mac80211: RCU-ify STA info structure access

This makes access to the STA hash table/list use RCU to protect
against freeing of items. However, it's not a true RCU, the
copy step is missing: whenever somebody changes a STA item it
is simply updated. This is an existing race condition that is
now somewhat understandable.

This patch also fixes the race key freeing vs. STA destruction
by making sure that sta_info_destroy() is always called under
RTNL and frees the key.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 52 insertions, 26 deletions

diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
index 727af295c969..85b1391375c0 100644
--- a/net/mac80211/ieee80211.c
+++ b/net/mac80211/ieee80211.c
@@ -375,15 +375,19 @@ static int ieee80211_stop(struct net_device *dev)
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        list_for_each_entry(sta, &local->sta_list, list) {
-                if (sta->dev == dev)
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sta->sdata == sdata)
                         for (i = 0; i <  STA_TID_NUM; i++)
-                                ieee80211_sta_stop_rx_ba_session(sta->dev,
+                                ieee80211_sta_stop_rx_ba_session(sdata->dev,
                                                 sta->addr, i,
                                                 WLAN_BACK_RECIPIENT,
                                                 WLAN_REASON_QSTA_LEAVE_QBSS);
         }
 
+        rcu_read_unlock();
+
         netif_stop_queue(dev);
 
         /*
@@ -449,7 +453,7 @@ static int ieee80211_stop(struct net_device *dev)
                 netif_tx_unlock_bh(local->mdev);
                 break;
         case IEEE80211_IF_TYPE_MESH_POINT:
-                sta_info_flush(local, dev);
+                sta_info_flush(local, sdata);
                 /* fall through */
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_IBSS:
@@ -522,9 +526,12 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                                 print_mac(mac, ra), tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, ra);
         if (!sta) {
                 printk(KERN_DEBUG "Could not find the station\n");
+                rcu_read_unlock();
                 return -ENOENT;
         }
 
@@ -564,7 +571,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 spin_unlock_bh(&local->mdev->queue_lock);
                 goto start_ba_exit;
         }
-        sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+        sdata = sta->sdata;
 
         /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
          * call back right away, it must see that the flow has begun */
@@ -601,7 +608,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                         sta->ampdu_mlme.dialog_token_allocator;
         sta->ampdu_mlme.tid_tx[tid].ssn = start_seq_num;
 
-        ieee80211_send_addba_request(sta->dev, ra, tid,
+        ieee80211_send_addba_request(sta->sdata->dev, ra, tid,
                          sta->ampdu_mlme.tid_tx[tid].dialog_token,
                          sta->ampdu_mlme.tid_tx[tid].ssn,
                          0x40, 5000);
@@ -614,7 +621,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 
 start_ba_exit:
         spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
-        sta_info_put(sta);
+        rcu_read_unlock();
         return ret;
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
@@ -637,9 +644,12 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
                                 print_mac(mac, ra), tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
+        rcu_read_lock();
         sta = sta_info_get(local, ra);
-        if (!sta)
+        if (!sta) {
+                rcu_read_unlock();
                 return -ENOENT;
+        }
 
         /* check if the TID is in aggregation */
         state = &sta->ampdu_mlme.tid_tx[tid].state;
@@ -673,7 +683,7 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
 
 stop_BA_exit:
         spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
-        sta_info_put(sta);
+        rcu_read_unlock();
         return ret;
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
@@ -691,8 +701,10 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 return;
         }
 
+        rcu_read_lock();
         sta = sta_info_get(local, ra);
         if (!sta) {
+                rcu_read_unlock();
                 printk(KERN_DEBUG "Could not find station: %s\n",
                                 print_mac(mac, ra));
                 return;
@@ -705,7 +717,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
                                 *state);
                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
-                sta_info_put(sta);
+                rcu_read_unlock();
                 return;
         }
 
@@ -718,7 +730,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
         }
         spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
-        sta_info_put(sta);
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
 
@@ -739,10 +751,12 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         printk(KERN_DEBUG "Stop a BA session requested on DA %s tid %d\n",
                                 print_mac(mac, ra), tid);
 
+        rcu_read_lock();
         sta = sta_info_get(local, ra);
         if (!sta) {
                 printk(KERN_DEBUG "Could not find station: %s\n",
                                 print_mac(mac, ra));
+                rcu_read_unlock();
                 return;
         }
         state = &sta->ampdu_mlme.tid_tx[tid].state;
@@ -750,13 +764,13 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
         if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
                 printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
-                sta_info_put(sta);
                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                rcu_read_unlock();
                 return;
         }
 
         if (*state & HT_AGG_STATE_INITIATOR_MSK)
-                ieee80211_send_delba(sta->dev, ra, tid,
+                ieee80211_send_delba(sta->sdata->dev, ra, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
 
         agg_queue = sta->tid_to_tx_q[tid];
@@ -777,7 +791,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         sta->ampdu_mlme.tid_tx[tid].addba_req_num = 0;
         spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
 
-        sta_info_put(sta);
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
 
@@ -887,32 +901,41 @@ int ieee80211_if_update_wds(struct net_device *dev, u8 *remote_addr)
         struct sta_info *sta;
         DECLARE_MAC_BUF(mac);
 
+        might_sleep();
+
         if (compare_ether_addr(remote_addr, sdata->u.wds.remote_addr) == 0)
                 return 0;
 
+        rcu_read_lock();
+
         /* Create STA entry for the new peer */
-        sta = sta_info_add(local, dev, remote_addr, GFP_KERNEL);
-        if (IS_ERR(sta))
+        sta = sta_info_add(sdata, remote_addr);
+        if (IS_ERR(sta)) {
+                rcu_read_unlock();
                 return PTR_ERR(sta);
+        }
 
         sta->flags |= WLAN_STA_AUTHORIZED;
 
-        sta_info_put(sta);
-
         /* Remove STA entry for the old peer */
         sta = sta_info_get(local, sdata->u.wds.remote_addr);
-        if (sta) {
-                sta_info_free(sta);
-                sta_info_put(sta);
-        } else {
+        if (sta)
+                sta_info_unlink(&sta);
+        else
                 printk(KERN_DEBUG "%s: could not find STA entry for WDS link "
                        "peer %s\n",
                        dev->name, print_mac(mac, sdata->u.wds.remote_addr));
-        }
 
         /* Update WDS link data */
         memcpy(&sdata->u.wds.remote_addr, remote_addr, ETH_ALEN);
 
+        rcu_read_unlock();
+
+        if (sta) {
+                synchronize_rcu();
+                sta_info_destroy(sta);
+        }
+
         return 0;
 }
 
@@ -1330,6 +1353,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return;
         }
 
+        rcu_read_lock();
+
         if (status->excessive_retries) {
                 struct sta_info *sta;
                 sta = sta_info_get(local, hdr->addr1);
@@ -1343,10 +1368,9 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                                 status->flags |= IEEE80211_TX_STATUS_TX_FILTERED;
                                 ieee80211_handle_filtered_frame(local, sta,
                                                                 skb, status);
-                                sta_info_put(sta);
+                                rcu_read_unlock();
                                 return;
                         }
-                        sta_info_put(sta);
                 }
         }
 
@@ -1356,12 +1380,14 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                 if (sta) {
                         ieee80211_handle_filtered_frame(local, sta, skb,
                                                         status);
-                        sta_info_put(sta);
+                        rcu_read_unlock();
                         return;
                 }
         } else
                 rate_control_tx_status(local->mdev, skb, status);
 
+        rcu_read_unlock();
+
         ieee80211_led_tx(local, 0);
 
         /* SNMP counters