diff options
| author | Alexander Wetzel <alexander@wetzel-home.de> | 2022-09-15 14:41:20 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2022-09-27 10:29:04 +0200 |
| commit | b7ce33df1ce2b6631234233c5367bcfe9c67fbe9 (patch) | |
| tree | 3aaea8c0553c5f810cb2fec3a953fd0a2d9b3121 | |
| parent | 64e966d1e84b29c9fa916cfeaabbf4013703942e (diff) | |
| download | linux-sgx-b7ce33df1ce2b6631234233c5367bcfe9c67fbe9.tar.gz | |
wifi: mac80211: don't start TX with fq->lock to fix deadlock
ieee80211_txq_purge() calls fq_tin_reset() and
ieee80211_purge_tx_queue(); Both are then calling
ieee80211_free_txskb(). Which can decide to TX the skb again.
There are at least two ways to get a deadlock:
1) When we have a TDLS teardown packet queued in either tin or frags
ieee80211_tdls_td_tx_handle() will call ieee80211_subif_start_xmit()
while we still hold fq->lock. ieee80211_txq_enqueue() will thus
deadlock.
2) A variant of the above happens if aggregation is up and running:
In that case ieee80211_iface_work() will deadlock with the original
task: The original tasks already holds fq->lock and tries to get
sta->lock after kicking off ieee80211_iface_work(). But the worker
can get sta->lock prior to the original task and will then spin for
fq->lock.
Avoid these deadlocks by not sending out any skbs when called via
ieee80211_free_txskb().
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Link: https://lore.kernel.org/r/20220915124120.301918-1-alexander@wetzel-home.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/status.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/mac80211/status.c b/net/mac80211/status.c index 8e77fd2e9fdffc..3f9ddd7f04b646 100644 --- a/net/mac80211/status.c +++ b/net/mac80211/status.c @@ -729,7 +729,7 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local, if (!sdata) { skb->dev = NULL; - } else { + } else if (!dropped) { unsigned int hdr_size = ieee80211_hdrlen(hdr->frame_control); |