Commit e229f844 authored by Stanislaw Gruszka's avatar Stanislaw Gruszka Committed by John W. Linville
Browse files

mac80211: keep lock when calling __ieee80211_scan_completed() 



We are taking local->mtx inside __ieee80211_scan_completed(), but just
before call to that function we drop the lock. Dropping/taking lock is not
good, because can lead to hard to understand race conditions.

Patch split scan_completed() code into two functions, first must be called
with local->mtx taken and second without it.

Signed-off-by: default avatarStanislaw Gruszka <sgruszka@redhat.com>
Acked-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 259b62e3

net/mac80211/scan.c

+39 −36
Original line number Diff line number Diff line
@@ -249,12 +249,12 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local) 
	return true;

}



static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)

static bool __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,

				       bool was_hw_scan)

{

	struct ieee80211_local *local = hw_to_local(hw);

	bool was_hw_scan;



	mutex_lock(&local->mtx);

	lockdep_assert_held(&local->mtx);



	/*

	 * It's ok to abort a not-yet-running scan (that
@@ -265,17 +265,13 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) 
	if (WARN_ON(!local->scanning && !aborted))

		aborted = true;



	if (WARN_ON(!local->scan_req)) {

		mutex_unlock(&local->mtx);

		return;

	}

	if (WARN_ON(!local->scan_req))

		return false;



	was_hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);

	if (was_hw_scan && !aborted && ieee80211_prep_hw_scan(local)) {

		ieee80211_queue_delayed_work(&local->hw,

					     &local->scan_work, 0);

		mutex_unlock(&local->mtx);

		return;

		return false;

	}



	kfree(local->hw_scan_req);
@@ -289,23 +285,25 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) 
	local->scanning = 0;

	local->scan_channel = NULL;



	/* we only have to protect scan_req and hw/sw scan */

	mutex_unlock(&local->mtx);

	return true;

}



	ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);

	if (was_hw_scan)

		goto done;

static void __ieee80211_scan_completed_finish(struct ieee80211_hw *hw,

					      bool was_hw_scan)

{

	struct ieee80211_local *local = hw_to_local(hw);



	ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);

	if (!was_hw_scan) {

		ieee80211_configure_filter(local);



		drv_sw_scan_complete(local);



		ieee80211_offchannel_return(local, true);

	}



 done:

	mutex_lock(&local->mtx);

	ieee80211_recalc_idle(local);

	mutex_unlock(&local->mtx);



	ieee80211_mlme_notify_scan_completed(local);

	ieee80211_ibss_notify_scan_completed(local);

	ieee80211_mesh_notify_scan_completed(local);
@@ -366,6 +364,8 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, 
	struct ieee80211_local *local = sdata->local;

	int rc;



	lockdep_assert_held(&local->mtx);



	if (local->scan_req)

		return -EBUSY;
@@ -447,7 +447,7 @@ ieee80211_scan_get_channel_time(struct ieee80211_channel *chan) 
	return IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME;

}



static int ieee80211_scan_state_decision(struct ieee80211_local *local,

static void ieee80211_scan_state_decision(struct ieee80211_local *local,

					  unsigned long *next_delay)

{

	bool associated = false;
@@ -458,12 +458,6 @@ static int ieee80211_scan_state_decision(struct ieee80211_local *local, 
	struct ieee80211_sub_if_data *sdata;

	struct ieee80211_channel *next_chan;



	/* if no more bands/channels left, complete scan and advance to the idle state */

	if (local->scan_channel_idx >= local->scan_req->n_channels) {

		__ieee80211_scan_completed(&local->hw, false);

		return 1;

	}



	/*

	 * check if at least one STA interface is associated,

	 * check if at least one STA interface has pending tx frames
@@ -535,7 +529,6 @@ static int ieee80211_scan_state_decision(struct ieee80211_local *local, 
	}



	*next_delay = 0;

	return 0;

}



static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
@@ -651,7 +644,7 @@ void ieee80211_scan_work(struct work_struct *work) 
		container_of(work, struct ieee80211_local, scan_work.work);

	struct ieee80211_sub_if_data *sdata = local->scan_sdata;

	unsigned long next_delay = 0;

	bool aborted;

	bool aborted, hw_scan, finish;



	mutex_lock(&local->mtx);
@@ -704,8 +697,12 @@ void ieee80211_scan_work(struct work_struct *work) 
	do {

		switch (local->next_scan_state) {

		case SCAN_DECISION:

			if (ieee80211_scan_state_decision(local, &next_delay))

				return;

			/* if no more bands/channels left, complete scan */

			if (local->scan_channel_idx >= local->scan_req->n_channels) {

				aborted = false;

				goto out_complete;

			}

			ieee80211_scan_state_decision(local, &next_delay);

			break;

		case SCAN_SET_CHANNEL:

			ieee80211_scan_state_set_channel(local, &next_delay);
@@ -726,8 +723,11 @@ void ieee80211_scan_work(struct work_struct *work) 
	return;



out_complete:

	hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);

	finish = __ieee80211_scan_completed(&local->hw, aborted, hw_scan);

	mutex_unlock(&local->mtx);

	__ieee80211_scan_completed(&local->hw, aborted);

	if (finish)

		__ieee80211_scan_completed_finish(&local->hw, hw_scan);

	return;



out:
@@ -796,6 +796,7 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata, 
void ieee80211_scan_cancel(struct ieee80211_local *local)

{

	bool abortscan;

	bool finish = false;



	cancel_delayed_work_sync(&local->scan_work);
@@ -806,8 +807,10 @@ void ieee80211_scan_cancel(struct ieee80211_local *local) 
	mutex_lock(&local->mtx);

	abortscan = test_bit(SCAN_SW_SCANNING, &local->scanning) ||

		    (!local->scanning && local->scan_req);

	if (abortscan)

		finish = __ieee80211_scan_completed(&local->hw, true, false);

	mutex_unlock(&local->mtx);



	if (abortscan)

		__ieee80211_scan_completed(&local->hw, true);

	if (finish)

		__ieee80211_scan_completed_finish(&local->hw, false);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE