diff mbox series

[2/5] ath10k: fix WARNING: suspicious RCU usage

Message ID 23a1333dfb0367cc69e7177a2e373df0b6d42980.1612915444.git.skhan@linuxfoundation.org
State New
Headers show
Series [1/5] ath10k: fix conf_mutex lock assert in ath10k_debug_fw_stats_request() | expand

Commit Message

Shuah Khan Feb. 10, 2021, 12:42 a.m. UTC 
ieee80211_find_sta_by_ifaddr() must be called under the RCU lock and
the resulting pointer is only valid under RCU lock as well.

Fix ath10k_wmi_tlv_parse_peer_stats_info() to hold RCU lock before it
calls ieee80211_find_sta_by_ifaddr() and release it when the resulting
pointer is no longer needed. The log below shows the problem.

While at it, fix ath10k_wmi_tlv_op_pull_peer_stats_info() to do the same.

Comments

Kalle Valo Feb. 10, 2021, 8:13 a.m. UTC | #1 
Shuah Khan <skhan@linuxfoundation.org> wrote:

> ieee80211_find_sta_by_ifaddr() must be called under the RCU lock and
> the resulting pointer is only valid under RCU lock as well.
> 
> Fix ath10k_wmi_tlv_parse_peer_stats_info() to hold RCU lock before it
> calls ieee80211_find_sta_by_ifaddr() and release it when the resulting
> pointer is no longer needed. The log below shows the problem.
> 
> While at it, fix ath10k_wmi_tlv_op_pull_peer_stats_info() to do the same.
> 
> =============================
> WARNING: suspicious RCU usage
> 5.11.0-rc7+ #20 Tainted: G        W
> -----------------------------
> include/linux/rhashtable.h:594 suspicious rcu_dereference_check() usage!
> other info that might help us debug this:
>                rcu_scheduler_active = 2, debug_locks = 1
> no locks held by ksoftirqd/5/44.
> 
> stack backtrace:
> CPU: 5 PID: 44 Comm: ksoftirqd/5 Tainted: G        W         5.11.0-rc7+ #20
> Hardware name: LENOVO 10VGCTO1WW/3130, BIOS M1XKT45A 08/21/2019
> Call Trace:
>  dump_stack+0x7d/0x9f
>  lockdep_rcu_suspicious+0xdb/0xe5
>  __rhashtable_lookup+0x1eb/0x260 [mac80211]
>  ieee80211_find_sta_by_ifaddr+0x5b/0xc0 [mac80211]
>  ath10k_wmi_tlv_parse_peer_stats_info+0x3e/0x90 [ath10k_core]
>  ath10k_wmi_tlv_iter+0x6a/0xc0 [ath10k_core]
>  ? ath10k_wmi_tlv_op_pull_mgmt_tx_bundle_compl_ev+0xe0/0xe0 [ath10k_core]
>  ath10k_wmi_tlv_op_rx+0x5da/0xda0 [ath10k_core]
>  ? trace_hardirqs_on+0x54/0xf0
>  ? ath10k_ce_completed_recv_next+0x4e/0x60 [ath10k_core]
>  ath10k_wmi_process_rx+0x1d/0x40 [ath10k_core]
>  ath10k_htc_rx_completion_handler+0x115/0x180 [ath10k_core]
>  ath10k_pci_process_rx_cb+0x149/0x1b0 [ath10k_pci]
>  ? ath10k_htc_process_trailer+0x2d0/0x2d0 [ath10k_core]
>  ? ath10k_pci_sleep.part.0+0x6a/0x80 [ath10k_pci]
>  ath10k_pci_htc_rx_cb+0x15/0x20 [ath10k_pci]
>  ath10k_ce_per_engine_service+0x61/0x80 [ath10k_core]
>  ath10k_ce_per_engine_service_any+0x7d/0xa0 [ath10k_core]
>  ath10k_pci_napi_poll+0x48/0x120 [ath10k_pci]
>  net_rx_action+0x136/0x500
>  __do_softirq+0xc6/0x459
>  ? smpboot_thread_fn+0x2b/0x1f0
>  run_ksoftirqd+0x2b/0x60
>  smpboot_thread_fn+0x116/0x1f0
>  kthread+0x14b/0x170
>  ? smpboot_register_percpu_thread+0xe0/0xe0
>  ? __kthread_bind_mask+0x70/0x70
>  ret_from_fork+0x22/0x30
> 
> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>

Unlucky timing also on this one, it conflicts with a patch I applied yesterday:

https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=ath-next&id=2615e3cdbd9c0e864f5906279c952a309871d225

Can you redo the patch to only change ath10k_wmi_event_tdls_peer()?

error: patch failed: drivers/net/wireless/ath/ath10k/wmi-tlv.c:240
error: drivers/net/wireless/ath/ath10k/wmi-tlv.c: patch does not apply
stg import: Diff does not apply cleanly

Patch set to Changes Requested.
Shuah Khan Feb. 10, 2021, 4:22 p.m. UTC | #2 
On 2/10/21 1:13 AM, Kalle Valo wrote:
> Shuah Khan <skhan@linuxfoundation.org> wrote:
> 
>> ieee80211_find_sta_by_ifaddr() must be called under the RCU lock and
>> the resulting pointer is only valid under RCU lock as well.
>>
>> Fix ath10k_wmi_tlv_parse_peer_stats_info() to hold RCU lock before it
>> calls ieee80211_find_sta_by_ifaddr() and release it when the resulting
>> pointer is no longer needed. The log below shows the problem.
>>
>> While at it, fix ath10k_wmi_tlv_op_pull_peer_stats_info() to do the same.
>>
>> =============================
>> WARNING: suspicious RCU usage
>> 5.11.0-rc7+ #20 Tainted: G        W
>> -----------------------------
>> include/linux/rhashtable.h:594 suspicious rcu_dereference_check() usage!
>> other info that might help us debug this:
>>                 rcu_scheduler_active = 2, debug_locks = 1
>> no locks held by ksoftirqd/5/44.
>>
>> stack backtrace:
>> CPU: 5 PID: 44 Comm: ksoftirqd/5 Tainted: G        W         5.11.0-rc7+ #20
>> Hardware name: LENOVO 10VGCTO1WW/3130, BIOS M1XKT45A 08/21/2019
>> Call Trace:
>>   dump_stack+0x7d/0x9f
>>   lockdep_rcu_suspicious+0xdb/0xe5
>>   __rhashtable_lookup+0x1eb/0x260 [mac80211]
>>   ieee80211_find_sta_by_ifaddr+0x5b/0xc0 [mac80211]
>>   ath10k_wmi_tlv_parse_peer_stats_info+0x3e/0x90 [ath10k_core]
>>   ath10k_wmi_tlv_iter+0x6a/0xc0 [ath10k_core]
>>   ? ath10k_wmi_tlv_op_pull_mgmt_tx_bundle_compl_ev+0xe0/0xe0 [ath10k_core]
>>   ath10k_wmi_tlv_op_rx+0x5da/0xda0 [ath10k_core]
>>   ? trace_hardirqs_on+0x54/0xf0
>>   ? ath10k_ce_completed_recv_next+0x4e/0x60 [ath10k_core]
>>   ath10k_wmi_process_rx+0x1d/0x40 [ath10k_core]
>>   ath10k_htc_rx_completion_handler+0x115/0x180 [ath10k_core]
>>   ath10k_pci_process_rx_cb+0x149/0x1b0 [ath10k_pci]
>>   ? ath10k_htc_process_trailer+0x2d0/0x2d0 [ath10k_core]
>>   ? ath10k_pci_sleep.part.0+0x6a/0x80 [ath10k_pci]
>>   ath10k_pci_htc_rx_cb+0x15/0x20 [ath10k_pci]
>>   ath10k_ce_per_engine_service+0x61/0x80 [ath10k_core]
>>   ath10k_ce_per_engine_service_any+0x7d/0xa0 [ath10k_core]
>>   ath10k_pci_napi_poll+0x48/0x120 [ath10k_pci]
>>   net_rx_action+0x136/0x500
>>   __do_softirq+0xc6/0x459
>>   ? smpboot_thread_fn+0x2b/0x1f0
>>   run_ksoftirqd+0x2b/0x60
>>   smpboot_thread_fn+0x116/0x1f0
>>   kthread+0x14b/0x170
>>   ? smpboot_register_percpu_thread+0xe0/0xe0
>>   ? __kthread_bind_mask+0x70/0x70
>>   ret_from_fork+0x22/0x30
>>
>> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
> 
> Unlucky timing also on this one, it conflicts with a patch I applied yesterday:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=ath-next&id=2615e3cdbd9c0e864f5906279c952a309871d225
> 
> Can you redo the patch to only change ath10k_wmi_event_tdls_peer()?
> 

Yes. I will send the patch just for ath10k_wmi_event_tdls_peer()
on top of your patch.

> error: patch failed: drivers/net/wireless/ath/ath10k/wmi-tlv.c:240
> error: drivers/net/wireless/ath/ath10k/wmi-tlv.c: patch does not apply
> stg import: Diff does not apply cleanly
> 
> Patch set to Changes Requested.
> 

thanks,
-- Shuah
diff mbox series

Patch

=============================
WARNING: suspicious RCU usage
5.11.0-rc7+ #20 Tainted: G        W
-----------------------------
include/linux/rhashtable.h:594 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
               rcu_scheduler_active = 2, debug_locks = 1
no locks held by ksoftirqd/5/44.

stack backtrace:
CPU: 5 PID: 44 Comm: ksoftirqd/5 Tainted: G        W         5.11.0-rc7+ #20
Hardware name: LENOVO 10VGCTO1WW/3130, BIOS M1XKT45A 08/21/2019
Call Trace:
 dump_stack+0x7d/0x9f
 lockdep_rcu_suspicious+0xdb/0xe5
 __rhashtable_lookup+0x1eb/0x260 [mac80211]
 ieee80211_find_sta_by_ifaddr+0x5b/0xc0 [mac80211]
 ath10k_wmi_tlv_parse_peer_stats_info+0x3e/0x90 [ath10k_core]
 ath10k_wmi_tlv_iter+0x6a/0xc0 [ath10k_core]
 ? ath10k_wmi_tlv_op_pull_mgmt_tx_bundle_compl_ev+0xe0/0xe0 [ath10k_core]
 ath10k_wmi_tlv_op_rx+0x5da/0xda0 [ath10k_core]
 ? trace_hardirqs_on+0x54/0xf0
 ? ath10k_ce_completed_recv_next+0x4e/0x60 [ath10k_core]
 ath10k_wmi_process_rx+0x1d/0x40 [ath10k_core]
 ath10k_htc_rx_completion_handler+0x115/0x180 [ath10k_core]
 ath10k_pci_process_rx_cb+0x149/0x1b0 [ath10k_pci]
 ? ath10k_htc_process_trailer+0x2d0/0x2d0 [ath10k_core]
 ? ath10k_pci_sleep.part.0+0x6a/0x80 [ath10k_pci]
 ath10k_pci_htc_rx_cb+0x15/0x20 [ath10k_pci]
 ath10k_ce_per_engine_service+0x61/0x80 [ath10k_core]
 ath10k_ce_per_engine_service_any+0x7d/0xa0 [ath10k_core]
 ath10k_pci_napi_poll+0x48/0x120 [ath10k_pci]
 net_rx_action+0x136/0x500
 __do_softirq+0xc6/0x459
 ? smpboot_thread_fn+0x2b/0x1f0
 run_ksoftirqd+0x2b/0x60
 smpboot_thread_fn+0x116/0x1f0
 kthread+0x14b/0x170
 ? smpboot_register_percpu_thread+0xe0/0xe0
 ? __kthread_bind_mask+0x70/0x70
 ret_from_fork+0x22/0x30

Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath10k/wmi-tlv.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index 7b5834157fe5..615157dd6866 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -225,6 +225,7 @@  static int ath10k_wmi_tlv_parse_peer_stats_info(struct ath10k *ar, u16 tag, u16
 	const struct wmi_tlv_peer_stats_info *stat = ptr;
 	struct ieee80211_sta *sta;
 	struct ath10k_sta *arsta;
+	int ret = 0;
 
 	if (tag != WMI_TLV_TAG_STRUCT_PEER_STATS_INFO)
 		return -EPROTO;
@@ -240,10 +241,12 @@  static int ath10k_wmi_tlv_parse_peer_stats_info(struct ath10k *ar, u16 tag, u16
 		   __le32_to_cpu(stat->last_tx_rate_code),
 		   __le32_to_cpu(stat->last_tx_bitrate_kbps));
 
+	rcu_read_lock();
 	sta = ieee80211_find_sta_by_ifaddr(ar->hw, stat->peer_macaddr.addr, NULL);
 	if (!sta) {
 		ath10k_warn(ar, "not found station for peer stats\n");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto exit;
 	}
 
 	arsta = (struct ath10k_sta *)sta->drv_priv;
@@ -252,7 +255,9 @@  static int ath10k_wmi_tlv_parse_peer_stats_info(struct ath10k *ar, u16 tag, u16
 	arsta->tx_rate_code = __le32_to_cpu(stat->last_tx_rate_code);
 	arsta->tx_bitrate_kbps = __le32_to_cpu(stat->last_tx_bitrate_kbps);
 
-	return 0;
+exit:
+	rcu_read_unlock();
+	return ret;
 }
 
 static int ath10k_wmi_tlv_op_pull_peer_stats_info(struct ath10k *ar,
@@ -573,13 +578,13 @@  static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb)
 	case WMI_TDLS_TEARDOWN_REASON_TX:
 	case WMI_TDLS_TEARDOWN_REASON_RSSI:
 	case WMI_TDLS_TEARDOWN_REASON_PTR_TIMEOUT:
+		rcu_read_lock();
 		station = ieee80211_find_sta_by_ifaddr(ar->hw,
 						       ev->peer_macaddr.addr,
 						       NULL);
 		if (!station) {
 			ath10k_warn(ar, "did not find station from tdls peer event");
-			kfree(tb);
-			return;
+			goto exit;
 		}
 		arvif = ath10k_get_arvif(ar, __le32_to_cpu(ev->vdev_id));
 		ieee80211_tdls_oper_request(
@@ -590,6 +595,8 @@  static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb)
 					);
 		break;
 	}
+exit:
+	rcu_read_unlock();
 	kfree(tb);
 }