wifi: ath12k: fix event locking

PATCH Superseded Johan Hovold 3 participants 6 messages Oct 19, 2023 – Oct 25, 2023

Subsystems (2)

Stable branch Qualcomm ATH12K wireless driver

lore

Share & tools

lore

Johan Hovold

author

2023-10-19 11:37 UTC #0 lore raw

cover wifi: ath12k: fix event locking

As was reported here:

	https://lore.kernel.org/lkml/[email protected]/
	https://lore.kernel.org/lkml/[email protected]/

RCU lockdep reported suspicious RCU usage in the ath11k temperature event handling code and code review revealed a few more handlers with similar problems.

Apparently these issues have also been reproduced in the ath12k driver.

Note that these were found through inspection and that this series has only been compile tested.

Johan

Johan Hovold (2):
wifi: ath12k: fix dfs-radar and temperature event locking
wifi: ath12k: fix htt mlo-offset event locking

 drivers/net/wireless/ath/ath12k/dp_rx.c | 7 +++++--
 drivers/net/wireless/ath/ath12k/wmi.c   | 8 +++++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

Signature · 1 line

2.41.0

Johan Hovold

author

2023-10-19 11:37 UTC #1 lore raw

PATCH 1/2 wifi: ath12k: fix dfs-radar and temperature event locking

The ath12k active pdevs are protected by RCU but the DFS-radar and temperature event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section.

Mark the code in question as RCU read-side critical sections to avoid any potential use-after-free issues.

Note that the temperature event handler looks like a place holder currently but would still trigger an RCU lockdep splat.

Fixes d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")

Cc [email protected] # v6.2

Signed-off-by Johan Hovold <[email protected]>

---
 drivers/net/wireless/ath/ath12k/wmi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

drivers/net/wireless/ath/ath12k/wmi.c +7 -1

index ef0f3cf35cfd..1a1f57c7ac7e 100644
@@ -6476,6 +6476,7 @@ ath12k_wmi_pdev_dfs_radar_detected_event(struct ath12k_base *ab, struct sk_buff
 		   ev->detector_id, ev->segment_id, ev->timestamp, ev->is_chirp,
 		   ev->freq_offset, ev->sidx);
 
+	rcu_read_lock();
 	ar = ath12k_mac_get_ar_by_pdev_id(ab, le32_to_cpu(ev->pdev_id));
 
 	if (!ar) {

@@ -6493,6 +6494,8 @@ ath12k_wmi_pdev_dfs_radar_detected_event(struct ath12k_base *ab, struct sk_buff
 		ieee80211_radar_detected(ar->hw);
 
 exit:
+	rcu_read_unlock();
+
 	kfree(tb);
 }

@@ -6511,11 +6514,14 @@ ath12k_wmi_pdev_temperature_event(struct ath12k_base *ab,
 	ath12k_dbg(ab, ATH12K_DBG_WMI,
 		   "pdev temperature ev temp %d pdev_id %d\n", ev.temp, ev.pdev_id);
 
+	rcu_read_lock();
 	ar = ath12k_mac_get_ar_by_pdev_id(ab, le32_to_cpu(ev.pdev_id));
 	if (!ar) {
 		ath12k_warn(ab, "invalid pdev id in pdev temperature ev %d", ev.pdev_id);
-		return;
+		goto exit;
 	}
+exit:
+	rcu_read_unlock();
 }
 
 static void ath12k_fils_discovery_event(struct ath12k_base *ab,

Signature · 1 line

2.41.0

Jeff Johnson

Acked-by on v1 1/2

2023-10-19 17:31 UTC #2 lore raw

Re: [PATCH 1/2] wifi: ath12k: fix dfs-radar and temperature event locking

Quoted 7 lines · Johan Hovold

The ath12k active pdevs are protected by RCU but the DFS-radar and temperature event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section.
Mark the code in question as RCU read-side critical sections to avoid any potential use-after-free issues.

Quoted 6 lines

Note that the temperature event handler looks like a place holder currently but would still trigger an RCU lockdep splat.
Fixes d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Cc [email protected] # v6.2
Signed-off-by Johan Hovold <[email protected]>

Acked-by Jeff Johnson <[email protected]>

Signature · 3 lines

ath12k mailing list
[email protected]
https://lists.infradead.org/mailman/listinfo/ath12k

Kalle Valo

2023-10-25 10:02 UTC #3 lore raw

Re: [PATCH 1/2] wifi: ath12k: fix dfs-radar and temperature event locking

In reply to Johan Hovold

Quoted 10 lines · Johan Hovold

The ath12k active pdevs are protected by RCU but the DFS-radar and temperature event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section.
Mark the code in question as RCU read-side critical sections to avoid any potential use-after-free issues.
Note that the temperature event handler looks like a place holder currently but would still trigger an RCU lockdep splat.

Quoted 7 lines

Compile tested only.
Fixes d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Cc [email protected] # v6.2
Signed-off-by Johan Hovold <[email protected]>
Acked-by Jeff Johnson <[email protected]>
Signed-off-by Kalle Valo <[email protected]>

2 patches applied to ath-next branch of ath.git, thanks.

69bd216e0493 wifi: ath12k: fix dfs-radar and temperature event locking 6afc57ea315e wifi: ath12k: fix htt mlo-offset event locking

Signature · 9 lines

https://patchwork.kernel.org/project/linux-wireless/patch/[email protected]/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches


-- 
ath12k mailing list
[email protected]
https://lists.infradead.org/mailman/listinfo/ath12k

Johan Hovold

author

2023-10-19 11:37 UTC #4 lore raw

PATCH 2/2 wifi: ath12k: fix htt mlo-offset event locking

In reply to Johan Hovold

The ath12k active pdevs are protected by RCU but the htt mlo-offset event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section.

Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues.

Fixes d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")

Cc [email protected] # v6.2

Signed-off-by Johan Hovold <[email protected]>

---
 drivers/net/wireless/ath/ath12k/dp_rx.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

drivers/net/wireless/ath/ath12k/dp_rx.c +5 -2

index e6e64d437c47..3294625650dc 100644
@@ -1641,11 +1641,12 @@ static void ath12k_htt_mlo_offset_event_handler(struct ath12k_base *ab,
 	msg = (struct ath12k_htt_mlo_offset_msg *)skb->data;
 	pdev_id = u32_get_bits(__le32_to_cpu(msg->info),
 			       HTT_T2H_MLO_OFFSET_INFO_PDEV_ID);
-	ar = ath12k_mac_get_ar_by_pdev_id(ab, pdev_id);
 
+	rcu_read_lock();
+	ar = ath12k_mac_get_ar_by_pdev_id(ab, pdev_id);
 	if (!ar) {
 		ath12k_warn(ab, "invalid pdev id %d on htt mlo offset\n", pdev_id);
-		return;
+		goto exit;
 	}
 
 	spin_lock_bh(&ar->data_lock);

@@ -1661,6 +1662,8 @@ static void ath12k_htt_mlo_offset_event_handler(struct ath12k_base *ab,
 	pdev->timestamp.mlo_comp_timer = __le32_to_cpu(msg->mlo_comp_timer);
 
 	spin_unlock_bh(&ar->data_lock);
+exit:
+	rcu_read_unlock();
 }
 
 void ath12k_dp_htt_htc_t2h_msg_handler(struct ath12k_base *ab,

Signature · 1 line

2.41.0

Jeff Johnson

Acked-by on v1 2/2

2023-10-19 17:33 UTC #5 lore raw

Re: [PATCH 2/2] wifi: ath12k: fix htt mlo-offset event locking

Quoted 10 lines · Johan Hovold

The ath12k active pdevs are protected by RCU but the htt mlo-offset event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section.
Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues.
Fixes d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Cc [email protected] # v6.2
Signed-off-by Johan Hovold <[email protected]>

Acked-by Jeff Johnson <[email protected]>

Signature · 3 lines

ath12k mailing list
[email protected]
https://lists.infradead.org/mailman/listinfo/ath12k