From patchwork Sun Jun 19 16:23:24 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?UmFmYcWCIE1pxYJlY2tp?= X-Patchwork-Id: 9186205 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3E7A26075F for ; Sun, 19 Jun 2016 16:39:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2357A2040D for ; Sun, 19 Jun 2016 16:39:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 057A722BF1; Sun, 19 Jun 2016 16:39:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8F0362040D for ; Sun, 19 Jun 2016 16:39:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751313AbcFSQjl (ORCPT ); Sun, 19 Jun 2016 12:39:41 -0400 Received: from mail-lf0-f67.google.com ([209.85.215.67]:34094 "EHLO mail-lf0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751167AbcFSQjj (ORCPT ); Sun, 19 Jun 2016 12:39:39 -0400 Received: by mail-lf0-f67.google.com with SMTP id l184so3561083lfl.1; Sun, 19 Jun 2016 09:37:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=/gbvG4dBcK5JlnDbuc5y11z+4n2i12m+E2nvoOEERgM=; b=zhIzBRpsa+S5E3pObri+AkDP+JbCGObQPF1PGEiHP5W5c2vi29WxFWXpFnpucvS6m4 VT9nigrnPsWJX4XG34WyjuKfNQ0km0s3l0uvgFIDEpL7K0QDadBR+RB2F+aV9/Pv2cJm JVY5X2k4R+9rpvX8qIFMIyLvVzp3pliCcpXUFx3tHlVfqaAx6lex5U57lP0Qq2GMz/af hdfx5ithLJKIvPWrcwTp5nGZy7m6ALePgI0SodU5blI3EQ0x2dQrDTNqBV981XLTHQ6V 4KKUYSSSbUMTppD9RHU17UuSzG9SKitbCWLiONGQ99/0SYLvqVkMQdZrET1ZgJSWJ5SJ nLQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=/gbvG4dBcK5JlnDbuc5y11z+4n2i12m+E2nvoOEERgM=; b=BIswIVMiezDqGrvcdhCjYtX91So6pFhdc26nRocWjFaWr0QFaoxKKR7Yolkrixbxem FzbVQqDSrl5YZJBr0srS1sqI8w4YGxDQDxx0A9bic276qfJAlV28H1pwFwdtEXB02Dz6 Tsf4Rr2IEtqMhCILACYR0/1h+CXtqcq+3Q408cvhzfDsQoRPuIRSgxEnkZg+CLz0mrFF V5++oj00mqcsv+rK086+JC+7wl4xAMwEipsxWbMGbRA2ZGitwqIFr6tksabm3Sx4aL/K 2rpeuj2JQnsDzgDW3HbLxAM83Bp7D2kPfvpTpyV+S3e0O600ulcasRItgdMBwkGF6aI5 xlTQ== X-Gm-Message-State: ALyK8tLp8D6DLR3tsLwo23bwWPMglKAyst2zTY7k+yzy/BKtGdB9A2/lqkjfmavLo8FFtg== X-Received: by 10.46.71.82 with SMTP id u79mr2914960lja.18.1466353428253; Sun, 19 Jun 2016 09:23:48 -0700 (PDT) Received: from linux-samsung.lan (ip-194-187-74-233.konfederacka.maverick.com.pl. [194.187.74.233]) by smtp.gmail.com with ESMTPSA id g22sm4016139lji.43.2016.06.19.09.23.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 19 Jun 2016 09:23:47 -0700 (PDT) From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= To: Kalle Valo Cc: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= , Arend van Spriel , Franky Lin , Hante Meuleman , Pieter-Paul Giesberts , "Franky (Zhenhui) Lin" , linux-wireless@vger.kernel.org (open list:BROADCOM BRCM80211 IEEE802.11n WIRELESS DRIVER), brcm80211-dev-list.pdl@broadcom.com (open list:BROADCOM BRCM80211 IEEE802.11n WIRELESS DRIVER), netdev@vger.kernel.org (open list:NETWORKING DRIVERS), linux-kernel@vger.kernel.org (open list) Subject: [PATCH V2 RFC 1/2] brcmfmac: delete interface directly in code that sent fw request Date: Sun, 19 Jun 2016 18:23:24 +0200 Message-Id: <1466353420-30998-1-git-send-email-zajec5@gmail.com> X-Mailer: git-send-email 1.8.4.5 In-Reply-To: <1466273932-11554-1-git-send-email-zajec5@gmail.com> References: <1466273932-11554-1-git-send-email-zajec5@gmail.com> MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP So far when receiving event about in-firmware-interface removal our event worker was notifying listener and afterwards it was removing Linux interface. First of all it was resulting in slightly unexpected order. The listener (del_virtual_intf callback) was (usually) returning with success before we even called unregister_netdev(ice). Please note this couldn't be simply fixed by changing order of calls in brcmf_fweh_handle_if_event as unregistering interface earlier could free struct brcmf_if. Another problem of current implementation are possible lockups. Focus on the time slot between calling event handler and removing Linux interface. During that time original caller may leave (unlocking rtnl semaphore) *and* another call to the same code may be done (locking it again). If that happens our event handler will stuck at removing Linux interface, it won't handle another event and will block process holding rtnl lock. This can be simply solved by unregistering interface in a proper callback, right after receiving confirmation event from firmware. This only required modifying worker to don't unregister on its own if there is someone waiting for the event. Signed-off-by: Rafał Miłecki --- V2: Modification of brcmf_fweh_handle_if_event done in V1 was a wrong idea as it could result in use-after-free regarding struct brcmf_if. Thanks Arend for noticing that! --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 10 ++++++++-- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 +-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c index 9da7a4c..79c081f 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c @@ -18,6 +18,7 @@ #include "brcmu_wifi.h" #include "brcmu_utils.h" +#include "cfg80211.h" #include "core.h" #include "debug.h" #include "tracepoint.h" @@ -182,8 +183,13 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr, err = brcmf_fweh_call_event_handler(ifp, emsg->event_code, emsg, data); - if (ifp && ifevent->action == BRCMF_E_IF_DEL) - brcmf_remove_interface(ifp, false); + if (ifp && ifevent->action == BRCMF_E_IF_DEL) { + bool armed = brcmf_cfg80211_vif_event_armed(drvr->config); + + /* Default handling in case no-one waits for this event */ + if (!armed) + brcmf_remove_interface(ifp, false); + } } /** diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c index f6241fd..66f942f 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c @@ -2288,8 +2288,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev) else err = 0; } - if (err) - brcmf_remove_interface(vif->ifp, true); + brcmf_remove_interface(vif->ifp, true); brcmf_cfg80211_arm_vif_event(cfg, NULL); if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE)