cfg80211: fix locking

Over time, a lot of locking issues have crept into
the smarts of cfg80211, so e.g. scan completion can
race against a new scan, IBSS join can race against
leaving an IBSS, etc.

Introduce a new per-interface lock that protects
most of the per-interface data that we need to keep
track of, and sprinkle assertions about that lock
everywhere. Some things now need to be offloaded to
work structs so that we don't require being able to
sleep in functions the drivers call. The exception
to that are the MLME callbacks (rx_auth etc.) that
currently only mac80211 calls because it was easier
to do that there instead of in cfg80211, and future
drivers implementing those calls will, if they ever
exist, probably need to use a similar scheme like
mac80211 anyway...

In order to be able to handle _deauth and _disassoc
properly, introduce a cookie passed to it that will
determine locking requirements.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 19 insertions, 5 deletions

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 60c1f11da45f..83c2c727d71e 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -555,6 +555,7 @@ struct cfg80211_scan_request {
         /* internal */
         struct wiphy *wiphy;
         int ifidx;
+        bool aborted;
 };
 
 /**
@@ -998,9 +999,11 @@ struct cfg80211_ops {
         int     (*assoc)(struct wiphy *wiphy, struct net_device *dev,
                          struct cfg80211_assoc_request *req);
         int     (*deauth)(struct wiphy *wiphy, struct net_device *dev,
-                          struct cfg80211_deauth_request *req);
+                          struct cfg80211_deauth_request *req,
+                          void *cookie);
         int     (*disassoc)(struct wiphy *wiphy, struct net_device *dev,
-                            struct cfg80211_disassoc_request *req);
+                            struct cfg80211_disassoc_request *req,
+                            void *cookie);
 
         int     (*connect)(struct wiphy *wiphy, struct net_device *dev,
                            struct cfg80211_connect_params *sme);
@@ -1249,10 +1252,12 @@ struct wireless_dev {
         struct wiphy *wiphy;
         enum nl80211_iftype iftype;
 
-        /* private to the generic wireless code */
+        /* the remainder of this struct should be private to cfg80211 */
         struct list_head list;
         struct net_device *netdev;
 
+        struct mutex mtx;
+
         /* currently used for IBSS and SME - might be rearranged later */
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         u8 ssid_len;
@@ -1263,6 +1268,9 @@ struct wireless_dev {
         } sme_state;
         struct cfg80211_conn *conn;
 
+        struct list_head event_list;
+        spinlock_t event_lock;
+
         struct cfg80211_internal_bss *authtry_bsses[MAX_AUTH_BSSES];
         struct cfg80211_internal_bss *auth_bsses[MAX_AUTH_BSSES];
         struct cfg80211_internal_bss *current_bss; /* associated / joined */
@@ -1765,24 +1773,30 @@ void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr);
  * @dev: network device
  * @buf: deauthentication frame (header + body)
  * @len: length of the frame data
+ * @cookie: cookie from ->deauth if called within that callback,
+ *      %NULL otherwise
  *
  * This function is called whenever deauthentication has been processed in
  * station mode. This includes both received deauthentication frames and
  * locally generated ones. This function may sleep.
  */
-void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len);
+void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len,
+                          void *cookie);
 
 /**
  * cfg80211_send_disassoc - notification of processed disassociation
  * @dev: network device
  * @buf: disassociation response frame (header + body)
  * @len: length of the frame data
+ * @cookie: cookie from ->disassoc if called within that callback,
+ *      %NULL otherwise
  *
  * This function is called whenever disassociation has been processed in
  * station mode. This includes both received disassociation frames and locally
  * generated ones. This function may sleep.
  */
-void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len);
+void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len,
+                            void *cookie);
 
 /**
  * cfg80211_michael_mic_failure - notification of Michael MIC failure (TKIP)