Re: [PATCH] mac80211: fix race in ieee80211_register_hw()

[Sumit Garg]

On Mon, 6 Apr 2020 at 23:39, Krishna Chaitanya <chaitanya.mgit@xxxxxxxxx> wrote:
>
> On Mon, Apr 6, 2020 at 8:36 PM Johannes Berg <johannes@xxxxxxxxxxxxxxxx> wrote:
> >
> > On Mon, 2020-04-06 at 19:55 +0530, Krishna Chaitanya wrote:
> >
> > > > iw phy0 interface add wlan0 type station
> > > > ip link set wlan0 up
> > > Ah okay, got it, thanks. Very narrow window though :-) as the
> > > alloc_ordered_workqueue
> > > doesn't need RTNL and there is a long way to go to do if_add() from
> > > user and setup
> > > the driver for interrupts.
> >
> > True, I do wonder how this is hit. Maybe something with no preempt and a
> > uevent triggering things?

The crash is reproducible while working with iwd [1] which is
basically a wireless daemon. It can be started as "iwd.service" during
boot that can detect wiphy registration events and configure
interfaces. Have a look at this text [2] from iwd manager.

To have a simple reproducer, please have a look at this trigger script
[3] from Matthias in CC. With this script I am able to reproduce the
kernel crash with approx. frequency of 1/10 across reboots on
dragonboard 410c.

There is nothing special like no preempt.

[1] https://wiki.archlinux.org/index.php/Iwd
[2] https://git.kernel.org/pub/scm/network/wireless/iwd.git/tree/src/manager.c#n563
[3] https://github.com/DasRoteSkelett/meta-iwd/blob/master/recipes-trigger/trigger/trigger/trigger.sh

> Probably, it might be specific to the dragonboard410c configuration
>

As described above, it isn't specific to any dragonboard 410c
configuration and one should be able to reproduce it on other boards
too using iwd depending on how long it takes to start corresponding
wiphy device.

> > > Again depends on the driver though, it
> > > should properly handle
> > > pending ieee80211_register_hw() with start().
>
> > It could, but it'd be really tricky. Much better to fix mac80211.

+1

-Sumit

> Sure, anyways it is a good change.