mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
rt2x00: Fix for race condition while update beacon
The patch "Implement set_tim callback for all drivers" can cause kernel oops in rt73usb_write_beacon. The oops is caused by one of the following race conditions: * In case of two near calls to set_tim: rt2x00lib_beacondone_iter is cleaning the beacon skb, whereas rt73usb_write_beacon is still using it. * In case of two near updates of beacon: first as the result of set_tim and second as the result of a call from an application (e.g. hostapd). This patch fixes the race condition by rearranging the update logic and guarding rt2x00_intf->beacon->skb with a mutex. Signed-off-by: Igor Perminov <igor.perminov@inbox.ru> Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
66679a65ef
commit
17512dc3b7
4 changed files with 20 additions and 8 deletions
|
@ -333,6 +333,11 @@ struct rt2x00_intf {
|
|||
*/
|
||||
u8 bssid[ETH_ALEN];
|
||||
|
||||
/*
|
||||
* beacon->skb must be protected with the mutex.
|
||||
*/
|
||||
struct mutex beacon_skb_mutex;
|
||||
|
||||
/*
|
||||
* Entry in the beacon queue which belongs to
|
||||
* this interface. Each interface has its own
|
||||
|
|
|
@ -186,7 +186,6 @@ static void rt2x00lib_intf_scheduled(struct work_struct *work)
|
|||
static void rt2x00lib_beacondone_iter(void *data, u8 *mac,
|
||||
struct ieee80211_vif *vif)
|
||||
{
|
||||
struct rt2x00_dev *rt2x00dev = data;
|
||||
struct rt2x00_intf *intf = vif_to_intf(vif);
|
||||
|
||||
if (vif->type != NL80211_IFTYPE_AP &&
|
||||
|
@ -195,12 +194,6 @@ static void rt2x00lib_beacondone_iter(void *data, u8 *mac,
|
|||
vif->type != NL80211_IFTYPE_WDS)
|
||||
return;
|
||||
|
||||
/*
|
||||
* Clean up the beacon skb.
|
||||
*/
|
||||
rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb);
|
||||
intf->beacon->skb = NULL;
|
||||
|
||||
spin_lock(&intf->lock);
|
||||
intf->delayed_flags |= DELAYED_UPDATE_BEACON;
|
||||
spin_unlock(&intf->lock);
|
||||
|
|
|
@ -274,6 +274,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
|
|||
|
||||
spin_lock_init(&intf->lock);
|
||||
spin_lock_init(&intf->seqlock);
|
||||
mutex_init(&intf->beacon_skb_mutex);
|
||||
intf->beacon = entry;
|
||||
|
||||
if (conf->type == NL80211_IFTYPE_AP)
|
||||
|
|
|
@ -503,14 +503,25 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
|
|||
if (unlikely(!intf->beacon))
|
||||
return -ENOBUFS;
|
||||
|
||||
mutex_lock(&intf->beacon_skb_mutex);
|
||||
|
||||
/*
|
||||
* Clean up the beacon skb.
|
||||
*/
|
||||
rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb);
|
||||
intf->beacon->skb = NULL;
|
||||
|
||||
if (!enable_beacon) {
|
||||
rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, QID_BEACON);
|
||||
mutex_unlock(&intf->beacon_skb_mutex);
|
||||
return 0;
|
||||
}
|
||||
|
||||
intf->beacon->skb = ieee80211_beacon_get(rt2x00dev->hw, vif);
|
||||
if (!intf->beacon->skb)
|
||||
if (!intf->beacon->skb) {
|
||||
mutex_unlock(&intf->beacon_skb_mutex);
|
||||
return -ENOMEM;
|
||||
}
|
||||
|
||||
/*
|
||||
* Copy all TX descriptor information into txdesc,
|
||||
|
@ -548,6 +559,8 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
|
|||
rt2x00dev->ops->lib->write_beacon(intf->beacon);
|
||||
rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, QID_BEACON);
|
||||
|
||||
mutex_unlock(&intf->beacon_skb_mutex);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue