package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch

   1 From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
   2 Date: Fri, 31 Aug 2018 11:31:06 +0300
   3 Subject: [PATCH] mac80211: fix a race between restart and CSA flows
   4
   5 We hit a problem with iwlwifi that was caused by a bug in
   6 mac80211. A bug in iwlwifi caused the firwmare to crash in
   7 certain cases in channel switch. Because of that bug,
   8 drv_pre_channel_switch would fail and trigger the restart
   9 flow.
  10 Now we had the hw restart worker which runs on the system's
  11 workqueue and the csa_connection_drop_work worker that runs
  12 on mac80211's workqueue that can run together. This is
  13 obviously problematic since the restart work wants to
  14 reconfigure the connection, while the csa_connection_drop_work
  15 worker does the exact opposite: it tries to disconnect.
  16
  17 Fix this by cancelling the csa_connection_drop_work worker
  18 in the restart worker.
  19
  20 Note that this can sound racy: we could have:
  21
  22 driver   iface_work   CSA_work   restart_work
  23 +++++++++++++++++++++++++++++++++++++++++++++
  24               |
  25  <--drv_cs ---|
  26 <FW CRASH!>
  27 -CS FAILED-->
  28               |                       |
  29               |                 cancel_work(CSA)
  30            schedule                   |
  31            CSA work                   |
  32                          |            |
  33                         Race between those 2
  34
  35 But this is not possible because we flush the workqueue
  36 in the restart worker before we cancel the CSA worker.
  37 That would be bullet proof if we could guarantee that
  38 we schedule the CSA worker only from the iface_work
  39 which runs on the workqueue (and not on the system's
  40 workqueue), but unfortunately we do have an instance
  41 in which we schedule the CSA work outside the context
  42 of the workqueue (ieee80211_chswitch_done).
  43
  44 Note also that we should probably cancel other workers
  45 like beacon_connection_loss_work and possibly others
  46 for different types of interfaces, at the very least,
  47 IBSS should suffer from the exact same problem, but for
  48 now, do the minimum to fix the actual bug that was actually
  49 experienced and reproduced.
  50
  51 Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
  52 Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
  53 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  54 ---
  55
  56 --- a/net/mac80211/main.c
  57 +++ b/net/mac80211/main.c
  58 @@ -255,8 +255,27 @@ static void ieee80211_restart_work(struc
  59
  60         flush_work(&local->radar_detected_work);
  61         rtnl_lock();
  62 -       list_for_each_entry(sdata, &local->interfaces, list)
  63 +       list_for_each_entry(sdata, &local->interfaces, list) {
  64 +               /*
  65 +                * XXX: there may be more work for other vif types and even
  66 +                * for station mode: a good thing would be to run most of
  67 +                * the iface type's dependent _stop (ieee80211_mg_stop,
  68 +                * ieee80211_ibss_stop) etc...
  69 +                * For now, fix only the specific bug that was seen: race
  70 +                * between csa_connection_drop_work and us.
  71 +                */
  72 +               if (sdata->vif.type == NL80211_IFTYPE_STATION) {
  73 +                       /*
  74 +                        * This worker is scheduled from the iface worker that
  75 +                        * runs on mac80211's workqueue, so we can't be
  76 +                        * scheduling this worker after the cancel right here.
  77 +                        * The exception is ieee80211_chswitch_done.
  78 +                        * Then we can have a race...
  79 +                        */
  80 +                       cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
  81 +               }
  82                 flush_delayed_work(&sdata->dec_tailroom_needed_wk);
  83 +       }
  84         ieee80211_scan_cancel(local);
  85
  86         /* make sure any new ROC will consider local->in_reconfig */