mac80211: Fix circular locking dependency in ARP filter handling

There is a circular locking dependency when configuring the
hardware ARP filters on association, occurring when flushing the mac80211
workqueue. This is what happens:

[   92.026800] =======================================================
[   92.030507] [ INFO: possible circular locking dependency detected ]
[   92.030507] 2.6.34-04781-g2b2c009 #85
[   92.030507] -------------------------------------------------------
[   92.030507] modprobe/5225 is trying to acquire lock:
[   92.030507]  ((wiphy_name(local->hw.wiphy))){+.+.+.}, at: [<ffffffff8105b5c0>] flush_workq
ueue+0x0/0xb0
[   92.030507]
[   92.030507] but task is already holding lock:
[   92.030507]  (rtnl_mutex){+.+.+.}, at: [<ffffffff812b9ce2>] rtnl_lock+0x12/0x20
[   92.030507]
[   92.030507] which lock already depends on the new lock.
[   92.030507]
[   92.030507]
[   92.030507] the existing dependency chain (in reverse order) is:
[   92.030507]
[   92.030507] -> #2 (rtnl_mutex){+.+.+.}:
[   92.030507]        [<ffffffff810761fb>] lock_acquire+0xdb/0x110
[   92.030507]        [<ffffffff81341754>] mutex_lock_nested+0x44/0x300
[   92.030507]        [<ffffffff812b9ce2>] rtnl_lock+0x12/0x20
[   92.030507]        [<ffffffffa022d47c>] ieee80211_assoc_done+0x6c/0xe0 [mac80211]
[   92.030507]        [<ffffffffa022f2ad>] ieee80211_work_work+0x31d/0x1280 [mac80211]

[   92.030507] -> #1 ((&local->work_work)){+.+.+.}:
[   92.030507]        [<ffffffff810761fb>] lock_acquire+0xdb/0x110
[   92.030507]        [<ffffffff8105a51a>] worker_thread+0x22a/0x370
[   92.030507]        [<ffffffff8105ecc6>] kthread+0x96/0xb0
[   92.030507]        [<ffffffff81003a94>] kernel_thread_helper+0x4/0x10
[   92.030507]
[   92.030507] -> #0 ((wiphy_name(local->hw.wiphy))){+.+.+.}:
[   92.030507]        [<ffffffff81075fdc>] __lock_acquire+0x1c0c/0x1d50
[   92.030507]        [<ffffffff810761fb>] lock_acquire+0xdb/0x110
[   92.030507]        [<ffffffff8105b60e>] flush_workqueue+0x4e/0xb0
[   92.030507]        [<ffffffffa023ff7b>] ieee80211_stop_device+0x2b/0xb0 [mac80211]
[   92.030507]        [<ffffffffa0231635>] ieee80211_stop+0x3e5/0x680 [mac80211]

The locking in this case is quite complex. Fix the problem by rewriting the
way the hardware ARP filter list is handled - i.e. make a copy of the address
list to the bss_conf struct, and provide that list to the hardware driver
when needed.

The current patch will enable filtering also in promiscuous mode. This may need
to be changed in the future.

Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 34 insertions, 20 deletions

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index c2e46e88f3c9..a1bf46c64b93 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -20,6 +20,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/bitmap.h>
 #include <linux/pm_qos_params.h>
+#include <linux/inetdevice.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
 
@@ -317,23 +318,6 @@ static void ieee80211_recalc_smps_work(struct work_struct *work)
 }
 
 #ifdef CONFIG_INET
-int ieee80211_set_arp_filter(struct ieee80211_sub_if_data *sdata)
-{
-        struct in_device *idev;
-        int ret = 0;
-
-        BUG_ON(!sdata);
-        ASSERT_RTNL();
-
-        idev = sdata->dev->ip_ptr;
-        if (!idev)
-                return 0;
-
-        ret = drv_configure_arp_filter(sdata->local, &sdata->vif,
-                                       idev->ifa_list);
-        return ret;
-}
-
 static int ieee80211_ifa_changed(struct notifier_block *nb,
                                  unsigned long data, void *arg)
 {
@@ -343,8 +327,11 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
                              ifa_notifier);
         struct net_device *ndev = ifa->ifa_dev->dev;
         struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        struct in_device *idev;
         struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_bss_conf *bss_conf;
         struct ieee80211_if_managed *ifmgd;
+        int c = 0;
 
         if (!netif_running(ndev))
                 return NOTIFY_DONE;
@@ -356,17 +343,44 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
         if (wdev->wiphy != local->hw.wiphy)
                 return NOTIFY_DONE;
 
-        /* We are concerned about IP addresses only when associated */
         sdata = IEEE80211_DEV_TO_SUB_IF(ndev);
+        bss_conf = &sdata->vif.bss_conf;
 
         /* ARP filtering is only supported in managed mode */
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return NOTIFY_DONE;
 
+        idev = sdata->dev->ip_ptr;
+        if (!idev)
+                return NOTIFY_DONE;
+
         ifmgd = &sdata->u.mgd;
         mutex_lock(&ifmgd->mtx);
-        if (ifmgd->associated)
-                ieee80211_set_arp_filter(sdata);
+
+        /* Copy the addresses to the bss_conf list */
+        ifa = idev->ifa_list;
+        while (c < IEEE80211_BSS_ARP_ADDR_LIST_LEN && ifa) {
+                bss_conf->arp_addr_list[c] = ifa->ifa_address;
+                ifa = ifa->ifa_next;
+                c++;
+        }
+
+        /* If not all addresses fit the list, disable filtering */
+        if (ifa) {
+                sdata->arp_filter_state = false;
+                c = 0;
+        } else {
+                sdata->arp_filter_state = true;
+        }
+        bss_conf->arp_addr_cnt = c;
+
+        /* Configure driver only if associated */
+        if (ifmgd->associated) {
+                bss_conf->arp_filter_enabled = sdata->arp_filter_state;
+                ieee80211_bss_info_change_notify(sdata,
+                                                 BSS_CHANGED_ARP_FILTER);
+        }
+
         mutex_unlock(&ifmgd->mtx);
 
         return NOTIFY_DONE;