Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ffae432 authored by Lior David's avatar Lior David Committed by Kalle Valo
Browse files

wil6210: fix protection of wil->scan_request 



Currently the places that check wil->scan_request and
call cfg80211_scan_done are not consistently protected,
so there is a risk that cfg80211_scan_done will be called
with NULL scan_request, causing a kernel crash.
Fix this by using p2p_wdev_mutex in few other places
that access scan_request. This makes sense since
scan_request may point to p2p_wdev, and it is not worth
the extra complexity of adding a new mutex.

Signed-off-by: default avatarLior David <qca_liord@qca.qualcomm.com>
Signed-off-by: default avatarMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
parent 47b1848d

drivers/net/wireless/ath/wil6210/cfg80211.c

+3 −0
Original line number Diff line number Diff line
@@ -354,10 +354,13 @@ static int wil_cfg80211_scan(struct wiphy *wiphy, 
	wil_dbg_misc(wil, "%s(), wdev=0x%p iftype=%d\n",

		     __func__, wdev, wdev->iftype);



	mutex_lock(&wil->p2p_wdev_mutex);

	if (wil->scan_request) {

		wil_err(wil, "Already scanning\n");

		mutex_unlock(&wil->p2p_wdev_mutex);

		return -EAGAIN;

	}

	mutex_unlock(&wil->p2p_wdev_mutex);



	/* check we are client side */

	switch (wdev->iftype) {

drivers/net/wireless/ath/wil6210/main.c

+4 −0
Original line number Diff line number Diff line
@@ -852,6 +852,7 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw) 
	bitmap_zero(wil->status, wil_status_last);

	mutex_unlock(&wil->wmi_mutex);



	mutex_lock(&wil->p2p_wdev_mutex);

	if (wil->scan_request) {

		struct cfg80211_scan_info info = {

			.aborted = true,
@@ -863,6 +864,7 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw) 
		cfg80211_scan_done(wil->scan_request, &info);

		wil->scan_request = NULL;

	}

	mutex_unlock(&wil->p2p_wdev_mutex);



	wil_mask_irq(wil);
@@ -1055,6 +1057,7 @@ int __wil_down(struct wil6210_priv *wil) 


	wil_p2p_stop_radio_operations(wil);



	mutex_lock(&wil->p2p_wdev_mutex);

	if (wil->scan_request) {

		struct cfg80211_scan_info info = {

			.aborted = true,
@@ -1066,6 +1069,7 @@ int __wil_down(struct wil6210_priv *wil) 
		cfg80211_scan_done(wil->scan_request, &info);

		wil->scan_request = NULL;

	}

	mutex_unlock(&wil->p2p_wdev_mutex);



	wil_reset(wil, false);

drivers/net/wireless/ath/wil6210/wil6210.h

+1 −1
Original line number Diff line number Diff line
@@ -657,7 +657,7 @@ struct wil6210_priv { 


	/* P2P_DEVICE vif */

	struct wireless_dev *p2p_wdev;

	struct mutex p2p_wdev_mutex; /* protect @p2p_wdev */

	struct mutex p2p_wdev_mutex; /* protect @p2p_wdev and @scan_request */

	struct wireless_dev *radio_wdev;



	/* High Access Latency Policy voting */

drivers/net/wireless/ath/wil6210/wmi.c

+2 −2
Original line number Diff line number Diff line
@@ -424,6 +424,7 @@ static void wmi_evt_tx_mgmt(struct wil6210_priv *wil, int id, void *d, int len) 
static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id,

				  void *d, int len)

{

	mutex_lock(&wil->p2p_wdev_mutex);

	if (wil->scan_request) {

		struct wmi_scan_complete_event *data = d;

		struct cfg80211_scan_info info = {
@@ -435,14 +436,13 @@ static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id, 
			     wil->scan_request, info.aborted);



		del_timer_sync(&wil->scan_timer);

		mutex_lock(&wil->p2p_wdev_mutex);

		cfg80211_scan_done(wil->scan_request, &info);

		wil->radio_wdev = wil->wdev;

		mutex_unlock(&wil->p2p_wdev_mutex);

		wil->scan_request = NULL;

	} else {

		wil_err(wil, "SCAN_COMPLETE while not scanning\n");

	}

	mutex_unlock(&wil->p2p_wdev_mutex);

}



static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)