mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-22 06:57:57 +00:00
47 lines
2.1 KiB
Diff
47 lines
2.1 KiB
Diff
From aa40d5a43526cca9439a2b45fcfdcd016594dece Mon Sep 17 00:00:00 2001
|
|
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
|
|
Date: Sun, 17 Jul 2022 21:21:52 +0900
|
|
Subject: [PATCH] wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
lockdep complains use of uninitialized spinlock at ieee80211_do_stop() [1],
|
|
for commit f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif
|
|
that is being stopped") guards clear_bit() using fq.lock even before
|
|
fq_init() from ieee80211_txq_setup_flows() initializes this spinlock.
|
|
|
|
According to discussion [2], Toke was not happy with expanding usage of
|
|
fq.lock. Since __ieee80211_wake_txqs() is called under RCU read lock, we
|
|
can instead use synchronize_rcu() for flushing ieee80211_wake_txqs().
|
|
|
|
Link: https://syzkaller.appspot.com/bug?extid=eceab52db7c4b961e9d6 [1]
|
|
Link: https://lkml.kernel.org/r/874k0zowh2.fsf@toke.dk [2]
|
|
Reported-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
|
|
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
|
|
Fixes: f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
|
|
Tested-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
|
|
Acked-by: Toke Høiland-Jørgensen <toke@kernel.org>
|
|
Signed-off-by: Kalle Valo <kvalo@kernel.org>
|
|
Link: https://lore.kernel.org/r/9cc9b81d-75a3-3925-b612-9d0ad3cab82b@I-love.SAKURA.ne.jp
|
|
[ pick up commit 3598cb6e1862 ("wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()") from -next]
|
|
Link: https://lore.kernel.org/all/87o7xcq6qt.fsf@kernel.org/
|
|
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
---
|
|
net/mac80211/iface.c | 3 +--
|
|
1 file changed, 1 insertion(+), 2 deletions(-)
|
|
|
|
--- a/net/mac80211/iface.c
|
|
+++ b/net/mac80211/iface.c
|
|
@@ -377,9 +377,8 @@ static void ieee80211_do_stop(struct iee
|
|
bool cancel_scan;
|
|
struct cfg80211_nan_func *func;
|
|
|
|
- spin_lock_bh(&local->fq.lock);
|
|
clear_bit(SDATA_STATE_RUNNING, &sdata->state);
|
|
- spin_unlock_bh(&local->fq.lock);
|
|
+ synchronize_rcu(); /* flush _ieee80211_wake_txqs() */
|
|
|
|
cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
|
|
if (cancel_scan)
|