Commit 13f61dfc authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by Kalle Valo
Browse files

mt76: fix schedule while atomic in mt76x02_reset_state 



Fix following schedule while atomic in mt76x02_reset_state
since synchronize_rcu is run inside a RCU section

[44036.944222] mt76x2e 0000:06:00.0: MCU message 31 (seq 3) timed out
[44036.944281] BUG: sleeping function called from invalid context at kernel/rcu/tree_exp.h:818
[44036.944284] in_atomic(): 1, irqs_disabled(): 0, pid: 28066, name: kworker/u4:1
[44036.944287] INFO: lockdep is turned off.
[44036.944292] CPU: 1 PID: 28066 Comm: kworker/u4:1 Tainted: G        W         5.0.0-rc7-wdn-t1+ #7
[44036.944294] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
[44036.944305] Workqueue: phy1 mt76x02_wdt_work [mt76x02_lib]
[44036.944308] Call Trace:
[44036.944317]  dump_stack+0x67/0x90
[44036.944322]  ___might_sleep.cold.88+0x9f/0xaf
[44036.944327]  rcu_blocking_is_gp+0x13/0x50
[44036.944330]  synchronize_rcu+0x17/0x80
[44036.944337]  mt76_sta_state+0x138/0x1d0 [mt76]
[44036.944349]  mt76x02_wdt_work+0x1c9/0x610 [mt76x02_lib]
[44036.944355]  process_one_work+0x2a5/0x620
[44036.944361]  worker_thread+0x35/0x3e0
[44036.944368]  kthread+0x11c/0x140
[44036.944376]  ret_from_fork+0x3a/0x50
[44036.944384] BUG: scheduling while atomic: kworker/u4:1/28066/0x00000002
[44036.944387] INFO: lockdep is turned off.
[44036.944389] Modules linked in: cmac ctr ccm af_packet snd_hda_codec_hdmi

Introduce __mt76_sta_remove in order to run sta_remove without holding dev->mutex.
Move __mt76_sta_remove outside of RCU section in mt76x02_reset_state

Fixes: e4ebb8b403d1 ("mt76: mt76x2: implement full device restart on watchdog reset")
Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent f2a00a82

drivers/net/wireless/mediatek/mt76/mac80211.c

+11 −7
Original line number Diff line number Diff line
@@ -679,19 +679,15 @@ out: 
	return ret;

}



static void

mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,

void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,

		       struct ieee80211_sta *sta)

{

	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;

	int idx = wcid->idx;

	int i;

	int i, idx = wcid->idx;



	rcu_assign_pointer(dev->wcid[idx], NULL);

	synchronize_rcu();



	mutex_lock(&dev->mutex);



	if (dev->drv->sta_remove)

		dev->drv->sta_remove(dev, vif, sta);
@@ -699,7 +695,15 @@ mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif, 
	for (i = 0; i < ARRAY_SIZE(sta->txq); i++)

		mt76_txq_remove(dev, sta->txq[i]);

	mt76_wcid_free(dev->wcid_mask, idx);

}

EXPORT_SYMBOL_GPL(__mt76_sta_remove);



static void

mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,

		struct ieee80211_sta *sta)

{

	mutex_lock(&dev->mutex);

	__mt76_sta_remove(dev, vif, sta);

	mutex_unlock(&dev->mutex);

}

drivers/net/wireless/mediatek/mt76/mt76.h

+2 −0
Original line number Diff line number Diff line
@@ -695,6 +695,8 @@ int mt76_sta_state(struct ieee80211_hw *hw, struct ieee80211_vif *vif, 
		   struct ieee80211_sta *sta,

		   enum ieee80211_sta_state old_state,

		   enum ieee80211_sta_state new_state);

void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,

		       struct ieee80211_sta *sta);



struct ieee80211_sta *mt76_rx_convert(struct sk_buff *skb);

drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c

+10 −9
Original line number Diff line number Diff line
@@ -441,19 +441,23 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev) 
{

	int i;



	lockdep_assert_held(&dev->mt76.mutex);



	clear_bit(MT76_STATE_RUNNING, &dev->mt76.state);



	rcu_read_lock();



	ieee80211_iter_keys_rcu(dev->mt76.hw, NULL, mt76x02_key_sync, NULL);

	rcu_read_unlock();



	for (i = 0; i < ARRAY_SIZE(dev->mt76.wcid); i++) {

		struct mt76_wcid *wcid = rcu_dereference(dev->mt76.wcid[i]);

		struct mt76x02_sta *msta;

		struct ieee80211_sta *sta;

		struct ieee80211_vif *vif;

		struct mt76x02_sta *msta;

		struct mt76_wcid *wcid;

		void *priv;



		wcid = rcu_dereference_protected(dev->mt76.wcid[i],

					lockdep_is_held(&dev->mt76.mutex));

		if (!wcid)

			continue;
@@ -463,13 +467,10 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev) 
		priv = msta->vif;

		vif = container_of(priv, struct ieee80211_vif, drv_priv);



		mt76_sta_state(dev->mt76.hw, vif, sta,

			       IEEE80211_STA_NONE, IEEE80211_STA_NOTEXIST);

		__mt76_sta_remove(&dev->mt76, vif, sta);

		memset(msta, 0, sizeof(*msta));

	}



	rcu_read_unlock();



	dev->vif_mask = 0;

	dev->beacon_mask = 0;

}
@@ -489,11 +490,11 @@ static void mt76x02_watchdog_reset(struct mt76x02_dev *dev) 
	for (i = 0; i < ARRAY_SIZE(dev->mt76.napi); i++)

		napi_disable(&dev->mt76.napi[i]);



	mutex_lock(&dev->mt76.mutex);



	if (restart)

		mt76x02_reset_state(dev);



	mutex_lock(&dev->mt76.mutex);



	if (dev->beacon_mask)

		mt76_clear(dev, MT_BEACON_TIME_CFG,

			   MT_BEACON_TIME_CFG_BEACON_TX |

CRA Git | Maintained and supported by SUSTech CRA and CCSE