mac80211: fix suspend/resume races with unregister hw

Stanislaw Gruszka · linvjw · commit ecb4433550f0 · 2011-08-22T14:21:40.000-04:00
Do not call -&gt;suspend, -&gt;resume methods after we unregister wiphy. Also
delete sta_clanup timer after we finish wiphy unregister to avoid this:

WARNING: at lib/debugobjects.c:262 debug_print_object+0x85/0xa0()
Hardware name: 6369CTO
ODEBUG: free active (active state 0) object type: timer_list hint: sta_info_cleanup+0x0/0x180 [mac80211]
Modules linked in: aes_i586 aes_generic fuse bridge stp llc autofs4 sunrpc cpufreq_ondemand acpi_cpufreq mperf ext2 dm_mod uinput thinkpad_acpi hwmon sg arc4 rt2800usb rt2800lib crc_ccitt rt2x00usb rt2x00lib mac80211 cfg80211 i2c_i801 iTCO_wdt iTCO_vendor_support e1000e ext4 mbcache jbd2 sd_mod crc_t10dif sr_mod cdrom yenta_socket ahci libahci pata_acpi ata_generic ata_piix i915 drm_kms_helper drm i2c_algo_bit video [last unloaded: microcode]
Pid: 5663, comm: pm-hibernate Not tainted 3.1.0-rc1-wl+ #19
Call Trace:
 [&lt;c0454cfd&gt;] warn_slowpath_common+0x6d/0xa0
 [&lt;c05e05e5&gt;] ? debug_print_object+0x85/0xa0
 [&lt;c05e05e5&gt;] ? debug_print_object+0x85/0xa0
 [&lt;c0454dae&gt;] warn_slowpath_fmt+0x2e/0x30
 [&lt;c05e05e5&gt;] debug_print_object+0x85/0xa0
 [&lt;f8a808e0&gt;] ? sta_info_alloc+0x1a0/0x1a0 [mac80211]
 [&lt;c05e0bd2&gt;] debug_check_no_obj_freed+0xe2/0x180
 [&lt;c051175b&gt;] kfree+0x8b/0x150
 [&lt;f8a126ae&gt;] cfg80211_dev_free+0x7e/0x90 [cfg80211]
 [&lt;f8a13afd&gt;] wiphy_dev_release+0xd/0x10 [cfg80211]
 [&lt;c068d959&gt;] device_release+0x19/0x80
 [&lt;c05d06ba&gt;] kobject_release+0x7a/0x1c0
 [&lt;c07646a8&gt;] ? rtnl_unlock+0x8/0x10
 [&lt;f8a13adb&gt;] ? wiphy_resume+0x6b/0x80 [cfg80211]
 [&lt;c05d0640&gt;] ? kobject_del+0x30/0x30
 [&lt;c05d1a6d&gt;] kref_put+0x2d/0x60
 [&lt;c05d056d&gt;] kobject_put+0x1d/0x50
 [&lt;c08015f4&gt;] ? mutex_lock+0x14/0x40
 [&lt;c068d60f&gt;] put_device+0xf/0x20
 [&lt;c069716a&gt;] dpm_resume+0xca/0x160
 [&lt;c04912bd&gt;] hibernation_snapshot+0xcd/0x260
 [&lt;c04903df&gt;] ? freeze_processes+0x3f/0x90
 [&lt;c049151b&gt;] hibernate+0xcb/0x1e0
 [&lt;c048fdc0&gt;] ? pm_async_store+0x40/0x40
 [&lt;c048fe60&gt;] state_store+0xa0/0xb0
 [&lt;c048fdc0&gt;] ? pm_async_store+0x40/0x40
 [&lt;c05d0200&gt;] kobj_attr_store+0x20/0x30
 [&lt;c0575ea4&gt;] sysfs_write_file+0x94/0xf0
 [&lt;c051e26a&gt;] vfs_write+0x9a/0x160
 [&lt;c0575e10&gt;] ? sysfs_open_file+0x200/0x200
 [&lt;c051e3fd&gt;] sys_write+0x3d/0x70
 [&lt;c080959f&gt;] sysenter_do_call+0x12/0x28

Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
@@ -1865,6 +1865,9 @@ struct wiphy {
 	 * you need use set_wiphy_dev() (see below) */
 	struct device dev;
 
+	/* protects ->resume, ->suspend sysfs callbacks against unregister hw */
+	bool registered;
+
 	/* dir in debugfs: ieee80211/<wiphyname> */
 	struct dentry *debugfsdir;
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
@@ -1012,7 +1012,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 	cancel_work_sync(&local->reconfig_filter);
 
 	ieee80211_clear_tx_pending(local);
-	sta_info_stop(local);
 	rate_control_deinitialize(local);
 
 	if (skb_queue_len(&local->skb_queue) ||
@@ -1024,6 +1023,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
 	destroy_workqueue(local->workqueue);
 	wiphy_unregister(local->hw.wiphy);
+	sta_info_stop(local);
 	ieee80211_wep_free(local);
 	ieee80211_led_exit(local);
 	kfree(local->int_scan_req);
diff --git a/net/wireless/core.c b/net/wireless/core.c
@@ -616,6 +616,9 @@ int wiphy_register(struct wiphy *wiphy)
 	if (res)
 		goto out_rm_dev;
 
+	rtnl_lock();
+	rdev->wiphy.registered = true;
+	rtnl_unlock();
 	return 0;
 
 out_rm_dev:
@@ -647,6 +650,10 @@ void wiphy_unregister(struct wiphy *wiphy)
 {
 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
+	rtnl_lock();
+	rdev->wiphy.registered = false;
+	rtnl_unlock();
+
 	rfkill_unregister(rdev->rfkill);
 
 	/* protect the device list */
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
@@ -93,7 +93,8 @@ static int wiphy_suspend(struct device *dev, pm_message_t state)
 
 	if (rdev->ops->suspend) {
 		rtnl_lock();
-		ret = rdev->ops->suspend(&rdev->wiphy, rdev->wowlan);
+		if (rdev->wiphy.registered)
+			ret = rdev->ops->suspend(&rdev->wiphy, rdev->wowlan);
 		rtnl_unlock();
 	}
 
@@ -112,7 +113,8 @@ static int wiphy_resume(struct device *dev)
 
 	if (rdev->ops->resume) {
 		rtnl_lock();
-		ret = rdev->ops->resume(&rdev->wiphy);
+		if (rdev->wiphy.registered)
+			ret = rdev->ops->resume(&rdev->wiphy);
 		rtnl_unlock();
 	}
 
