From patchwork Wed Sep 21 09:19:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aran Dalton X-Patchwork-Id: 12983478 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D626DECAAD8 for ; Wed, 21 Sep 2022 09:20:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231607AbiIUJU0 (ORCPT ); Wed, 21 Sep 2022 05:20:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47078 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229733AbiIUJUA (ORCPT ); Wed, 21 Sep 2022 05:20:00 -0400 Received: from out29-196.mail.aliyun.com (out29-196.mail.aliyun.com [115.124.29.196]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0BD1B9080E; Wed, 21 Sep 2022 02:19:19 -0700 (PDT) X-Alimail-AntiSpam: AC=CONTINUE;BC=0.190038|-1;BR=01201311R781S98rulernew998_84748_2000303;CH=blue;DM=|CONTINUE|false|;DS=CONTINUE|ham_system_inform|0.0916624-0.0191534-0.889184;FP=0|0|0|0|0|-1|-1|-1;HT=ay29a033018047212;MF=arda@allwinnertech.com;NM=1;PH=DS;RN=9;RT=9;SR=0;TI=SMTPD_---.PKrbnBk_1663751956; Received: from SunxiBot.allwinnertech.com(mailfrom:arda@allwinnertech.com fp:SMTPD_---.PKrbnBk_1663751956) by smtp.aliyun-inc.com; Wed, 21 Sep 2022 17:19:17 +0800 From: Aran Dalton To: johannes@sipsolutions.net, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: johannes.berg@intel.com, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/2] cfg80211: fix dead lock for nl80211_new_interface() Date: Wed, 21 Sep 2022 17:19:12 +0800 Message-Id: <20220921091913.110749-1-arda@allwinnertech.com> X-Mailer: git-send-email 2.29.0 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Both nl80211_new_interface and cfg80211_netdev_notifier_call hold the same wiphy_lock, then cause deadlock. The main call stack as bellow: nl80211_new_interface() takes wiphy_lock -> _nl80211_new_interface: -> rdev_add_virtual_intf -> rdev->ops->add_virtual_intf -> register_netdevice -> call_netdevice_notifiers(NETDEV_REGISTER, dev); -> call_netdevice_notifiers_extack -> call_netdevice_notifiers_info -> raw_notifier_call_chain -> cfg80211_netdev_notifier_call -> wiphy_lock(&rdev->wiphy), cfg80211_register_wdev Fixes: ea6b2098dd02 ("cfg80211: fix locking in netlink owner interface destruction") Signed-off-by: Aran Dalton --- net/wireless/nl80211.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 2705e3ee8fc4..bdacddc3ffa3 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -4260,9 +4260,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) /* to avoid failing a new interface creation due to pending removal */ cfg80211_destroy_ifaces(rdev); - wiphy_lock(&rdev->wiphy); ret = _nl80211_new_interface(skb, info); - wiphy_unlock(&rdev->wiphy); return ret; } From patchwork Wed Sep 21 09:19:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aran Dalton X-Patchwork-Id: 12983479 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 87C19ECAAD8 for ; Wed, 21 Sep 2022 09:20:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230372AbiIUJUm (ORCPT ); Wed, 21 Sep 2022 05:20:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49422 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230403AbiIUJUP (ORCPT ); Wed, 21 Sep 2022 05:20:15 -0400 Received: from out29-148.mail.aliyun.com (out29-148.mail.aliyun.com [115.124.29.148]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 995EE239; Wed, 21 Sep 2022 02:19:28 -0700 (PDT) X-Alimail-AntiSpam: AC=CONTINUE;BC=0.08073047|-1;BR=01201311R111S08rulernew998_84748_2000303;CH=blue;DM=|CONTINUE|false|;DS=CONTINUE|ham_system_inform|0.0363558-0.00159698-0.962047;FP=0|0|0|0|0|-1|-1|-1;HT=ay29a033018047190;MF=arda@allwinnertech.com;NM=1;PH=DS;RN=9;RT=9;SR=0;TI=SMTPD_---.PKrbnDF_1663751957; Received: from SunxiBot.allwinnertech.com(mailfrom:arda@allwinnertech.com fp:SMTPD_---.PKrbnDF_1663751957) by smtp.aliyun-inc.com; Wed, 21 Sep 2022 17:19:25 +0800 From: Aran Dalton To: johannes@sipsolutions.net, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: johannes.berg@intel.com, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/2] cfg80211: fix dead lock for nl80211_del_interface() Date: Wed, 21 Sep 2022 17:19:13 +0800 Message-Id: <20220921091913.110749-2-arda@allwinnertech.com> X-Mailer: git-send-email 2.29.0 In-Reply-To: <20220921091913.110749-1-arda@allwinnertech.com> References: <20220921091913.110749-1-arda@allwinnertech.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Both nl80211_del_interface and cfg80211_netdev_notifier_call hold the same wiphy_lock, then cause deadlock. The main call stack as bellow: nl80211_del_interface() takes wiphy_lock -> cfg80211_remove_virtual_intf -> rdev_del_virtual_intf -> rdev->ops->del_virtual_intf -> cfg80211_unregister_netdevice -> cfg80211_unregister_wdev -> _cfg80211_unregister_wdev -> unregister_netdevice -> unregister_netdevice_queue -> unregister_netdevice_many -> call_netdevice_notifiers(NETDEV_UNREGISTER, dev); -> call_netdevice_notifiers_extack -> call_netdevice_notifiers_info -> raw_notifier_call_chain -> cfg80211_netdev_notifier_call -> wiphy_lock(&rdev->wiphy), _cfg80211_unregister_wdev Fixes: a05829a7222e ("cfg80211: avoid holding the RTNL when calling the driver") Signed-off-by: Aran Dalton --- net/wireless/nl80211.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index bdacddc3ffa3..664bf977b7bc 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -4269,6 +4269,7 @@ static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) { struct cfg80211_registered_device *rdev = info->user_ptr[0]; struct wireless_dev *wdev = info->user_ptr[1]; + int ret; if (!rdev->ops->del_virtual_intf) return -EOPNOTSUPP; @@ -4296,9 +4297,11 @@ static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) else dev_close(wdev->netdev); + ret = cfg80211_remove_virtual_intf(rdev, wdev); + mutex_lock(&rdev->wiphy.mtx); - return cfg80211_remove_virtual_intf(rdev, wdev); + return ret; } static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)