mac80211: fix suspend

Jan reported that his b43-based laptop hangs during suspend.
The problem turned out to be mac80211 asking the driver to
stop the hardware before removing interfaces, and interface
removal caused b43 to touch the hardware (while down, which
causes the hang).

This patch fixes mac80211 to do reorder these operations to
have them in the correct order -- first remove interfaces
and then stop the hardware. Some more code is necessary to
be able to do so in a race-free manner, in particular it is
necessary to not process frames received during quiescing.

Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13337.

Reported-by: Jan Scholz <scholz@fias.uni-frankfurt.de>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7a549f9deb967c1acbcf4ce1dbc41d28bcbefb4d..5e3d476972f916f741ea44d5c1d62fb60acf83dc 100644 (file)
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -55,15 +55,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 
        rcu_read_unlock();
 
-       /* flush again, in case driver queued work */
-       flush_workqueue(local->hw.workqueue);
-
-       /* stop hardware - this must stop RX */
-       if (local->open_count) {
-               ieee80211_led_radio(local, false);
-               drv_stop(local);
-       }
-
        /* remove STAs */
        spin_lock_irqsave(&local->sta_lock, flags);
        list_for_each_entry(sta, &local->sta_list, list) {
@@ -111,7 +102,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                drv_remove_interface(local, &conf);
        }
 
+       /* stop hardware - this must stop RX */
+       if (local->open_count) {
+               ieee80211_led_radio(local, false);
+               drv_stop(local);
+       }
+
+       /*
+        * flush again, in case driver queued work -- it
+        * shouldn't be doing (or cancel everything in the
+        * stop callback) that but better safe than sorry.
+        */
+       flush_workqueue(local->hw.workqueue);
+
        local->suspended = true;
+       /* need suspended to be visible before quiescing is false */
+       barrier();
        local->quiescing = false;
 
        return 0;

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index de5bba7f910ae876637c3002544a6963eebccdfd..0936fc24942deddd8ea69f66f29c1b8c35d1e468 100644 (file)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2453,6 +2453,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                return;
        }
 
+       /*
+        * If we're suspending, it is possible although not too likely
+        * that we'd be receiving frames after having already partially
+        * quiesced the stack. We can't process such frames then since
+        * that might, for example, cause stations to be added or other
+        * driver callbacks be invoked.
+        */
+       if (unlikely(local->quiescing || local->suspended)) {
+               kfree_skb(skb);
+               return;
+       }
+
        if (status->flag & RX_FLAG_HT) {
                /* rate_idx is MCS index */
                if (WARN_ON(status->rate_idx < 0 ||