rt2x00: Fix for race condition while update beacon

The patch "Implement set_tim callback for all drivers" can cause kernel
oops in rt73usb_write_beacon. The oops is caused by one of the following
race conditions:
* In case of two near calls to set_tim: rt2x00lib_beacondone_iter is
cleaning the beacon skb, whereas rt73usb_write_beacon is still using it.
* In case of two near updates of beacon: first as the result of set_tim
and second as the result of a call from an application (e.g. hostapd).
This patch fixes the race condition by rearranging the update logic and
guarding rt2x00_intf->beacon->skb with a mutex.

Signed-off-by: Igor Perminov <igor.perminov@inbox.ru>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index e6e73be31e378816612015c6d51b1e4800d7393c..7c74c4efcb0f7eddc6ffc9438943a8692101303f 100644 (file)
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -333,6 +333,11 @@ struct rt2x00_intf {
         */
        u8 bssid[ETH_ALEN];
 
+       /*
+        * beacon->skb must be protected with the mutex.
+        */
+       struct mutex beacon_skb_mutex;
+
        /*
         * Entry in the beacon queue which belongs to
         * this interface. Each interface has its own

diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index e0348cc22d16cb3d98e9c2f274b8fecdbcde487b..b6676c6722fc54de677c1cf6bef92f29f7771ec1 100644 (file)
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -186,7 +186,6 @@ static void rt2x00lib_intf_scheduled(struct work_struct *work)
 static void rt2x00lib_beacondone_iter(void *data, u8 *mac,
                                      struct ieee80211_vif *vif)
 {
-       struct rt2x00_dev *rt2x00dev = data;
        struct rt2x00_intf *intf = vif_to_intf(vif);
 
        if (vif->type != NL80211_IFTYPE_AP &&
@@ -195,12 +194,6 @@ static void rt2x00lib_beacondone_iter(void *data, u8 *mac,
            vif->type != NL80211_IFTYPE_WDS)
                return;
 
-       /*
-        * Clean up the beacon skb.
-        */
-       rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb);
-       intf->beacon->skb = NULL;
-
        spin_lock(&intf->lock);
        intf->delayed_flags |= DELAYED_UPDATE_BEACON;
        spin_unlock(&intf->lock);

diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 4164fce05987343871e95df71a249f63039da5d4..74451f9672d97bb5d41c63f7840730fdd976f527 100644 (file)
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -274,6 +274,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
 
        spin_lock_init(&intf->lock);
        spin_lock_init(&intf->seqlock);
+       mutex_init(&intf->beacon_skb_mutex);
        intf->beacon = entry;
 
        if (conf->type == NL80211_IFTYPE_AP)

diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index e67e339d9dfdf75c692fc9aa4e42659fa0bbbf4d..06af823efd83fe122030adb4ed49d21397cabef8 100644 (file)
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -503,14 +503,25 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
        if (unlikely(!intf->beacon))
                return -ENOBUFS;
 
+       mutex_lock(&intf->beacon_skb_mutex);
+
+       /*
+        * Clean up the beacon skb.
+        */
+       rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb);
+       intf->beacon->skb = NULL;
+
        if (!enable_beacon) {
                rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, QID_BEACON);
+               mutex_unlock(&intf->beacon_skb_mutex);
                return 0;
        }
 
        intf->beacon->skb = ieee80211_beacon_get(rt2x00dev->hw, vif);
-       if (!intf->beacon->skb)
+       if (!intf->beacon->skb) {
+               mutex_unlock(&intf->beacon_skb_mutex);
                return -ENOMEM;
+       }
 
        /*
         * Copy all TX descriptor information into txdesc,
@@ -548,6 +559,8 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
        rt2x00dev->ops->lib->write_beacon(intf->beacon);
        rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, QID_BEACON);
 
+       mutex_unlock(&intf->beacon_skb_mutex);
+
        return 0;
 }