mt76: fix schedule while atomic in mt76x02_reset_state

PATCH Superseded Lorenzo Bianconi 3 participants 3 messages Mar 10, 2019 – Mar 11, 2019 1 message not in the archive

Subsystems (2)

Arm MediaTek MediaTek MT76 wireless LAN driver

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Lorenzo Bianconi

author maintainer

2019-03-10 22:47 UTC #1 lore raw

PATCH 1/1 mt76: fix schedule while atomic in mt76x02_reset_state

Fix following schedule while atomic mt76x02_reset_state since synchronize_rcu is run inside a RCU section

[44036.944222] mt76x2e 0000:06:00.0: MCU message 31 (seq 3) timed out
[44036.944281] BUG: sleeping function called from invalid context at kernel/rcu/tree_exp.h:818
[44036.944284] in_atomic(): 1, irqs_disabled(): 0, pid: 28066, name: kworker/u4:1
[44036.944287] INFO: lockdep is turned off.
[44036.944292] CPU: 1 PID: 28066 Comm: kworker/u4:1 Tainted: G        W         5.0.0-rc7-wdn-t1+ #7
[44036.944294] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
[44036.944305] Workqueue: phy1 mt76x02_wdt_work [mt76x02_lib]
[44036.944308] Call Trace:
[44036.944317]  dump_stack+0x67/0x90
[44036.944322]  ___might_sleep.cold.88+0x9f/0xaf
[44036.944327]  rcu_blocking_is_gp+0x13/0x50
[44036.944330]  synchronize_rcu+0x17/0x80
[44036.944337]  mt76_sta_state+0x138/0x1d0 [mt76]
[44036.944349]  mt76x02_wdt_work+0x1c9/0x610 [mt76x02_lib]
[44036.944355]  process_one_work+0x2a5/0x620
[44036.944361]  worker_thread+0x35/0x3e0
[44036.944368]  kthread+0x11c/0x140
[44036.944376]  ret_from_fork+0x3a/0x50
[44036.944384] BUG: scheduling while atomic: kworker/u4:1/28066/0x00000002
[44036.944387] INFO: lockdep is turned off.
[44036.944389] Modules linked in: cmac ctr ccm af_packet snd_hda_codec_hdmi

Introduce __mt76_sta_remove in order to run sta_remove without holding dev->mutex. Move __mt76_sta_remove outside RCU section in mt76x02_reset_state

Fixes e4ebb8b403d1 ("mt76: mt76x2: implement full device restart on watchdog reset")

Signed-off-by Lorenzo Bianconi <[email protected]>

---
 drivers/net/wireless/mediatek/mt76/mac80211.c  | 18 +++++++++++-------
 drivers/net/wireless/mediatek/mt76/mt76.h      |  2 ++
 .../net/wireless/mediatek/mt76/mt76x02_mmio.c  | 14 ++++++--------
 3 files changed, 19 insertions(+), 15 deletions(-)

drivers/net/wireless/mediatek/mt76/mac80211.c +11 -7

index a033745adb2f..bde52943ecaf 100644
@@ -679,19 +679,15 @@ mt76_sta_add(struct mt76_dev *dev, struct ieee80211_vif *vif,
 	return ret;
 }
 
-static void
-mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
-	        struct ieee80211_sta *sta)
+void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+		       struct ieee80211_sta *sta)
 {
 	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
-	int idx = wcid->idx;
-	int i;
+	int i, idx = wcid->idx;
 
 	rcu_assign_pointer(dev->wcid[idx], NULL);
 	synchronize_rcu();
 
-	mutex_lock(&dev->mutex);
-
 	if (dev->drv->sta_remove)
 		dev->drv->sta_remove(dev, vif, sta);

@@ -699,7 +695,15 @@ mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
 	for (i = 0; i < ARRAY_SIZE(sta->txq); i++)
 		mt76_txq_remove(dev, sta->txq[i]);
 	mt76_wcid_free(dev->wcid_mask, idx);
+}
+EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 
+static void
+mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+	        struct ieee80211_sta *sta)
+{
+	mutex_lock(&dev->mutex);
+	__mt76_sta_remove(dev, vif, sta);
 	mutex_unlock(&dev->mutex);
 }

drivers/net/wireless/mediatek/mt76/mt76.h +2 -0

index 477027bb9aaf..eb72e4bf3db6 100644
@@ -697,6 +697,8 @@ int mt76_sta_state(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 		   struct ieee80211_sta *sta,
 		   enum ieee80211_sta_state old_state,
 		   enum ieee80211_sta_state new_state);
+void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+		       struct ieee80211_sta *sta);
 
 struct ieee80211_sta *mt76_rx_convert(struct sk_buff *skb);

drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +6 -8

index 6a34a6afcfe4..898afcbcdf52 100644
@@ -419,6 +419,7 @@ static void mt76x02_key_sync(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	mt76x02_mac_wcid_sync_pn(dev, wcid->idx, key);
 }
 
+/* need to run with mt76.mutex held */
 static void mt76x02_reset_state(struct mt76x02_dev *dev)
 {
 	int i;

@@ -426,11 +427,11 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev)
 	clear_bit(MT76_STATE_RUNNING, &dev->mt76.state);
 
 	rcu_read_lock();
-
 	ieee80211_iter_keys_rcu(dev->mt76.hw, NULL, mt76x02_key_sync, NULL);
+	rcu_read_unlock();
 
 	for (i = 0; i < ARRAY_SIZE(dev->mt76.wcid); i++) {
-		struct mt76_wcid *wcid = rcu_dereference(dev->mt76.wcid[i]);
+		struct mt76_wcid *wcid = dev->mt76.wcid[i];
 		struct mt76x02_sta *msta;
 		struct ieee80211_sta *sta;
 		struct ieee80211_vif *vif;

@@ -445,13 +446,10 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev)
 		priv = msta->vif;
 		vif = container_of(priv, struct ieee80211_vif, drv_priv);
 
-		mt76_sta_state(dev->mt76.hw, vif, sta,
-			       IEEE80211_STA_NONE, IEEE80211_STA_NOTEXIST);
+		__mt76_sta_remove(&dev->mt76, vif, sta);
 		memset(msta, 0, sizeof(*msta));
 	}
 
-	rcu_read_unlock();
-
 	dev->vif_mask = 0;
 	dev->beacon_mask = 0;
 }

@@ -471,11 +469,11 @@ static void mt76x02_watchdog_reset(struct mt76x02_dev *dev)
 	for (i = 0; i < ARRAY_SIZE(dev->mt76.napi); i++)
 		napi_disable(&dev->mt76.napi[i]);
 
+	mutex_lock(&dev->mt76.mutex);
+
 	if (restart)
 		mt76x02_reset_state(dev);
 
-	mutex_lock(&dev->mt76.mutex);
-
 	if (dev->beacon_mask)
 		mt76_clear(dev, MT_BEACON_TIME_CFG,
 			   MT_BEACON_TIME_CFG_BEACON_TX |

Signature · 1 line

2.20.1

Felix Fietkau

maintainer

2019-03-11 10:07 UTC #2 lore raw

Quoted 35 lines · Lorenzo Bianconi

Fix following schedule while atomic mt76x02_reset_state since synchronize_rcu is run inside a RCU section

[44036.944222] mt76x2e 0000:06:00.0: MCU message 31 (seq 3) timed out
[44036.944281] BUG: sleeping function called from invalid context at kernel/rcu/tree_exp.h:818
[44036.944284] in_atomic(): 1, irqs_disabled(): 0, pid: 28066, name: kworker/u4:1
[44036.944287] INFO: lockdep is turned off.
[44036.944292] CPU: 1 PID: 28066 Comm: kworker/u4:1 Tainted: G        W         5.0.0-rc7-wdn-t1+ #7
[44036.944294] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
[44036.944305] Workqueue: phy1 mt76x02_wdt_work [mt76x02_lib]
[44036.944308] Call Trace:
[44036.944317]  dump_stack+0x67/0x90
[44036.944322]  ___might_sleep.cold.88+0x9f/0xaf
[44036.944327]  rcu_blocking_is_gp+0x13/0x50
[44036.944330]  synchronize_rcu+0x17/0x80
[44036.944337]  mt76_sta_state+0x138/0x1d0 [mt76]
[44036.944349]  mt76x02_wdt_work+0x1c9/0x610 [mt76x02_lib]
[44036.944355]  process_one_work+0x2a5/0x620
[44036.944361]  worker_thread+0x35/0x3e0
[44036.944368]  kthread+0x11c/0x140
[44036.944376]  ret_from_fork+0x3a/0x50
[44036.944384] BUG: scheduling while atomic: kworker/u4:1/28066/0x00000002
[44036.944387] INFO: lockdep is turned off.
[44036.944389] Modules linked in: cmac ctr ccm af_packet snd_hda_codec_hdmi

Introduce __mt76_sta_remove in order to run sta_remove without holding dev->mutex. Move __mt76_sta_remove outside RCU section in mt76x02_reset_state

Fixes e4ebb8b403d1 ("mt76: mt76x2: implement full device restart on watchdog reset")

Signed-off-by Lorenzo Bianconi <[email protected]>

drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +0 -0

index 6a34a6afcfe4..898afcbcdf52 100644

drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c static void mt76x02_key_sync(struct ieee80211_hw *hw, struct ieee80211_vif *vif, · line 423

Quoted 5 lines

drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +1 -0

@@ -419,6 +419,7 @@ static void mt76x02_key_sync(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	mt76x02_mac_wcid_sync_pn(dev, wcid->idx, key);
 }
 
+/* need to run with mt76.mutex held */
 static void mt76x02_reset_state(struct mt76x02_dev *dev)

You can replace that comment with a call to lockdep_assert_held in the function.

drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c static void mt76x02_reset_state(struct mt76x02_dev *dev) · line 434

Quoted 11 lines

drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +2 -2

@@ -426,11 +427,11 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev)
 	clear_bit(MT76_STATE_RUNNING, &dev->mt76.state);
 
 	rcu_read_lock();
-
 	ieee80211_iter_keys_rcu(dev->mt76.hw, NULL, mt76x02_key_sync, NULL);
+	rcu_read_unlock();
 
 	for (i = 0; i < ARRAY_SIZE(dev->mt76.wcid); i++) {
-		struct mt76_wcid *wcid = rcu_dereference(dev->mt76.wcid[i]);
+		struct mt76_wcid *wcid = dev->mt76.wcid[i];

This should use rcu_dereference_protected() instead of accessing the pointer directly.

Thanks,

- Felix

Lorenzo Bianconi

2019-03-11 10:11 UTC #3 lore raw

Quoted 52 lines · Lorenzo Bianconi

Quoted 35 lines
Fix following schedule while atomic mt76x02_reset_state since synchronize_rcu is run inside a RCU section
[44036.944222] mt76x2e 0000:06:00.0: MCU message 31 (seq 3) timed out
[44036.944281] BUG: sleeping function called from invalid context at kernel/rcu/tree_exp.h:818
[44036.944284] in_atomic(): 1, irqs_disabled(): 0, pid: 28066, name: kworker/u4:1
[44036.944287] INFO: lockdep is turned off.
[44036.944292] CPU: 1 PID: 28066 Comm: kworker/u4:1 Tainted: G        W         5.0.0-rc7-wdn-t1+ #7
[44036.944294] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
[44036.944305] Workqueue: phy1 mt76x02_wdt_work [mt76x02_lib]
[44036.944308] Call Trace:
[44036.944317]  dump_stack+0x67/0x90
[44036.944322]  ___might_sleep.cold.88+0x9f/0xaf
[44036.944327]  rcu_blocking_is_gp+0x13/0x50
[44036.944330]  synchronize_rcu+0x17/0x80
[44036.944337]  mt76_sta_state+0x138/0x1d0 [mt76]
[44036.944349]  mt76x02_wdt_work+0x1c9/0x610 [mt76x02_lib]
[44036.944355]  process_one_work+0x2a5/0x620
[44036.944361]  worker_thread+0x35/0x3e0
[44036.944368]  kthread+0x11c/0x140
[44036.944376]  ret_from_fork+0x3a/0x50
[44036.944384] BUG: scheduling while atomic: kworker/u4:1/28066/0x00000002
[44036.944387] INFO: lockdep is turned off.
[44036.944389] Modules linked in: cmac ctr ccm af_packet snd_hda_codec_hdmi
Introduce __mt76_sta_remove in order to run sta_remove without holding dev->mutex. Move __mt76_sta_remove outside RCU section in mt76x02_reset_state
Fixes e4ebb8b403d1 ("mt76: mt76x2: implement full device restart on watchdog reset")
Signed-off-by Lorenzo Bianconi <[email protected]>
drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +0 -0
index 6a34a6afcfe4..898afcbcdf52 100644
drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c static void mt76x02_key_sync(struct ieee80211_hw *hw, struct ieee80211_vif *vif, · line 423
Quoted 5 lines
drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +1 -0
@@ -419,6 +419,7 @@ static void mt76x02_key_sync(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	mt76x02_mac_wcid_sync_pn(dev, wcid->idx, key);
 }
 
+/* need to run with mt76.mutex held */
 static void mt76x02_reset_state(struct mt76x02_dev *dev)
You can replace that comment with a call to lockdep_assert_held in the function.
Quoted 8 lines
drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +1 -1
@@ -426,11 +427,11 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev)
 	clear_bit(MT76_STATE_RUNNING, &dev->mt76.state);
 
 	rcu_read_lock();
-
 	ieee80211_iter_keys_rcu(dev->mt76.hw, NULL, mt76x02_key_sync, NULL);
+	rcu_read_unlock();
 

Quoted 6 lines

drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c static void mt76x02_reset_state(struct mt76x02_dev *dev) · line 434
Quoted 3 lines
drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +1 -1
 	for (i = 0; i < ARRAY_SIZE(dev->mt76.wcid); i++) {
-		struct mt76_wcid *wcid = rcu_dereference(dev->mt76.wcid[i]);
+		struct mt76_wcid *wcid = dev->mt76.wcid[i];
This should use rcu_dereference_protected() instead of accessing the pointer directly.

ack, I will fix them in v2.

Regards,
Lorenzo

Quoted 3 lines

Thanks,
- Felix