linux-kernel - Re: locking problems in iwlwifi? was Re: 6.16-rcX: crashing way too often on thinkpad X220

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <84h5z2vupd.fsf@jogness.linutronix.de>
Date: Thu, 24 Jul 2025 10:56:22 +0206
From: John Ogness <john.ogness@...utronix.de>
To: Pavel Machek <pavel@....cz>, Johannes Berg <johannes@...solutions.net>
Cc: kernel list <linux-kernel@...r.kernel.org>, tglx@...utronix.de,
 mingo@...hat.com, bp@...en8.de, dave.hansen@...ux.intel.com,
 x86@...nel.org, hpa@...or.com, peterz@...radead.org, will@...nel.org,
 longman@...hat.com, miriam.rachel.korenblit@...el.com,
 linux-wireless@...r.kernel.org, pmladek@...e.com, rostedt@...dmis.org,
 senozhatsky@...omium.org
Subject: Re: locking problems in iwlwifi? was Re: 6.16-rcX: crashing way too
 often on thinkpad X220

On 2025-07-23, Pavel Machek <pavel@....cz> wrote:
>> On Wed, 2025-07-23 at 17:42 +0200, Pavel Machek wrote:
>> > [  402.125635] ------------[ cut here ]------------
>> > [  402.125638] raw_local_irq_restore() called with IRQs enabled
>> > [  402.125645] WARNING: CPU: 3 PID: 387 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x25/0x30
>> > [  402.125654] Modules linked in:
>> > [  402.125661] CPU: 3 UID: 0 PID: 387 Comm: kworker/u16:5 Tainted: G S                  6.16.0-rc7+ #303 PREEMPT(voluntary) 
>> > [  402.125667] Tainted: [S]=CPU_OUT_OF_SPEC
>> > [  402.125668] Hardware name: LENOVO 4291W3B/4291W3B, BIOS 8DET73WW (1.43 ) 10/12/2016
>> > [  402.125671] Workqueue: events_unbound cfg80211_wiphy_work
>> > [  402.125678] RIP: 0010:warn_bogus_irq_restore+0x25/0x30
>> > [  402.125683] Code: 90 90 90 90 90 80 3d 51 3d dc 00 00 74 05 c3 cc cc cc cc 55 48 c7 c7 c0 4f c9 85 48 89 e5 c6 05 38 3d dc 00 01 e8 9b d8 e6 fe <0f> 0b 5d c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90
>> > [  402.125686] RSP: 0018:ffffc9000173fb30 EFLAGS: 00010282
>> > [  402.125691] RAX: 0000000000000000 RBX: ffffffff8616b460 RCX: 0000000000000000
>> > [  402.125694] RDX: 0000000000000003 RSI: 0000000000000027 RDI: 00000000ffffffff
>> > [  402.125696] RBP: ffffc9000173fb30 R08: 0000000028935f32 R09: 0000000000000001
>> > [  402.125699] R10: 0000000000000044 R11: ffff888100ba52c8 R12: 0000000000000001
>> > [  402.125702] R13: ffffc9000173fbcb R14: ffffffff84301224 R15: 0000000000000000
>> > [  402.125704] FS:  0000000000000000(0000) GS:ffff88829007f000(0000) knlGS:0000000000000000
>> > [  402.125707] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> > [  402.125710] CR2: 000055967d471ee0 CR3: 0000000006046001 CR4: 00000000000606b0
>> > [  402.125713] Call Trace:
>> > [  402.125716]  <TASK>
>> > [  402.125719]  console_flush_all+0x41e/0x460
>> > [  402.125725]  ? console_flush_all+0x43/0x460
>> > [  402.125735]  console_unlock+0x55/0x100
>> > [  402.125741]  vprintk_emit+0x157/0x320
>> > [  402.125748]  vprintk_default+0x18/0x20
>> > [  402.125752]  vprintk+0x9/0x10
>> > [  402.125756]  _printk+0x52/0x70
>> > [  402.125766]  ieee80211_sta_rx_queued_mgmt+0x4c8/0xd30
>> > [  402.125775]  ? __this_cpu_preempt_check+0x13/0x20
>> > [  402.125784]  ieee80211_iface_work+0x3ad/0x500
>> 
>> That's not great, but I don't see how the driver or wifi subsystem is
>> involved ... ieee80211_sta_rx_queued_mgmt() doesn't even use spinlocks
>> let alone disable IRQs or use raw_ APIs, and it's in the middle of
>> printk anyway.

printk() does perform local_irq_save()/_restore(). I rechecked all the
sites and they are properly balanced in all paths.

It looks like you may have found other issues related to corruption, so
I will assume printk is not the culprit. But please keep us CC or ping
us again if printk comes under suspicion again.

John Ogness