From: Greg KH <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Gary Morain <gmorain@google.com>,
Paul Stewart <pstew@google.com>,
Abhijit Pradhan <abhijit@qca.qualcomm.com>,
Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>,
Rajkumar Manoharan <rmanohar@qca.qualcomm.com>,
Johannes Berg <johannes.berg@intel.com>,
Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>,
"John W. Linville" <linville@tuxdriver.com>
Subject: [ 06/72] mac80211: Fix a rwlock bad magic bug
Date: Mon, 27 Feb 2012 17:04:35 -0800 [thread overview]
Message-ID: <20120228010429.937533618@linuxfoundation.org> (raw)
In-Reply-To: <20120228010511.GA8453@kroah.com>
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
commit b57e6b560fc2a2742910ac5ca0eb2c46e45aeac2 upstream.
read_lock(&tpt_trig->trig.leddev_list_lock) is accessed via the path
ieee80211_open (->) ieee80211_do_open (->) ieee80211_mod_tpt_led_trig
(->) ieee80211_start_tpt_led_trig (->) tpt_trig_timer before initializing
it.
the intilization of this read/write lock happens via the path
ieee80211_led_init (->) led_trigger_register, but we are doing
'ieee80211_led_init' after 'ieeee80211_if_add' where we
register netdev_ops.
so we access leddev_list_lock before initializing it and causes the
following bug in chrome laptops with AR928X cards with the following
script
while true
do
sudo modprobe -v ath9k
sleep 3
sudo modprobe -r ath9k
sleep 3
done
BUG: rwlock bad magic on CPU#1, wpa_supplicant/358, f5b9eccc
Pid: 358, comm: wpa_supplicant Not tainted 3.0.13 #1
Call Trace:
[<8137b9df>] rwlock_bug+0x3d/0x47
[<81179830>] do_raw_read_lock+0x19/0x29
[<8137f063>] _raw_read_lock+0xd/0xf
[<f9081957>] tpt_trig_timer+0xc3/0x145 [mac80211]
[<f9081f3a>] ieee80211_mod_tpt_led_trig+0x152/0x174 [mac80211]
[<f9076a3f>] ieee80211_do_open+0x11e/0x42e [mac80211]
[<f9075390>] ? ieee80211_check_concurrent_iface+0x26/0x13c [mac80211]
[<f9076d97>] ieee80211_open+0x48/0x4c [mac80211]
[<812dbed8>] __dev_open+0x82/0xab
[<812dc0c9>] __dev_change_flags+0x9c/0x113
[<812dc1ae>] dev_change_flags+0x18/0x44
[<8132144f>] devinet_ioctl+0x243/0x51a
[<81321ba9>] inet_ioctl+0x93/0xac
[<812cc951>] sock_ioctl+0x1c6/0x1ea
[<812cc78b>] ? might_fault+0x20/0x20
[<810b1ebb>] do_vfs_ioctl+0x46e/0x4a2
[<810a6ebb>] ? fget_light+0x2f/0x70
[<812ce549>] ? sys_recvmsg+0x3e/0x48
[<810b1f35>] sys_ioctl+0x46/0x69
[<8137fa77>] sysenter_do_call+0x12/0x2
Cc: Gary Morain <gmorain@google.com>
Cc: Paul Stewart <pstew@google.com>
Cc: Abhijit Pradhan <abhijit@qca.qualcomm.com>
Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Acked-by: Johannes Berg <johannes.berg@intel.com>
Tested-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -885,6 +885,8 @@ int ieee80211_register_hw(struct ieee802
wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
result);
+ ieee80211_led_init(local);
+
rtnl_lock();
result = ieee80211_init_rate_ctrl_alg(local,
@@ -906,8 +908,6 @@ int ieee80211_register_hw(struct ieee802
rtnl_unlock();
- ieee80211_led_init(local);
-
local->network_latency_notifier.notifier_call =
ieee80211_max_network_latency;
result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
next prev parent reply other threads:[~2012-02-28 1:23 UTC|newest]
Thread overview: 101+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-02-28 1:05 [ 00/72] 3.2.9-stable review Greg KH
2012-02-28 1:04 ` [ 01/72] Security: tomoyo: add .gitignore file Greg KH
2012-02-28 1:04 ` [ 02/72] powerpc/perf: power_pmu_start restores incorrect values, breaking frequency events Greg KH
2012-02-28 1:04 ` [ 03/72] ARM: at91: USB AT91 gadget registration for module Greg KH
2012-02-28 1:04 ` [ 04/72] drm/radeon/kms: fix MSI re-arm on rv370+ Greg KH
2012-02-28 1:04 ` [ 05/72] PCI: workaround hard-wired bus number V2 Greg KH
2012-02-28 1:04 ` Greg KH [this message]
2012-02-28 1:04 ` [ 07/72] ipheth: Add iPhone 4S Greg KH
2012-02-28 1:04 ` [ 08/72] regmap: Fix cache defaults initialization from raw cache defaults Greg KH
2012-02-28 1:04 ` [ 09/72] eCryptfs: Copy up lower inode attrs after setting lower xattr Greg KH
2012-02-28 1:04 ` [ 10/72] S390: correct ktime to tod clock comparator conversion Greg KH
2012-02-28 1:04 ` [ 11/72] vfs: fix d_inode_lookup() dentry ref leak Greg KH
2012-02-28 1:04 ` [ 12/72] ARM: 7326/2: PL330: fix null pointer dereference in pl330_chan_ctrl() Greg KH
2012-02-28 2:29 ` Mans Rullgard
2012-02-28 8:44 ` Russell King
2012-02-28 9:33 ` Javi Merino
2012-02-28 11:36 ` Mans Rullgard
2012-02-28 1:04 ` [ 13/72] ALSA: hda - Fix redundant jack creations for cx5051 Greg KH
2012-02-28 1:04 ` [ 14/72] mmc: core: check for zero length ioctl data Greg KH
2012-02-28 1:04 ` [ 15/72] NFSv4: Fix an Oops in the NFSv4 getacl code Greg KH
2012-02-28 1:04 ` [ 16/72] NFSv4: Ensure we throw out bad delegation stateids on NFS4ERR_BAD_STATEID Greg KH
2012-02-28 1:04 ` [ 17/72] NFSv4: fix server_scope memory leak Greg KH
2012-02-28 1:04 ` [ 18/72] ARM: 7321/1: cache-v7: Disable preemption when reading CCSIDR Greg KH
2012-02-28 1:04 ` [ 19/72] ARM: 7325/1: fix v7 boot with lockdep enabled Greg KH
2012-02-28 1:04 ` [ 20/72] 3c59x: shorten timer period for slave devices Greg KH
2012-02-28 1:04 ` [ 21/72] net: Dont proxy arp respond if iif == rt->dst.dev if private VLAN is disabled Greg KH
2012-02-28 1:04 ` [ 22/72] netpoll: netpoll_poll_dev() should access dev->flags Greg KH
2012-02-28 1:04 ` [ 23/72] net_sched: Bug in netem reordering Greg KH
2012-02-28 1:04 ` [ 24/72] veth: Enforce minimum size of VETH_INFO_PEER Greg KH
2012-02-28 1:04 ` [ 25/72] via-velocity: S3 resume fix Greg KH
2012-02-28 1:04 ` [ 26/72] ipv4: reset flowi parameters on route connect Greg KH
2012-02-28 1:04 ` [ 27/72] tcp_v4_send_reset: binding oif to iif in no sock case Greg KH
2012-02-28 1:04 ` [ 28/72] ipv4: Fix wrong order of ip_rt_get_source() and update iph->daddr Greg KH
2012-02-28 1:04 ` [ 29/72] net: Make qdisc_skb_cb upper size bound explicit Greg KH
2012-02-28 1:04 ` [ 30/72] IPoIB: Stop lying about hard_header_len and use skb->cb to stash LL addresses Greg KH
2012-02-28 1:05 ` [ 31/72] gro: more generic L2 header check Greg KH
2012-02-28 1:05 ` [ 32/72] tcp: allow tcp_sacktag_one() to tag ranges not aligned with skbs Greg KH
2012-02-28 1:05 ` [ 33/72] tcp: fix range tcp_shifted_skb() passes to tcp_sacktag_one() Greg KH
2012-02-28 1:05 ` [ 34/72] tcp: fix tcp_shifted_skb() adjustment of lost_cnt_hint for FACK Greg KH
2012-02-28 1:05 ` [ 35/72] USB: Added Kamstrup VID/PIDs to cp210x serial driver Greg KH
2012-02-28 1:05 ` [ 36/72] USB: option: cleanup zte 3g-dongles pid in option.c Greg KH
2012-02-28 1:05 ` [ 37/72] USB: Serial: ti_usb_3410_5052: Add Abbot Diabetes Care cable id Greg KH
2012-02-28 1:05 ` [ 38/72] USB: Remove duplicate USB 3.0 hub feature #defines Greg KH
2012-02-28 1:05 ` [ 39/72] USB: Fix handoff when BIOS disables host PCI device Greg KH
2012-02-28 1:05 ` [ 40/72] xhci: Fix oops caused by more USB2 ports than USB3 ports Greg KH
2012-02-28 1:05 ` [ 41/72] xhci: Fix encoding for HS bulk/control NAK rate Greg KH
2012-02-28 1:05 ` [ 42/72] USB: Dont fail USB3 probe on missing legacy PCI IRQ Greg KH
2012-02-28 1:05 ` [ 43/72] USB: Set hub depth after USB3 hub reset Greg KH
2012-02-28 1:05 ` [ 44/72] usb-storage: fix freezing of the scanning thread Greg KH
2012-02-28 1:05 ` [ 45/72] target: Allow control CDBs with data > 1 page Greg KH
2012-02-28 1:05 ` [ 46/72] ASoC: wm8962: Fix sidetone enumeration texts Greg KH
2012-02-28 1:05 ` [ 47/72] ALSA: hda/realtek - Fix overflow of vol/sw check bitmap Greg KH
2012-02-28 1:05 ` [ 48/72] ALSA: hda/realtek - Fix surround output regression on Acer Aspire 5935 Greg KH
2012-02-28 1:05 ` [ 49/72] NOMMU: Lock i_mmap_mutex for access to the VMA prio list Greg KH
2012-02-28 1:05 ` [ 50/72] hwmon: (max6639) Fix FAN_FROM_REG calculation Greg KH
2012-02-28 1:05 ` [ 51/72] hwmon: (max6639) Fix PPR register initialization to set both channels Greg KH
2012-02-28 1:05 ` [ 52/72] hwmon: (ads1015) Fix file leak in probe function Greg KH
2012-02-28 1:05 ` [ 53/72] ARM: omap: fix oops in drivers/video/omap2/dss/dpi.c Greg KH
2012-02-28 1:05 ` [ 54/72] ARM: omap: fix oops in arch/arm/mach-omap2/vp.c when pmic is not found Greg KH
2012-02-28 1:05 ` [ 55/72] x86/amd: Fix L1i and L2 cache sharing information for AMD family 15h processors Greg KH
2012-02-28 1:05 ` [ 56/72] ath9k: stop on rates with idx -1 in ath9k rate controls .tx_status Greg KH
2012-02-28 1:05 ` [ 57/72] genirq: Unmask oneshot irqs when thread was not woken Greg KH
2012-03-04 21:06 ` Sven Joachim
2012-03-04 21:53 ` Jonathan Nieder
2012-03-04 22:08 ` Sven Joachim
2012-03-05 0:43 ` Stefan Lippers-Hollmann
2012-03-06 0:34 ` Linus Torvalds
2012-03-06 8:28 ` Thomas Gleixner
2012-03-06 9:52 ` Thomas Gleixner
2012-03-06 19:31 ` Thomas Gleixner
2012-03-06 19:53 ` Sven Joachim
2012-03-06 20:26 ` Thomas Gleixner
2012-03-06 20:54 ` Thomas Gleixner
2012-03-06 21:07 ` Sven Joachim
2012-03-06 21:11 ` Thomas Gleixner
2012-03-06 21:40 ` Linus Torvalds
2012-03-06 21:08 ` Stefan Lippers-Hollmann
2012-03-06 21:40 ` Linus Torvalds
2012-03-06 21:47 ` Linus Torvalds
2012-03-06 22:18 ` Thomas Gleixner
2012-03-06 22:33 ` Linus Torvalds
2012-03-06 23:38 ` Stefan Lippers-Hollmann
2012-03-07 5:36 ` Sven Joachim
2012-03-06 20:25 ` Stefan Lippers-Hollmann
2012-03-06 19:45 ` Thomas Gleixner
2012-03-06 20:10 ` Sven Joachim
2012-02-28 1:05 ` [ 58/72] genirq: Handle pending irqs in irq_startup() Greg KH
2012-02-28 1:05 ` [ 59/72] [SCSI] scsi_scan: Fix Poison overwritten warning caused by using freed shost Greg KH
2012-02-28 1:05 ` [ 60/72] [SCSI] scsi_pm: Fix bug in the SCSI power management handler Greg KH
2012-02-28 1:05 ` [ 61/72] ipvs: fix matching of fwmark templates during scheduling Greg KH
2012-02-28 1:05 ` [ 62/72] jme: Fix FIFO flush issue Greg KH
2012-02-28 1:05 ` [ 63/72] davinci_emac: Do not free all rx dma descriptors during init Greg KH
2012-02-28 1:05 ` [ 64/72] builddeb: Dont create files in /tmp with predictable names Greg KH
2012-02-28 1:05 ` [ 65/72] can: sja1000: fix isr hang when hw is unplugged under load Greg KH
2012-02-28 1:05 ` [ 66/72] [media] hdpvr: fix race conditon during start of streaming Greg KH
2012-02-28 1:05 ` [ 67/72] [media] imon: dont wedge hardware after early callbacks Greg KH
2012-02-28 1:05 ` [ 68/72] hwmon: (f75375s) Fix register write order when setting fans to full speed Greg KH
2012-02-28 1:05 ` [ 69/72] epoll: introduce POLLFREE to flush ->signalfd_wqh before kfree() Greg KH
2012-02-28 1:05 ` [ 70/72] epoll: ep_unregister_pollwait() can use the freed pwq->whead Greg KH
2012-02-28 1:05 ` [ 71/72] epoll: limit paths Greg KH
2012-02-28 1:05 ` [ 72/72] cdrom: use copy_to_user() without the underscores Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120228010429.937533618@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=abhijit@qca.qualcomm.com \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=gmorain@google.com \
--cc=johannes.berg@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=mohammed@qca.qualcomm.com \
--cc=pstew@google.com \
--cc=rmanohar@qca.qualcomm.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=vthiagar@qca.qualcomm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).