Re: [PATCH] mac80211: fix race in ieee80211_register_hw()

On Mon, 2020-04-06 at 19:55 +0530, Krishna Chaitanya wrote:

quoted

iw phy0 interface add wlan0 type station
ip link set wlan0 up

Ah okay, got it, thanks. Very narrow window though :-) as the
alloc_ordered_workqueue
doesn't need RTNL and there is a long way to go to do if_add() from
user and setup
the driver for interrupts. 

True, I do wonder how this is hit. Maybe something with no preempt and a
uevent triggering things?

Again depends on the driver though, it
should properly handle
pending ieee80211_register_hw() with start().

It could, but it'd be really tricky. Much better to fix mac80211.

johannes

On Mon, Apr 6, 2020 at 8:36 PM Johannes Berg [off-list ref] wrote:

On Mon, 2020-04-06 at 19:55 +0530, Krishna Chaitanya wrote:

quoted

quoted

iw phy0 interface add wlan0 type station
ip link set wlan0 up

Ah okay, got it, thanks. Very narrow window though :-) as the
alloc_ordered_workqueue
doesn't need RTNL and there is a long way to go to do if_add() from
user and setup
the driver for interrupts.

True, I do wonder how this is hit. Maybe something with no preempt and a
uevent triggering things?

Probably, it might be specific to the dragonboard410c configuration

quoted

Again depends on the driver though, it
should properly handle
pending ieee80211_register_hw() with start().

It could, but it'd be really tricky. Much better to fix mac80211.

Sure, anyways it is a good change.

On Mon, 6 Apr 2020 at 23:39, Krishna Chaitanya [off-list ref] wrote:

On Mon, Apr 6, 2020 at 8:36 PM Johannes Berg [off-list ref] wrote:

quoted

On Mon, 2020-04-06 at 19:55 +0530, Krishna Chaitanya wrote:

quoted

quoted

iw phy0 interface add wlan0 type station
ip link set wlan0 up

Ah okay, got it, thanks. Very narrow window though :-) as the
alloc_ordered_workqueue
doesn't need RTNL and there is a long way to go to do if_add() from
user and setup
the driver for interrupts.

True, I do wonder how this is hit. Maybe something with no preempt and a
uevent triggering things?

The crash is reproducible while working with iwd [1] which is
basically a wireless daemon. It can be started as "iwd.service" during
boot that can detect wiphy registration events and configure
interfaces. Have a look at this text [2] from iwd manager.

To have a simple reproducer, please have a look at this trigger script
[3] from Matthias in CC. With this script I am able to reproduce the
kernel crash with approx. frequency of 1/10 across reboots on
dragonboard 410c.

There is nothing special like no preempt.

[1] https://wiki.archlinux.org/index.php/Iwd
[2] https://git.kernel.org/pub/scm/network/wireless/iwd.git/tree/src/manager.c#n563
[3] https://github.com/DasRoteSkelett/meta-iwd/blob/master/recipes-trigger/trigger/trigger/trigger.sh

Probably, it might be specific to the dragonboard410c configuration

As described above, it isn't specific to any dragonboard 410c
configuration and one should be able to reproduce it on other boards
too using iwd depending on how long it takes to start corresponding
wiphy device.

quoted

quoted

Again depends on the driver though, it
should properly handle
pending ieee80211_register_hw() with start().

quoted

It could, but it'd be really tricky. Much better to fix mac80211.

+1

-Sumit

Sure, anyways it is a good change.