Commit 5ffae432 authored by Lior David's avatar Lior David Committed by Kalle Valo

wil6210: fix protection of wil->scan_request

Currently the places that check wil->scan_request and
call cfg80211_scan_done are not consistently protected,
so there is a risk that cfg80211_scan_done will be called
with NULL scan_request, causing a kernel crash.
Fix this by using p2p_wdev_mutex in few other places
that access scan_request. This makes sense since
scan_request may point to p2p_wdev, and it is not worth
the extra complexity of adding a new mutex.
Signed-off-by: default avatarLior David <qca_liord@qca.qualcomm.com>
Signed-off-by: default avatarMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
parent 47b1848d
...@@ -354,10 +354,13 @@ static int wil_cfg80211_scan(struct wiphy *wiphy, ...@@ -354,10 +354,13 @@ static int wil_cfg80211_scan(struct wiphy *wiphy,
wil_dbg_misc(wil, "%s(), wdev=0x%p iftype=%d\n", wil_dbg_misc(wil, "%s(), wdev=0x%p iftype=%d\n",
__func__, wdev, wdev->iftype); __func__, wdev, wdev->iftype);
mutex_lock(&wil->p2p_wdev_mutex);
if (wil->scan_request) { if (wil->scan_request) {
wil_err(wil, "Already scanning\n"); wil_err(wil, "Already scanning\n");
mutex_unlock(&wil->p2p_wdev_mutex);
return -EAGAIN; return -EAGAIN;
} }
mutex_unlock(&wil->p2p_wdev_mutex);
/* check we are client side */ /* check we are client side */
switch (wdev->iftype) { switch (wdev->iftype) {
......
...@@ -852,6 +852,7 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw) ...@@ -852,6 +852,7 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw)
bitmap_zero(wil->status, wil_status_last); bitmap_zero(wil->status, wil_status_last);
mutex_unlock(&wil->wmi_mutex); mutex_unlock(&wil->wmi_mutex);
mutex_lock(&wil->p2p_wdev_mutex);
if (wil->scan_request) { if (wil->scan_request) {
struct cfg80211_scan_info info = { struct cfg80211_scan_info info = {
.aborted = true, .aborted = true,
...@@ -863,6 +864,7 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw) ...@@ -863,6 +864,7 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw)
cfg80211_scan_done(wil->scan_request, &info); cfg80211_scan_done(wil->scan_request, &info);
wil->scan_request = NULL; wil->scan_request = NULL;
} }
mutex_unlock(&wil->p2p_wdev_mutex);
wil_mask_irq(wil); wil_mask_irq(wil);
...@@ -1055,6 +1057,7 @@ int __wil_down(struct wil6210_priv *wil) ...@@ -1055,6 +1057,7 @@ int __wil_down(struct wil6210_priv *wil)
wil_p2p_stop_radio_operations(wil); wil_p2p_stop_radio_operations(wil);
mutex_lock(&wil->p2p_wdev_mutex);
if (wil->scan_request) { if (wil->scan_request) {
struct cfg80211_scan_info info = { struct cfg80211_scan_info info = {
.aborted = true, .aborted = true,
...@@ -1066,6 +1069,7 @@ int __wil_down(struct wil6210_priv *wil) ...@@ -1066,6 +1069,7 @@ int __wil_down(struct wil6210_priv *wil)
cfg80211_scan_done(wil->scan_request, &info); cfg80211_scan_done(wil->scan_request, &info);
wil->scan_request = NULL; wil->scan_request = NULL;
} }
mutex_unlock(&wil->p2p_wdev_mutex);
wil_reset(wil, false); wil_reset(wil, false);
......
...@@ -657,7 +657,7 @@ struct wil6210_priv { ...@@ -657,7 +657,7 @@ struct wil6210_priv {
/* P2P_DEVICE vif */ /* P2P_DEVICE vif */
struct wireless_dev *p2p_wdev; struct wireless_dev *p2p_wdev;
struct mutex p2p_wdev_mutex; /* protect @p2p_wdev */ struct mutex p2p_wdev_mutex; /* protect @p2p_wdev and @scan_request */
struct wireless_dev *radio_wdev; struct wireless_dev *radio_wdev;
/* High Access Latency Policy voting */ /* High Access Latency Policy voting */
......
...@@ -424,6 +424,7 @@ static void wmi_evt_tx_mgmt(struct wil6210_priv *wil, int id, void *d, int len) ...@@ -424,6 +424,7 @@ static void wmi_evt_tx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id, static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id,
void *d, int len) void *d, int len)
{ {
mutex_lock(&wil->p2p_wdev_mutex);
if (wil->scan_request) { if (wil->scan_request) {
struct wmi_scan_complete_event *data = d; struct wmi_scan_complete_event *data = d;
struct cfg80211_scan_info info = { struct cfg80211_scan_info info = {
...@@ -435,14 +436,13 @@ static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id, ...@@ -435,14 +436,13 @@ static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id,
wil->scan_request, info.aborted); wil->scan_request, info.aborted);
del_timer_sync(&wil->scan_timer); del_timer_sync(&wil->scan_timer);
mutex_lock(&wil->p2p_wdev_mutex);
cfg80211_scan_done(wil->scan_request, &info); cfg80211_scan_done(wil->scan_request, &info);
wil->radio_wdev = wil->wdev; wil->radio_wdev = wil->wdev;
mutex_unlock(&wil->p2p_wdev_mutex);
wil->scan_request = NULL; wil->scan_request = NULL;
} else { } else {
wil_err(wil, "SCAN_COMPLETE while not scanning\n"); wil_err(wil, "SCAN_COMPLETE while not scanning\n");
} }
mutex_unlock(&wil->p2p_wdev_mutex);
} }
static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len) static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment