linux/net
Emmanuel Grumbach f3ffb6c3a2 mac80211: fix a race between restart and CSA flows
We hit a problem with iwlwifi that was caused by a bug in
mac80211. A bug in iwlwifi caused the firwmare to crash in
certain cases in channel switch. Because of that bug,
drv_pre_channel_switch would fail and trigger the restart
flow.
Now we had the hw restart worker which runs on the system's
workqueue and the csa_connection_drop_work worker that runs
on mac80211's workqueue that can run together. This is
obviously problematic since the restart work wants to
reconfigure the connection, while the csa_connection_drop_work
worker does the exact opposite: it tries to disconnect.

Fix this by cancelling the csa_connection_drop_work worker
in the restart worker.

Note that this can sound racy: we could have:

driver   iface_work   CSA_work   restart_work
+++++++++++++++++++++++++++++++++++++++++++++
              |
 <--drv_cs ---|
<FW CRASH!>
-CS FAILED-->
              |                       |
              |                 cancel_work(CSA)
           schedule                   |
           CSA work                   |
                         |            |
                        Race between those 2

But this is not possible because we flush the workqueue
in the restart worker before we cancel the CSA worker.
That would be bullet proof if we could guarantee that
we schedule the CSA worker only from the iface_work
which runs on the workqueue (and not on the system's
workqueue), but unfortunately we do have an instance
in which we schedule the CSA work outside the context
of the workqueue (ieee80211_chswitch_done).

Note also that we should probably cancel other workers
like beacon_connection_loss_work and possibly others
for different types of interfaces, at the very least,
IBSS should suffer from the exact same problem, but for
now, do the minimum to fix the actual bug that was actually
experienced and reproduced.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2018-09-03 10:38:39 +02:00
..
6lowpan
9p net/9p/client.c: put refcount of trans_mod in error case in parse_opts() 2018-07-14 11:11:09 -07:00
802
8021q net: fix use-after-free in GRO with ESP 2018-07-02 20:34:04 +09:00
appletalk Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
atm Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
ax25 Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
batman-adv batman-adv: Fix multicast TT issues with bogus ROAM flags 2018-06-23 10:29:33 +02:00
bluetooth Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
bpf bpf: fix panic due to oob in bpf_prog_test_run_skb 2018-07-11 16:10:57 -07:00
bpfilter bpfilter: include bpfilter_umh in assembly instead of using objcopy 2018-06-28 21:39:16 +09:00
bridge Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-06-16 07:39:34 +09:00
caif net: caif: Add a missing rcu_read_unlock() in caif_flow_cb 2018-07-21 16:14:39 -07:00
can Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
ceph The main piece is a set of libceph changes that revamps how OSD 2018-06-15 07:24:58 +09:00
core Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 2018-07-28 21:02:21 -07:00
dcb treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
dccp dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart() 2018-08-07 15:34:44 -07:00
decnet Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
dns_resolver KEYS: DNS: fix parsing multiple options 2018-07-16 11:22:14 -07:00
dsa dsa: slave: eee: Allow ports to use phylink 2018-08-08 19:19:03 -07:00
ethernet net: core: rework basic flow dissection helper 2018-05-08 00:02:36 -04:00
hsr
ieee802154 ieee802154: 6lowpan: set IFLA_LINK 2018-07-05 11:13:17 +02:00
ife net: sched: ife: check on metadata length 2018-04-22 21:12:00 -04:00
ipv4 ipv4: frags: handle possible skb truesize change 2018-07-31 14:41:29 -07:00
ipv6 ip6_tunnel: use the right value for ipv4 min mtu check in ip6_tnl_xmit 2018-08-05 17:35:02 -07:00
iucv Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
kcm Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
key Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
l2tp l2tp: fix missing refcount drop in pppol2tp_tunnel_ioctl() 2018-08-03 12:39:01 -07:00
l3mdev
lapb
llc llc: use refcount_inc_not_zero() for llc_sap_find() 2018-08-07 15:54:00 -07:00
mac80211 mac80211: fix a race between restart and CSA flows 2018-09-03 10:38:39 +02:00
mac802154 net/mac802154: disambiguate mac80215 vs mac802154 trace events 2018-03-28 22:55:18 +02:00
mpls
ncsi net/ncsi: Use netdev_dbg for debug messages 2018-06-20 07:26:58 +09:00
netfilter netfilter: nf_tables: move dumper state allocation into ->start 2018-07-24 00:36:33 +02:00
netlabel audit: use inline function to get audit context 2018-05-14 17:24:18 -04:00
netlink netlink: Don't shift on 64 for ngroups 2018-08-04 17:52:51 -07:00
netrom Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
nfc net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL. 2018-07-18 10:51:45 -07:00
nsh nsh: set mac len based on inner packet 2018-07-12 16:55:29 -07:00
openvswitch openvswitch: meter: Fix setting meter id for new entries 2018-07-29 13:20:54 -07:00
packet packet: refine ring v3 block size test to hold one frame 2018-08-06 13:48:33 -07:00
phonet Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
psample
qrtr net: qrtr: Reset the node and port ID of broadcast messages 2018-07-05 20:20:03 +09:00
rds RDS: RDMA: Fix the NULL-ptr deref in rds_ib_get_mr 2018-07-26 14:03:07 -07:00
rfkill rfkill-gpio: include linux/mod_devicetable.h 2018-08-14 13:59:28 +02:00
rose Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
rxrpc rxrpc: Fix the keepalive generator [ver #2] 2018-08-08 19:10:26 -07:00
sched net: sched: Using NULL instead of plain integer 2018-07-18 13:44:07 -07:00
sctp sctp: fix the issue that pathmtu may be set lower than MINSEGMENT 2018-07-04 21:36:34 +09:00
smc net/smc: move sock lock in smc_ioctl() 2018-08-08 19:14:22 -07:00
strparser strparser: Remove early eaten to fix full tcp receive buffer stall 2018-06-28 21:37:26 +09:00
sunrpc NFS client bugfixes for Linux 4.18 2018-06-22 06:21:34 +09:00
switchdev
tipc tipc: fix an interrupt unsafe locking scenario 2018-08-07 13:15:35 -07:00
tls tls: check RCV_SHUTDOWN in tls_wait_data 2018-07-20 14:38:14 -07:00
unix Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
vmw_vsock vsock: split dwork to avoid reinitializations 2018-08-07 12:39:13 -07:00
wimax
wireless cfg80211: fix a type issue in ieee80211_chandef_to_operating_class() 2018-09-03 10:34:12 +02:00
x25 Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
xdp net: xsk: don't return frames via the allocator on error 2018-07-31 02:03:19 +02:00
xfrm xfrm: free skb if nlsk pointer is NULL 2018-06-25 16:43:36 +02:00
compat.c net: support compat 64-bit time in {s,g}etsockopt 2018-04-27 19:46:06 -04:00
Kconfig net: Introduce generic failover module 2018-05-28 22:59:54 -04:00
Makefile bpfilter: check compiler capability in Kconfig 2018-06-28 13:36:39 +09:00
socket.c net: socket: Fix potential spectre v1 gadget in sock_is_registered 2018-07-28 22:43:30 -07:00
sysctl_net.c