aboutsummaryrefslogtreecommitdiffstats
path: root/net/wireless/core.c
diff options
context:
space:
mode:
authorJohannes Berg <johannes@sipsolutions.net>2009-08-12 16:21:21 -0400
committerJohn W. Linville <linville@tuxdriver.com>2009-08-14 09:14:07 -0400
commit36e6fea84905512ea776707e82b5b435220efc17 (patch)
treedb588e7dbbfcf0fa47f4954344a03961e960c898 /net/wireless/core.c
parent70bdb6b275d789ddf05c3a858e6b57715539394b (diff)
cfg80211: check for and abort dangling scan requests
If you trigger a scan request on an interface and then take it down, or rmmod the module or unplug the device the driver might "forget" to cancel the scan request. That is a bug in the driver, but the current behaviour is that we just hang endlessly waiting for the netdev refcount to become 0 which it never will. To improve robustness, check for this situation in cfg80211, warn about it and clean up behind the driver. I don't just clean up silently because it's likely that the driver also has some internal state it has now leaked. Additionally, this fixes a locking bug, clearing the scan_req pointer should be done under the rdev lock. Finally, we also need to _wait_ for the scan work and not just abort it since it might be pending and wanting to do a cleanup. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/wireless/core.c')
-rw-r--r--net/wireless/core.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/net/wireless/core.c b/net/wireless/core.c
index e630648fef7..35d83bedfe5 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -601,8 +601,8 @@ void wiphy_unregister(struct wiphy *wiphy)
601 601
602 mutex_unlock(&cfg80211_mutex); 602 mutex_unlock(&cfg80211_mutex);
603 603
604 flush_work(&rdev->scan_done_wk);
604 cancel_work_sync(&rdev->conn_work); 605 cancel_work_sync(&rdev->conn_work);
605 cancel_work_sync(&rdev->scan_done_wk);
606 kfree(rdev->scan_req); 606 kfree(rdev->scan_req);
607 flush_work(&rdev->event_work); 607 flush_work(&rdev->event_work);
608} 608}
@@ -728,6 +728,13 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
728#endif 728#endif
729 break; 729 break;
730 case NETDEV_UNREGISTER: 730 case NETDEV_UNREGISTER:
731 cfg80211_lock_rdev(rdev);
732
733 if (WARN_ON(rdev->scan_req && rdev->scan_req->dev == dev)) {
734 rdev->scan_req->aborted = true;
735 ___cfg80211_scan_done(rdev);
736 }
737
731 mutex_lock(&rdev->devlist_mtx); 738 mutex_lock(&rdev->devlist_mtx);
732 /* 739 /*
733 * It is possible to get NETDEV_UNREGISTER 740 * It is possible to get NETDEV_UNREGISTER
@@ -746,6 +753,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
746#endif 753#endif
747 } 754 }
748 mutex_unlock(&rdev->devlist_mtx); 755 mutex_unlock(&rdev->devlist_mtx);
756 cfg80211_unlock_rdev(rdev);
749 break; 757 break;
750 case NETDEV_PRE_UP: 758 case NETDEV_PRE_UP:
751 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype))) 759 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))