From: Greg KH <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Stanislaw Gruszka <sgruszka@redhat.com>,
Helmut Schaa <helmut.schaa@googlemail.com>,
Gertjan van Wingerde <gwingerde@gmail.com>,
"John W. Linville" <linville@tuxdriver.com>
Subject: [ 28/42] rt2x00: use atomic variable for seqno
Date: Thu, 14 Jun 2012 16:56:51 -0700 [thread overview]
Message-ID: <20120614235626.367789531@linuxfoundation.org> (raw)
In-Reply-To: <20120614235636.GA5275@kroah.com>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <sgruszka@redhat.com>
commit e5851dac2c95af7159716832300b9f50c62c648e upstream.
Remove spinlock as atomic_t can be used instead. Note we use only 16
lower bits, upper bits are changed but we impilcilty cast to u16.
This fix possible deadlock on IBSS mode reproted by lockdep:
=================================
[ INFO: inconsistent lock state ]
3.4.0-wl+ #4 Not tainted
---------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
kworker/u:2/30374 [HC0[0]:SC0[0]:HE1:SE1] takes:
(&(&intf->seqlock)->rlock){+.?...}, at: [<f9979a20>] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
{IN-SOFTIRQ-W} state was registered at:
[<c04978ab>] __lock_acquire+0x47b/0x1050
[<c0498504>] lock_acquire+0x84/0xf0
[<c0835733>] _raw_spin_lock+0x33/0x40
[<f9979a20>] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
[<f9979f2a>] rt2x00queue_write_tx_frame+0x1a/0x300 [rt2x00lib]
[<f997834f>] rt2x00mac_tx+0x7f/0x380 [rt2x00lib]
[<f98fe363>] __ieee80211_tx+0x1b3/0x300 [mac80211]
[<f98ffdf5>] ieee80211_tx+0x105/0x130 [mac80211]
[<f99000dd>] ieee80211_xmit+0xad/0x100 [mac80211]
[<f9900519>] ieee80211_subif_start_xmit+0x2d9/0x930 [mac80211]
[<c0782e87>] dev_hard_start_xmit+0x307/0x660
[<c079bb71>] sch_direct_xmit+0xa1/0x1e0
[<c0784bb3>] dev_queue_xmit+0x183/0x730
[<c078c27a>] neigh_resolve_output+0xfa/0x1e0
[<c07b436a>] ip_finish_output+0x24a/0x460
[<c07b4897>] ip_output+0xb7/0x100
[<c07b2d60>] ip_local_out+0x20/0x60
[<c07e01ff>] igmpv3_sendpack+0x4f/0x60
[<c07e108f>] igmp_ifc_timer_expire+0x29f/0x330
[<c04520fc>] run_timer_softirq+0x15c/0x2f0
[<c0449e3e>] __do_softirq+0xae/0x1e0
irq event stamp: 18380437
hardirqs last enabled at (18380437): [<c0526027>] __slab_alloc.clone.3+0x67/0x5f0
hardirqs last disabled at (18380436): [<c0525ff3>] __slab_alloc.clone.3+0x33/0x5f0
softirqs last enabled at (18377616): [<c0449eb3>] __do_softirq+0x123/0x1e0
softirqs last disabled at (18377611): [<c041278d>] do_softirq+0x9d/0xe0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&(&intf->seqlock)->rlock);
<Interrupt>
lock(&(&intf->seqlock)->rlock);
*** DEADLOCK ***
4 locks held by kworker/u:2/30374:
#0: (wiphy_name(local->hw.wiphy)){++++.+}, at: [<c045cf99>] process_one_work+0x109/0x3f0
#1: ((&sdata->work)){+.+.+.}, at: [<c045cf99>] process_one_work+0x109/0x3f0
#2: (&ifibss->mtx){+.+.+.}, at: [<f98f005b>] ieee80211_ibss_work+0x1b/0x470 [mac80211]
#3: (&intf->beacon_skb_mutex){+.+...}, at: [<f997a644>] rt2x00queue_update_beacon+0x24/0x50 [rt2x00lib]
stack backtrace:
Pid: 30374, comm: kworker/u:2 Not tainted 3.4.0-wl+ #4
Call Trace:
[<c04962a6>] print_usage_bug+0x1f6/0x220
[<c0496a12>] mark_lock+0x2c2/0x300
[<c0495ff0>] ? check_usage_forwards+0xc0/0xc0
[<c04978ec>] __lock_acquire+0x4bc/0x1050
[<c0527890>] ? __kmalloc_track_caller+0x1c0/0x1d0
[<c0777fb6>] ? copy_skb_header+0x26/0x90
[<c0498504>] lock_acquire+0x84/0xf0
[<f9979a20>] ? rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
[<c0835733>] _raw_spin_lock+0x33/0x40
[<f9979a20>] ? rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
[<f9979a20>] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
[<f997a5cf>] rt2x00queue_update_beacon_locked+0x5f/0xb0 [rt2x00lib]
[<f997a64d>] rt2x00queue_update_beacon+0x2d/0x50 [rt2x00lib]
[<f9977e3a>] rt2x00mac_bss_info_changed+0x1ca/0x200 [rt2x00lib]
[<f9977c70>] ? rt2x00mac_remove_interface+0x70/0x70 [rt2x00lib]
[<f98e4dd0>] ieee80211_bss_info_change_notify+0xe0/0x1d0 [mac80211]
[<f98ef7b8>] __ieee80211_sta_join_ibss+0x3b8/0x610 [mac80211]
[<c0496ab4>] ? mark_held_locks+0x64/0xc0
[<c0440012>] ? virt_efi_query_capsule_caps+0x12/0x50
[<f98efb09>] ieee80211_sta_join_ibss+0xf9/0x140 [mac80211]
[<f98f0456>] ieee80211_ibss_work+0x416/0x470 [mac80211]
[<c0496d8b>] ? trace_hardirqs_on+0xb/0x10
[<c077683b>] ? skb_dequeue+0x4b/0x70
[<f98f207f>] ieee80211_iface_work+0x13f/0x230 [mac80211]
[<c045cf99>] ? process_one_work+0x109/0x3f0
[<c045d015>] process_one_work+0x185/0x3f0
[<c045cf99>] ? process_one_work+0x109/0x3f0
[<f98f1f40>] ? ieee80211_teardown_sdata+0xa0/0xa0 [mac80211]
[<c045ed86>] worker_thread+0x116/0x270
[<c045ec70>] ? manage_workers+0x1e0/0x1e0
[<c0462f64>] kthread+0x84/0x90
[<c0462ee0>] ? __init_kthread_worker+0x60/0x60
[<c083d382>] kernel_thread_helper+0x6/0x10
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rt2x00/rt2x00.h | 3 +--
drivers/net/wireless/rt2x00/rt2x00mac.c | 1 -
drivers/net/wireless/rt2x00/rt2x00queue.c | 13 ++++++-------
3 files changed, 7 insertions(+), 10 deletions(-)
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -396,8 +396,7 @@ struct rt2x00_intf {
* for hardware which doesn't support hardware
* sequence counting.
*/
- spinlock_t seqlock;
- u16 seqno;
+ atomic_t seqno;
};
static inline struct rt2x00_intf* vif_to_intf(struct ieee80211_vif *vif)
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -277,7 +277,6 @@ int rt2x00mac_add_interface(struct ieee8
else
rt2x00dev->intf_sta_count++;
- spin_lock_init(&intf->seqlock);
mutex_init(&intf->beacon_skb_mutex);
intf->beacon = entry;
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -207,6 +207,7 @@ static void rt2x00queue_create_tx_descri
struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
struct rt2x00_intf *intf = vif_to_intf(tx_info->control.vif);
+ u16 seqno;
if (!(tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
return;
@@ -227,15 +228,13 @@ static void rt2x00queue_create_tx_descri
* sequence counting per-frame, since those will override the
* sequence counter given by mac80211.
*/
- spin_lock(&intf->seqlock);
-
if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags))
- intf->seqno += 0x10;
- hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
- hdr->seq_ctrl |= cpu_to_le16(intf->seqno);
-
- spin_unlock(&intf->seqlock);
+ seqno = atomic_add_return(0x10, &intf->seqno);
+ else
+ seqno = atomic_read(&intf->seqno);
+ hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+ hdr->seq_ctrl |= cpu_to_le16(seqno);
}
static void rt2x00queue_create_tx_descriptor_plcp(struct rt2x00_dev *rt2x00dev,
next prev parent reply other threads:[~2012-06-14 23:56 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-06-14 23:56 [ 00/42] 3.4.3-stable review Greg KH
2012-06-14 23:56 ` [ 01/42] drm/nouveau/disp: fix dithering not being enabled on some eDP macbooks Greg KH
2012-06-14 23:56 ` [ 02/42] drm/i915: Reset last_retired_head when resetting ring Greg KH
2012-06-14 23:56 ` [ 03/42] char/agp: add another Ironlake host bridge Greg KH
2012-06-14 23:56 ` [ 04/42] btree: fix tree corruption in btree_get_prev() Greg KH
2012-06-14 23:56 ` [ 05/42] powerpc/time: Sanity check of decrementer expiration is necessary Greg KH
2012-06-14 23:56 ` [ 06/42] powerpc: Fix kernel panic during kernel module load Greg KH
2012-06-14 23:56 ` [ 07/42] module_param: stop double-calling parameters Greg KH
2012-06-14 23:56 ` [ 08/42] timekeeping: Fix CLOCK_MONOTONIC inconsistency during leapsecond Greg KH
2012-06-14 23:56 ` [ 09/42] ext4: fix the free blocks calculation for ext3 file systems w/ uninit_bg Greg KH
2012-06-14 23:56 ` [ 10/42] x86/uv: Fix UV2 BAU legacy mode Greg KH
2012-06-14 23:56 ` [ 11/42] x86, MCE, AMD: Make APIC LVT thresholding interrupt optional Greg KH
2012-06-14 23:56 ` [ 12/42] hwrng: atmel-rng - fix race condition leading to repeated bits Greg KH
2012-06-14 23:56 ` [ 13/42] crypto: aesni-intel - fix unaligned cbc decrypt for x86-32 Greg KH
2012-06-14 23:56 ` [ 14/42] drm/ttm: Fix buffer object metadata accounting regression v2 Greg KH
2012-06-14 23:56 ` [ 15/42] Btrfs: fall back to non-inline if we dont have enough space Greg KH
2012-06-14 23:56 ` [ 16/42] iwlwifi: disable WoWLAN if !CONFIG_PM_SLEEP Greg KH
2012-06-14 23:56 ` [ 17/42] iwlwifi: unregister LEDs if mac80211 registration fails Greg KH
2012-06-14 23:56 ` [ 18/42] iwlwifi: dont mess up the SCD when removing a key Greg KH
2012-06-14 23:56 ` [ 19/42] iwlwifi: disable the buggy chain extension feature in HW Greg KH
2012-06-14 23:56 ` [ 20/42] mac80211: fix error in station state transitions during reconfig Greg KH
2012-06-14 23:56 ` [ 21/42] mac80211: clean up remain-on-channel on interface stop Greg KH
2012-06-14 23:56 ` [ 22/42] mac80211: fix non RCU-safe sta_list manipulation Greg KH
2012-06-14 23:56 ` [ 23/42] ASoC: wm8994: Ensure all AIFnCLK events are run from the _late variants Greg KH
2012-06-14 23:56 ` [ 24/42] ASoC: wm8994: Apply volume updates with clocks enabled Greg KH
2012-06-14 23:56 ` [ 25/42] bcma: add ext PA workaround for BCM4331 and BCM43431 Greg KH
2012-06-14 23:56 ` [ 26/42] ALSA: HDA: Pin fixup for Zotac Z68 motherboard Greg KH
2012-06-14 23:56 ` [ 27/42] cfg80211: fix interface combinations check Greg KH
2012-06-14 23:56 ` Greg KH [this message]
2012-06-14 23:56 ` [ 29/42] wireless: rt2x00: rt2800usb add more devices ids Greg KH
2012-06-14 23:56 ` [ 30/42] wireless: rt2x00: rt2800usb more devices were identified Greg KH
2012-06-14 23:56 ` [ 31/42] net: sierra_net: device IDs for Aircard 320U++ Greg KH
2012-06-14 23:56 ` [ 32/42] can: c_can: fix "BUG! echo_skb is occupied!" during transmit Greg KH
2012-06-14 23:56 ` [ 33/42] can: c_can: fix an interrupt thrash issue with c_can driver Greg KH
2012-06-14 23:56 ` [ 34/42] can: c_can: fix race condition in c_can_open() Greg KH
2012-06-14 23:56 ` [ 35/42] gma500: dont register the ACPI video bus Greg KH
2012-06-14 23:56 ` [ 36/42] acpi_video: fix leaking PCI references Greg KH
2012-06-14 23:57 ` [ 37/42] sched: Fix the relax_domain_level boot parameter Greg KH
2012-06-14 23:57 ` [ 38/42] drm/radeon: fix tiling and command stream checking on evergreen v3 Greg KH
2012-06-14 23:57 ` [ 39/42] drm/i915: Mark the ringbuffers as being in the GTT domain Greg KH
2012-06-14 23:57 ` [ 40/42] fuse: fix stat call on 32 bit platforms Greg KH
2012-06-14 23:57 ` [ 41/42] libata: add a host flag to ignore detected ATA devices Greg KH
2012-06-14 23:57 ` [ 42/42] ata_piix: defer disks to the Hyper-V drivers by default Greg KH
2012-06-15 11:16 ` From all Hyper-V admins: Big thanks! Re: [ 41/42] libata + [ 42/42] ata_piix: defer disks to the Hyper-V drivers by default has been added to the 3.4-stable tree Victor Miasnikov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120614235626.367789531@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=gwingerde@gmail.com \
--cc=helmut.schaa@googlemail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=sgruszka@redhat.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).