netdev - Re: [BUG] Deadlock in _cfg80211_unregister

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <da9f48e0-42fe-1f27-6ed8-ea796f95f894@gmail.com>
Date:   Fri, 14 May 2021 15:46:11 +0200
From:   Maximilian Luz <luzmaximilian@...il.com>
To:     Johannes Berg <johannes.berg@...el.com>,
        linux-wireless@...r.kernel.org
Cc:     Marek Szyprowski <m.szyprowski@...sung.com>,
        Kalle Valo <kvalo@...eaurora.org>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org,
        Amitkumar Karwar <amitkarwar@...il.com>,
        Ganapathi Bhat <ganapathi.bhat@....com>,
        Xinming Hu <huxinming820@...il.com>, dave@...aar.me
Subject: Re: [BUG] Deadlock in _cfg80211_unregister_wdev()

On 5/14/21 1:07 AM, Maximilian Luz wrote:
> Following commit a05829a7222e ("cfg80211: avoid holding the RTNL when
> calling the driver"), the mwifiex_pcie module fails to unload. This also
> prevents the device from rebooting / shutting down.
> 
> Attempting to unload the module produces the log pasted below. Upon
> further investigation, this looks like a deadlock inside
> _cfg80211_unregister_wdev():
> 
> - According to [1], this function expects the rdev->wiphy.mtx to be
>    held.
> - Down the line, this function (through some indirections, see third
>    trace in log below) calls call_netdevice_notifiers(NETDEV_GOING_DOWN,
>    ...) [2].
> - One of the registered notifiers seems to be
>    cfg80211_netdev_notifier_call(), which attempts to lock
>    rdev->wiphy.mtx again [3], completing the deadlock.

Looks like the underlying issue also leads to

   https://lore.kernel.org/linux-wireless/ab4d00ce52f32bd8e45ad0448a44737e@bewaar.me/

Regards,
Max