From patchwork Mon Jul 30 06:10:51 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tamizh chelvam X-Patchwork-Id: 10548455 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8CB03157D for ; Mon, 30 Jul 2018 06:11:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7BD4D29762 for ; Mon, 30 Jul 2018 06:11:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6F92829772; Mon, 30 Jul 2018 06:11:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id C5F2F29762 for ; Mon, 30 Jul 2018 06:11:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=e/XQyWm3aHzAOlmZ18xw8Cql8Nsc+WK2KXI2qin3Oh4=; b=lpe D6eTbIdu6ZNa4l9iRbBOJvFMZlChRMv2rNqdo8jg8NaQf8oUjjB6cVWO7hquKxeClw/Hq6psuP1qE /vb2SDQFETZ4/UspWXSgB2pa6RgJVz4M5JKOUBojs9HWWAz+KNM4ncYWDvjNliJVkGwyqPkylg04I yV3NkjRanELCaWi2E9OP9ZvkDehtlEqHpWiBkvC9bi3OqV685tm+feBOgI6Wg3vblMrhEdxbxTVCs yNqtj/mVJyxCCyWp7JbvVBovFZHYi7C5Bdzme7xB4OaIXNAw/+WRpAl/HFyLSX0FrIUx+X69x8y72 OJK1KpNC7dF3itTsC9eNVpcwtnwZRew==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fk1Ou-00073E-Tm; Mon, 30 Jul 2018 06:11:24 +0000 Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fk1Or-00072Y-Qk for ath10k@lists.infradead.org; Mon, 30 Jul 2018 06:11:23 +0000 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 28AE7615C0; Mon, 30 Jul 2018 06:11:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1532931069; bh=qIJkBUs1aRR0gzNf6ntGVyJ1yOlSvV4TzP0PLQ3o3/I=; h=From:To:Cc:Subject:Date:From; b=ONn67KN5+gI1wnfHm20f+TKq3b2WMld+defgK4qdlioB6QxFLvTg6gFFB3rZtkmaP zqppRGUQPjY4Tt97Tg3gAFDN6jsX7mPMKLoaX5d0XqTgf6Nrj+hsPpGqMJDUYRPki+ jUQjSWPtAa4ZPGfp8dO3EKV1M4Aqo2rWk2/NObnI= Received: from cheath10p342229-lin.qca.qualcomm.com (blr-c-bdr-fw-01_globalnat_allzones-outside.qualcomm.com [103.229.19.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: tamizhr@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id C3891615C0; Mon, 30 Jul 2018 06:11:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1532931068; bh=qIJkBUs1aRR0gzNf6ntGVyJ1yOlSvV4TzP0PLQ3o3/I=; h=From:To:Cc:Subject:Date:From; b=DGmpRB5fbplErHAEMeX9g0AkWpWszr5mvj6446knkVS3iRWykCr8kDlkyHSZSFcJ0 IZjII75VpIjz1s0CCJRgfmjW/mYKB+90YztlnBWsuQnvCn9axbujE4yihmbDrgMOfx YXXfcNWqsJQM2zGtJv8V9sqfWB2K5bTQYMEj+ZCA= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org C3891615C0 Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=tamizhr@codeaurora.org From: Tamizh chelvam To: ath10k@lists.infradead.org Subject: [PATCH] ath10k: fix kernel panic by moving pci flush after napi_disable Date: Mon, 30 Jul 2018 11:40:51 +0530 Message-Id: <1532931051-20118-1-git-send-email-tamizhr@codeaurora.org> X-Mailer: git-send-email 1.9.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180729_231121_906165_48303A8B X-CRM114-Status: GOOD ( 11.97 ) X-BeenThere: ath10k@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-wireless@vger.kernel.org, Tamizh chelvam MIME-Version: 1.0 Sender: "ath10k" Errors-To: ath10k-bounces+patchwork-ath10k=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP When continuously running wifi up/down sequence, the napi poll can be scheduled after the CE buffers being freed by ath10k_pci_flush Steps: In a certain condition, during wifi down below scenario might occur. ath10k_stop->ath10k_hif_stop->napi_schedule->ath10k_pci_flush->napi_poll(napi_synchronize). In the above scenario, CE buffer entries will be freed up and become NULL in ath10k_pci_flush. And the napi_poll has been invoked after the flush process and it will try to get the skb from the CE buffer entry and perform some action on that. Since the CE buffer already cleaned by pci flush this action will create NULL pointer dereference and trigger below kernel panic. Unable to handle kernel NULL pointer dereference at virtual address 0000005c PC is at ath10k_pci_htt_rx_cb+0x64/0x3ec [ath10k_pci] ath10k_pci_htt_rx_cb [ath10k_pci] ath10k_ce_per_engine_service+0x74/0xc4 [ath10k_pci] ath10k_ce_per_engine_service [ath10k_pci] ath10k_ce_per_engine_service_any+0x74/0x80 [ath10k_pci] ath10k_ce_per_engine_service_any [ath10k_pci] ath10k_pci_napi_poll+0x48/0xec [ath10k_pci] ath10k_pci_napi_poll [ath10k_pci] net_rx_action+0xac/0x160 net_rx_action __do_softirq+0xdc/0x208 __do_softirq irq_exit+0x84/0xe0 irq_exit __handle_domain_irq+0x80/0xa0 __handle_domain_irq gic_handle_irq+0x38/0x5c gic_handle_irq __irq_usr+0x44/0x60 Tested on QCA4019 and firmware version 10.4.3.2.1.1-00010 Signed-off-by: Tamizh chelvam --- drivers/net/wireless/ath/ath10k/ahb.c | 4 ++-- drivers/net/wireless/ath/ath10k/pci.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c index fa39fff..e244dc5 100644 --- a/drivers/net/wireless/ath/ath10k/ahb.c +++ b/drivers/net/wireless/ath/ath10k/ahb.c @@ -660,10 +660,10 @@ static void ath10k_ahb_hif_stop(struct ath10k *ar) ath10k_ahb_irq_disable(ar); synchronize_irq(ar_ahb->irq); - ath10k_pci_flush(ar); - napi_synchronize(&ar->napi); napi_disable(&ar->napi); + + ath10k_pci_flush(ar); } static int ath10k_ahb_hif_power_up(struct ath10k *ar) diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c index af2cf55..97fa5c7 100644 --- a/drivers/net/wireless/ath/ath10k/pci.c +++ b/drivers/net/wireless/ath/ath10k/pci.c @@ -2068,9 +2068,9 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) ath10k_pci_irq_disable(ar); ath10k_pci_irq_sync(ar); - ath10k_pci_flush(ar); napi_synchronize(&ar->napi); napi_disable(&ar->napi); + ath10k_pci_flush(ar); spin_lock_irqsave(&ar_pci->ps_lock, flags); WARN_ON(ar_pci->ps_wake_refcount > 0);