tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv

There are sleep in atomic context bugs when uploading device dump
data in mwifiex. The root cause is that dev_coredumpv could not
be used in atomic contexts, because it calls dev_set_name which
include operations that may sleep. The call tree shows execution
paths that could lead to bugs:

(Interrupt context)
fw_dump_timer_fn
mwifiex_upload_device_dump
dev_coredumpv(..., GFP_KERNEL)
dev_coredumpm()
kzalloc(sizeof(*devcd), gfp); //may sleep
dev_set_name
kobject_set_name_vargs
kvasprintf_const(GFP_KERNEL, ...); //may sleep
kstrdup(s, GFP_KERNEL); //may sleep

The corresponding fail log is shown below:

[ 135.275938] usb 1-1: == mwifiex dump information to /sys/class/devcoredump start
[ 135.281029] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:265
...
[ 135.293613] Call Trace:
[ 135.293613] <IRQ>
[ 135.293613] dump_stack_lvl+0x57/0x7d
[ 135.293613] __might_resched.cold+0x138/0x173
[ 135.293613] ? dev_coredumpm+0xca/0x2e0
[ 135.293613] kmem_cache_alloc_trace+0x189/0x1f0
[ 135.293613] ? devcd_match_failing+0x30/0x30
[ 135.293613] dev_coredumpm+0xca/0x2e0
[ 135.293613] ? devcd_freev+0x10/0x10
[ 135.293613] dev_coredumpv+0x1c/0x20
[ 135.293613] ? devcd_match_failing+0x30/0x30
[ 135.293613] mwifiex_upload_device_dump+0x65/0xb0
[ 135.293613] ? mwifiex_dnld_fw+0x1b0/0x1b0
[ 135.293613] call_timer_fn+0x122/0x3d0
[ 135.293613] ? msleep_interruptible+0xb0/0xb0
[ 135.293613] ? lock_downgrade+0x3c0/0x3c0
[ 135.293613] ? __next_timer_interrupt+0x13c/0x160
[ 135.293613] ? lockdep_hardirqs_on_prepare+0xe/0x220
[ 135.293613] ? mwifiex_dnld_fw+0x1b0/0x1b0
[ 135.293613] __run_timers.part.0+0x3f8/0x540
[ 135.293613] ? call_timer_fn+0x3d0/0x3d0
[ 135.293613] ? arch_restore_msi_irqs+0x10/0x10
[ 135.293613] ? lapic_next_event+0x31/0x40
[ 135.293613] run_timer_softirq+0x4f/0xb0
[ 135.293613] __do_softirq+0x1c2/0x651
...
[ 135.293613] RIP: 0010:default_idle+0xb/0x10
[ 135.293613] RSP: 0018:ffff888006317e68 EFLAGS: 00000246
[ 135.293613] RAX: ffffffff82ad8d10 RBX: ffff888006301cc0 RCX: ffffffff82ac90e1
[ 135.293613] RDX: ffffed100d9ff1b4 RSI: ffffffff831ad140 RDI: ffffffff82ad8f20
[ 135.293613] RBP: 0000000000000003 R08: 0000000000000000 R09: ffff88806cff8d9b
[ 135.293613] R10: ffffed100d9ff1b3 R11: 0000000000000001 R12: ffffffff84593410
[ 135.293613] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffff11000c62fd2
...
[ 135.389205] usb 1-1: == mwifiex dump information to /sys/class/devcoredump end

This patch uses delayed work to replace timer and moves the operations
that may sleep into a delayed work in order to mitigate bugs, it was
tested on Marvell 88W8801 chip whose port is usb and the firmware is
usb8801_uapsta.bin. The following is the result after using delayed
work to replace timer.

[ 134.936453] usb 1-1: == mwifiex dump information to /sys/class/devcoredump start
[ 135.043344] usb 1-1: == mwifiex dump information to /sys/class/devcoredump end

As we can see, there is no bug now.

Fixes: f5ecd02a8b20 ("mwifiex: device dump support for usb interface")
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/b63b77fc84ed3e8a6bef02378e17c7c71a0bc3be.1654569290.git.duoming@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Duoming Zhou and committed by
Greg Kroah-Hartman a52ed486 77515eba

+10 -8
+5 -4
drivers/net/wireless/marvell/mwifiex/init.c
··· 63 63 adapter->if_ops.card_reset(adapter); 64 64 } 65 65 66 - static void fw_dump_timer_fn(struct timer_list *t) 66 + static void fw_dump_work(struct work_struct *work) 67 67 { 68 - struct mwifiex_adapter *adapter = from_timer(adapter, t, devdump_timer); 68 + struct mwifiex_adapter *adapter = 69 + container_of(work, struct mwifiex_adapter, devdump_work.work); 69 70 70 71 mwifiex_upload_device_dump(adapter); 71 72 } ··· 322 321 adapter->active_scan_triggered = false; 323 322 timer_setup(&adapter->wakeup_timer, wakeup_timer_fn, 0); 324 323 adapter->devdump_len = 0; 325 - timer_setup(&adapter->devdump_timer, fw_dump_timer_fn, 0); 324 + INIT_DELAYED_WORK(&adapter->devdump_work, fw_dump_work); 326 325 } 327 326 328 327 /* ··· 401 400 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter) 402 401 { 403 402 del_timer(&adapter->wakeup_timer); 404 - del_timer_sync(&adapter->devdump_timer); 403 + cancel_delayed_work_sync(&adapter->devdump_work); 405 404 mwifiex_cancel_all_pending_cmd(adapter); 406 405 wake_up_interruptible(&adapter->cmd_wait_q.wait); 407 406 wake_up_interruptible(&adapter->hs_activate_wait_q);
+2 -1
drivers/net/wireless/marvell/mwifiex/main.h
··· 49 49 #include <linux/pm_runtime.h> 50 50 #include <linux/slab.h> 51 51 #include <linux/of_irq.h> 52 + #include <linux/workqueue.h> 52 53 53 54 #include "decl.h" 54 55 #include "ioctl.h" ··· 1056 1055 /* Device dump data/length */ 1057 1056 void *devdump_data; 1058 1057 int devdump_len; 1059 - struct timer_list devdump_timer; 1058 + struct delayed_work devdump_work; 1060 1059 1061 1060 bool ignore_btcoex_events; 1062 1061 };
+3 -3
drivers/net/wireless/marvell/mwifiex/sta_event.c
··· 623 623 * transmission event get lost, in this cornel case, 624 624 * user would still get partial of the dump. 625 625 */ 626 - mod_timer(&adapter->devdump_timer, 627 - jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S)); 626 + schedule_delayed_work(&adapter->devdump_work, 627 + msecs_to_jiffies(MWIFIEX_TIMER_10S)); 628 628 } 629 629 630 630 /* Overflow check */ ··· 643 643 return; 644 644 645 645 upload_dump: 646 - del_timer_sync(&adapter->devdump_timer); 646 + cancel_delayed_work_sync(&adapter->devdump_work); 647 647 mwifiex_upload_device_dump(adapter); 648 648 } 649 649