Skip to content

Commit ce3653a

Browse files
jerome-pouillergregkh
authored andcommitted
staging: wfx: fix potential use before init
The trace below can appear: [83613.832200] INFO: trying to register non-static key. [83613.837248] the code is fine but needs lockdep annotation. [83613.842808] turning off the locking correctness validator. [83613.848375] CPU: 3 PID: 141 Comm: kworker/3:2H Tainted: G O 5.6.13-silabs15 #2 [83613.857019] Hardware name: BCM2835 [83613.860605] Workqueue: events_highpri bh_work [wfx] [83613.865552] Backtrace: [83613.868041] [<c010f2cc>] (dump_backtrace) from [<c010f7b8>] (show_stack+0x20/0x24) [83613.881463] [<c010f798>] (show_stack) from [<c0d82138>] (dump_stack+0xe8/0x114) [83613.888882] [<c0d82050>] (dump_stack) from [<c01a02ec>] (register_lock_class+0x748/0x768) [83613.905035] [<c019fba4>] (register_lock_class) from [<c019da04>] (__lock_acquire+0x88/0x13dc) [83613.924192] [<c019d97c>] (__lock_acquire) from [<c019f6a4>] (lock_acquire+0xe8/0x274) [83613.942644] [<c019f5bc>] (lock_acquire) from [<c0daa5dc>] (_raw_spin_lock_irqsave+0x58/0x6c) [83613.961714] [<c0daa584>] (_raw_spin_lock_irqsave) from [<c0ab3248>] (skb_dequeue+0x24/0x78) [83613.974967] [<c0ab3224>] (skb_dequeue) from [<bf330db0>] (wfx_tx_queues_get+0x96c/0x1294 [wfx]) [83613.989728] [<bf330444>] (wfx_tx_queues_get [wfx]) from [<bf320454>] (bh_work+0x454/0x26d8 [wfx]) [83614.009337] [<bf320000>] (bh_work [wfx]) from [<c014c920>] (process_one_work+0x23c/0x7ec) [83614.028141] [<c014c6e4>] (process_one_work) from [<c014cf1c>] (worker_thread+0x4c/0x55c) [83614.046861] [<c014ced0>] (worker_thread) from [<c0154c04>] (kthread+0x138/0x168) [83614.064876] [<c0154acc>] (kthread) from [<c01010b4>] (ret_from_fork+0x14/0x20) [83614.072200] Exception stack(0xecad3fb0 to 0xecad3ff8) [83614.077323] 3fa0: 00000000 00000000 00000000 00000000 [83614.085620] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [83614.093914] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 Indeed, the code of wfx_add_interface() shows that the interface is enabled to early. So, the spinlock associated with some skb_queue may not yet initialized when wfx_tx_queues_get() is called. Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Link: https://lore.kernel.org/r/20200825085828.399505-8-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 7373f31 commit ce3653a

File tree

1 file changed

+14
-14
lines changed

1 file changed

+14
-14
lines changed

drivers/staging/wfx/sta.c

+14-14
Original file line numberDiff line numberDiff line change
@@ -759,17 +759,6 @@ int wfx_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
759759
return -EOPNOTSUPP;
760760
}
761761

762-
for (i = 0; i < ARRAY_SIZE(wdev->vif); i++) {
763-
if (!wdev->vif[i]) {
764-
wdev->vif[i] = vif;
765-
wvif->id = i;
766-
break;
767-
}
768-
}
769-
if (i == ARRAY_SIZE(wdev->vif)) {
770-
mutex_unlock(&wdev->conf_mutex);
771-
return -EOPNOTSUPP;
772-
}
773762
// FIXME: prefer use of container_of() to get vif
774763
wvif->vif = vif;
775764
wvif->wdev = wdev;
@@ -786,12 +775,22 @@ int wfx_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
786775
init_completion(&wvif->scan_complete);
787776
INIT_WORK(&wvif->scan_work, wfx_hw_scan_work);
788777

789-
mutex_unlock(&wdev->conf_mutex);
778+
wfx_tx_queues_init(wvif);
779+
wfx_tx_policy_init(wvif);
780+
781+
for (i = 0; i < ARRAY_SIZE(wdev->vif); i++) {
782+
if (!wdev->vif[i]) {
783+
wdev->vif[i] = vif;
784+
wvif->id = i;
785+
break;
786+
}
787+
}
788+
WARN(i == ARRAY_SIZE(wdev->vif), "try to instantiate more vif than supported");
790789

791790
hif_set_macaddr(wvif, vif->addr);
792791

793-
wfx_tx_queues_init(wvif);
794-
wfx_tx_policy_init(wvif);
792+
mutex_unlock(&wdev->conf_mutex);
793+
795794
wvif = NULL;
796795
while ((wvif = wvif_iterate(wdev, wvif)) != NULL) {
797796
// Combo mode does not support Block Acks. We can re-enable them
@@ -823,6 +822,7 @@ void wfx_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
823822
wvif->vif = NULL;
824823

825824
mutex_unlock(&wdev->conf_mutex);
825+
826826
wvif = NULL;
827827
while ((wvif = wvif_iterate(wdev, wvif)) != NULL) {
828828
// Combo mode does not support Block Acks. We can re-enable them

0 commit comments

Comments
 (0)