diff options
| author | Igor Perminov <igor.perminov@inbox.ru> | 2009-08-08 23:55:18 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-08-14 09:13:53 -0400 |
| commit | 17512dc3b7fc9ff1a60d3748ce87c323df507c3d (patch) | |
| tree | 1ad4c98c3c653571552156116ce639c6e0aa2789 /drivers/net/wireless/rt2x00/rt2x00queue.c | |
| parent | 66679a65efffffb62dc2650960b3aff758d575f9 (diff) | |
rt2x00: Fix for race condition while update beacon
The patch "Implement set_tim callback for all drivers" can cause kernel
oops in rt73usb_write_beacon. The oops is caused by one of the following
race conditions:
* In case of two near calls to set_tim: rt2x00lib_beacondone_iter is
cleaning the beacon skb, whereas rt73usb_write_beacon is still using it.
* In case of two near updates of beacon: first as the result of set_tim
and second as the result of a call from an application (e.g. hostapd).
This patch fixes the race condition by rearranging the update logic and
guarding rt2x00_intf->beacon->skb with a mutex.
Signed-off-by: Igor Perminov <igor.perminov@inbox.ru>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/rt2x00/rt2x00queue.c')
| -rw-r--r-- | drivers/net/wireless/rt2x00/rt2x00queue.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c index e67e339d9df..06af823efd8 100644 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c @@ -503,14 +503,25 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev, if (unlikely(!intf->beacon)) return -ENOBUFS; + mutex_lock(&intf->beacon_skb_mutex); + + /* + * Clean up the beacon skb. + */ + rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb); + intf->beacon->skb = NULL; + if (!enable_beacon) { rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, QID_BEACON); + mutex_unlock(&intf->beacon_skb_mutex); return 0; } intf->beacon->skb = ieee80211_beacon_get(rt2x00dev->hw, vif); - if (!intf->beacon->skb) + if (!intf->beacon->skb) { + mutex_unlock(&intf->beacon_skb_mutex); return -ENOMEM; + } /* * Copy all TX descriptor information into txdesc, @@ -548,6 +559,8 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev, rt2x00dev->ops->lib->write_beacon(intf->beacon); rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, QID_BEACON); + mutex_unlock(&intf->beacon_skb_mutex); + return 0; } |