BUG: bad unlock balance detected iwl3945/1438 is trying to release lock

BUG: bad unlock balance detected iwl3945/1438 is trying to release lock

[Zdenek Kabelac]

Hello

This stacktrace is with git
8876b8ed5fc9e996918cac4a553b8bc40d5605d7
(compiled few minutes ago)

(Unsure how it's related to other bugs around iwl driver)

Happens when wifi network is enabled/disabled

Zdenek


 ACPI: PCI interrupt for device 0000:03:00.0 disabled
 ACPI: PCI Interrupt 0000:03:00.0[A] -> GSI 17 (level, low) -> IRQ 17
 PM: Writing back config space on device 0000:03:00.0 at offset 1 (was
100102, writing 100106)

 =====================================
 [ BUG: bad unlock balance detected! ]
 -------------------------------------
 iwl3945/1438 is trying to release lock (&priv->mutex) at:
 [<ffffffff812ed439>] mutex_unlock+0x9/0x10
 but there are no more locks to release!

 other info that might help us debug this:
 2 locks held by iwl3945/1438:
  #0:  ((name)){--..}, at: [<ffffffff8105107a>] run_workqueue+0xaa/0x230
  #1:  (&ifsta->work){--..}, at: [<ffffffff8105107a>] run_workqueue+0xaa/0x230

 stack backtrace:
 Pid: 1438, comm: iwl3945 Not tainted 2.6.25 #61

 Call Trace:
  [<ffffffff810669d5>] print_unlock_inbalance_bug+0x105/0x130
  [<ffffffff81013458>] ? native_sched_clock+0x78/0x80
  [<ffffffff81065434>] ? __lock_acquire+0x364/0x11d0
  [<ffffffff81065434>] ? __lock_acquire+0x364/0x11d0
  [<ffffffff81066b18>] lock_release_non_nested+0x118/0x1a0
  [<ffffffff812ed439>] ? mutex_unlock+0x9/0x10
  [<ffffffff81066c66>] lock_release+0xc6/0x230
  [<ffffffff812ed336>] __mutex_unlock_slowpath+0x86/0x180
  [<ffffffff812ed439>] mutex_unlock+0x9/0x10
  [<ffffffffa0189d34>] :iwl3945:iwl3945_mac_config_interface+0x44/0x420
  [<ffffffff81062aca>] ? get_lock_stats+0x2a/0x70
  [<ffffffffa014ac46>] :mac80211:__ieee80211_if_config+0x86/0xe0
  [<ffffffffa014b67a>] :mac80211:ieee80211_if_config+0x3a/0x70
  [<ffffffffa0151f52>] :mac80211:ieee80211_sta_set_bssid+0xb2/0xd0
  [<ffffffffa01577be>] :mac80211:ieee80211_sta_work+0x158e/0x19b0
  [<ffffffff81062aca>] ? get_lock_stats+0x2a/0x70
  [<ffffffff81062aca>] ? get_lock_stats+0x2a/0x70
  [<ffffffff81062b1e>] ? put_lock_stats+0xe/0x30
  [<ffffffff81059311>] ? hrtimer_start+0xe1/0x1a0
  [<ffffffff81013458>] ? native_sched_clock+0x78/0x80
  [<ffffffff81065434>] ? __lock_acquire+0x364/0x11d0
  [<ffffffff81062b1e>] ? put_lock_stats+0xe/0x30
  [<ffffffff8105107a>] ? run_workqueue+0xaa/0x230
  [<ffffffff8105107a>] ? run_workqueue+0xaa/0x230
  [<ffffffffa0156230>] ? :mac80211:ieee80211_sta_work+0x0/0x19b0
  [<ffffffff810510c6>] run_workqueue+0xf6/0x230
  [<ffffffff810512a7>] worker_thread+0xa7/0x120
  [<ffffffff81055810>] ? autoremove_wake_function+0x0/0x40
  [<ffffffff81051200>] ? worker_thread+0x0/0x120
  [<ffffffff81055479>] kthread+0x49/0x90
  [<ffffffff8100d548>] child_rip+0xa/0x12
  [<ffffffff8100cc33>] ? restore_args+0x0/0x30
  [<ffffffff81055430>] ? kthread+0x0/0x90
  [<ffffffff8100d53e>] ? child_rip+0x0/0x12

[PATCH] iwlwifi: Don't unlock priv->mutex if it isn't locked

[Roland Dreier]

Commit b716bb91 ("iwlwifi: Cancel scanning upon association") moved the
test of priv->vif in iwl{3945,4964}_mac_config_interface() outside of
where priv->mutex is held, but still tries to do mutex_unlock() on
return.  This is clearly wrong and triggers a nasty lockdep warning when
this codepath is triggered.  Fix this by removing the mutex_unlock().

Signed-off-by: Roland Dreier <rolandd@cisco.com>
---
Assuming the original b716bb91 commit is correct, this is probably the
right fix.  But I'm not sure if it's correct to look at priv->vif
without holding priv->mutex, so maybe the fix is more complicated.

 drivers/net/wireless/iwlwifi/iwl3945-base.c |    1 -
 drivers/net/wireless/iwlwifi/iwl4965-base.c |    1 -
 2 files changed, 0 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 1a5678f..a1a0b3c 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -6907,7 +6907,6 @@ static int iwl3945_mac_config_interface(struct ieee80211_hw *hw,
 
 	if (priv->vif != vif) {
 		IWL_DEBUG_MAC80211("leave - priv->vif != vif\n");
-		mutex_unlock(&priv->mutex);
 		return 0;
 	}
 
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index d7e2358..d0bbcaa 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -6473,7 +6473,6 @@ static int iwl4965_mac_config_interface(struct ieee80211_hw *hw,
 
 	if (priv->vif != vif) {
 		IWL_DEBUG_MAC80211("leave - priv->vif != vif\n");
-		mutex_unlock(&priv->mutex);
 		return 0;
 	}