From: Arend van Spriel <arend.vanspriel@broadcom•com>
To: Kalle Valo <kvalo@codeaurora•org>, Jia-Ju Bai <baijiaju1990@163•com>
Cc: Larry.Finger@lwfinger•net, linux-wireless@vger•kernel.org,
b43-dev@lists•infradead.org, netdev@vger•kernel.org,
linux-kernel@vger•kernel.org
Subject: Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_op_bss_info_changed
Date: Wed, 31 May 2017 14:15:47 +0200 [thread overview]
Message-ID: <471e5030-0a9a-e9bb-855c-90dcd506f466@broadcom.com> (raw)
In-Reply-To: <877f0xnwyk.fsf@kamboji.qca.qualcomm.com>
On 31-05-17 12:26, Kalle Valo wrote:
> Jia-Ju Bai <baijiaju1990@163•com> writes:
>
>> The driver may sleep under a spin lock, and the function call path is:
>> b43legacy_op_bss_info_changed (acquire the lock by spin_lock_irqsave)
>> b43legacy_synchronize_irq
>> synchronize_irq --> may sleep
>>
>> To fix it, the lock is released before b43legacy_synchronize_irq, and the
>> lock is acquired again after this function.
>>
>> Signed-off-by: Jia-Ju Bai <baijiaju1990@163•com>
>> ---
>> drivers/net/wireless/broadcom/b43legacy/main.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c
>> index f1e3dad..31ead21 100644
>> --- a/drivers/net/wireless/broadcom/b43legacy/main.c
>> +++ b/drivers/net/wireless/broadcom/b43legacy/main.c
>> @@ -2859,7 +2859,9 @@ static void b43legacy_op_bss_info_changed(struct ieee80211_hw *hw,
>> b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, 0);
>>
>> if (changed & BSS_CHANGED_BSSID) {
>> + spin_unlock_irqrestore(&wl->irq_lock, flags);
>> b43legacy_synchronize_irq(dev);
>> + spin_lock_irqsave(&wl->irq_lock, flags);
>
> To me this looks like a fragile workaround and not a real fix. You can
> easily add new race conditions with releasing the lock like this.
Hi Jia-Ju,
Agree with Kalle as I was about to say the same thing. You really need
to determine what is protected by the irq_lock. Here you are using the
lock because you are about to change wl->bssid a bit further down. Did
not check the entire function but it seems the lock perimeter is too wide.
Regards,
Arend
next prev parent reply other threads:[~2017-05-31 12:15 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-31 10:09 [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_op_bss_info_changed Jia-Ju Bai
2017-05-31 10:26 ` Kalle Valo
2017-05-31 12:15 ` Arend van Spriel [this message]
2017-05-31 15:32 ` Michael Büsch
2017-06-01 0:07 ` Larry Finger
[not found] ` <284d6d5d-d548-9e05-eafd-a6b521af5a04-tQ5ms3gMjBLk1uMJSBkQmQ@public.gmane.org>
2017-06-01 1:07 ` Jia-Ju Bai
2017-06-01 5:31 ` Michael Büsch
2017-06-01 4:27 ` Kalle Valo
2017-06-01 5:29 ` Michael Büsch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=471e5030-0a9a-e9bb-855c-90dcd506f466@broadcom.com \
--to=arend.vanspriel@broadcom$(echo .)com \
--cc=Larry.Finger@lwfinger$(echo .)net \
--cc=b43-dev@lists$(echo .)infradead.org \
--cc=baijiaju1990@163$(echo .)com \
--cc=kvalo@codeaurora$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-wireless@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox