|
|
@@ -0,0 +1,38 @@
|
|
|
+From: Felix Fietkau <[email protected]>
|
|
|
+Date: Sat, 26 Mar 2022 23:58:35 +0100
|
|
|
+Subject: [PATCH] mac80211: do not wake queues on a vif that is being stopped
|
|
|
+
|
|
|
+When a vif is being removed and sdata->bss is cleared, __ieee80211_wake_txqs
|
|
|
+can still be called on it, which crashes as soon as sdata->bss is being
|
|
|
+dereferenced.
|
|
|
+To fix this properly, check for SDATA_STATE_RUNNING before waking queues,
|
|
|
+and take the fq lock when setting it (to ensure that __ieee80211_wake_txqs
|
|
|
+observes the change when running on a different CPU
|
|
|
+
|
|
|
+Signed-off-by: Felix Fietkau <[email protected]>
|
|
|
+---
|
|
|
+
|
|
|
+--- a/net/mac80211/iface.c
|
|
|
++++ b/net/mac80211/iface.c
|
|
|
+@@ -377,7 +377,9 @@ static void ieee80211_do_stop(struct iee
|
|
|
+ bool cancel_scan;
|
|
|
+ struct cfg80211_nan_func *func;
|
|
|
+
|
|
|
++ spin_lock_bh(&local->fq.lock);
|
|
|
+ clear_bit(SDATA_STATE_RUNNING, &sdata->state);
|
|
|
++ spin_unlock_bh(&local->fq.lock);
|
|
|
+
|
|
|
+ cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
|
|
|
+ if (cancel_scan)
|
|
|
+--- a/net/mac80211/util.c
|
|
|
++++ b/net/mac80211/util.c
|
|
|
+@@ -301,6 +301,9 @@ static void __ieee80211_wake_txqs(struct
|
|
|
+ local_bh_disable();
|
|
|
+ spin_lock(&fq->lock);
|
|
|
+
|
|
|
++ if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
|
|
|
++ goto out;
|
|
|
++
|
|
|
+ if (sdata->vif.type == NL80211_IFTYPE_AP)
|
|
|
+ ps = &sdata->bss->ps;
|
|
|
+
|
Felix Fietkau