Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 17512dc3 authored by Igor Perminov's avatar Igor Perminov Committed by John W. Linville
Browse files

rt2x00: Fix for race condition while update beacon 



The patch "Implement set_tim callback for all drivers" can cause kernel
oops in rt73usb_write_beacon. The oops is caused by one of the following
race conditions:
* In case of two near calls to set_tim: rt2x00lib_beacondone_iter is
cleaning the beacon skb, whereas rt73usb_write_beacon is still using it.
* In case of two near updates of beacon: first as the result of set_tim
and second as the result of a call from an application (e.g. hostapd).
This patch fixes the race condition by rearranging the update logic and
guarding rt2x00_intf->beacon->skb with a mutex.

Signed-off-by: default avatarIgor Perminov <igor.perminov@inbox.ru>
Signed-off-by: default avatarIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 66679a65

drivers/net/wireless/rt2x00/rt2x00.h

+5 −0
Original line number Original line Diff line number Diff line
@@ -333,6 +333,11 @@ struct rt2x00_intf { 
	 */

	 */

	u8 bssid[ETH_ALEN];

	u8 bssid[ETH_ALEN];





	/*

	 * beacon->skb must be protected with the mutex.

	 */

	struct mutex beacon_skb_mutex;



	/*

	/*

	 * Entry in the beacon queue which belongs to

	 * Entry in the beacon queue which belongs to

	 * this interface. Each interface has its own

	 * this interface. Each interface has its own

drivers/net/wireless/rt2x00/rt2x00dev.c

+0 −7
Original line number Original line Diff line number Diff line
@@ -186,7 +186,6 @@ static void rt2x00lib_intf_scheduled(struct work_struct *work) 
static void rt2x00lib_beacondone_iter(void *data, u8 *mac,

static void rt2x00lib_beacondone_iter(void *data, u8 *mac,

				      struct ieee80211_vif *vif)

				      struct ieee80211_vif *vif)

{

{

	struct rt2x00_dev *rt2x00dev = data;

	struct rt2x00_intf *intf = vif_to_intf(vif);

	struct rt2x00_intf *intf = vif_to_intf(vif);





	if (vif->type != NL80211_IFTYPE_AP &&

	if (vif->type != NL80211_IFTYPE_AP &&
@@ -195,12 +194,6 @@ static void rt2x00lib_beacondone_iter(void *data, u8 *mac, 
	    vif->type != NL80211_IFTYPE_WDS)

	    vif->type != NL80211_IFTYPE_WDS)

		return;

		return;





	/*

	 * Clean up the beacon skb.

	 */

	rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb);

	intf->beacon->skb = NULL;



	spin_lock(&intf->lock);

	spin_lock(&intf->lock);

	intf->delayed_flags |= DELAYED_UPDATE_BEACON;

	intf->delayed_flags |= DELAYED_UPDATE_BEACON;

	spin_unlock(&intf->lock);

	spin_unlock(&intf->lock);

drivers/net/wireless/rt2x00/rt2x00mac.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -274,6 +274,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw, 




	spin_lock_init(&intf->lock);

	spin_lock_init(&intf->lock);

	spin_lock_init(&intf->seqlock);

	spin_lock_init(&intf->seqlock);

	mutex_init(&intf->beacon_skb_mutex);

	intf->beacon = entry;

	intf->beacon = entry;





	if (conf->type == NL80211_IFTYPE_AP)

	if (conf->type == NL80211_IFTYPE_AP)

drivers/net/wireless/rt2x00/rt2x00queue.c

+14 −1
Original line number Original line Diff line number Diff line
@@ -503,14 +503,25 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev, 
	if (unlikely(!intf->beacon))

	if (unlikely(!intf->beacon))

		return -ENOBUFS;

		return -ENOBUFS;





	mutex_lock(&intf->beacon_skb_mutex);



	/*

	 * Clean up the beacon skb.

	 */

	rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb);

	intf->beacon->skb = NULL;



	if (!enable_beacon) {

	if (!enable_beacon) {

		rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, QID_BEACON);

		rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, QID_BEACON);

		mutex_unlock(&intf->beacon_skb_mutex);

		return 0;

		return 0;

	}

	}





	intf->beacon->skb = ieee80211_beacon_get(rt2x00dev->hw, vif);

	intf->beacon->skb = ieee80211_beacon_get(rt2x00dev->hw, vif);

	if (!intf->beacon->skb)

	if (!intf->beacon->skb) {

		mutex_unlock(&intf->beacon_skb_mutex);

		return -ENOMEM;

		return -ENOMEM;

	}





	/*

	/*

	 * Copy all TX descriptor information into txdesc,

	 * Copy all TX descriptor information into txdesc,
@@ -548,6 +559,8 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev, 
	rt2x00dev->ops->lib->write_beacon(intf->beacon);

	rt2x00dev->ops->lib->write_beacon(intf->beacon);

	rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, QID_BEACON);

	rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, QID_BEACON);





	mutex_unlock(&intf->beacon_skb_mutex);



	return 0;

	return 0;

}

}