Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5a7e582 authored by Johannes Berg's avatar Johannes Berg
Browse files

cfg80211: fix locking regression in monitor channel tracking 



Michal's monitor channel tracking introduce a locking problem
as it locked the rdev lock inside the netdev notifier which
isn't allowed as we might already hold it if we get there by
removing an interface that is up.

Fix this by relying only on the RTNL to protect the interface
counters, the RTNL is always held in these code paths anyway.

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent a1845fc7

net/wireless/core.c

+2 −6
Original line number Original line Diff line number Diff line
@@ -766,7 +766,7 @@ void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev, 
	bool has_monitors_only_old = cfg80211_has_monitors_only(rdev);

	bool has_monitors_only_old = cfg80211_has_monitors_only(rdev);

	bool has_monitors_only_new;

	bool has_monitors_only_new;





	ASSERT_RDEV_LOCK(rdev);

	ASSERT_RTNL();





	rdev->num_running_ifaces += num;

	rdev->num_running_ifaces += num;

	if (iftype == NL80211_IFTYPE_MONITOR)

	if (iftype == NL80211_IFTYPE_MONITOR)
@@ -888,10 +888,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb, 
		wdev->beacon_interval = 0;

		wdev->beacon_interval = 0;

		break;

		break;

	case NETDEV_DOWN:

	case NETDEV_DOWN:

		dev_hold(dev);

		cfg80211_lock_rdev(rdev);

		cfg80211_update_iface_num(rdev, wdev->iftype, -1);

		cfg80211_update_iface_num(rdev, wdev->iftype, -1);

		cfg80211_unlock_rdev(rdev);

		dev_hold(dev);

		queue_work(cfg80211_wq, &wdev->cleanup_work);

		queue_work(cfg80211_wq, &wdev->cleanup_work);

		break;

		break;

	case NETDEV_UP:

	case NETDEV_UP:
@@ -1001,9 +999,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb, 
		mutex_unlock(&rdev->devlist_mtx);

		mutex_unlock(&rdev->devlist_mtx);

		if (ret)

		if (ret)

			return notifier_from_errno(ret);

			return notifier_from_errno(ret);

		cfg80211_lock_rdev(rdev);

		cfg80211_update_iface_num(rdev, wdev->iftype, 1);

		cfg80211_update_iface_num(rdev, wdev->iftype, 1);

		cfg80211_unlock_rdev(rdev);

		break;

		break;

	}

	}

net/wireless/core.h

+3 −1
Original line number Original line Diff line number Diff line
@@ -13,6 +13,7 @@ 
#include <linux/debugfs.h>

#include <linux/debugfs.h>

#include <linux/rfkill.h>

#include <linux/rfkill.h>

#include <linux/workqueue.h>

#include <linux/workqueue.h>

#include <linux/rtnetlink.h>

#include <net/genetlink.h>

#include <net/genetlink.h>

#include <net/cfg80211.h>

#include <net/cfg80211.h>

#include "reg.h"

#include "reg.h"
@@ -56,6 +57,7 @@ struct cfg80211_registered_device { 




	u32 ap_beacons_nlpid;

	u32 ap_beacons_nlpid;





	/* protected by RTNL only */

	int num_running_ifaces;

	int num_running_ifaces;

	int num_running_monitor_ifaces;

	int num_running_monitor_ifaces;
@@ -205,7 +207,7 @@ static inline void wdev_unlock(struct wireless_dev *wdev) 




static inline bool cfg80211_has_monitors_only(struct cfg80211_registered_device *rdev)

static inline bool cfg80211_has_monitors_only(struct cfg80211_registered_device *rdev)

{

{

	ASSERT_RDEV_LOCK(rdev);

	ASSERT_RTNL();





	return rdev->num_running_ifaces == rdev->num_running_monitor_ifaces &&

	return rdev->num_running_ifaces == rdev->num_running_monitor_ifaces &&

	       rdev->num_running_ifaces > 0;

	       rdev->num_running_ifaces > 0;