Skip to contentSkip to conversation

ath11k: fix a locking bug in ath11k_mac_op_start()

PATCH In review Dan Carpenter 2 participants 5 messages Feb 2, 2021 – Feb 10, 2021

Subsystems (2)
Kernel janitors Qualcomm Atheros ATH11K wireless driver
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH v2 1/1 ath11k: fix a locking bug in ath11k_mac_op_start()

This error path leads to a Smatch warning:

	drivers/net/wireless/ath/ath11k/mac.c:4269 ath11k_mac_op_start()
	error: double unlocked '&ar->conf_mutex' (orig line 4251)

We're not holding the lock when we do the "goto err;" so it leads to a double unlock. The fix is to hold the lock for a little longer.

Fixes c83c500b55b6 ("ath11k: enable idle power save mode")
Signed-off-by Dan Carpenter <[email protected]>

---
v2: reviewers were concern that v1 was racy

 drivers/net/wireless/ath/ath11k/mac.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +3 -2
index c1608f64ea95..464d3425488b 100644
@@ -4248,8 +4248,6 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
 	/* Configure the hash seed for hash based reo dest ring selection */
 	ath11k_wmi_pdev_lro_cfg(ar, ar->pdev->pdev_id);
 
-	mutex_unlock(&ar->conf_mutex);
-
 	rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx],
 			   &ab->pdevs[ar->pdev_idx]);
 

@@ -4262,6 +4260,9 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
 			goto err;
 		}
 	}
+
+	mutex_unlock(&ar->conf_mutex);
+
 	return 0;
 
 err:
Signature · 1 line
2.30.0
#1 lore raw
Quoted 41 lines · Dan Carpenter

This error path leads to a Smatch warning:

	drivers/net/wireless/ath/ath11k/mac.c:4269 ath11k_mac_op_start()
	error: double unlocked '&ar->conf_mutex' (orig line 4251)

We're not holding the lock when we do the "goto err;" so it leads to a double unlock. The fix is to hold the lock for a little longer.

Fixes c83c500b55b6 ("ath11k: enable idle power save mode")
Signed-off-by Dan Carpenter <[email protected]>

---
v2: reviewers were concern that v1 was racy

 drivers/net/wireless/ath/ath11k/mac.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +3 -2
index c1608f64ea95..464d3425488b 100644
@@ -4248,8 +4248,6 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
 	/* Configure the hash seed for hash based reo dest ring selection */
 	ath11k_wmi_pdev_lro_cfg(ar, ar->pdev->pdev_id);
 
-	mutex_unlock(&ar->conf_mutex);
-
 	rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx],
 			   &ab->pdevs[ar->pdev_idx]);
 

@@ -4262,6 +4260,9 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
 			goto err;
 		}
 	}
+
+	mutex_unlock(&ar->conf_mutex);
+
 	return 0;
 
 err:
Signature · 1 line
2.30.0

But now rcu_assign_pointer() is called while conf_mutex is held, previously it was not. I didn't check if this creates problems, but just to be on the safe side I modified your patch to keep the original functionality. Please check my changes in the pending branch:

https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=pending&idŽff3667c211072a2107271139b81cbf8c7fd10a

Signature · 3 lines
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
author
#2 lore raw
Quoted 49 lines · Kalle Valo
Quoted 41 lines · Dan Carpenter

This error path leads to a Smatch warning:

	drivers/net/wireless/ath/ath11k/mac.c:4269 ath11k_mac_op_start()
	error: double unlocked '&ar->conf_mutex' (orig line 4251)

We're not holding the lock when we do the "goto err;" so it leads to a double unlock. The fix is to hold the lock for a little longer.

Fixes c83c500b55b6 ("ath11k: enable idle power save mode")
Signed-off-by Dan Carpenter <[email protected]>

---
v2: reviewers were concern that v1 was racy

 drivers/net/wireless/ath/ath11k/mac.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +3 -2
index c1608f64ea95..464d3425488b 100644
@@ -4248,8 +4248,6 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
 	/* Configure the hash seed for hash based reo dest ring selection */
 	ath11k_wmi_pdev_lro_cfg(ar, ar->pdev->pdev_id);
 
-	mutex_unlock(&ar->conf_mutex);
-
 	rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx],
 			   &ab->pdevs[ar->pdev_idx]);
 

@@ -4262,6 +4260,9 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
 			goto err;
 		}
 	}
+
+	mutex_unlock(&ar->conf_mutex);
+
 	return 0;
 
 err:
Signature · 1 line
2.30.0

But now rcu_assign_pointer() is called while conf_mutex is held, previously it was not. I didn't check if this creates problems, but just to be on the safe side I modified your patch to keep the original functionality. Please check my changes in the pending branch:

Quoted 2 lines

https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=pending&idŽff3667c211072a2107271139b81cbf8c7fd10a

I don't think the assignment is a problem, but I'm also fine with the way you modified the patch. Thanks!

regards,
dan carpenter

#3 lore raw
In reply to Dan Carpenter
Quoted 5 lines · Dan Carpenter

This error path leads to a Smatch warning:

	drivers/net/wireless/ath/ath11k/mac.c:4269 ath11k_mac_op_start()
	error: double unlocked '&ar->conf_mutex' (orig line 4251)
Quoted 7 lines

We're not holding the lock when we do the "goto err;" so it leads to a double unlock. The fix is to hold the lock for a little longer.

Fixes c83c500b55b6 ("ath11k: enable idle power save mode")
Signed-off-by Dan Carpenter <[email protected]>
[[email protected]: move also rcu_assign_pointer() call]
Signed-off-by Kalle Valo <[email protected]>

Patch applied to ath-next branch of ath.git, thanks.

c202e2ebe1dc ath11k: fix a locking bug in ath11k_mac_op_start()

Signature · 3 lines
https://patchwork.kernel.org/project/linux-wireless/patch/YBk4GoeE+yc0wlJH@mwanda/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
#4 lore raw
In reply to Dan Carpenter
Quoted 5 lines · Dan Carpenter

This error path leads to a Smatch warning:

	drivers/net/wireless/ath/ath11k/mac.c:4269 ath11k_mac_op_start()
	error: double unlocked '&ar->conf_mutex' (orig line 4251)
Quoted 7 lines

We're not holding the lock when we do the "goto err;" so it leads to a double unlock. The fix is to hold the lock for a little longer.

Fixes c83c500b55b6 ("ath11k: enable idle power save mode")
Signed-off-by Dan Carpenter <[email protected]>
[[email protected]: move also rcu_assign_pointer() call]
Signed-off-by Kalle Valo <[email protected]>

Patch applied to ath-next branch of ath.git, thanks.

c202e2ebe1dc ath11k: fix a locking bug in ath11k_mac_op_start()

Signature · 9 lines
https://patchwork.kernel.org/project/linux-wireless/patch/YBk4GoeE+yc0wlJH@mwanda/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches


-- 
ath11k mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/ath11k