Received: by 2002:ac0:a5b6:0:0:0:0:0 with SMTP id m51-v6csp2504020imm; Mon, 28 May 2018 09:18:53 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqkGOvjWfn1XFuXVruNJzOIqS/vMW0PAqHtdQQAcgCE8o+W+pNbEXRvv5ua6XyIV70oSTWz X-Received: by 2002:a63:b907:: with SMTP id z7-v6mr11239230pge.9.1527524333014; Mon, 28 May 2018 09:18:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1527524332; cv=none; d=google.com; s=arc-20160816; b=C7VSF2PzbFVlb9xTucyeH7e+rXDSoM3/rVn8b84WHw4QbWUSwnedE6JwnwJI/Ox2Z1 wAzJiL6E2+mUcyQjjFm+yuarNs7lRt0cj8A2QMyZPcaiLRKhzgvCzhrWjiQLgmDP7m60 +olZuIo1ATXo3J/Ld04MFieUchRXHsuVJaY/GzsNL4Dx1Lf/10CVv0g0cpXO71JCnIKl 02oZwlFMuClmmDL/coLHYO15AbyIh11jYHR3sQwgx3/RFFHxU45pqFQ7/Ud0drhRI5nV iX98qVpIo+WDlsidBd9U1+Muq3uFc0Xew1ijC1vvdw/NOh3EgtcbpCyH+LFjPTwO461y uE3w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature :arc-authentication-results; bh=D/s0D/3y83tF94ij2JgWR7JZlSc6h+KpDkKCzrGu04I=; b=jpaPztlETy4Rj1dpuJ7ndM3zfQuvu4iMzV6IyBPYd5TzP+64R4ovQDMlUEoLdqiwxW HEmaiGl9NZnWUs7aKnYIa8iQ3loOqvpD9LSlSSKqMToEUIZo8xv9TZMAc6mZa+ZUBmR7 e+ENb3EYXZCYOzWwcyb5mooHVoSlCraKHgosIc766cHhtHxp5Xow5B4ax3s8PW07WG7+ 4R9Kymd0+rtptvdCD+sckHRPUHDurcd+o8YRJQ9D998ZnlqkxnlhoIS92geoIzv6Mf+k MYAqswFWjjnSpzUlxmqSKcWyD+2n6juPGSnmSd6OC2/9M5Y9EPiTgxVIyiTN22Ds/Q9V 0VOg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=WIwkt+5r; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id o73-v6si30537561pfg.327.2018.05.28.09.18.38; Mon, 28 May 2018 09:18:52 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=WIwkt+5r; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S939959AbeE1QSE (ORCPT + 99 others); Mon, 28 May 2018 12:18:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:60658 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S936470AbeE1KMb (ORCPT ); Mon, 28 May 2018 06:12:31 -0400 Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6D1CE2089E; Mon, 28 May 2018 10:12:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1527502350; bh=NxFNQBzmwv37grUakCSOYBqcHUB1/Aiy0ORQEzdXSWI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WIwkt+5rhNpQh3rQ78HzYiawEq90QgeQw0gp7ZnG4RQYozY6bHaUebhUQrE+x1Dyo 7R3peNZ63YRSQ+toWAfLLnpI42oQ/MyDSaFslNDoiPukZCwDEIv+LzaBwHJeTOwKyw Hfn7nhJXfSGTVGK5G2tlUFO7OwQpbv11OKhym2HI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Karthikeyan Periyasamy , Kalle Valo , Sasha Levin Subject: [PATCH 3.18 137/185] ath10k: Fix kernel panic while using worker (ath10k_sta_rc_update_wk) Date: Mon, 28 May 2018 12:02:58 +0200 Message-Id: <20180528100106.279343920@linuxfoundation.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180528100050.700971285@linuxfoundation.org> References: <20180528100050.700971285@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Karthikeyan Periyasamy [ Upstream commit 8b2d93dd22615cb7f3046a5a2083a6f8bb8052ed ] When attempt to run worker (ath10k_sta_rc_update_wk) after the station object (ieee80211_sta) delete will trigger the kernel panic. This problem arise in AP + Mesh configuration, Where the current node AP VAP and neighbor node mesh VAP MAC address are same. When the current mesh node try to establish the mesh link with neighbor node, driver peer creation for the neighbor mesh node fails due to duplication MAC address. Already the AP VAP created with same MAC address. It is caused by the following scenario steps. Steps: 1. In above condition, ath10k driver sta_state callback (ath10k_sta_state) fails to do the state change for a station from IEEE80211_STA_NOTEXIST to IEEE80211_STA_NONE due to peer creation fails. Sta_state callback is called from ieee80211_add_station() to handle the new station (neighbor mesh node) request from the wpa_supplicant. 2. Concurrently ath10k receive the sta_rc_update callback notification from the mesh_neighbour_update() to handle the beacon frames of the above neighbor mesh node. since its atomic callback, ath10k driver queue the work (ath10k_sta_rc_update_wk) to handle rc update. 3. Due to driver sta_state callback fails (step 1), mac80211 free the station object. 4. When the worker (ath10k_sta_rc_update_wk) scheduled to run, it will access the station object which is already deleted. so it will trigger kernel panic. Added the peer exist check in sta_rc_update callback before queue the work. Kernel Panic log: Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = c0204000 [00000000] *pgd=00000000 Internal error: Oops: 17 [#1] PREEMPT SMP ARM CPU: 1 PID: 1833 Comm: kworker/u4:2 Not tainted 3.14.77 #1 task: dcef0000 ti: d72b6000 task.ti: d72b6000 PC is at pwq_activate_delayed_work+0x10/0x40 LR is at pwq_activate_delayed_work+0xc/0x40 pc : [] lr : [] psr: 40000193 sp : d72b7f18 ip : 0000007a fp : d72b6000 r10: 00000000 r9 : dd404414 r8 : d8c31998 r7 : d72b6038 r6 : 00000004 r5 : d4907ec8 r4 : dcee1300 r3 : ffffffe0 r2 : 00000000 r1 : 00000001 r0 : 00000000 Flags: nZcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel Control: 10c5787d Table: 595bc06a DAC: 00000015 ... Process kworker/u4:2 (pid: 1833, stack limit = 0xd72b6238) Stack: (0xd72b7f18 to 0xd72b8000) 7f00: 00000001 dcee1300 7f20: 00000001 c02410dc d8c31980 dd404400 dd404400 c0242790 d8c31980 00000089 7f40: 00000000 d93e1340 00000000 d8c31980 c0242568 00000000 00000000 00000000 7f60: 00000000 c02474dc 00000000 00000000 000000f8 d8c31980 00000000 00000000 7f80: d72b7f80 d72b7f80 00000000 00000000 d72b7f90 d72b7f90 d72b7fac d93e1340 7fa0: c0247404 00000000 00000000 c0208d20 00000000 00000000 00000000 00000000 7fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [] (pwq_activate_delayed_work) from [] (pwq_dec_nr_in_flight+0x58/0xc4) [] (pwq_dec_nr_in_flight) from [] (worker_thread+0x228/0x360) [] (worker_thread) from [] (kthread+0xd8/0xec) [] (kthread) from [] (ret_from_fork+0x14/0x34) Code: e92d4038 e1a05000 ebffffbc[69210.619376] SMP: failed to stop secondary CPUs Rebooting in 3 seconds.. Signed-off-by: Karthikeyan Periyasamy Signed-off-by: Kalle Valo Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/ath/ath10k/mac.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c @@ -4319,10 +4319,20 @@ static void ath10k_sta_rc_update(struct { struct ath10k *ar = hw->priv; struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv; + struct ath10k_vif *arvif = (void *)vif->drv_priv; + struct ath10k_peer *peer; u32 bw, smps; spin_lock_bh(&ar->data_lock); + peer = ath10k_peer_find(ar, arvif->vdev_id, sta->addr); + if (!peer) { + spin_unlock_bh(&ar->data_lock); + ath10k_warn(ar, "mac sta rc update failed to find peer %pM on vdev %i\n", + sta->addr, arvif->vdev_id); + return; + } + ath10k_dbg(ar, ATH10K_DBG_MAC, "mac sta rc update for %pM changed %08x bw %d nss %d smps %d\n", sta->addr, changed, sta->bandwidth, sta->rx_nss,