d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a panic in the wifi stack when a software beacon miss occurs in the wrong state.

Browse Source 
The ieee80211_swbmiss() callout is not called with the ic lock held, so it's
quite possible the scheduler will run the callout during a state change.

This patch:

* changes the swbmiss callout to be locked by the ic lock
* enforces the ic lock being held across the beacon vap functions
  by grabbing it inside beacon_miss() and beacon_swmiss().

This ensures that the ic lock is held (and thus the VAP state
stays constant) during beacon miss and software miss processing.
Since the callout is removed whilst the ic lock is held, it also
ensures that the ic lock can't be called during a state change
or exhibit any race conditions seen above.

Both Edgar and Joel report that this patch fixes the crash and
doesn't introduce new issues.

Reported by:	Edgar Martinez <emartinez@kbcnetworks.com>
Reported by:	Joel Dahl <joel@vnode.se>
Reported by:	emaste
This commit is contained in:
Adrian Chadd 2011-10-02 02:42:31 +00:00
parent 2d455a01bd
commit 23401900d3
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=225913
3 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
sys/net80211/ieee80211_proto.c
View File

@ -193,7 +193,7 @@ ieee80211_proto_vattach(struct ieee80211vap *vap)
vap->iv_rtsthreshold = IEEE80211_RTS_DEFAULT;
vap->iv_fragthreshold = IEEE80211_FRAG_DEFAULT;
vap->iv_bmiss_max = IEEE80211_BMISS_MAX;
callout_init(&vap->iv_swbmiss, CALLOUT_MPSAFE);
callout_init_mtx(&vap->iv_swbmiss, IEEE80211_LOCK_OBJ(ic), 0);
callout_init(&vap->iv_mgtsend, CALLOUT_MPSAFE);
TASK_INIT(&vap->iv_nstate_task, 0, ieee80211_newstate_cb, vap);
TASK_INIT(&vap->iv_swbmiss_task, 0, beacon_swmiss, vap);
@ -1403,7 +1403,7 @@ beacon_miss(void *arg, int npending)
struct ieee80211com *ic = arg;
struct ieee80211vap *vap;
/* XXX locking */
IEEE80211_LOCK(ic);
TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
/*
* We only pass events through for sta vap's in RUN state;
@ -1415,18 +1415,21 @@ beacon_miss(void *arg, int npending)
vap->iv_bmiss != NULL)
vap->iv_bmiss(vap);
}
IEEE80211_UNLOCK(ic);
}
static void
beacon_swmiss(void *arg, int npending)
{
struct ieee80211vap *vap = arg;
struct ieee80211com *ic = vap->iv_ic;
if (vap->iv_state != IEEE80211_S_RUN)
return;
/* XXX Call multiple times if npending > zero? */
vap->iv_bmiss(vap);
IEEE80211_LOCK(ic);
if (vap->iv_state == IEEE80211_S_RUN) {
/* XXX Call multiple times if npending > zero? */
vap->iv_bmiss(vap);
}
IEEE80211_UNLOCK(ic);
}
/*
@ -1440,6 +1443,8 @@ ieee80211_swbmiss(void *arg)
struct ieee80211vap *vap = arg;
struct ieee80211com *ic = vap->iv_ic;
IEEE80211_LOCK_ASSERT(ic);
/* XXX sleep state? */
KASSERT(vap->iv_state == IEEE80211_S_RUN,
("wrong state %d", vap->iv_state));

2
sys/net80211/ieee80211_sta.c
View File

@ -109,6 +109,8 @@ sta_beacon_miss(struct ieee80211vap *vap)
{
struct ieee80211com *ic = vap->iv_ic;
IEEE80211_LOCK_ASSERT(ic);
KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
KASSERT(vap->iv_state >= IEEE80211_S_RUN,
("wrong state %s", ieee80211_state_name[vap->iv_state]));

3
sys/net80211/ieee80211_tdma.c
View File

@ -285,6 +285,9 @@ static void
tdma_beacon_miss(struct ieee80211vap *vap)
{
struct ieee80211_tdma_state *ts = vap->iv_tdma;
struct ieee80211com *ic = vap->iv_ic;
IEEE80211_LOCK_ASSERT(ic);
KASSERT((vap->iv_ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
KASSERT(vap->iv_state == IEEE80211_S_RUN,