diff mbox series

[FIX] brcmfmac: disable PCIe interrupts before bus reset

Message ID 20191118115308.21963-1-zajec5@gmail.com (mailing list archive)
State Accepted
Commit 5d26a6a6150c486f51ea2aaab33af04db02f63b8
Delegated to: Kalle Valo
Headers show
Series [FIX] brcmfmac: disable PCIe interrupts before bus reset | expand

Commit Message

Rafał Miłecki Nov. 18, 2019, 11:53 a.m. UTC
From: Rafał Miłecki <rafal@milecki.pl>

Keeping interrupts on could result in brcmfmac freeing some resources
and then IRQ handlers trying to use them. That was obviously a straight
path for crashing a kernel.

Example:
CPU0                           CPU1
----                           ----
brcmf_pcie_reset
  brcmf_pcie_bus_console_read
  brcmf_detach
    ...
    brcmf_fweh_detach
    brcmf_proto_detach
                               brcmf_pcie_isr_thread
                                 ...
                                 brcmf_proto_msgbuf_rx_trigger
                                   ...
                                   drvr->proto->pd
    brcmf_pcie_release_irq

[  363.789218] Unable to handle kernel NULL pointer dereference at virtual address 00000038
[  363.797339] pgd = c0004000
[  363.800050] [00000038] *pgd=00000000
[  363.803635] Internal error: Oops: 17 [#1] SMP ARM
(...)
[  364.029209] Backtrace:
[  364.031725] [<bf243838>] (brcmf_proto_msgbuf_rx_trigger [brcmfmac]) from [<bf2471dc>] (brcmf_pcie_isr_thread+0x228/0x274 [brcmfmac])
[  364.043662]  r7:00000001 r6:c8ca0000 r5:00010000 r4:c7b4f800

Fixes: 4684997d9eea ("brcmfmac: reset PCIe bus on a firmware crash")
Cc: stable@vger.kernel.org # v5.2+
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
---
Kalle: if you are planning another pull request for 5.4 you may push
       this to the wireless-drivers. Otherwise make it
       wireless-drivers-next and lets have stable maintainers pick it.
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Kalle Valo Nov. 19, 2019, 9:26 a.m. UTC | #1
Rafał Miłecki <zajec5@gmail.com> writes:

> From: Rafał Miłecki <rafal@milecki.pl>
>
> Keeping interrupts on could result in brcmfmac freeing some resources
> and then IRQ handlers trying to use them. That was obviously a straight
> path for crashing a kernel.
>
> Example:
> CPU0                           CPU1
> ----                           ----
> brcmf_pcie_reset
>   brcmf_pcie_bus_console_read
>   brcmf_detach
>     ...
>     brcmf_fweh_detach
>     brcmf_proto_detach
>                                brcmf_pcie_isr_thread
>                                  ...
>                                  brcmf_proto_msgbuf_rx_trigger
>                                    ...
>                                    drvr->proto->pd
>     brcmf_pcie_release_irq
>
> [  363.789218] Unable to handle kernel NULL pointer dereference at virtual address 00000038
> [  363.797339] pgd = c0004000
> [  363.800050] [00000038] *pgd=00000000
> [  363.803635] Internal error: Oops: 17 [#1] SMP ARM
> (...)
> [  364.029209] Backtrace:
> [  364.031725] [<bf243838>] (brcmf_proto_msgbuf_rx_trigger [brcmfmac]) from [<bf2471dc>] (brcmf_pcie_isr_thread+0x228/0x274 [brcmfmac])
> [  364.043662]  r7:00000001 r6:c8ca0000 r5:00010000 r4:c7b4f800
>
> Fixes: 4684997d9eea ("brcmfmac: reset PCIe bus on a firmware crash")
> Cc: stable@vger.kernel.org # v5.2+
> Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
> ---
> Kalle: if you are planning another pull request for 5.4 you may push
>        this to the wireless-drivers. Otherwise make it
>        wireless-drivers-next and lets have stable maintainers pick it.

Unless the sky falls down I'm not planning to submit anything for v5.4
anymore. So this has to go to -next.
Kalle Valo Nov. 20, 2019, 7:45 a.m. UTC | #2
Rafał Miłecki wrote:

> From: Rafał Miłecki <rafal@milecki.pl>
> 
> Keeping interrupts on could result in brcmfmac freeing some resources
> and then IRQ handlers trying to use them. That was obviously a straight
> path for crashing a kernel.
> 
> Example:
> CPU0                           CPU1
> ----                           ----
> brcmf_pcie_reset
>   brcmf_pcie_bus_console_read
>   brcmf_detach
>     ...
>     brcmf_fweh_detach
>     brcmf_proto_detach
>                                brcmf_pcie_isr_thread
>                                  ...
>                                  brcmf_proto_msgbuf_rx_trigger
>                                    ...
>                                    drvr->proto->pd
>     brcmf_pcie_release_irq
> 
> [  363.789218] Unable to handle kernel NULL pointer dereference at virtual address 00000038
> [  363.797339] pgd = c0004000
> [  363.800050] [00000038] *pgd=00000000
> [  363.803635] Internal error: Oops: 17 [#1] SMP ARM
> (...)
> [  364.029209] Backtrace:
> [  364.031725] [<bf243838>] (brcmf_proto_msgbuf_rx_trigger [brcmfmac]) from [<bf2471dc>] (brcmf_pcie_isr_thread+0x228/0x274 [brcmfmac])
> [  364.043662]  r7:00000001 r6:c8ca0000 r5:00010000 r4:c7b4f800
> 
> Fixes: 4684997d9eea ("brcmfmac: reset PCIe bus on a firmware crash")
> Cc: stable@vger.kernel.org # v5.2+
> Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

Patch applied to wireless-drivers-next.git, thanks.

5d26a6a6150c brcmfmac: disable PCIe interrupts before bus reset
diff mbox series

Patch

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index 3184dab41a5e..f64ce5074a55 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1425,6 +1425,8 @@  static int brcmf_pcie_reset(struct device *dev)
 	struct brcmf_fw_request *fwreq;
 	int err;
 
+	brcmf_pcie_intr_disable(devinfo);
+
 	brcmf_pcie_bus_console_read(devinfo, true);
 
 	brcmf_detach(dev);