linux-kernel - [2.6.38-rc1] iwlagn lock misuse...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 19 Jan 2011 16:44:01 +0700
From:	Daniel J Blueman <daniel.blueman@...il.com>
To:	Reinette Chatre <reinette.chatre@...el.com>,
	Wey-Yi Guy <wey-yi.w.guy@...el.com>,
	Intel Linux Wireless <ilw@...ux.intel.com>
Cc:	linux-wireless@...r.kernel.org,
	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: [2.6.38-rc1] iwlagn lock misuse...

Booting an instrumented 2.6.38-rc1 kernel with an Intel WiFi Link 5300
card and associating with an access point, I see a lockdep warning
[attached].

This is essentially (struct iwl_priv)->lock being taken with
interrupts disabled in iwl-agn-ict.c:152 [1] and the same lock taken
with interrupts enabled in rx.c:2476 [2] (confirmed via disassembly).

It feels like this would have been introduced in this commit:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=6e8cc38d5b05bb812f89a35bd9bf52405e67d0df

Shall I raise a kernel.org bugzilla entry?

Thanks,
  Daniel

--- [1] iwl-agn-ict.c:152

static irqreturn_t iwl_isr(int irq, void *data)
{
	struct iwl_priv *priv = data;
	u32 inta, inta_mask;
	unsigned long flags;
#ifdef CONFIG_IWLWIFI_DEBUG
	u32 inta_fh;
#endif
	if (!priv)
		return IRQ_NONE;

	spin_lock_irqsave(&priv->lock, flags); <---

--- [2] rx.c:2476

static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
{
	ieee80211_rx_result res = RX_DROP_MONITOR;
	struct sk_buff *skb;

#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
			goto rxh_next;  \
	} while (0);

	spin_lock(&rx->local->rx_skb_queue.lock);  <---
-- 
Daniel J Blueman

View attachment "2.6.38-rc1-iwlagn.txt" of type "text/plain" (32260 bytes)