0x61/0x80 [ath10k_core] >> ath10k_ce_per_engine_service_any+0x7d/0xa0 [ath10k_core] >> ath10k_pci_napi_poll+0x48/0x120 [ath10k_pci] >> net_rx_action+0x136/0x500 >> __do_softirq+0xc6/0x459 >> ? smpboot_thread_fn+0x2b/0x1f0 >> run_ksoftirqd+0x2b/0x60 >> smpboot_thread_fn+0x116/0x1f0 >> kthread+0x14b/0x170 >> ? smpboot_register_percpu_thread+0xe0/0xe0 >> ? __kthread_bind_mask+0x70/0x70 >> ret_from_fork+0x22/0x30 >> >> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> > > Unlucky timing also on this one, it conflicts with a patch I applied yesterday: > > https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=ath-next&id=2615e3cdbd9c0e864f5906279c952a309871d225 > > Can you redo the patch to only change ath10k_wmi_event_tdls_peer()? > Yes. I will send the patch just for ath10k_wmi_event_tdls_peer() on top of your patch. > error: patch failed: drivers/net/wireless/ath/ath10k/wmi-tlv.c:240 > error: drivers/net/wireless/ath/ath10k/wmi-tlv.c: patch does not apply > stg import: Diff does not apply cleanly > > Patch set to Changes Requested. > thanks, -- Shuah
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c index 7b5834157fe5..615157dd6866 100644 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c @@ -225,6 +225,7 @@ static int ath10k_wmi_tlv_parse_peer_stats_info(struct ath10k *ar, u16 tag, u16 const struct wmi_tlv_peer_stats_info *stat = ptr; struct ieee80211_sta *sta; struct ath10k_sta *arsta; + int ret = 0; if (tag != WMI_TLV_TAG_STRUCT_PEER_STATS_INFO) return -EPROTO; @@ -240,10 +241,12 @@ static int ath10k_wmi_tlv_parse_peer_stats_info(struct ath10k *ar, u16 tag, u16 __le32_to_cpu(stat->last_tx_rate_code), __le32_to_cpu(stat->last_tx_bitrate_kbps)); + rcu_read_lock(); sta = ieee80211_find_sta_by_ifaddr(ar->hw, stat->peer_macaddr.addr, NULL); if (!sta) { ath10k_warn(ar, "not found station for peer stats\n"); - return -EINVAL; + ret = -EINVAL; + goto exit; } arsta = (struct ath10k_sta *)sta->drv_priv; @@ -252,7 +255,9 @@ static int ath10k_wmi_tlv_parse_peer_stats_info(struct ath10k *ar, u16 tag, u16 arsta->tx_rate_code = __le32_to_cpu(stat->last_tx_rate_code); arsta->tx_bitrate_kbps = __le32_to_cpu(stat->last_tx_bitrate_kbps); - return 0; +exit: + rcu_read_unlock(); + return ret; } static int ath10k_wmi_tlv_op_pull_peer_stats_info(struct ath10k *ar, @@ -573,13 +578,13 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb) case WMI_TDLS_TEARDOWN_REASON_TX: case WMI_TDLS_TEARDOWN_REASON_RSSI: case WMI_TDLS_TEARDOWN_REASON_PTR_TIMEOUT: + rcu_read_lock(); station = ieee80211_find_sta_by_ifaddr(ar->hw, ev->peer_macaddr.addr, NULL); if (!station) { ath10k_warn(ar, "did not find station from tdls peer event"); - kfree(tb); - return; + goto exit; } arvif = ath10k_get_arvif(ar, __le32_to_cpu(ev->vdev_id)); ieee80211_tdls_oper_request( @@ -590,6 +595,8 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb) ); break; } +exit: + rcu_read_unlock(); kfree(tb); }
ieee80211_find_sta_by_ifaddr() must be called under the RCU lock and the resulting pointer is only valid under RCU lock as well. Fix ath10k_wmi_tlv_parse_peer_stats_info() to hold RCU lock before it calls ieee80211_find_sta_by_ifaddr() and release it when the resulting pointer is no longer needed. The log below shows the problem. While at it, fix ath10k_wmi_tlv_op_pull_peer_stats_info() to do the same. ============================= WARNING: suspicious RCU usage 5.11.0-rc7+ #20 Tainted: G W ----------------------------- include/linux/rhashtable.h:594 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 no locks held by ksoftirqd/5/44. stack backtrace: CPU: 5 PID: 44 Comm: ksoftirqd/5 Tainted: G W 5.11.0-rc7+ #20 Hardware name: LENOVO 10VGCTO1WW/3130, BIOS M1XKT45A 08/21/2019 Call Trace: dump_stack+0x7d/0x9f lockdep_rcu_suspicious+0xdb/0xe5 __rhashtable_lookup+0x1eb/0x260 [mac80211] ieee80211_find_sta_by_ifaddr+0x5b/0xc0 [mac80211] ath10k_wmi_tlv_parse_peer_stats_info+0x3e/0x90 [ath10k_core] ath10k_wmi_tlv_iter+0x6a/0xc0 [ath10k_core] ? ath10k_wmi_tlv_op_pull_mgmt_tx_bundle_compl_ev+0xe0/0xe0 [ath10k_core] ath10k_wmi_tlv_op_rx+0x5da/0xda0 [ath10k_core] ? trace_hardirqs_on+0x54/0xf0 ? ath10k_ce_completed_recv_next+0x4e/0x60 [ath10k_core] ath10k_wmi_process_rx+0x1d/0x40 [ath10k_core] ath10k_htc_rx_completion_handler+0x115/0x180 [ath10k_core] ath10k_pci_process_rx_cb+0x149/0x1b0 [ath10k_pci] ? ath10k_htc_process_trailer+0x2d0/0x2d0 [ath10k_core] ? ath10k_pci_sleep.part.0+0x6a/0x80 [ath10k_pci] ath10k_pci_htc_rx_cb+0x15/0x20 [ath10k_pci] ath10k_ce_per_engine_service+0x61/0x80 [ath10k_core] ath10k_ce_per_engine_service_any+0x7d/0xa0 [ath10k_core] ath10k_pci_napi_poll+0x48/0x120 [ath10k_pci] net_rx_action+0x136/0x500 __do_softirq+0xc6/0x459 ? smpboot_thread_fn+0x2b/0x1f0 run_ksoftirqd+0x2b/0x60 smpboot_thread_fn+0x116/0x1f0 kthread+0x14b/0x170 ? smpboot_register_percpu_thread+0xe0/0xe0 ? __kthread_bind_mask+0x70/0x70 ret_from_fork+0x22/0x30 Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> --- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)