brcmsmac: fix deadlock on missing firmware
authorEmil Goode <emilgoode@gmail.com>
Sun, 9 Mar 2014 20:06:51 +0000 (21:06 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 7 Jun 2014 17:28:18 +0000 (10:28 -0700)
commit9f531ef39d2a3dcfb50e66faabf66a6376f324e5
treedf3713ce3422f27e34c25c07477b643f1a9366a6
parent7a5db34ad2ea9a97448904a8a9e6e49d82e9d133
brcmsmac: fix deadlock on missing firmware

commit 8fc1e8c240aab968db658b2d8d079b4391207a36 upstream.

When brcm80211 firmware is not installed networking hangs.
A deadlock happens because we call ieee80211_unregister_hw()
from the .start callback of struct ieee80211_ops. When .start
is called we are under rtnl lock and ieee80211_unregister_hw()
tries to take it again.

Function call stack:

dev_change_flags()
__dev_change_flags()
__dev_open()
ASSERT_RTNL() <-- Assert rtnl lock
ops->ndo_open()

.ndo_open = ieee80211_open,

ieee80211_open()
ieee80211_do_open()
drv_start()
local->ops->start()

.start = brcms_ops_start,

brcms_ops_start()
brcms_remove()
ieee80211_unregister_hw()
rtnl_lock() <-- Here we deadlock

Introduced by:
commit 25b5632fb35ca61b8ae3eee235edcdc2883f7a5e
("brcmsmac: request firmware in .start() callback")

This patch fixes the bug by removing the call to brcms_remove()
and moves the brcms_request_fw() call to the top of the .start
callback to not initiate anything unless firmware is installed.

Signed-off-by: Emil Goode <emilgoode@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c