[PATCH] mac80211: fix locking in ieee80211_sta_tear_down_BA_sessions

[PATCH] mac80211: fix locking in ieee80211_sta_tear_down_BA_sessions

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

Due to overlap between
commit 1281103770e9 ("mac80211: Simplify locking in ieee80211_sta_tear_down_BA_sessions()")
and the way that Luca modified
commit 72e2c3438ba3 ("mac80211: tear down RX aggregations first")
when sending it upstream from Intel's internal tree, we get
the following warning:

WARNING: CPU: 0 PID: 5472 at net/mac80211/agg-tx.c:315 ___ieee80211_stop_tx_ba_session+0x158/0x1f0

since there's no appropriate locking around the call to
___ieee80211_stop_tx_ba_session; Sara's original just had
a call to the locked __ieee80211_stop_tx_ba_session (one
less underscore) but it looks like Luca modified both of
the calls when fixing it up for upstream, leading to the
problem at hand.

Move the locking appropriately to fix this problem.

Reported-by: Kalle Valo <kvalo@codeaurora.org>
Reported-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/mac80211/ht.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 167f83b853e6..1621b6ab17ba 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -291,16 +291,15 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
 	int i;
 
 	mutex_lock(&sta->ampdu_mlme.mtx);
-	for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
+	for (i = 0; i <  IEEE80211_NUM_TIDS; i++)
 		___ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
 						WLAN_REASON_QSTA_LEAVE_QBSS,
 						reason != AGG_STOP_DESTROY_STA &&
 						reason != AGG_STOP_PEER_REQUEST);
-	}
-	mutex_unlock(&sta->ampdu_mlme.mtx);
 
 	for (i = 0; i <  IEEE80211_NUM_TIDS; i++)
 		___ieee80211_stop_tx_ba_session(sta, i, reason);
+	mutex_unlock(&sta->ampdu_mlme.mtx);
 
 	/* stopping might queue the work again - so cancel only afterwards */
 	cancel_work_sync(&sta->ampdu_mlme.work);
-- 
2.14.2

Re: [PATCH] mac80211: fix locking in ieee80211_sta_tear_down_BA_sessions

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 1244 bytes --]

On Sat 2017-12-09 21:13:38, Johannes Berg wrote:
> From: Johannes Berg <johannes.berg@intel.com>
> 
> Due to overlap between
> commit 1281103770e9 ("mac80211: Simplify locking in ieee80211_sta_tear_down_BA_sessions()")
> and the way that Luca modified
> commit 72e2c3438ba3 ("mac80211: tear down RX aggregations first")
> when sending it upstream from Intel's internal tree, we get
> the following warning:
> 
> WARNING: CPU: 0 PID: 5472 at net/mac80211/agg-tx.c:315 ___ieee80211_stop_tx_ba_session+0x158/0x1f0
> 
> since there's no appropriate locking around the call to
> ___ieee80211_stop_tx_ba_session; Sara's original just had
> a call to the locked __ieee80211_stop_tx_ba_session (one
> less underscore) but it looks like Luca modified both of
> the calls when fixing it up for upstream, leading to the
> problem at hand.
> 
> Move the locking appropriately to fix this problem.
> 
> Reported-by: Kalle Valo <kvalo@codeaurora.org>
> Reported-by: Pavel Machek <pavel@ucw.cz>
> Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Tested-by: Pavel Machek <pavel@ucw.cz>

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]