From patchwork Tue May 10 20:06:19 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luca Coelho X-Patchwork-Id: 9063011 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 0959B9F6FA for ; Tue, 10 May 2016 20:31:18 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 1D1C320142 for ; Tue, 10 May 2016 20:31:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 78DA0201C8 for ; Tue, 10 May 2016 20:31:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752785AbcEJUbO (ORCPT ); Tue, 10 May 2016 16:31:14 -0400 Received: from paleale.coelho.fi ([176.9.41.70]:40892 "EHLO farmhouse.coelho.fi" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752843AbcEJUbM (ORCPT ); Tue, 10 May 2016 16:31:12 -0400 Received: from [192.40.95.10] (helo=dubbel.ger.corp.intel.com) by farmhouse.coelho.fi with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.87) (envelope-from ) id 1b0E1A-0004Ao-4U; Tue, 10 May 2016 23:12:47 +0300 From: Luca Coelho To: kvalo@codeaurora.org Cc: linux-wireless@vger.kernel.org, emmanuel.grumbach@intel.com Date: Tue, 10 May 2016 23:06:19 +0300 Message-Id: <1462910797-20303-23-git-send-email-luca@coelho.fi> X-Mailer: git-send-email 2.8.1 In-Reply-To: <1462910797-20303-1-git-send-email-luca@coelho.fi> References: <1462910585.25219.7.camel@coelho.fi> <1462910797-20303-1-git-send-email-luca@coelho.fi> X-SA-Exim-Connect-IP: 192.40.95.10 X-SA-Exim-Mail-From: luca@coelho.fi X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RCVD_IN_SBL, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Subject: [PATCH 23/41] iwlwifi: mvm: don't allow negative reference count X-SA-Exim-Version: 4.2.1 (built Mon, 06 Jul 2015 07:28:29 +0000) X-SA-Exim-Scanned: Yes (on farmhouse.coelho.fi) Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Sara Sharon Currently code allows mvm reference to become negative and only warns in case mvm reference is released while reference counting is 0. However, we better prevent this from happening at all since iwl_mvm_unref() may race against iwl_mvm_unref_all_except() which is called on restart. As a result we might get the same reference unreferenced twice ending with a negative value: An example for an easily reproduced log: [ 2689.909166] iwl_mvm_ref Take mvm reference - type 8 [ 2690.732716] iwl_mvm_unref_all_except Cleanup: remove mvm ref type 8 (1) [ 2690.849708] iwl_mvm_unref Leave mvm reference - type 8 [ 2690.849721] WARNING: ... iwl_mvm_unref+0xb0/0xc0 [iwlmvm]() If there will be yet another another restart iwl_mvm_unref_all_except will run from 0 up to ref count, and since it is unsigned, we will throw the transport ref count completely out of balance: iwl_mvm_unref_all_except[I] -- Cleanup: remove mvm ref type 8 (255) iwl_trans_slv_unref[I] -- rpm counter: 0 iwl_trans_slv_unref[I] -- rpm counter: -1 iwl_trans_slv_unref[I] -- rpm counter: -2 ... iwl_trans_slv_unref[I] -- rpm counter: -253 iwl_trans_slv_unref[I] -- rpm counter: -254 As there is no valid scenario where we can get to a negative reference count - prevent it from happening. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho --- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c index 5648e37..cd71017 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c @@ -229,7 +229,11 @@ void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type) IWL_DEBUG_RPM(mvm, "Leave mvm reference - type %d\n", ref_type); spin_lock_bh(&mvm->refs_lock); - WARN_ON(!mvm->refs[ref_type]--); + if (WARN_ON(!mvm->refs[ref_type])) { + spin_unlock_bh(&mvm->refs_lock); + return; + } + mvm->refs[ref_type]--; spin_unlock_bh(&mvm->refs_lock); iwl_trans_unref(mvm->trans); }