rt2x00: Fix for race condition while update beacon

The patch "Implement set_tim callback for all drivers" can cause kernel
oops in rt73usb_write_beacon. The oops is caused by one of the following
race conditions:
* In case of two near calls to set_tim: rt2x00lib_beacondone_iter is
cleaning the beacon skb, whereas rt73usb_write_beacon is still using it.
* In case of two near updates of beacon: first as the result of set_tim
and second as the result of a call from an application (e.g. hostapd).
This patch fixes the race condition by rearranging the update logic and
guarding rt2x00_intf->beacon->skb with a mutex.

Signed-off-by: Igor Perminov <igor.perminov@inbox.ru>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 14 insertions, 1 deletions

diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index e67e339d9dfd..06af823efd83 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -503,14 +503,25 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         if (unlikely(!intf->beacon))
                 return -ENOBUFS;
 
+        mutex_lock(&intf->beacon_skb_mutex);
+
+        /*
+         * Clean up the beacon skb.
+         */
+        rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb);
+        intf->beacon->skb = NULL;
+
         if (!enable_beacon) {
                 rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, QID_BEACON);
+                mutex_unlock(&intf->beacon_skb_mutex);
                 return 0;
         }
 
         intf->beacon->skb = ieee80211_beacon_get(rt2x00dev->hw, vif);
-        if (!intf->beacon->skb)
+        if (!intf->beacon->skb) {
+                mutex_unlock(&intf->beacon_skb_mutex);
                 return -ENOMEM;
+        }
 
         /*
          * Copy all TX descriptor information into txdesc,
@@ -548,6 +559,8 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         rt2x00dev->ops->lib->write_beacon(intf->beacon);
         rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, QID_BEACON);
 
+        mutex_unlock(&intf->beacon_skb_mutex);
+
         return 0;
 }