From patchwork Sat Aug 8 21:55:18 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ivo van Doorn X-Patchwork-Id: 40206 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n78LuKMB010342 for ; Sat, 8 Aug 2009 21:56:21 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752632AbZHHV4Q (ORCPT ); Sat, 8 Aug 2009 17:56:16 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751407AbZHHV4Q (ORCPT ); Sat, 8 Aug 2009 17:56:16 -0400 Received: from mail-ew0-f211.google.com ([209.85.219.211]:38598 "EHLO mail-ew0-f211.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752486AbZHHV4M (ORCPT ); Sat, 8 Aug 2009 17:56:12 -0400 Received: by mail-ew0-f211.google.com with SMTP id 7so1937875ewy.18 for ; Sat, 08 Aug 2009 14:56:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:to:subject:date :user-agent:cc:references:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:message-id; bh=xTCf6tVmV364tBD8f/d6jIMlZZkT/Ek7QFz0tjg7DFo=; b=eNUPEGl1V+V8Xs6Rudjgy2nTXxLmGQIFZsqJEJ/1nEWivJ2AeoVuWKtrAG1W5td2AW POY5EJaCUuG+fyTxK+Q5CNPIGUvhI+xGS711M2kgO2FRT+dhumd/ETmfMTlql/M/k95q Od5FovgocD7Y9UKJKnPS/toYwYlyZ3imnn5WE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding :content-disposition:message-id; b=bFZhAiZe33OKug6kTsLejSvJye91osuR4GurlxUqKkgY/3cX3lBpW+kBnKhk6MMQyl vXhPMesxggD1IHTbrxrAefzppUqFmA9xHSTObam6EmT0otEahaoq789ioJtcuINSFe8+ 6FSJOT1OgV1pRu/zH+6gY8J+QThpn6l7cM094= Received: by 10.211.201.8 with SMTP id d8mr3256393ebq.7.1249768573137; Sat, 08 Aug 2009 14:56:13 -0700 (PDT) Received: from ?192.168.8.41? (k19232.upc-k.chello.nl [62.108.19.232]) by mx.google.com with ESMTPS id 10sm6832687eyd.37.2009.08.08.14.56.12 (version=SSLv3 cipher=RC4-MD5); Sat, 08 Aug 2009 14:56:12 -0700 (PDT) From: Ivo van Doorn To: John Linville Subject: [PATCH 6/7] rt2x00: Fix for race condition while update beacon Date: Sat, 8 Aug 2009 23:55:18 +0200 User-Agent: KMail/1.9.10 Cc: users@host1.serialmonkey.com, "linux-wireless" , Igor Perminov References: <200908082353.04274.IvDoorn@gmail.com> <200908082354.24733.IvDoorn@gmail.com> <200908082354.51745.IvDoorn@gmail.com> In-Reply-To: <200908082354.51745.IvDoorn@gmail.com> MIME-Version: 1.0 Content-Disposition: inline Message-Id: <200908082355.19233.IvDoorn@gmail.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Igor Perminov The patch "Implement set_tim callback for all drivers" can cause kernel oops in rt73usb_write_beacon. The oops is caused by one of the following race conditions: * In case of two near calls to set_tim: rt2x00lib_beacondone_iter is cleaning the beacon skb, whereas rt73usb_write_beacon is still using it. * In case of two near updates of beacon: first as the result of set_tim and second as the result of a call from an application (e.g. hostapd). This patch fixes the race condition by rearranging the update logic and guarding rt2x00_intf->beacon->skb with a mutex. Signed-off-by: Igor Perminov Signed-off-by: Ivo van Doorn --- drivers/net/wireless/rt2x00/rt2x00.h | 5 +++++ drivers/net/wireless/rt2x00/rt2x00dev.c | 7 ------- drivers/net/wireless/rt2x00/rt2x00mac.c | 1 + drivers/net/wireless/rt2x00/rt2x00queue.c | 15 ++++++++++++++- 4 files changed, 20 insertions(+), 8 deletions(-) diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h index 19ca146..806ef60 100644 --- a/drivers/net/wireless/rt2x00/rt2x00.h +++ b/drivers/net/wireless/rt2x00/rt2x00.h @@ -334,6 +334,11 @@ struct rt2x00_intf { u8 bssid[ETH_ALEN]; /* + * beacon->skb must be protected with the mutex. + */ + struct mutex beacon_skb_mutex; + + /* * Entry in the beacon queue which belongs to * this interface. Each interface has its own * dedicated beacon entry. diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c index e0348cc..b6676c6 100644 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c @@ -186,7 +186,6 @@ static void rt2x00lib_intf_scheduled(struct work_struct *work) static void rt2x00lib_beacondone_iter(void *data, u8 *mac, struct ieee80211_vif *vif) { - struct rt2x00_dev *rt2x00dev = data; struct rt2x00_intf *intf = vif_to_intf(vif); if (vif->type != NL80211_IFTYPE_AP && @@ -195,12 +194,6 @@ static void rt2x00lib_beacondone_iter(void *data, u8 *mac, vif->type != NL80211_IFTYPE_WDS) return; - /* - * Clean up the beacon skb. - */ - rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb); - intf->beacon->skb = NULL; - spin_lock(&intf->lock); intf->delayed_flags |= DELAYED_UPDATE_BEACON; spin_unlock(&intf->lock); diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c index 4164fce..74451f9 100644 --- a/drivers/net/wireless/rt2x00/rt2x00mac.c +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c @@ -274,6 +274,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw, spin_lock_init(&intf->lock); spin_lock_init(&intf->seqlock); + mutex_init(&intf->beacon_skb_mutex); intf->beacon = entry; if (conf->type == NL80211_IFTYPE_AP) diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c index e67e339..06af823 100644 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c @@ -503,14 +503,25 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev, if (unlikely(!intf->beacon)) return -ENOBUFS; + mutex_lock(&intf->beacon_skb_mutex); + + /* + * Clean up the beacon skb. + */ + rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb); + intf->beacon->skb = NULL; + if (!enable_beacon) { rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, QID_BEACON); + mutex_unlock(&intf->beacon_skb_mutex); return 0; } intf->beacon->skb = ieee80211_beacon_get(rt2x00dev->hw, vif); - if (!intf->beacon->skb) + if (!intf->beacon->skb) { + mutex_unlock(&intf->beacon_skb_mutex); return -ENOMEM; + } /* * Copy all TX descriptor information into txdesc, @@ -548,6 +559,8 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev, rt2x00dev->ops->lib->write_beacon(intf->beacon); rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, QID_BEACON); + mutex_unlock(&intf->beacon_skb_mutex); + return 0; }