Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Kalle Valo]

Rafał Miłecki  writes:

 Failed to apply, please rebase:

 Applying: brcmfmac: fix lockup when removing P2P interface after event 
 timeout
 Using index info to reconstruct a base tree...
 Falling back to patching base and 3-way merge...
 Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
 Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 CONFLICT (content): Merge conflict in 
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 Failed to merge in the changes.
 Patch failed at 0001 brcmfmac: fix lockup when removing P2P interface 
 after event timeout
>>>
>>> What tree did you try it on?
>>>
>>> I just went into a dir where I have cloned:
>>> git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
>>>
>>> My HEAD commit is:
>>> 034fdd4 Merge ath-current from ath.git
>>>
>>> And I can apply this patch cleanly doing:
>>> curl https://patchwork.kernel.org/patch/9138925/mbox/ | git am
>>
>> I was trying to apply this to wireless-drivers-next. I didn't get a
>> confirmation from Arend and I didn't consider the fix important enough
>> for 4.7. But of course I can reconsider if needed.
>
> I think I agree it won't hurt to get it into -next. Noone earlier
> reported this bug and it seems to be there for a long time. Also
> applying it to -next will allow avoiding merge conflicts and immediate
> development work on -next.

Exactly, there is a cost when taking patches to wireless-drivers.git and
that's why I try to keep the bar high. Regressions and user reported
bugs take priority, other fixes are handled case by case.

> I'll resend this patch rebased on -next soon.

Thanks.

-- 
Kalle Valo

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Kalle Valo]

Rafał Miłecki  writes:

 Failed to apply, please rebase:

 Applying: brcmfmac: fix lockup when removing P2P interface after event 
 timeout
 Using index info to reconstruct a base tree...
 Falling back to patching base and 3-way merge...
 Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
 Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 CONFLICT (content): Merge conflict in 
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 Failed to merge in the changes.
 Patch failed at 0001 brcmfmac: fix lockup when removing P2P interface 
 after event timeout
>>>
>>> What tree did you try it on?
>>>
>>> I just went into a dir where I have cloned:
>>> git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
>>>
>>> My HEAD commit is:
>>> 034fdd4 Merge ath-current from ath.git
>>>
>>> And I can apply this patch cleanly doing:
>>> curl https://patchwork.kernel.org/patch/9138925/mbox/ | git am
>>
>> I was trying to apply this to wireless-drivers-next. I didn't get a
>> confirmation from Arend and I didn't consider the fix important enough
>> for 4.7. But of course I can reconsider if needed.
>
> I think I agree it won't hurt to get it into -next. Noone earlier
> reported this bug and it seems to be there for a long time. Also
> applying it to -next will allow avoiding merge conflicts and immediate
> development work on -next.

Exactly, there is a cost when taking patches to wireless-drivers.git and
that's why I try to keep the bar high. Regressions and user reported
bugs take priority, other fixes are handled case by case.

> I'll resend this patch rebased on -next soon.

Thanks.

-- 
Kalle Valo

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Rafał Miłecki]

On 17 June 2016 at 07:13, Kalle Valo  wrote:
> Rafał Miłecki  writes:
>
>> On 16 June 2016 at 17:10, Kalle Valo  wrote:
>>> Rafał Miłecki  writes:
>>>
 Removing P2P interface is handled by sending a proper request to the
 firmware. On success firmware triggers an event and driver's handler
 removes a matching interface.

 However on event timeout we remove interface directly from the cfg80211
 callback. Current code doesn't handle this case correctly as it always
 assumes rtnl to be unlocked.

 Fix it by adding an extra rtnl_locked parameter to functions and calling
 unregister_netdevice when needed.

 Signed-off-by: Rafał Miłecki 
>>>
>>> Failed to apply, please rebase:
>>>
>>> Applying: brcmfmac: fix lockup when removing P2P interface after event 
>>> timeout
>>> Using index info to reconstruct a base tree...
>>> Falling back to patching base and 3-way merge...
>>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
>>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
>>> CONFLICT (content): Merge conflict in 
>>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
>>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
>>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
>>> Failed to merge in the changes.
>>> Patch failed at 0001 brcmfmac: fix lockup when removing P2P interface after 
>>> event timeout
>>
>> What tree did you try it on?
>>
>> I just went into a dir where I have cloned:
>> git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
>>
>> My HEAD commit is:
>> 034fdd4 Merge ath-current from ath.git
>>
>> And I can apply this patch cleanly doing:
>> curl https://patchwork.kernel.org/patch/9138925/mbox/ | git am
>
> I was trying to apply this to wireless-drivers-next. I didn't get a
> confirmation from Arend and I didn't consider the fix important enough
> for 4.7. But of course I can reconsider if needed.

I think I agree it won't hurt to get it into -next. Noone earlier
reported this bug and it seems to be there for a long time. Also
applying it to -next will allow avoiding merge conflicts and immediate
development work on -next.

I'll resend this patch rebased on -next soon.

-- 
Rafał

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Rafał Miłecki]

On 17 June 2016 at 07:13, Kalle Valo  wrote:
> Rafał Miłecki  writes:
>
>> On 16 June 2016 at 17:10, Kalle Valo  wrote:
>>> Rafał Miłecki  writes:
>>>
 Removing P2P interface is handled by sending a proper request to the
 firmware. On success firmware triggers an event and driver's handler
 removes a matching interface.

 However on event timeout we remove interface directly from the cfg80211
 callback. Current code doesn't handle this case correctly as it always
 assumes rtnl to be unlocked.

 Fix it by adding an extra rtnl_locked parameter to functions and calling
 unregister_netdevice when needed.

 Signed-off-by: Rafał Miłecki 
>>>
>>> Failed to apply, please rebase:
>>>
>>> Applying: brcmfmac: fix lockup when removing P2P interface after event 
>>> timeout
>>> Using index info to reconstruct a base tree...
>>> Falling back to patching base and 3-way merge...
>>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
>>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
>>> CONFLICT (content): Merge conflict in 
>>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
>>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
>>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
>>> Failed to merge in the changes.
>>> Patch failed at 0001 brcmfmac: fix lockup when removing P2P interface after 
>>> event timeout
>>
>> What tree did you try it on?
>>
>> I just went into a dir where I have cloned:
>> git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
>>
>> My HEAD commit is:
>> 034fdd4 Merge ath-current from ath.git
>>
>> And I can apply this patch cleanly doing:
>> curl https://patchwork.kernel.org/patch/9138925/mbox/ | git am
>
> I was trying to apply this to wireless-drivers-next. I didn't get a
> confirmation from Arend and I didn't consider the fix important enough
> for 4.7. But of course I can reconsider if needed.

I think I agree it won't hurt to get it into -next. Noone earlier
reported this bug and it seems to be there for a long time. Also
applying it to -next will allow avoiding merge conflicts and immediate
development work on -next.

I'll resend this patch rebased on -next soon.

-- 
Rafał

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Kalle Valo]

Rafał Miłecki  writes:

> On 16 June 2016 at 17:10, Kalle Valo  wrote:
>> Rafał Miłecki  writes:
>>
>>> Removing P2P interface is handled by sending a proper request to the
>>> firmware. On success firmware triggers an event and driver's handler
>>> removes a matching interface.
>>>
>>> However on event timeout we remove interface directly from the cfg80211
>>> callback. Current code doesn't handle this case correctly as it always
>>> assumes rtnl to be unlocked.
>>>
>>> Fix it by adding an extra rtnl_locked parameter to functions and calling
>>> unregister_netdevice when needed.
>>>
>>> Signed-off-by: Rafał Miłecki 
>>
>> Failed to apply, please rebase:
>>
>> Applying: brcmfmac: fix lockup when removing P2P interface after event 
>> timeout
>> Using index info to reconstruct a base tree...
>> Falling back to patching base and 3-way merge...
>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
>> CONFLICT (content): Merge conflict in 
>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
>> Failed to merge in the changes.
>> Patch failed at 0001 brcmfmac: fix lockup when removing P2P interface after 
>> event timeout
>
> What tree did you try it on?
>
> I just went into a dir where I have cloned:
> git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
>
> My HEAD commit is:
> 034fdd4 Merge ath-current from ath.git
>
> And I can apply this patch cleanly doing:
> curl https://patchwork.kernel.org/patch/9138925/mbox/ | git am

I was trying to apply this to wireless-drivers-next. I didn't get a
confirmation from Arend and I didn't consider the fix important enough
for 4.7. But of course I can reconsider if needed.

-- 
Kalle Valo

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Kalle Valo]

Rafał Miłecki  writes:

> On 16 June 2016 at 17:10, Kalle Valo  wrote:
>> Rafał Miłecki  writes:
>>
>>> Removing P2P interface is handled by sending a proper request to the
>>> firmware. On success firmware triggers an event and driver's handler
>>> removes a matching interface.
>>>
>>> However on event timeout we remove interface directly from the cfg80211
>>> callback. Current code doesn't handle this case correctly as it always
>>> assumes rtnl to be unlocked.
>>>
>>> Fix it by adding an extra rtnl_locked parameter to functions and calling
>>> unregister_netdevice when needed.
>>>
>>> Signed-off-by: Rafał Miłecki 
>>
>> Failed to apply, please rebase:
>>
>> Applying: brcmfmac: fix lockup when removing P2P interface after event 
>> timeout
>> Using index info to reconstruct a base tree...
>> Falling back to patching base and 3-way merge...
>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
>> CONFLICT (content): Merge conflict in 
>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
>> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
>> Failed to merge in the changes.
>> Patch failed at 0001 brcmfmac: fix lockup when removing P2P interface after 
>> event timeout
>
> What tree did you try it on?
>
> I just went into a dir where I have cloned:
> git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
>
> My HEAD commit is:
> 034fdd4 Merge ath-current from ath.git
>
> And I can apply this patch cleanly doing:
> curl https://patchwork.kernel.org/patch/9138925/mbox/ | git am

I was trying to apply this to wireless-drivers-next. I didn't get a
confirmation from Arend and I didn't consider the fix important enough
for 4.7. But of course I can reconsider if needed.

-- 
Kalle Valo

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Rafał Miłecki]

On 16 June 2016 at 17:10, Kalle Valo  wrote:
> Rafał Miłecki  writes:
>
>> Removing P2P interface is handled by sending a proper request to the
>> firmware. On success firmware triggers an event and driver's handler
>> removes a matching interface.
>>
>> However on event timeout we remove interface directly from the cfg80211
>> callback. Current code doesn't handle this case correctly as it always
>> assumes rtnl to be unlocked.
>>
>> Fix it by adding an extra rtnl_locked parameter to functions and calling
>> unregister_netdevice when needed.
>>
>> Signed-off-by: Rafał Miłecki 
>
> Failed to apply, please rebase:
>
> Applying: brcmfmac: fix lockup when removing P2P interface after event timeout
> Using index info to reconstruct a base tree...
> Falling back to patching base and 3-way merge...
> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
> CONFLICT (content): Merge conflict in 
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> Failed to merge in the changes.
> Patch failed at 0001 brcmfmac: fix lockup when removing P2P interface after 
> event timeout

What tree did you try it on?

I just went into a dir where I have cloned:
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git

My HEAD commit is:
034fdd4 Merge ath-current from ath.git

And I can apply this patch cleanly doing:
curl https://patchwork.kernel.org/patch/9138925/mbox/ | git am

-- 
Rafał

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Rafał Miłecki]

On 16 June 2016 at 17:10, Kalle Valo  wrote:
> Rafał Miłecki  writes:
>
>> Removing P2P interface is handled by sending a proper request to the
>> firmware. On success firmware triggers an event and driver's handler
>> removes a matching interface.
>>
>> However on event timeout we remove interface directly from the cfg80211
>> callback. Current code doesn't handle this case correctly as it always
>> assumes rtnl to be unlocked.
>>
>> Fix it by adding an extra rtnl_locked parameter to functions and calling
>> unregister_netdevice when needed.
>>
>> Signed-off-by: Rafał Miłecki 
>
> Failed to apply, please rebase:
>
> Applying: brcmfmac: fix lockup when removing P2P interface after event timeout
> Using index info to reconstruct a base tree...
> Falling back to patching base and 3-way merge...
> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
> CONFLICT (content): Merge conflict in 
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> Failed to merge in the changes.
> Patch failed at 0001 brcmfmac: fix lockup when removing P2P interface after 
> event timeout

What tree did you try it on?

I just went into a dir where I have cloned:
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git

My HEAD commit is:
034fdd4 Merge ath-current from ath.git

And I can apply this patch cleanly doing:
curl https://patchwork.kernel.org/patch/9138925/mbox/ | git am

-- 
Rafał

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Kalle Valo]

Rafał Miłecki  writes:

> Removing P2P interface is handled by sending a proper request to the
> firmware. On success firmware triggers an event and driver's handler
> removes a matching interface.
>
> However on event timeout we remove interface directly from the cfg80211
> callback. Current code doesn't handle this case correctly as it always
> assumes rtnl to be unlocked.
>
> Fix it by adding an extra rtnl_locked parameter to functions and calling
> unregister_netdevice when needed.
>
> Signed-off-by: Rafał Miłecki 

Failed to apply, please rebase:

Applying: brcmfmac: fix lockup when removing P2P interface after event timeout
Using index info to reconstruct a base tree...
Falling back to patching base and 3-way merge...
Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
CONFLICT (content): Merge conflict in 
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
Failed to merge in the changes.
Patch failed at 0001 brcmfmac: fix lockup when removing P2P interface after 
event timeout

-- 
Kalle Valo

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Kalle Valo]

Rafał Miłecki  writes:

> Removing P2P interface is handled by sending a proper request to the
> firmware. On success firmware triggers an event and driver's handler
> removes a matching interface.
>
> However on event timeout we remove interface directly from the cfg80211
> callback. Current code doesn't handle this case correctly as it always
> assumes rtnl to be unlocked.
>
> Fix it by adding an extra rtnl_locked parameter to functions and calling
> unregister_netdevice when needed.
>
> Signed-off-by: Rafał Miłecki 

Failed to apply, please rebase:

Applying: brcmfmac: fix lockup when removing P2P interface after event timeout
Using index info to reconstruct a base tree...
Falling back to patching base and 3-way merge...
Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
CONFLICT (content): Merge conflict in 
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
Auto-merging drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
Failed to merge in the changes.
Patch failed at 0001 brcmfmac: fix lockup when removing P2P interface after 
event timeout

-- 
Kalle Valo

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Kalle Valo]

Rafał Miłecki  writes:

> Removing P2P interface is handled by sending a proper request to the
> firmware. On success firmware triggers an event and driver's handler
> removes a matching interface.
>
> However on event timeout we remove interface directly from the cfg80211
> callback. Current code doesn't handle this case correctly as it always
> assumes rtnl to be unlocked.
>
> Fix it by adding an extra rtnl_locked parameter to functions and calling
> unregister_netdevice when needed.
>
> Signed-off-by: Rafał Miłecki 

Arend, are you ok to push this to 4.7?

-- 
Kalle Valo

Re: [PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Kalle Valo]

Rafał Miłecki  writes:

> Removing P2P interface is handled by sending a proper request to the
> firmware. On success firmware triggers an event and driver's handler
> removes a matching interface.
>
> However on event timeout we remove interface directly from the cfg80211
> callback. Current code doesn't handle this case correctly as it always
> assumes rtnl to be unlocked.
>
> Fix it by adding an extra rtnl_locked parameter to functions and calling
> unregister_netdevice when needed.
>
> Signed-off-by: Rafał Miłecki 

Arend, are you ok to push this to 4.7?

-- 
Kalle Valo

[PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Rafał Miłecki]

Removing P2P interface is handled by sending a proper request to the
firmware. On success firmware triggers an event and driver's handler
removes a matching interface.

However on event timeout we remove interface directly from the cfg80211
callback. Current code doesn't handle this case correctly as it always
assumes rtnl to be unlocked.

Fix it by adding an extra rtnl_locked parameter to functions and calling
unregister_netdevice when needed.

Signed-off-by: Rafał Miłecki 
---
 .../broadcom/brcm80211/brcmfmac/cfg80211.c |  2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.c| 29 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.h|  2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/fweh.c|  2 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c |  4 +--
 5 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 62f475e..ef09382 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5364,7 +5364,7 @@ brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info 
*cfg,
brcmf_dbg(CONN, "AP mode link down\n");
complete(>vif_disabled);
if (ifp->vif->mbss)
-   brcmf_remove_interface(ifp);
+   brcmf_remove_interface(ifp, false);
return 0;
}
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index b590499..7f8ba48c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -548,12 +548,16 @@ fail:
return -EBADE;
 }
 
-static void brcmf_net_detach(struct net_device *ndev)
+static void brcmf_net_detach(struct net_device *ndev, bool rtnl_locked)
 {
-   if (ndev->reg_state == NETREG_REGISTERED)
-   unregister_netdev(ndev);
-   else
+   if (ndev->reg_state == NETREG_REGISTERED) {
+   if (rtnl_locked)
+   unregister_netdevice(ndev);
+   else
+   unregister_netdev(ndev);
+   } else {
brcmf_cfg80211_free_netdev(ndev);
+   }
 }
 
 void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on)
@@ -651,7 +655,7 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 
bsscfgidx, s32 ifidx,
brcmf_err("ERROR: netdev:%s already exists\n",
  ifp->ndev->name);
netif_stop_queue(ifp->ndev);
-   brcmf_net_detach(ifp->ndev);
+   brcmf_net_detach(ifp->ndev, false);
drvr->iflist[bsscfgidx] = NULL;
} else {
brcmf_dbg(INFO, "netdev:%s ignore IF event\n",
@@ -699,7 +703,8 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 
bsscfgidx, s32 ifidx,
return ifp;
 }
 
-static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx)
+static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
+bool rtnl_locked)
 {
struct brcmf_if *ifp;
 
@@ -729,7 +734,7 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 
bsscfgidx)
cancel_work_sync(>multicast_work);
cancel_work_sync(>ndoffload_work);
}
-   brcmf_net_detach(ifp->ndev);
+   brcmf_net_detach(ifp->ndev, rtnl_locked);
} else {
/* Only p2p device interfaces which get dynamically created
 * end up here. In this case the p2p module should be informed
@@ -743,14 +748,14 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 
bsscfgidx)
}
 }
 
-void brcmf_remove_interface(struct brcmf_if *ifp)
+void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked)
 {
if (!ifp || WARN_ON(ifp->drvr->iflist[ifp->bsscfgidx] != ifp))
return;
brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", ifp->bsscfgidx,
  ifp->ifidx);
brcmf_fws_del_interface(ifp);
-   brcmf_del_if(ifp->drvr, ifp->bsscfgidx);
+   brcmf_del_if(ifp->drvr, ifp->bsscfgidx, rtnl_locked);
 }
 
 int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr)
@@ -1081,9 +1086,9 @@ fail:
brcmf_fws_deinit(drvr);
}
if (ifp)
-   brcmf_net_detach(ifp->ndev);
+   brcmf_net_detach(ifp->ndev, false);
if (p2p_ifp)
-   brcmf_net_detach(p2p_ifp->ndev);
+   brcmf_net_detach(p2p_ifp->ndev, false);
drvr->iflist[0] = NULL;
drvr->iflist[1] = NULL;
if (drvr->settings->ignore_probe_fail)
@@ -1152,7 +1157,7 @@ void brcmf_detach(struct device *dev)
 
/* make sure primary 

[PATCH 4.7 FIX] brcmfmac: fix lockup when removing P2P interface after event timeout

[Rafał Miłecki]

Removing P2P interface is handled by sending a proper request to the
firmware. On success firmware triggers an event and driver's handler
removes a matching interface.

However on event timeout we remove interface directly from the cfg80211
callback. Current code doesn't handle this case correctly as it always
assumes rtnl to be unlocked.

Fix it by adding an extra rtnl_locked parameter to functions and calling
unregister_netdevice when needed.

Signed-off-by: Rafał Miłecki 
---
 .../broadcom/brcm80211/brcmfmac/cfg80211.c |  2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.c| 29 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.h|  2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/fweh.c|  2 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c |  4 +--
 5 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 62f475e..ef09382 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5364,7 +5364,7 @@ brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info 
*cfg,
brcmf_dbg(CONN, "AP mode link down\n");
complete(>vif_disabled);
if (ifp->vif->mbss)
-   brcmf_remove_interface(ifp);
+   brcmf_remove_interface(ifp, false);
return 0;
}
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index b590499..7f8ba48c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -548,12 +548,16 @@ fail:
return -EBADE;
 }
 
-static void brcmf_net_detach(struct net_device *ndev)
+static void brcmf_net_detach(struct net_device *ndev, bool rtnl_locked)
 {
-   if (ndev->reg_state == NETREG_REGISTERED)
-   unregister_netdev(ndev);
-   else
+   if (ndev->reg_state == NETREG_REGISTERED) {
+   if (rtnl_locked)
+   unregister_netdevice(ndev);
+   else
+   unregister_netdev(ndev);
+   } else {
brcmf_cfg80211_free_netdev(ndev);
+   }
 }
 
 void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on)
@@ -651,7 +655,7 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 
bsscfgidx, s32 ifidx,
brcmf_err("ERROR: netdev:%s already exists\n",
  ifp->ndev->name);
netif_stop_queue(ifp->ndev);
-   brcmf_net_detach(ifp->ndev);
+   brcmf_net_detach(ifp->ndev, false);
drvr->iflist[bsscfgidx] = NULL;
} else {
brcmf_dbg(INFO, "netdev:%s ignore IF event\n",
@@ -699,7 +703,8 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 
bsscfgidx, s32 ifidx,
return ifp;
 }
 
-static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx)
+static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
+bool rtnl_locked)
 {
struct brcmf_if *ifp;
 
@@ -729,7 +734,7 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 
bsscfgidx)
cancel_work_sync(>multicast_work);
cancel_work_sync(>ndoffload_work);
}
-   brcmf_net_detach(ifp->ndev);
+   brcmf_net_detach(ifp->ndev, rtnl_locked);
} else {
/* Only p2p device interfaces which get dynamically created
 * end up here. In this case the p2p module should be informed
@@ -743,14 +748,14 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 
bsscfgidx)
}
 }
 
-void brcmf_remove_interface(struct brcmf_if *ifp)
+void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked)
 {
if (!ifp || WARN_ON(ifp->drvr->iflist[ifp->bsscfgidx] != ifp))
return;
brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", ifp->bsscfgidx,
  ifp->ifidx);
brcmf_fws_del_interface(ifp);
-   brcmf_del_if(ifp->drvr, ifp->bsscfgidx);
+   brcmf_del_if(ifp->drvr, ifp->bsscfgidx, rtnl_locked);
 }
 
 int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr)
@@ -1081,9 +1086,9 @@ fail:
brcmf_fws_deinit(drvr);
}
if (ifp)
-   brcmf_net_detach(ifp->ndev);
+   brcmf_net_detach(ifp->ndev, false);
if (p2p_ifp)
-   brcmf_net_detach(p2p_ifp->ndev);
+   brcmf_net_detach(p2p_ifp->ndev, false);
drvr->iflist[0] = NULL;
drvr->iflist[1] = NULL;
if (drvr->settings->ignore_probe_fail)
@@ -1152,7 +1157,7 @@ void brcmf_detach(struct device *dev)
 
/* make sure primary interface removed