2021-02-01 12:30:14

by Dan Carpenter

[permalink] [raw]
Subject: [PATCH] ath11k: fix a locking bug in ath11k_mac_op_start()

This error path leads to a Smatch warning:

drivers/net/wireless/ath/ath11k/mac.c:4269 ath11k_mac_op_start()
error: double unlocked '&ar->conf_mutex' (orig line 4251)

We're not holding the lock when we do the "goto err;" so it leads to a
double unlock. We should hold the lock because the error path sets
"ar->state" so the right fix is to take the lock before doing the goto.

Fixes: c83c500b55b6 ("ath11k: enable idle power save mode")
Signed-off-by: Dan Carpenter <[email protected]>
---
drivers/net/wireless/ath/ath11k/mac.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index c1608f64ea95..12e981e9e3d7 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -4259,6 +4259,7 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
1, pdev->pdev_id);
if (ret) {
ath11k_err(ab, "failed to enable idle ps: %d\n", ret);
+ mutex_lock(&ar->conf_mutex);
goto err;
}
}
--
2.29.2


2021-02-01 21:48:52

by Peter Oh

[permalink] [raw]
Subject: Re: [PATCH] ath11k: fix a locking bug in ath11k_mac_op_start()


On 2/1/21 4:24 AM, Dan Carpenter wrote:
> This error path leads to a Smatch warning:
>
> drivers/net/wireless/ath/ath11k/mac.c:4269 ath11k_mac_op_start()
> error: double unlocked '&ar->conf_mutex' (orig line 4251)
>
> We're not holding the lock when we do the "goto err;" so it leads to a
> double unlock. We should hold the lock because the error path sets
> "ar->state" so the right fix is to take the lock before doing the goto.
>
> Fixes: c83c500b55b6 ("ath11k: enable idle power save mode")
> Signed-off-by: Dan Carpenter <[email protected]>
> ---
> drivers/net/wireless/ath/ath11k/mac.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
> index c1608f64ea95..12e981e9e3d7 100644
> --- a/drivers/net/wireless/ath/ath11k/mac.c
> +++ b/drivers/net/wireless/ath/ath11k/mac.c
> @@ -4259,6 +4259,7 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
> 1, pdev->pdev_id);
> if (ret) {
> ath11k_err(ab, "failed to enable idle ps: %d\n", ret);
> + mutex_lock(&ar->conf_mutex);
> goto err;
> }
> }
It seems moving idle_ps condition in between ath11k_wmi_pdev_lro_cfg()
and mutex_unlock()
 is a better way in this case.

Thanks,
Peter

2021-02-02 04:34:32

by Kalle Valo

[permalink] [raw]
Subject: Re: [PATCH] ath11k: fix a locking bug in ath11k_mac_op_start()

Peter Oh <[email protected]> writes:

> On 2/1/21 4:24 AM, Dan Carpenter wrote:
>> This error path leads to a Smatch warning:
>>
>> drivers/net/wireless/ath/ath11k/mac.c:4269 ath11k_mac_op_start()
>> error: double unlocked '&ar->conf_mutex' (orig line 4251)
>>
>> We're not holding the lock when we do the "goto err;" so it leads to a
>> double unlock. We should hold the lock because the error path sets
>> "ar->state" so the right fix is to take the lock before doing the goto.
>>
>> Fixes: c83c500b55b6 ("ath11k: enable idle power save mode")
>> Signed-off-by: Dan Carpenter <[email protected]>
>> ---
>> drivers/net/wireless/ath/ath11k/mac.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
>> index c1608f64ea95..12e981e9e3d7 100644
>> --- a/drivers/net/wireless/ath/ath11k/mac.c
>> +++ b/drivers/net/wireless/ath/ath11k/mac.c
>> @@ -4259,6 +4259,7 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
>> 1, pdev->pdev_id);
>> if (ret) {
>> ath11k_err(ab, "failed to enable idle ps: %d\n", ret);
>> + mutex_lock(&ar->conf_mutex);
>> goto err;
>> }
>> }
>
> It seems moving idle_ps condition in between ath11k_wmi_pdev_lro_cfg()
> and mutex_unlock()
>  is a better way in this case.

I agree. In Dan's approach I'm worried about the race when we unlock and
lock again, the state can change in that case.

--
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches