From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Hans de Goede <hdegoede@redhat.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>,
devel@driverdev.osuosl.org
Subject: [PATCH AUTOSEL 5.15 26/82] staging: rtl8723bs: remove a third possible deadlock
Date: Tue, 9 Nov 2021 17:15:44 -0500 [thread overview]
Message-ID: <20211109221641.1233217-26-sashal@kernel.org> (raw)
In-Reply-To: <20211109221641.1233217-1-sashal@kernel.org>
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit bdc1bbdbaa92df19a14d4c1902088c8432b46c6f ]
The assoc_timer takes the pmlmepriv->lock and various functions which
take the pmlmepriv->scanned_queue.lock first take the pmlmepriv->lock,
this means that we cannot have code which waits for the timer
(timer_del_sync) while holding the pmlmepriv->scanned_queue.lock
to avoid a triangle deadlock:
[ 363.139361] ======================================================
[ 363.139377] WARNING: possible circular locking dependency detected
[ 363.139396] 5.15.0-rc1+ #470 Tainted: G C E
[ 363.139413] ------------------------------------------------------
[ 363.139424] RTW_CMD_THREAD/2466 is trying to acquire lock:
[ 363.139441] ffffbacd00699038 (&pmlmepriv->lock){+.-.}-{2:2}, at: _rtw_join_timeout_handler+0x3c/0x160 [r8723bs]
[ 363.139598]
but task is already holding lock:
[ 363.139610] ffffbacd00128ea0 ((&pmlmepriv->assoc_timer)){+.-.}-{0:0}, at: call_timer_fn+0x5/0x260
[ 363.139673]
which lock already depends on the new lock.
[ 363.139684]
the existing dependency chain (in reverse order) is:
[ 363.139696]
-> #2 ((&pmlmepriv->assoc_timer)){+.-.}-{0:0}:
[ 363.139734] del_timer_sync+0x59/0x100
[ 363.139762] rtw_joinbss_event_prehandle+0x342/0x640 [r8723bs]
[ 363.139870] report_join_res+0xdf/0x110 [r8723bs]
[ 363.139980] OnAssocRsp+0x17a/0x200 [r8723bs]
[ 363.140092] rtw_recv_entry+0x190/0x1120 [r8723bs]
[ 363.140209] rtl8723b_process_phy_info+0x3f9/0x750 [r8723bs]
[ 363.140318] tasklet_action_common.constprop.0+0xe8/0x110
[ 363.140345] __do_softirq+0xde/0x485
[ 363.140372] __irq_exit_rcu+0xd0/0x100
[ 363.140393] irq_exit_rcu+0xa/0x20
[ 363.140413] common_interrupt+0x83/0xa0
[ 363.140440] asm_common_interrupt+0x1e/0x40
[ 363.140463] finish_task_switch.isra.0+0x157/0x3d0
[ 363.140492] __schedule+0x447/0x1880
[ 363.140516] schedule+0x59/0xc0
[ 363.140537] smpboot_thread_fn+0x161/0x1c0
[ 363.140565] kthread+0x143/0x160
[ 363.140585] ret_from_fork+0x22/0x30
[ 363.140614]
-> #1 (&pmlmepriv->scanned_queue.lock){+.-.}-{2:2}:
[ 363.140653] _raw_spin_lock_bh+0x34/0x40
[ 363.140675] rtw_free_network_queue+0x31/0x80 [r8723bs]
[ 363.140776] rtw_sitesurvey_cmd+0x79/0x1e0 [r8723bs]
[ 363.140869] rtw_cfg80211_surveydone_event_callback+0x3cf/0x470 [r8723bs]
[ 363.140973] rdev_scan+0x42/0x1a0 [cfg80211]
[ 363.141307] nl80211_trigger_scan+0x566/0x660 [cfg80211]
[ 363.141635] genl_family_rcv_msg_doit+0xcd/0x110
[ 363.141661] genl_rcv_msg+0xce/0x1c0
[ 363.141680] netlink_rcv_skb+0x50/0xf0
[ 363.141699] genl_rcv+0x24/0x40
[ 363.141717] netlink_unicast+0x16d/0x230
[ 363.141736] netlink_sendmsg+0x22b/0x450
[ 363.141755] sock_sendmsg+0x5e/0x60
[ 363.141781] ____sys_sendmsg+0x22f/0x270
[ 363.141803] ___sys_sendmsg+0x81/0xc0
[ 363.141828] __sys_sendmsg+0x49/0x80
[ 363.141851] do_syscall_64+0x3b/0x90
[ 363.141873] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 363.141895]
-> #0 (&pmlmepriv->lock){+.-.}-{2:2}:
[ 363.141930] __lock_acquire+0x1158/0x1de0
[ 363.141954] lock_acquire+0xb5/0x2b0
[ 363.141974] _raw_spin_lock_bh+0x34/0x40
[ 363.141993] _rtw_join_timeout_handler+0x3c/0x160 [r8723bs]
[ 363.142097] call_timer_fn+0x94/0x260
[ 363.142122] __run_timers.part.0+0x1bf/0x290
[ 363.142147] run_timer_softirq+0x26/0x50
[ 363.142171] __do_softirq+0xde/0x485
[ 363.142193] __irq_exit_rcu+0xd0/0x100
[ 363.142215] irq_exit_rcu+0xa/0x20
[ 363.142235] sysvec_apic_timer_interrupt+0x72/0x90
[ 363.142260] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 363.142283] __module_address.part.0+0x0/0xd0
[ 363.142309] is_module_address+0x25/0x40
[ 363.142334] static_obj+0x4f/0x60
[ 363.142361] lockdep_init_map_type+0x47/0x220
[ 363.142382] __init_swait_queue_head+0x45/0x60
[ 363.142408] mmc_wait_for_req+0x4a/0xc0 [mmc_core]
[ 363.142504] mmc_wait_for_cmd+0x55/0x70 [mmc_core]
[ 363.142592] mmc_io_rw_direct+0x75/0xe0 [mmc_core]
[ 363.142691] sdio_writeb+0x2e/0x50 [mmc_core]
[ 363.142788] _sd_cmd52_write+0x62/0x80 [r8723bs]
[ 363.142885] sd_cmd52_write+0x6c/0xb0 [r8723bs]
[ 363.142981] rtl8723bs_set_hal_ops+0x982/0x9b0 [r8723bs]
[ 363.143089] rtw_write16+0x1e/0x30 [r8723bs]
[ 363.143184] SetHwReg8723B+0xcc9/0xd30 [r8723bs]
[ 363.143294] mlmeext_joinbss_event_callback+0x17a/0x1a0 [r8723bs]
[ 363.143405] rtw_joinbss_event_callback+0x11/0x20 [r8723bs]
[ 363.143507] mlme_evt_hdl+0x4d/0x70 [r8723bs]
[ 363.143620] rtw_cmd_thread+0x168/0x3c0 [r8723bs]
[ 363.143712] kthread+0x143/0x160
[ 363.143732] ret_from_fork+0x22/0x30
[ 363.143757]
other info that might help us debug this:
[ 363.143768] Chain exists of:
&pmlmepriv->lock --> &pmlmepriv->scanned_queue.lock --> (&pmlmepriv->assoc_timer)
[ 363.143809] Possible unsafe locking scenario:
[ 363.143819] CPU0 CPU1
[ 363.143831] ---- ----
[ 363.143841] lock((&pmlmepriv->assoc_timer));
[ 363.143862] lock(&pmlmepriv->scanned_queue.lock);
[ 363.143882] lock((&pmlmepriv->assoc_timer));
[ 363.143902] lock(&pmlmepriv->lock);
[ 363.143921]
*** DEADLOCK ***
Make rtw_joinbss_event_prehandle() release the scanned_queue.lock before
it deletes the timer to avoid this (it is still holding pmlmepriv->lock
protecting against racing the timer).
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210920145502.155454-3-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index 1f49c49e10b45..cf79bec916c51 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -1234,16 +1234,13 @@ void rtw_joinbss_event_prehandle(struct adapter *adapter, u8 *pbuf)
rtw_indicate_connect(adapter);
}
+ spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
+
/* s5. Cancel assoc_timer */
del_timer_sync(&pmlmepriv->assoc_timer);
-
} else {
spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
- goto ignore_joinbss_callback;
}
-
- spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
-
} else if (pnetwork->join_res == -4) {
rtw_reset_securitypriv(adapter);
_set_timer(&pmlmepriv->assoc_timer, 1);
--
2.33.0
next prev parent reply other threads:[~2021-11-09 22:18 UTC|newest]
Thread overview: 88+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-09 22:15 [PATCH AUTOSEL 5.15 01/82] arm64: zynqmp: Do not duplicate flash partition label property Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 02/82] arm64: zynqmp: Fix serial compatible string Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 03/82] clk: sunxi-ng: Unregister clocks/resets when unbinding Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 04/82] ARM: dts: sunxi: Fix OPPs node name Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 05/82] arm64: dts: allwinner: h5: Fix GPU thermal zone " Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 06/82] arm64: dts: allwinner: a100: Fix " Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 07/82] staging: wfx: ensure IRQ is ready before enabling it Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 08/82] ARM: dts: BCM5301X: Fix nodes names Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 09/82] ARM: dts: BCM5301X: Fix MDIO mux binding Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 10/82] ARM: dts: NSP: Fix mpcore, mmc node names Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 11/82] arm64: dts: broadcom: bcm4908: Move reboot syscon out of bus Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 12/82] scsi: pm80xx: Fix memory leak during rmmod Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 13/82] scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 14/82] ASoC: mediatek: mt8195: Add missing of_node_put() Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 15/82] arm64: dts: rockchip: Disable CDN DP on Pinebook Pro Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 16/82] arm64: dts: hisilicon: fix arm,sp805 compatible string Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 17/82] arm64: dts: rockchip: add Coresight debug range for RK3399 Sasha Levin
2021-11-09 23:25 ` Brian Norris
2021-11-10 0:44 ` Sasha Levin
2021-11-10 0:49 ` Brian Norris
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 18/82] RDMA/bnxt_re: Check if the vlan is valid before reporting Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 19/82] bus: ti-sysc: Add quirk handling for reinit on context lost Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 20/82] bus: ti-sysc: Use context lost quirk for otg Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 21/82] usb: musb: tusb6010: check return value after calling platform_get_resource() Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 22/82] usb: typec: tipd: Remove WARN_ON in tps6598x_block_read Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 23/82] ARM: dts: ux500: Skomer regulator fixes Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 24/82] staging: rtl8723bs: remove possible deadlock when disconnect (v2) Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 25/82] staging: rtl8723bs: remove a second possible deadlock Sasha Levin
2021-11-09 22:15 ` Sasha Levin [this message]
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 27/82] ARM: BCM53016: Specify switch ports for Meraki MR32 Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 28/82] arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 29/82] arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 30/82] arm64: dts: qcom: ipq8074: " Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 31/82] arm64: dts: qcom: sdm845: " Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 32/82] arm64: dts: qcom: msm8916: Add unit name for /soc node Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 33/82] arm64: dts: freescale: fix arm,sp805 compatible string Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 34/82] arm64: dts: ls1012a: Add serial alias for ls1012a-rdb Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 35/82] RDMA/rxe: Separate HW and SW l/rkeys Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 36/82] ASoC: SOF: Intel: hda-dai: fix potential locking issue Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 37/82] scsi: core: Fix scsi_mode_sense() buffer length handling Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 38/82] ALSA: usb-audio: disable implicit feedback sync for Behringer UFX1204 and UFX1604 Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 39/82] clk: imx: imx6ul: Move csi_sel mux to correct base register Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 40/82] ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 41/82] ASoC: rt5651: " Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 42/82] ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 43/82] scsi: advansys: Fix kernel pointer leak Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 44/82] scsi: smartpqi: Add controller handshake during kdump Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 45/82] arm64: dts: imx8mm-kontron: Fix reset delays for ethernet PHY Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 46/82] ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336 codec Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 47/82] ASoC: Intel: soc-acpi: add missing quirk for TGL SDCA single amp Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 48/82] ASoC: Intel: sof_sdw: add missing quirk for Dell SKU 0A45 Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 49/82] firmware_loader: fix pre-allocated buf built-in firmware use Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 50/82] cpuidle: tegra: Check whether PMC is ready Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 51/82] HID: multitouch: disable sticky fingers for UPERFECT Y Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 52/82] ALSA: usb-audio: Add support for the Pioneer DJM 750MK2 Mixer/Soundcard Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 53/82] ARM: dts: omap: fix gpmc,mux-add-data type Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 54/82] usb: host: ohci-tmio: check return value after calling platform_get_resource() Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 55/82] ASoC: rt5682: fix a little pop while playback Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 56/82] ARM: dts: ls1021a: move thermal-zones node out of soc/ Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 57/82] ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for flash Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 58/82] ALSA: ISA: not for M68K Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 59/82] iommu/vt-d: Do not falsely log intel_iommu is unsupported kernel option Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 60/82] tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 61/82] MIPS: sni: Fix the build Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 62/82] scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 63/82] scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 64/82] scsi: target: Fix ordered tag handling Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 65/82] scsi: target: Fix alua_tg_pt_gps_count tracking Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 66/82] iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr() Sasha Levin
2021-11-12 17:33 ` Jonathan Cameron
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 67/82] RDMA/core: Use kvzalloc when allocating the struct ib_port Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 68/82] scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 69/82] scsi: lpfc: Fix link down processing to address NULL pointer dereference Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 70/82] scsi: lpfc: Allow fabric node recovery if recovery is in progress before devloss Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 71/82] memory: tegra20-emc: Add runtime dependency on devfreq governor module Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 72/82] powerpc/5200: dts: fix memory node unit name Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 73/82] arm64: dts: qcom: msm8916: Add CPU ACC and SAW/SPM Sasha Levin
2021-11-10 8:40 ` Stephan Gerhold
2021-11-12 13:43 ` Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 74/82] ARM: dts: qcom: fix memory and mdio nodes naming for RB3011 Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 75/82] arm64: dts: qcom: Fix node name of rpm-msg-ram device nodes Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 76/82] ALSA: gus: fix null pointer dereference on pointer block Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 77/82] ALSA: usb-audio: fix null pointer dereference on pointer cs_desc Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 78/82] clk: at91: sama7g5: remove prescaler part of master clock Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 79/82] iommu/dart: Initialize DART_STREAMS_ENABLE Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 80/82] powerpc/dcr: Use cmplwi instead of 3-argument cmpli Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 81/82] powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without DEBUG_RODATA_TEST Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 82/82] HID: playstation: require multicolor LED functionality Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211109221641.1233217-26-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=hdegoede@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox