From patchwork Fri Mar 28 04:05:26 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bing Zhao X-Patchwork-Id: 3900681 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 7DD25BF540 for ; Fri, 28 Mar 2014 04:05:50 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 8D57E20295 for ; Fri, 28 Mar 2014 04:05:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9723D20274 for ; Fri, 28 Mar 2014 04:05:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752151AbaC1EFp (ORCPT ); Fri, 28 Mar 2014 00:05:45 -0400 Received: from mx0a-0016f401.pphosted.com ([67.231.148.174]:6545 "EHLO mx0a-0016f401.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751744AbaC1EFo (ORCPT ); Fri, 28 Mar 2014 00:05:44 -0400 Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.14.5/8.14.5) with SMTP id s2S45egZ002281; Thu, 27 Mar 2014 21:05:40 -0700 Received: from sc-owa.marvell.com ([199.233.58.135]) by mx0a-0016f401.pphosted.com with ESMTP id 1jvg9m3bcq-1 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Thu, 27 Mar 2014 21:05:40 -0700 Received: from maili.marvell.com (10.93.76.43) by SC-OWA.marvell.com (10.93.76.28) with Microsoft SMTP Server id 8.3.327.1; Thu, 27 Mar 2014 21:05:39 -0700 Received: from u910-64.marvell.com (unknown [10.80.112.61]) by maili.marvell.com (Postfix) with ESMTP id 781D63F703F; Thu, 27 Mar 2014 21:05:39 -0700 (PDT) From: Bing Zhao To: CC: "John W. Linville" , Amitkumar Karwar , Avinash Patil , Maithili Hinge , Xinming Hu , Bing Zhao Subject: [PATCH] mwifiex: fix spinlock bad magic bug Date: Thu, 27 Mar 2014 21:05:26 -0700 Message-ID: <1395979526-2181-1-git-send-email-bzhao@marvell.com> X-Mailer: git-send-email 1.8.2.3 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.11.87, 1.0.14, 0.0.0000 definitions=2014-03-28_02:2014-03-27, 2014-03-28, 1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1402240000 definitions=main-1403270169 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Amitkumar Karwar [ 6630.450908] BUG: spinlock bad magic on CPU#1, ksdioirqd/mmc1/355 [ 6630.450914] Unable to handle kernel NULL pointer dereference at virtual address 0000004f [ 6630.450919] pgd = ecbd8000 [ 6630.450926] [0000004f] *pgd=00000000 [ 6630.450936] lock: 0xeea4ab08, .magic: 00000000, .owner: /-1, .owner_cpu: 0 [ 6630.450939] Backtrace: [ 6630.450956] [] (unwind_backtrace+0x0/0x118) from [] (dump_stack+0x28/0x30) [ 6630.450960] Internal error: Oops: 5 [#1] SMP ARM [ 6630.450964] Modules linked in: uvcvideo videobuf2_vmalloc [ 6630.450980] [] (dump_stack+0x28/0x30) from [] (spin_dump+0x80/0x94) [ 6630.450988] [] (spin_dump+0x80/0x94) from [] (spin_bug+0x2c/0x30) [ 6630.450996] [] (spin_bug+0x2c/0x30) from [] (do_raw_spin_lock+0x28/0x15c) [ 6630.451004] [] (do_raw_spin_lock+0x28/0x15c) from [] (_raw_spin_lock_irqsave+0x20/0x28) [ 6630.451016] [] (_raw_spin_lock_irqsave+0x20/0x28) from [] (mwifiex_exec_next_cmd +0x6c/0x45c [mwifiex]) [ 6630.451030] [] (mwifiex_exec_next_cmd+0x6c/0x45c [mwifiex]) from [] (mwifiex_main_process+0x2c8/0x464 [mwifiex]) [ 6630.451047] [] (mwifiex_main_process+0x2c8/0x464 [mwifiex]) from [] (mwifiex_sdio_interrupt+0xc8/0x1cc [mwifiex_sdio] [ 6630.451064] [] (mwifiex_sdio_interrupt+0xc8/0x1cc [mwifiex_sdio]) from [] (sdio_irq_thread+0x178/0x31c) [ 6630.451079] [] (sdio_irq_thread+0x178/0x31c) from [] (kthread+0xc8/0xd8) [ 6630.451095] [] (kthread+0xc8/0xd8) from [] (ret_from_fork+0x14/0x20) This bug has introduced/exposed due to recent patch in which we cancel pending commands before suspend (using hs_enabling flag). The NULL pointer is dereferenced when both mwifiex_cancel_all_pending_cmd() and mwifiex_exec_next_cmd() try to access cmd pending queue simultaneously. Signed-off-by: Amitkumar Karwar Signed-off-by: Bing Zhao --- drivers/net/wireless/mwifiex/cmdevt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c index a23791d..1062c91 100644 --- a/drivers/net/wireless/mwifiex/cmdevt.c +++ b/drivers/net/wireless/mwifiex/cmdevt.c @@ -981,11 +981,10 @@ mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter) struct mwifiex_private *priv; int i; + spin_lock_irqsave(&adapter->mwifiex_cmd_lock, cmd_flags); /* Cancel current cmd */ if ((adapter->curr_cmd) && (adapter->curr_cmd->wait_q_enabled)) { - spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags); adapter->curr_cmd->wait_q_enabled = false; - spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags); adapter->cmd_wait_q.status = -1; mwifiex_complete_cmd(adapter, adapter->curr_cmd); } @@ -1005,6 +1004,7 @@ mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter) spin_lock_irqsave(&adapter->cmd_pending_q_lock, flags); } spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, flags); + spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags); /* Cancel all pending scan command */ spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);