This is a note to let you know that I've just added the patch titled
mac80211: fix deadlock in AP/VLAN handling
to the 5.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
mac80211-fix-deadlock-in-ap-vlan-handling.patch
and it can be found in the queue-5.12 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From d5befb224edbe53056c2c18999d630dafb4a08b9 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@xxxxxxxxx>
Date: Mon, 17 May 2021 16:03:23 +0200
Subject: mac80211: fix deadlock in AP/VLAN handling
From: Johannes Berg <johannes.berg@xxxxxxxxx>
commit d5befb224edbe53056c2c18999d630dafb4a08b9 upstream.
Syzbot reports that when you have AP_VLAN interfaces that are up
and close the AP interface they belong to, we get a deadlock. No
surprise - since we dev_close() them with the wiphy mutex held,
which goes back into the netdev notifier in cfg80211 and tries to
acquire the wiphy mutex there.
To fix this, we need to do two things:
1) prevent changing iftype while AP_VLANs are up, we can't
easily fix this case since cfg80211 already calls us with
the wiphy mutex held, but change_interface() is relatively
rare in drivers anyway, so changing iftype isn't used much
(and userspace has to fall back to down/change/up anyway)
2) pull the dev_close() loop over VLANs out of the wiphy mutex
section in the normal stop case
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: syzbot+452ea4fbbef700ff0a56@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: a05829a7222e ("cfg80211: avoid holding the RTNL when calling the driver")
Link: https://lore.kernel.org/r/20210517160322.9b8f356c0222.I392cb0e2fa5a1a94cf2e637555d702c7e512c1ff@changeid
Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/mac80211/iface.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -475,14 +475,7 @@ static void ieee80211_do_stop(struct iee
GFP_KERNEL);
}
- /* APs need special treatment */
if (sdata->vif.type == NL80211_IFTYPE_AP) {
- struct ieee80211_sub_if_data *vlan, *tmpsdata;
-
- /* down all dependent devices, that is VLANs */
- list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
- u.vlan.list)
- dev_close(vlan->dev);
WARN_ON(!list_empty(&sdata->u.ap.vlans));
} else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
/* remove all packets in parent bc_buf pointing to this dev */
@@ -640,6 +633,15 @@ static int ieee80211_stop(struct net_dev
{
struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ /* close all dependent VLAN interfaces before locking wiphy */
+ if (sdata->vif.type == NL80211_IFTYPE_AP) {
+ struct ieee80211_sub_if_data *vlan, *tmpsdata;
+
+ list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
+ u.vlan.list)
+ dev_close(vlan->dev);
+ }
+
wiphy_lock(sdata->local->hw.wiphy);
ieee80211_do_stop(sdata, true);
wiphy_unlock(sdata->local->hw.wiphy);
@@ -1589,6 +1591,9 @@ static int ieee80211_runtime_change_ifty
switch (sdata->vif.type) {
case NL80211_IFTYPE_AP:
+ if (!list_empty(&sdata->u.ap.vlans))
+ return -EBUSY;
+ break;
case NL80211_IFTYPE_STATION:
case NL80211_IFTYPE_ADHOC:
case NL80211_IFTYPE_OCB:
Patches currently in stable-queue which might be from johannes.berg@xxxxxxxxx are
queue-5.12/mac80211-fix-null-ptr-deref-for-injected-rate-info.patch
queue-5.12/cfg80211-avoid-double-free-of-pmsr-request.patch
queue-5.12/cfg80211-shut-down-interfaces-on-failed-resume.patch
queue-5.12/cfg80211-fix-phy80211-symlink-creation.patch
queue-5.12/mac80211-minstrel_ht-fix-sample-time-check.patch
queue-5.12/mac80211-fix-deadlock-in-ap-vlan-handling.patch
queue-5.12/cfg80211-make-certificate-generation-more-robust.patch
queue-5.12/staging-rtl8723bs-fix-monitor-netdev-register-unregi.patch
queue-5.12/mac80211-move-interface-shutdown-out-of-wiphy-lock.patch
queue-5.12/mac80211-fix-reset-debugfs-locking.patch
queue-5.12/mac80211-fix-skb-length-check-in-ieee80211_scan_rx.patch
