mac80211: RCU-ify STA info structure access

This makes access to the STA hash table/list use RCU to protect
against freeing of items. However, it's not a true RCU, the
copy step is missing: whenever somebody changes a STA item it
is simply updated. This is an existing race condition that is
now somewhat understandable.

This patch also fixes the race key freeing vs. STA destruction
by making sure that sta_info_destroy() is always called under
RTNL and frees the key.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 85 insertions, 38 deletions

diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index 9f933aeca719..a3e96eb59eb0 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -24,6 +24,7 @@
 #include <linux/wireless.h>
 #include <linux/random.h>
 #include <linux/etherdevice.h>
+#include <linux/rtnetlink.h>
 #include <net/iw_handler.h>
 #include <asm/types.h>
 
@@ -845,6 +846,8 @@ static void ieee80211_associated(struct net_device *dev,
 
         ifsta->state = IEEE80211_ASSOCIATED;
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
                 printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
@@ -860,7 +863,7 @@ static void ieee80211_associated(struct net_device *dev,
                                        "range\n",
                                        dev->name, print_mac(mac, ifsta->bssid));
                                 disassoc = 1;
-                                sta_info_free(sta);
+                                sta_info_unlink(&sta);
                         } else
                                 ieee80211_send_probe_req(dev, ifsta->bssid,
                                                          local->scan_ssid,
@@ -876,8 +879,17 @@ static void ieee80211_associated(struct net_device *dev,
                                                          ifsta->ssid_len);
                         }
                 }
-                sta_info_put(sta);
         }
+
+        rcu_read_unlock();
+
+        if (disassoc && sta) {
+                synchronize_rcu();
+                rtnl_lock();
+                sta_info_destroy(sta);
+                rtnl_unlock();
+        }
+
         if (disassoc) {
                 ifsta->state = IEEE80211_DISABLED;
                 ieee80211_set_associated(dev, ifsta, 0);
@@ -1103,9 +1115,13 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
         int ret = -EOPNOTSUPP;
         DECLARE_MAC_BUF(mac);
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, mgmt->sa);
-        if (!sta)
+        if (!sta) {
+                rcu_read_unlock();
                 return;
+        }
 
         /* extract session parameters from addba request frame */
         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
@@ -1197,9 +1213,9 @@ end:
         spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
 
 end_no_lock:
-        ieee80211_send_addba_resp(sta->dev, sta->addr, tid, dialog_token,
-                                status, 1, buf_size, timeout);
-        sta_info_put(sta);
+        ieee80211_send_addba_resp(sta->sdata->dev, sta->addr, tid,
+                                  dialog_token, status, 1, buf_size, timeout);
+        rcu_read_unlock();
 }
 
 static void ieee80211_sta_process_addba_resp(struct net_device *dev,
@@ -1213,9 +1229,13 @@ static void ieee80211_sta_process_addba_resp(struct net_device *dev,
         u16 tid;
         u8 *state;
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, mgmt->sa);
-        if (!sta)
+        if (!sta) {
+                rcu_read_unlock();
                 return;
+        }
 
         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
@@ -1230,7 +1250,7 @@ static void ieee80211_sta_process_addba_resp(struct net_device *dev,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
-                sta_info_put(sta);
+                rcu_read_unlock();
                 return;
         }
 
@@ -1244,7 +1264,7 @@ static void ieee80211_sta_process_addba_resp(struct net_device *dev,
                         spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
                         printk(KERN_DEBUG "state not HT_ADDBA_REQUESTED_MSK:"
                                 "%d\n", *state);
-                        sta_info_put(sta);
+                        rcu_read_unlock();
                         return;
                 }
 
@@ -1271,7 +1291,7 @@ static void ieee80211_sta_process_addba_resp(struct net_device *dev,
                 ieee80211_stop_tx_ba_session(hw, sta->addr, tid,
                                              WLAN_BACK_INITIATOR);
         }
-        sta_info_put(sta);
+        rcu_read_unlock();
 }
 
 void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
@@ -1326,16 +1346,20 @@ void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
         struct sta_info *sta;
         int ret, i;
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, ra);
-        if (!sta)
+        if (!sta) {
+                rcu_read_unlock();
                 return;
+        }
 
         /* check if TID is in operational state */
         spin_lock_bh(&sta->ampdu_mlme.ampdu_rx);
         if (sta->ampdu_mlme.tid_rx[tid].state
                                 != HT_AGG_STATE_OPERATIONAL) {
                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
-                sta_info_put(sta);
+                rcu_read_unlock();
                 return;
         }
         sta->ampdu_mlme.tid_rx[tid].state =
@@ -1374,7 +1398,7 @@ void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
         kfree(sta->ampdu_mlme.tid_rx[tid].reorder_buf);
 
         sta->ampdu_mlme.tid_rx[tid].state = HT_AGG_STATE_IDLE;
-        sta_info_put(sta);
+        rcu_read_unlock();
 }
 
 
@@ -1387,9 +1411,13 @@ static void ieee80211_sta_process_delba(struct net_device *dev,
         u16 initiator;
         DECLARE_MAC_BUF(mac);
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, mgmt->sa);
-        if (!sta)
+        if (!sta) {
+                rcu_read_unlock();
                 return;
+        }
 
         params = le16_to_cpu(mgmt->u.action.u.delba.params);
         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
@@ -1414,7 +1442,7 @@ static void ieee80211_sta_process_delba(struct net_device *dev,
                 ieee80211_stop_tx_ba_session(&local->hw, sta->addr, tid,
                                              WLAN_BACK_RECIPIENT);
         }
-        sta_info_put(sta);
+        rcu_read_unlock();
 }
 
 /*
@@ -1437,9 +1465,13 @@ void sta_addba_resp_timer_expired(unsigned long data)
         struct sta_info *sta;
         u8 *state;
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, temp_sta->addr);
-        if (!sta)
+        if (!sta) {
+                rcu_read_unlock();
                 return;
+        }
 
         state = &sta->ampdu_mlme.tid_tx[tid].state;
         /* check if the TID waits for addBA response */
@@ -1461,7 +1493,7 @@ void sta_addba_resp_timer_expired(unsigned long data)
                                      WLAN_BACK_INITIATOR);
 
 timer_expired_exit:
-        sta_info_put(sta);
+        rcu_read_unlock();
 }
 
 /*
@@ -1481,8 +1513,8 @@ void sta_rx_agg_session_timer_expired(unsigned long data)
                                          timer_to_tid[0]);
 
         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
-        ieee80211_sta_stop_rx_ba_session(sta->dev, sta->addr, (u16)*ptid,
-                                         WLAN_BACK_TIMER,
+        ieee80211_sta_stop_rx_ba_session(sta->sdata->dev, sta->addr,
+                                         (u16)*ptid, WLAN_BACK_TIMER,
                                          WLAN_REASON_QSTA_TIMEOUT);
 }
 
@@ -1791,14 +1823,18 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         if (ifsta->assocresp_ies)
                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
 
+        rcu_read_lock();
+
         /* Add STA entry for the AP */
         sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
                 struct ieee80211_sta_bss *bss;
-                sta = sta_info_add(local, dev, ifsta->bssid, GFP_KERNEL);
+
+                sta = sta_info_add(sdata, ifsta->bssid);
                 if (IS_ERR(sta)) {
                         printk(KERN_DEBUG "%s: failed to add STA entry for the"
                                " AP (error %ld)\n", dev->name, PTR_ERR(sta));
+                        rcu_read_unlock();
                         return;
                 }
                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
@@ -1812,7 +1848,6 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        sta->dev = dev;
         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
                       WLAN_STA_AUTHORIZED;
 
@@ -1883,7 +1918,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         bss_conf->aid = aid;
         ieee80211_set_associated(dev, ifsta, 1);
 
-        sta_info_put(sta);
+        rcu_read_unlock();
 
         ieee80211_associated(dev, ifsta);
 }
@@ -2329,6 +2364,8 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                                       mesh_peer_accepts_plinks(&elems, dev));
         }
 
+        rcu_read_lock();
+
         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
             (sta = sta_info_get(local, mgmt->sa))) {
@@ -2354,9 +2391,10 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                                (unsigned long long) supp_rates,
                                (unsigned long long) sta->supp_rates[rx_status->band]);
                 }
-                sta_info_put(sta);
         }
 
+        rcu_read_unlock();
+
         if (elems.ds_params && elems.ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
         else
@@ -2550,8 +2588,10 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                                        "local TSF - IBSS merge with BSSID %s\n",
                                        dev->name, print_mac(mac, mgmt->bssid));
                         ieee80211_sta_join_ibss(dev, &sdata->u.sta, bss);
+                        rcu_read_lock();
                         ieee80211_ibss_add_sta(dev, NULL,
                                                mgmt->bssid, mgmt->sa);
+                        rcu_read_unlock();
                 }
         }
 
@@ -2893,17 +2933,20 @@ static int ieee80211_sta_active_ibss(struct net_device *dev)
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         int active = 0;
         struct sta_info *sta;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        read_lock_bh(&local->sta_lock);
-        list_for_each_entry(sta, &local->sta_list, list) {
-                if (sta->dev == dev &&
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sta->sdata == sdata &&
                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
                                jiffies)) {
                         active++;
                         break;
                 }
         }
-        read_unlock_bh(&local->sta_lock);
+
+        rcu_read_unlock();
 
         return active;
 }
@@ -2915,22 +2958,25 @@ static void ieee80211_sta_expire(struct net_device *dev, unsigned long exp_time)
         struct sta_info *sta, *tmp;
         LIST_HEAD(tmp_list);
         DECLARE_MAC_BUF(mac);
+        unsigned long flags;
 
-        write_lock_bh(&local->sta_lock);
+        spin_lock_irqsave(&local->sta_lock, flags);
         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
                 if (time_after(jiffies, sta->last_rx + exp_time)) {
                         printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
                                dev->name, print_mac(mac, sta->addr));
-                        __sta_info_get(sta);
-                        sta_info_remove(sta);
-                        list_add(&sta->list, &tmp_list);
+                        sta_info_unlink(&sta);
+                        if (sta)
+                                list_add(&sta->list, &tmp_list);
                 }
-        write_unlock_bh(&local->sta_lock);
+        spin_unlock_irqrestore(&local->sta_lock, flags);
 
-        list_for_each_entry_safe(sta, tmp, &tmp_list, list) {
-                sta_info_free(sta);
-                sta_info_put(sta);
-        }
+        synchronize_rcu();
+
+        rtnl_lock();
+        list_for_each_entry_safe(sta, tmp, &tmp_list, list)
+                sta_info_destroy(sta);
+        rtnl_unlock();
 }
 
 
@@ -3977,6 +4023,7 @@ int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
 }
 
 
+/* must be called under RCU read lock */
 struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
                                          struct sk_buff *skb, u8 *bssid,
                                          u8 *addr)
@@ -3999,7 +4046,7 @@ struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
         printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
                wiphy_name(local->hw.wiphy), print_mac(mac, addr), dev->name);
 
-        sta = sta_info_add(local, dev, addr, GFP_ATOMIC);
+        sta = sta_info_add(sdata, addr);
         if (IS_ERR(sta))
                 return NULL;
 
@@ -4010,7 +4057,7 @@ struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
 
         rate_control_rate_init(sta, local);
 
-        return sta; /* caller will call sta_info_put() */
+        return sta;
 }