linux-kernel - Re: [PATCH net v2] phy: mscc: Stop taking ts_lock for tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dbc50956-4aa6-4484-be32-0b091d494bc1@linux.dev>
Date: Mon, 1 Sep 2025 11:19:44 +0100
From: Vadim Fedorenko <vadim.fedorenko@...ux.dev>
To: Horatiu Vultur <horatiu.vultur@...rochip.com>, andrew@...n.ch,
 hkallweit1@...il.com, linux@...linux.org.uk, davem@...emloft.net,
 edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com,
 richardcochran@...il.com, vladimir.oltean@....com, viro@...iv.linux.org.uk,
 atenart@...nel.org, quentin.schulz@...tlin.com
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net v2] phy: mscc: Stop taking ts_lock for tx_queue and
 use its own lock

On 01/09/2025 10:23, Horatiu Vultur wrote:
> When transmitting a PTP frame which is timestamp using 2 step, the
> following warning appears if CONFIG_PROVE_LOCKING is enabled:
> =============================
> [ BUG: Invalid wait context ]
> 6.17.0-rc1-00326-ge6160462704e #427 Not tainted
> -----------------------------
> ptp4l/119 is trying to lock:
> c2a44ed4 (&vsc8531->ts_lock){+.+.}-{3:3}, at: vsc85xx_txtstamp+0x50/0xac
> other info that might help us debug this:
> context-{4:4}
> 4 locks held by ptp4l/119:
>   #0: c145f068 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x58/0x1440
>   #1: c29df974 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x5c4/0x1440
>   #2: c2aaaad0 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x108/0x350
>   #3: c2aac170 (&lan966x->tx_lock){+.-.}-{2:2}, at: lan966x_port_xmit+0xd0/0x350
> stack backtrace:
> CPU: 0 UID: 0 PID: 119 Comm: ptp4l Not tainted 6.17.0-rc1-00326-ge6160462704e #427 NONE
> Hardware name: Generic DT based system
> Call trace:
>   unwind_backtrace from show_stack+0x10/0x14
>   show_stack from dump_stack_lvl+0x7c/0xac
>   dump_stack_lvl from __lock_acquire+0x8e8/0x29dc
>   __lock_acquire from lock_acquire+0x108/0x38c
>   lock_acquire from __mutex_lock+0xb0/0xe78
>   __mutex_lock from mutex_lock_nested+0x1c/0x24
>   mutex_lock_nested from vsc85xx_txtstamp+0x50/0xac
>   vsc85xx_txtstamp from lan966x_fdma_xmit+0xd8/0x3a8
>   lan966x_fdma_xmit from lan966x_port_xmit+0x1bc/0x350
>   lan966x_port_xmit from dev_hard_start_xmit+0xc8/0x2c0
>   dev_hard_start_xmit from sch_direct_xmit+0x8c/0x350
>   sch_direct_xmit from __dev_queue_xmit+0x680/0x1440
>   __dev_queue_xmit from packet_sendmsg+0xfa4/0x1568
>   packet_sendmsg from __sys_sendto+0x110/0x19c
>   __sys_sendto from sys_send+0x18/0x20
>   sys_send from ret_fast_syscall+0x0/0x1c
> Exception stack(0xf0b05fa8 to 0xf0b05ff0)
> 5fa0:                   00000001 0000000e 0000000e 0004b47a 0000003a 00000000
> 5fc0: 00000001 0000000e 00000000 00000121 0004af58 00044874 00000000 00000000
> 5fe0: 00000001 bee9d420 00025a10 b6e75c7c
> 
> So, instead of using the ts_lock for tx_queue, use the spinlock that
> skb_buff_head has.
> 
> Fixes: 7d272e63e0979d ("net: phy: mscc: timestamping and PHC support")
> Signed-off-by: Horatiu Vultur <horatiu.vultur@...rochip.com>
> 
> ---
> v1->v2:
> - initialize tx_queue in ptp_probe
> - purge the tx_queue when the driver is removed or when TX timestamping
>    is OFF
> ---
>   drivers/net/phy/mscc/mscc_ptp.c | 16 +++++++---------
>   1 file changed, 7 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/net/phy/mscc/mscc_ptp.c b/drivers/net/phy/mscc/mscc_ptp.c
> index 72847320cb652..e866a1d865f8b 100644
> --- a/drivers/net/phy/mscc/mscc_ptp.c
> +++ b/drivers/net/phy/mscc/mscc_ptp.c
> @@ -461,7 +461,7 @@ static void vsc85xx_dequeue_skb(struct vsc85xx_ptp *ptp)
>   		return;
>   
>   	while (len--) {
> -		skb = __skb_dequeue(&ptp->tx_queue);
> +		skb = skb_dequeue(&ptp->tx_queue);

Now as you switched to use spinlock of tx_queue, it is technically
correct to change skb_queue_len(&ptp->tx_queue) to
skb_queue_len_lockless(&ptp->tx_queue) a couple of lines above this
chunk.

Otherwise LGTM, once skb_queue_len fixed you can add

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@...ux.dev>


Thanks!

>   		if (!skb)
>   			return;
>   
> @@ -486,7 +486,7 @@ static void vsc85xx_dequeue_skb(struct vsc85xx_ptp *ptp)
>   		 * packet in the FIFO right now, reschedule it for later
>   		 * packets.
>   		 */
> -		__skb_queue_tail(&ptp->tx_queue, skb);
> +		skb_queue_tail(&ptp->tx_queue, skb);