From 8b804cae5e039142bc63896a75f15146eca3bebc Mon Sep 17 00:00:00 2001 From: Koen Vandeputte Date: Mon, 1 Aug 2022 15:07:44 +0200 Subject: mac80211: backport upstream fix for unitialized lock usage Backports upstream fix from 5.19 lockdep complains use of uninitialized spinlock at ieee80211_do_stop() [1], for commit f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif that is being stopped") guards clear_bit() using fq.lock even before fq_init() from ieee80211_txq_setup_flows() initializes this spinlock. According to discussion [2], Toke was not happy with expanding usage of fq.lock. Since __ieee80211_wake_txqs() is called under RCU read lock, we can instead use synchronize_rcu() for flushing ieee80211_wake_txqs(). Signed-off-by: Koen Vandeputte --- ...11-do-not-abuse-fq.lock-in-ieee80211_do_s.patch | 46 ++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 package/kernel/mac80211/patches/subsys/340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch (limited to 'package') diff --git a/package/kernel/mac80211/patches/subsys/340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch b/package/kernel/mac80211/patches/subsys/340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch new file mode 100644 index 0000000000..82243f1d98 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch @@ -0,0 +1,46 @@ +From aa40d5a43526cca9439a2b45fcfdcd016594dece Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Sun, 17 Jul 2022 21:21:52 +0900 +Subject: [PATCH] wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +lockdep complains use of uninitialized spinlock at ieee80211_do_stop() [1], +for commit f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif +that is being stopped") guards clear_bit() using fq.lock even before +fq_init() from ieee80211_txq_setup_flows() initializes this spinlock. + +According to discussion [2], Toke was not happy with expanding usage of +fq.lock. Since __ieee80211_wake_txqs() is called under RCU read lock, we +can instead use synchronize_rcu() for flushing ieee80211_wake_txqs(). + +Link: https://syzkaller.appspot.com/bug?extid=eceab52db7c4b961e9d6 [1] +Link: https://lkml.kernel.org/r/874k0zowh2.fsf@toke.dk [2] +Reported-by: syzbot +Signed-off-by: Tetsuo Handa +Fixes: f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif that is being stopped") +Tested-by: syzbot +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/9cc9b81d-75a3-3925-b612-9d0ad3cab82b@I-love.SAKURA.ne.jp +[ pick up commit 3598cb6e1862 ("wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()") from -next] +Link: https://lore.kernel.org/all/87o7xcq6qt.fsf@kernel.org/ +Signed-off-by: Jakub Kicinski +--- + net/mac80211/iface.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -377,9 +377,8 @@ static void ieee80211_do_stop(struct iee + bool cancel_scan; + struct cfg80211_nan_func *func; + +- spin_lock_bh(&local->fq.lock); + clear_bit(SDATA_STATE_RUNNING, &sdata->state); +- spin_unlock_bh(&local->fq.lock); ++ synchronize_rcu(); /* flush _ieee80211_wake_txqs() */ + + cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata; + if (cancel_scan) -- cgit v1.2.3