reg_check_chans_work() holds rtnl_mutex for the entire duration of
iterating over all registered devices and calling cfg80211_leave() on
each invalid wdev. cfg80211_leave() can be slow (disconnect, stop AP,
leave mesh), causing rtnl_mutex starvation when many wireless interfaces
are present. This results in tasks waiting for rtnl_mutex for longer
than hung_task_timeout_secs:
INFO: task hung in inet_rtm_newaddr
INFO: task hung in inet6_rtm_newaddr
INFO: task hung in nsim_destroy
INFO: task hung in tun_chr_close
INFO: task hung in switchdev_deferred_process_work
Fix by walking cfg80211_rdev_list under RCU and acquiring rtnl per-device,
so other rtnl waiters get a chance to run between devices.
I could not add the Fixes: tag because this patch addresses five separate
hung task reports whose cause bisections all failed, making it impossible
to identify a single introducing commit.
Reported-by: syzbot+adeb8550754921fece20@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=adeb8550754921fece20
Reported-by: syzbot+101224300649c3eb8af4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=101224300649c3eb8af4
Reported-by: syzbot+8141dcbd23a8f857798a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8141dcbd23a8f857798a
Reported-by: syzbot+b0ae8f1abf7d891e0426@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b0ae8f1abf7d891e0426
Reported-by: syzbot+d6bbe0f5705cb8a5aa2b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d6bbe0f5705cb8a5aa2b
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
net/wireless/reg.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index a8336baf85dc..a2e0d1cf8317 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2466,12 +2466,21 @@ static void reg_check_chans_work(struct work_struct *work)
struct cfg80211_registered_device *rdev;
pr_debug("Verifying active interfaces after reg change\n");
- rtnl_lock();
-
- for_each_rdev(rdev)
+ /*
+ * Acquire rtnl per-device instead of holding it for the entire loop;
+ * cfg80211_leave() can be slow and starve other rtnl waiters otherwise.
+ * wiphy_unregister() holds rtnl across list_del_rcu() + synchronize_rcu(),
+ * so rdev cannot be freed while we hold rtnl_lock() below.
+ */
+ rcu_read_lock();
+ list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
+ rcu_read_unlock();
+ rtnl_lock();
reg_leave_invalid_chans(&rdev->wiphy);
-
- rtnl_unlock();
+ rtnl_unlock();
+ rcu_read_lock();
+ }
+ rcu_read_unlock();
}
void reg_check_channels(void)
--
2.55.0