mac80211: RCU-ify STA info structure access

This makes access to the STA hash table/list use RCU to protect
against freeing of items. However, it's not a true RCU, the
copy step is missing: whenever somebody changes a STA item it
is simply updated. This is an existing race condition that is
now somewhat understandable.

This patch also fixes the race key freeing vs. STA destruction
by making sure that sta_info_destroy() is always called under
RTNL and frees the key.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 10 insertions, 3 deletions

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index d3b5cc57af40..8e440c5706dd 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -574,6 +574,7 @@ struct ieee80211_local {
         unsigned int filter_flags; /* FIF_* */
         struct iw_statistics wstats;
         u8 wstats_flags;
+        bool tim_in_locked_section; /* see ieee80211_beacon_get() */
         int tx_headroom; /* required headroom for hardware/radiotap */
 
         enum {
@@ -591,9 +592,15 @@ struct ieee80211_local {
         struct sk_buff_head skb_queue;
         struct sk_buff_head skb_queue_unreliable;
 
-        /* Station data structures */
-        rwlock_t sta_lock; /* protects STA data structures */
-        int num_sta; /* number of stations in sta_list */
+        /* Station data */
+        /*
+         * The lock only protects the list, hash, timer and counter
+         * against manipulation, reads are done in RCU. Additionally,
+         * the lock protects each BSS's TIM bitmap and a few items
+         * in a STA info structure.
+         */
+        spinlock_t sta_lock;
+        unsigned long num_sta;
         struct list_head sta_list;
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;