xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wil6210: fix race conditions in p2p listen and search

Browse Source 
Fix 2 race conditions found during test runs of P2P discovery:
1. Because wil_p2p_cancel_listen was not protected, user space
could start a new P2P listen/search before wmi_stop_discovery
completed. This caused a crash in the firmware.
2. In P2P listen, when listen timer expires and user space calls
cancel_remain_on_channel at the same time, code could send the
cfg80211_remain_on_channel_expired notification twice.

Added protections with wil->mutex to several places that call
wmi_stop_discovery.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
This commit is contained in:
Lior David
2016-03-01 19:18:14 +02:00
committed by Kalle Valo
parent 4332cac17b
commit 280ab987ef
4 changed files with 53 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/net/wireless/ath/wil6210/cfg80211.c
View File

@@ -387,7 +387,7 @@ static int wil_cfg80211_scan(struct wiphy *wiphy,
return rc;
}
wil_p2p_stop_discovery(wil);
(void)wil_p2p_stop_discovery(wil);
wil_dbg_misc(wil, "Start scan_request 0x%p\n", request);
wil_dbg_misc(wil, "SSID count: %d", request->n_ssids);
@@ -868,6 +868,9 @@ static int wil_cfg80211_set_default_key(struct wiphy *wiphy,
u8 key_index, bool unicast,
bool multicast)
{
struct wil6210_priv *wil = wiphy_to_wil(wiphy);
wil_dbg_misc(wil, "%s: entered\n", __func__);
return 0;
}
@@ -903,9 +906,7 @@ static int wil_cancel_remain_on_channel(struct wiphy *wiphy,
wil_dbg_misc(wil, "%s()\n", __func__);
wil_p2p_cancel_listen(wil, cookie);
return 0;
return wil_p2p_cancel_listen(wil, cookie);
}
/**