Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <1608515579-1066-1-git-send-email-miaoqing@codeaurora.org>
In-Reply-To: <1608515579-1066-1-git-send-email-miaoqing@codeaurora.org>
From:   Brian Norris <briannorris@chromium.org>
Date:   Mon, 21 Dec 2020 11:31:40 -0800
Message-ID: <CA+ASDXP8LotnQZNvXYZqfYH8za6rx1DaZmnH21TsO2NmzX+OZA@mail.gmail.com>
Subject: Re: [PATCH] ath10k: fix wmi mgmt tx queue full due to race condition
To:     Miaoqing Pan <miaoqing@codeaurora.org>
Cc:     ath10k <ath10k@lists.infradead.org>,
        linux-wireless <linux-wireless@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi,

On Sun, Dec 20, 2020 at 5:53 PM Miaoqing Pan <miaoqing@codeaurora.org> wrot=
e:
>
> Failed to transmit wmi management frames:
>
> [84977.840894] ath10k_snoc a000000.wifi: wmi mgmt tx queue is full
> [84977.840913] ath10k_snoc a000000.wifi: failed to transmit packet, dropp=
ing: -28
> [84977.840924] ath10k_snoc a000000.wifi: failed to submit frame: -28
> [84977.840932] ath10k_snoc a000000.wifi: failed to transmit frame: -28
>
> This issue is caused by race condition between skb_dequeue and
> __skb_queue_tail. The queue of =E2=80=98wmi_mgmt_tx_queue=E2=80=99 is pro=
tected by a
> different lock: ar->data_lock vs list->lock, the result is no protection.

Nice catch!

> --- a/drivers/net/wireless/ath/ath10k/mac.c
> +++ b/drivers/net/wireless/ath/ath10k/mac.c
> @@ -3763,23 +3763,16 @@ bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar=
)
>  static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb=
)
>  {
>         struct sk_buff_head *q =3D &ar->wmi_mgmt_tx_queue;
> -       int ret =3D 0;
> -
> -       spin_lock_bh(&ar->data_lock);
>
>         if (skb_queue_len(q) =3D=3D ATH10K_MAX_NUM_MGMT_PENDING) {

I believe you should be switching this to use skb_queue_len_lockless()
too. And this still probably leaves a TOCTOU race; maybe we should use
">=3D" here, in case we queue a few SKBs simultaneously? It doesn't seem
like we actually have a hard limit here, but it still seems like we
shouldn't leave this potential inconsistency.

Brian

>                 ath10k_warn(ar, "wmi mgmt tx queue is full\n");
> -               ret =3D -ENOSPC;
> -               goto unlock;
> +               return -ENOSPC;
>         }
>
> -       __skb_queue_tail(q, skb);
> +       skb_queue_tail(q, skb);
>         ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work);