1 Subject: [PATCH] cfg80211: fix deadlock
2 From: Johannes Berg <johannes@sipsolutions.net>
3 To: John Linville <linville@tuxdriver.com>
4 Cc: linux-wireless <linux-wireless@vger.kernel.org>,
5 Christian Lamparter <chunkeey@web.de>
6 Content-Type: text/plain
7 Date: Sun, 16 Aug 2009 13:32:38 +0200
8 Message-Id: <1250422358.17522.0.camel@johannes.local>
10 X-Mailer: Evolution 2.27.90
11 Content-Transfer-Encoding: 7bit
12 Sender: linux-wireless-owner@vger.kernel.org
14 List-ID: <linux-wireless.vger.kernel.org>
15 X-Mailing-List: linux-wireless@vger.kernel.org
17 When removing an interface with nl80211, cfg80211 will
18 deadlock in the netdev notifier because we're already
19 holding rdev->mtx and try to acquire it again to verify
20 the scan has been done.
22 This bug was introduced by my patch
23 "cfg80211: check for and abort dangling scan requests".
25 To fix this, move the dangling scan request check into
26 wiphy_unregister(). This will not be able to catch all
27 cases right away, but if the scan problem happens with
28 a manual ifdown or so it will be possible to remedy it
29 by removing the module/device.
31 Additionally, add comments about the deadlock scenario.
33 Reported-by: Christian Lamparter <chunkeey@web.de>
34 Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
36 net/wireless/core.c | 32 +++++++++++++++++++-------------
37 1 file changed, 19 insertions(+), 13 deletions(-)
39 --- a/net/wireless/core.c
40 +++ b/net/wireless/core.c
41 @@ -586,9 +586,15 @@ void wiphy_unregister(struct wiphy *wiph
42 * get to lock contention here if userspace issues a command
43 * that identified the hardware by wiphy index.
45 - mutex_lock(&rdev->mtx);
46 - /* unlock again before freeing */
47 - mutex_unlock(&rdev->mtx);
48 + cfg80211_lock_rdev(rdev);
50 + if (WARN_ON(rdev->scan_req)) {
51 + rdev->scan_req->aborted = true;
52 + ___cfg80211_scan_done(rdev);
55 + cfg80211_unlock_rdev(rdev);
56 + flush_work(&rdev->scan_done_wk);
58 cfg80211_debugfs_rdev_del(rdev);
60 @@ -603,9 +609,7 @@ void wiphy_unregister(struct wiphy *wiph
62 mutex_unlock(&cfg80211_mutex);
64 - flush_work(&rdev->scan_done_wk);
65 cancel_work_sync(&rdev->conn_work);
66 - kfree(rdev->scan_req);
67 flush_work(&rdev->event_work);
69 EXPORT_SYMBOL(wiphy_unregister);
70 @@ -653,6 +657,11 @@ static int cfg80211_netdev_notifier_call
75 + * NB: cannot take rdev->mtx here because this may be
76 + * called within code protected by it when interfaces
77 + * are added with nl80211.
79 mutex_init(&wdev->mtx);
80 INIT_LIST_HEAD(&wdev->event_list);
81 spin_lock_init(&wdev->event_lock);
82 @@ -730,13 +739,11 @@ static int cfg80211_netdev_notifier_call
85 case NETDEV_UNREGISTER:
86 - cfg80211_lock_rdev(rdev);
88 - if (WARN_ON(rdev->scan_req && rdev->scan_req->dev == dev)) {
89 - rdev->scan_req->aborted = true;
90 - ___cfg80211_scan_done(rdev);
94 + * NB: cannot take rdev->mtx here because this may be
95 + * called within code protected by it when interfaces
96 + * are removed with nl80211.
98 mutex_lock(&rdev->devlist_mtx);
100 * It is possible to get NETDEV_UNREGISTER
101 @@ -755,7 +762,6 @@ static int cfg80211_netdev_notifier_call
104 mutex_unlock(&rdev->devlist_mtx);
105 - cfg80211_unlock_rdev(rdev);
108 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))