On 2019-03-10 23:47, Lorenzo Bianconi wrote:
> Fix following schedule while atomic mt76x02_reset_state
> since synchronize_rcu is run inside a RCU section
>
> [44036.944222] mt76x2e 0000:06:00.0: MCU message 31 (seq 3) timed out
> [44036.944281] BUG: sleeping function called from invalid context at kernel/rcu/tree_exp.h:818
> [44036.944284] in_atomic(): 1, irqs_disabled(): 0, pid: 28066, name: kworker/u4:1
> [44036.944287] INFO: lockdep is turned off.
> [44036.944292] CPU: 1 PID: 28066 Comm: kworker/u4:1 Tainted: G W 5.0.0-rc7-wdn-t1+ #7
> [44036.944294] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
> [44036.944305] Workqueue: phy1 mt76x02_wdt_work [mt76x02_lib]
> [44036.944308] Call Trace:
> [44036.944317] dump_stack+0x67/0x90
> [44036.944322] ___might_sleep.cold.88+0x9f/0xaf
> [44036.944327] rcu_blocking_is_gp+0x13/0x50
> [44036.944330] synchronize_rcu+0x17/0x80
> [44036.944337] mt76_sta_state+0x138/0x1d0 [mt76]
> [44036.944349] mt76x02_wdt_work+0x1c9/0x610 [mt76x02_lib]
> [44036.944355] process_one_work+0x2a5/0x620
> [44036.944361] worker_thread+0x35/0x3e0
> [44036.944368] kthread+0x11c/0x140
> [44036.944376] ret_from_fork+0x3a/0x50
> [44036.944384] BUG: scheduling while atomic: kworker/u4:1/28066/0x00000002
> [44036.944387] INFO: lockdep is turned off.
> [44036.944389] Modules linked in: cmac ctr ccm af_packet snd_hda_codec_hdmi
>
> Introduce __mt76_sta_remove in order to run sta_remove without holding dev->mutex.
> Move __mt76_sta_remove outside RCU section in mt76x02_reset_state
>
> Fixes: e4ebb8b403d1 ("mt76: mt76x2: implement full device restart on watchdog reset")
> Signed-off-by: Lorenzo Bianconi <lorenzo@xxxxxxxxxx>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c
> index 6a34a6afcfe4..898afcbcdf52 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c
> @@ -419,6 +419,7 @@ static void mt76x02_key_sync(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
> mt76x02_mac_wcid_sync_pn(dev, wcid->idx, key);
> }
>
> +/* need to run with mt76.mutex held */
> static void mt76x02_reset_state(struct mt76x02_dev *dev)
You can replace that comment with a call to lockdep_assert_held in the
function.
> @@ -426,11 +427,11 @@ static void mt76x02_reset_state(struct mt76x02_dev *dev)
> clear_bit(MT76_STATE_RUNNING, &dev->mt76.state);
>
> rcu_read_lock();
> -
> ieee80211_iter_keys_rcu(dev->mt76.hw, NULL, mt76x02_key_sync, NULL);
> + rcu_read_unlock();
>
> for (i = 0; i < ARRAY_SIZE(dev->mt76.wcid); i++) {
> - struct mt76_wcid *wcid = rcu_dereference(dev->mt76.wcid[i]);
> + struct mt76_wcid *wcid = dev->mt76.wcid[i];
This should use rcu_dereference_protected() instead of accessing the
pointer directly.
Thanks,
- Felix
