• Vasanthakumar Thiagarajan's avatar
    ath10k: fix kernel panic due to race in accessing arvif list · ebaa4b16
    Vasanthakumar Thiagarajan authored
    arvifs list is traversed within data_lock spin_lock in tasklet
    context to fill channel information from the corresponding vif.
    This means any access to arvifs list for add/del operations
    should also be protected with the same spin_lock to avoid the
    race. Fix this by performing list add/del on arvfis within the
    data_lock. This could fix kernel panic something like the below.
    
     LR is at ath10k_htt_rx_pktlog_completion_handler+0x100/0xb6c [ath10k_core]
     PC is at ath10k_htt_rx_pktlog_completion_handler+0x1c0/0xb6c [ath10k_core]
     Internal error: Oops: 17 [#1] PREEMPT SMP ARM
     [<bf4857f4>] (ath10k_htt_rx_pktlog_completion_handler+0x2f4/0xb6c [ath10k_core])
     [<bf487540>] (ath10k_htt_txrx_compl_task+0x8b4/0x1188 [ath10k_core])
     [<c00312d4>] (tasklet_action+0x8c/0xec)
     [<c00309a8>] (__do_softirq+0xdc/0x208)
     [<c0030d6c>] (irq_exit+0x84/0xe0)
     [<c005db04>] (__handle_domain_irq+0x80/0xa0)
     [<c00085c4>] (gic_handle_irq+0x38/0x5c)
     [<c0009640>] (__irq_svc+0x40/0x74)
    
    (gdb) list *(ath10k_htt_rx_pktlog_completion_handler+0x1c0)
    0x136c0 is in ath10k_htt_rx_h_channel (drivers/net/wireless/ath/ath10k/htt_rx.c:769)
    764		struct cfg80211_chan_def def;
    765
    766		lockdep_assert_held(&ar->data_lock);
    767
    768		list_for_each_entry(arvif, &ar->arvifs, list) {
    769			if (arvif->vdev_id == vdev_id &&
    770			    ath10k_mac_vif_chan(arvif->vif, &def) == 0)
    771				return def.chan;
    772		}
    773
    Signed-off-by: default avatarVasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
    Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
    ebaa4b16
mac.c 206 KB