mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-22 06:57:57 +00:00
39 lines
1.2 KiB
Diff
39 lines
1.2 KiB
Diff
From: Felix Fietkau <nbd@nbd.name>
|
|
Date: Sat, 26 Mar 2022 23:58:35 +0100
|
|
Subject: [PATCH] mac80211: do not wake queues on a vif that is being stopped
|
|
|
|
When a vif is being removed and sdata->bss is cleared, __ieee80211_wake_txqs
|
|
can still be called on it, which crashes as soon as sdata->bss is being
|
|
dereferenced.
|
|
To fix this properly, check for SDATA_STATE_RUNNING before waking queues,
|
|
and take the fq lock when setting it (to ensure that __ieee80211_wake_txqs
|
|
observes the change when running on a different CPU
|
|
|
|
Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
|
---
|
|
|
|
--- a/net/mac80211/iface.c
|
|
+++ b/net/mac80211/iface.c
|
|
@@ -377,7 +377,9 @@ static void ieee80211_do_stop(struct iee
|
|
bool cancel_scan;
|
|
struct cfg80211_nan_func *func;
|
|
|
|
+ spin_lock_bh(&local->fq.lock);
|
|
clear_bit(SDATA_STATE_RUNNING, &sdata->state);
|
|
+ spin_unlock_bh(&local->fq.lock);
|
|
|
|
cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
|
|
if (cancel_scan)
|
|
--- a/net/mac80211/util.c
|
|
+++ b/net/mac80211/util.c
|
|
@@ -301,6 +301,9 @@ static void __ieee80211_wake_txqs(struct
|
|
local_bh_disable();
|
|
spin_lock(&fq->lock);
|
|
|
|
+ if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
|
|
+ goto out;
|
|
+
|
|
if (sdata->vif.type == NL80211_IFTYPE_AP)
|
|
ps = &sdata->bss->ps;
|
|
|