Commit f9d15d16 authored by Johannes Berg's avatar Johannes Berg
Browse files

cfg80211: send scan results from work queue 



Due to the previous commit, when a scan finishes, it is in theory
possible to hit the following sequence:
 1. interface starts being removed
 2. scan is cancelled by driver and cfg80211 is notified
 3. scan done work is scheduled
 4. interface is removed completely, rdev->scan_req is freed,
    event sent to userspace but scan done work remains pending
 5. new scan is requested on another virtual interface
 6. scan done work runs, freeing the still-running scan

To fix this situation, hang on to the scan done message and block
new scans while that is the case, and only send the message from
the work function, regardless of whether the scan_req is already
freed from interface removal. This makes step 5 above impossible
and changes step 6 to be
 5. scan done work runs, sending the scan done message

As this can't work for wext, so we send the message immediately,
but this shouldn't be an issue since we still return -EBUSY.

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent a617302c

net/wireless/core.c

+2 −2
Original line number Diff line number Diff line
@@ -206,7 +206,7 @@ void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev, 
	if (rdev->scan_req && rdev->scan_req->wdev == wdev) {

		if (WARN_ON(!rdev->scan_req->notified))

			rdev->scan_req->aborted = true;

		___cfg80211_scan_done(rdev);

		___cfg80211_scan_done(rdev, false);

	}

}
@@ -862,7 +862,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb, 
		if (rdev->scan_req && rdev->scan_req->wdev == wdev) {

			if (WARN_ON(!rdev->scan_req->notified))

				rdev->scan_req->aborted = true;

			___cfg80211_scan_done(rdev);

			___cfg80211_scan_done(rdev, false);

		}



		if (WARN_ON(rdev->sched_scan_req &&

net/wireless/core.h

+3 −1
Original line number Diff line number Diff line
@@ -62,6 +62,7 @@ struct cfg80211_registered_device { 
	struct rb_root bss_tree;

	u32 bss_generation;

	struct cfg80211_scan_request *scan_req; /* protected by RTNL */

	struct sk_buff *scan_msg;

	struct cfg80211_sched_scan_request *sched_scan_req;

	unsigned long suspend_at;

	struct work_struct scan_done_wk;
@@ -361,7 +362,8 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev, 
				   struct key_params *params, int key_idx,

				   bool pairwise, const u8 *mac_addr);

void __cfg80211_scan_done(struct work_struct *wk);

void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev);

void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,

			   bool send_message);

void __cfg80211_sched_scan_results(struct work_struct *wk);

int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,

			       bool driver_initiated);

net/wireless/nl80211.c

+10 −19
Original line number Diff line number Diff line
@@ -5245,7 +5245,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 
	if (!rdev->ops->scan)

		return -EOPNOTSUPP;



	if (rdev->scan_req) {

	if (rdev->scan_req || rdev->scan_msg) {

		err = -EBUSY;

		goto unlock;

	}
@@ -10012,40 +10012,31 @@ void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 
				NL80211_MCGRP_SCAN, GFP_KERNEL);

}



void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,

			    struct wireless_dev *wdev)

struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,

				       struct wireless_dev *wdev, bool aborted)

{

	struct sk_buff *msg;



	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);

	if (!msg)

		return;

		return NULL;



	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,

				  aborted ? NL80211_CMD_SCAN_ABORTED :

					    NL80211_CMD_NEW_SCAN_RESULTS) < 0) {

		nlmsg_free(msg);

		return;

		return NULL;

	}



	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,

				NL80211_MCGRP_SCAN, GFP_KERNEL);

	return msg;

}



void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,

			       struct wireless_dev *wdev)

void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,

			      struct sk_buff *msg)

{

	struct sk_buff *msg;



	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);

	if (!msg)

		return;



	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,

				  NL80211_CMD_SCAN_ABORTED) < 0) {

		nlmsg_free(msg);

		return;

	}



	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,

				NL80211_MCGRP_SCAN, GFP_KERNEL);

}

net/wireless/nl80211.h

+4 −4
Original line number Diff line number Diff line
@@ -8,10 +8,10 @@ void nl80211_exit(void); 
void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev);

void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,

			     struct wireless_dev *wdev);

void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,

			    struct wireless_dev *wdev);

void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,

			       struct wireless_dev *wdev);

struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,

				       struct wireless_dev *wdev, bool aborted);

void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,

			      struct sk_buff *msg);

void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,

			     struct net_device *netdev, u32 cmd);

void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,

net/wireless/scan.c

+25 −15
Original line number Diff line number Diff line
@@ -161,18 +161,25 @@ static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev, 
		dev->bss_generation++;

}



void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)

void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,

			   bool send_message)

{

	struct cfg80211_scan_request *request;

	struct wireless_dev *wdev;

	struct sk_buff *msg;

#ifdef CONFIG_CFG80211_WEXT

	union iwreq_data wrqu;

#endif



	ASSERT_RTNL();



	request = rdev->scan_req;

	if (rdev->scan_msg) {

		nl80211_send_scan_result(rdev, rdev->scan_msg);

		rdev->scan_msg = NULL;

		return;

	}



	request = rdev->scan_req;

	if (!request)

		return;
@@ -186,17 +193,15 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev) 
	if (wdev->netdev)

		cfg80211_sme_scan_done(wdev->netdev);



	if (request->aborted) {

		nl80211_send_scan_aborted(rdev, wdev);

	} else {

		if (request->flags & NL80211_SCAN_FLAG_FLUSH) {

	if (!request->aborted &&

	    request->flags & NL80211_SCAN_FLAG_FLUSH) {

		/* flush entries from previous scans */

		spin_lock_bh(&rdev->bss_lock);

		__cfg80211_bss_expire(rdev, request->scan_start);

		spin_unlock_bh(&rdev->bss_lock);

	}

		nl80211_send_scan_done(rdev, wdev);

	}



	msg = nl80211_build_scan_msg(rdev, wdev, request->aborted);



#ifdef CONFIG_CFG80211_WEXT

	if (wdev->netdev && !request->aborted) {
@@ -211,6 +216,11 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev) 


	rdev->scan_req = NULL;

	kfree(request);



	if (!send_message)

		rdev->scan_msg = msg;

	else

		nl80211_send_scan_result(rdev, msg);

}



void __cfg80211_scan_done(struct work_struct *wk)
@@ -221,7 +231,7 @@ void __cfg80211_scan_done(struct work_struct *wk) 
			    scan_done_wk);



	rtnl_lock();

	___cfg80211_scan_done(rdev);

	___cfg80211_scan_done(rdev, true);

	rtnl_unlock();

}
@@ -1079,7 +1089,7 @@ int cfg80211_wext_siwscan(struct net_device *dev, 
	if (IS_ERR(rdev))

		return PTR_ERR(rdev);



	if (rdev->scan_req) {

	if (rdev->scan_req || rdev->scan_msg) {

		err = -EBUSY;

		goto out;

	}
@@ -1481,7 +1491,7 @@ int cfg80211_wext_giwscan(struct net_device *dev, 
	if (IS_ERR(rdev))

		return PTR_ERR(rdev);



	if (rdev->scan_req)

	if (rdev->scan_req || rdev->scan_msg)

		return -EAGAIN;



	res = ieee80211_scan_results(rdev, info, extra, data->length);

CRA Git | Maintained and supported by SUSTech CRA and CCSE