package/mac80211/patches/721-mac80211-fix-scan-race.patch

   1 Index: compat-wireless-2011-02-25/net/mac80211/scan.c
   2 ===================================================================
   3 --- compat-wireless-2011-02-25.orig/net/mac80211/scan.c 2011-03-07 14:43:55.695666042 +0100
   4 +++ compat-wireless-2011-02-25/net/mac80211/scan.c      2011-03-07 14:43:57.594439631 +0100
   5 @@ -258,10 +258,12 @@ static bool ieee80211_prep_hw_scan(struc
   6         return true;
   7  }
   8
   9 -static bool __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
  10 +static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
  11                                        bool was_hw_scan)
  12  {
  13         struct ieee80211_local *local = hw_to_local(hw);
  14 +       bool on_oper_chan;
  15 +       bool enable_beacons = false;
  16
  17         lockdep_assert_held(&local->mtx);
  18
  19 @@ -275,12 +277,12 @@ static bool __ieee80211_scan_completed(s
  20                 aborted = true;
  21
  22         if (WARN_ON(!local->scan_req))
  23 -               return false;
  24 +               return;
  25
  26         if (was_hw_scan && !aborted && ieee80211_prep_hw_scan(local)) {
  27                 int rc = drv_hw_scan(local, local->scan_sdata, local->hw_scan_req);
  28                 if (rc == 0)
  29 -                       return false;
  30 +                       return;
  31         }
  32
  33         kfree(local->hw_scan_req);
  34 @@ -294,26 +296,13 @@ static bool __ieee80211_scan_completed(s
  35         local->scanning = 0;
  36         local->scan_channel = NULL;
  37
  38 -       return true;
  39 -}
  40 -
  41 -static void __ieee80211_scan_completed_finish(struct ieee80211_hw *hw,
  42 -                                             bool was_hw_scan)
  43 -{
  44 -       struct ieee80211_local *local = hw_to_local(hw);
  45 -       bool on_oper_chan;
  46 -       bool enable_beacons = false;
  47 -
  48 -       mutex_lock(&local->mtx);
  49         on_oper_chan = ieee80211_cfg_on_oper_channel(local);
  50
  51         WARN_ON(local->scanning & (SCAN_SW_SCANNING | SCAN_HW_SCANNING));
  52
  53 -       if (was_hw_scan || !on_oper_chan) {
  54 -               if (WARN_ON(local->scan_channel))
  55 -                       local->scan_channel = NULL;
  56 +       if (was_hw_scan || !on_oper_chan)
  57                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
  58 -       } else
  59 +       else
  60                 /* Set power back to normal operating levels. */
  61                 ieee80211_hw_config(local, 0);
  62
  63 @@ -331,7 +320,6 @@ static void __ieee80211_scan_completed_f
  64         }
  65
  66         ieee80211_recalc_idle(local);
  67 -       mutex_unlock(&local->mtx);
  68
  69         ieee80211_mlme_notify_scan_completed(local);
  70         ieee80211_ibss_notify_scan_completed(local);
  71 @@ -686,12 +674,14 @@ void ieee80211_scan_work(struct work_str
  72  {
  73         struct ieee80211_local *local =
  74                 container_of(work, struct ieee80211_local, scan_work.work);
  75 -       struct ieee80211_sub_if_data *sdata = local->scan_sdata;
  76 +       struct ieee80211_sub_if_data *sdata;
  77         unsigned long next_delay = 0;
  78 -       bool aborted, hw_scan, finish;
  79 +       bool aborted, hw_scan;
  80
  81         mutex_lock(&local->mtx);
  82
  83 +       sdata = local->scan_sdata;
  84 +
  85         if (test_and_clear_bit(SCAN_COMPLETED, &local->scanning)) {
  86                 aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
  87                 goto out_complete;
  88 @@ -755,17 +745,11 @@ void ieee80211_scan_work(struct work_str
  89         } while (next_delay == 0);
  90
  91         ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay);
  92 -       mutex_unlock(&local->mtx);
  93 -       return;
  94 +       goto out;
  95
  96  out_complete:
  97         hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
  98 -       finish = __ieee80211_scan_completed(&local->hw, aborted, hw_scan);
  99 -       mutex_unlock(&local->mtx);
 100 -       if (finish)
 101 -               __ieee80211_scan_completed_finish(&local->hw, hw_scan);
 102 -       return;
 103 -
 104 +       __ieee80211_scan_completed(&local->hw, aborted, hw_scan);
 105  out:
 106         mutex_unlock(&local->mtx);
 107  }
 108 @@ -835,7 +819,6 @@ int ieee80211_request_internal_scan(stru
 109  void ieee80211_scan_cancel(struct ieee80211_local *local)
 110  {
 111         bool abortscan;
 112 -       bool finish = false;
 113
 114         /*
 115          * We are only canceling software scan, or deferred scan that was not
 116 @@ -855,14 +838,17 @@ void ieee80211_scan_cancel(struct ieee80
 117
 118         mutex_lock(&local->mtx);
 119         abortscan = local->scan_req && !test_bit(SCAN_HW_SCANNING, &local->scanning);
 120 -       if (abortscan)
 121 -               finish = __ieee80211_scan_completed(&local->hw, true, false);
 122 -       mutex_unlock(&local->mtx);
 123 -
 124         if (abortscan) {
 125 -               /* The scan is canceled, but stop work from being pending */
 126 -               cancel_delayed_work_sync(&local->scan_work);
 127 +               /*
 128 +                * The scan is canceled, but stop work from being pending.
 129 +                *
 130 +                * If the work is currently running, it must be blocked on
 131 +                * the mutex, but we'll set scan_sdata = NULL and it'll
 132 +                * simply exit once it acquires the mutex.
 133 +                */
 134 +               cancel_delayed_work(&local->scan_work);
 135 +               /* and clean up */
 136 +               __ieee80211_scan_completed(&local->hw, true, false);
 137         }
 138 -       if (finish)
 139 -               __ieee80211_scan_completed_finish(&local->hw, false);
 140 +       mutex_unlock(&local->mtx);
 141  }