mac80211: Fix circular locking dependency in ARP filter handling

There is a circular locking dependency when configuring the
hardware ARP filters on association, occurring when flushing the mac80211
workqueue. This is what happens:

[   92.026800] =======================================================
[   92.030507] [ INFO: possible circular locking dependency detected ]
[   92.030507] 2.6.34-04781-g2b2c009 #85
[   92.030507] -------------------------------------------------------
[   92.030507] modprobe/5225 is trying to acquire lock:
[   92.030507]  ((wiphy_name(local->hw.wiphy))){+.+.+.}, at: [<ffffffff8105b5c0>] flush_workq
ueue+0x0/0xb0
[   92.030507]
[   92.030507] but task is already holding lock:
[   92.030507]  (rtnl_mutex){+.+.+.}, at: [<ffffffff812b9ce2>] rtnl_lock+0x12/0x20
[   92.030507]
[   92.030507] which lock already depends on the new lock.
[   92.030507]
[   92.030507]
[   92.030507] the existing dependency chain (in reverse order) is:
[   92.030507]
[   92.030507] -> #2 (rtnl_mutex){+.+.+.}:
[   92.030507]        [<ffffffff810761fb>] lock_acquire+0xdb/0x110
[   92.030507]        [<ffffffff81341754>] mutex_lock_nested+0x44/0x300
[   92.030507]        [<ffffffff812b9ce2>] rtnl_lock+0x12/0x20
[   92.030507]        [<ffffffffa022d47c>] ieee80211_assoc_done+0x6c/0xe0 [mac80211]
[   92.030507]        [<ffffffffa022f2ad>] ieee80211_work_work+0x31d/0x1280 [mac80211]

[   92.030507] -> #1 ((&local->work_work)){+.+.+.}:
[   92.030507]        [<ffffffff810761fb>] lock_acquire+0xdb/0x110
[   92.030507]        [<ffffffff8105a51a>] worker_thread+0x22a/0x370
[   92.030507]        [<ffffffff8105ecc6>] kthread+0x96/0xb0
[   92.030507]        [<ffffffff81003a94>] kernel_thread_helper+0x4/0x10
[   92.030507]
[   92.030507] -> #0 ((wiphy_name(local->hw.wiphy))){+.+.+.}:
[   92.030507]        [<ffffffff81075fdc>] __lock_acquire+0x1c0c/0x1d50
[   92.030507]        [<ffffffff810761fb>] lock_acquire+0xdb/0x110
[   92.030507]        [<ffffffff8105b60e>] flush_workqueue+0x4e/0xb0
[   92.030507]        [<ffffffffa023ff7b>] ieee80211_stop_device+0x2b/0xb0 [mac80211]
[   92.030507]        [<ffffffffa0231635>] ieee80211_stop+0x3e5/0x680 [mac80211]

The locking in this case is quite complex. Fix the problem by rewriting the
way the hardware ARP filter list is handled - i.e. make a copy of the address
list to the bss_conf struct, and provide that list to the hardware driver
when needed.

The current patch will enable filtering also in promiscuous mode. This may need
to be changed in the future.

Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 19 insertions, 15 deletions

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 583b34686a26..74479c2d12d4 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -806,11 +806,12 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_bss *bss = (void *)cbss->priv;
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
         /* set timing information */
-        sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
-        sdata->vif.bss_conf.timestamp = cbss->tsf;
+        bss_conf->beacon_int = cbss->beacon_interval;
+        bss_conf->timestamp = cbss->tsf;
 
         bss_info_changed |= BSS_CHANGED_BEACON_INT;
         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
@@ -835,7 +836,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_led_assoc(local, 1);
 
-        sdata->vif.bss_conf.assoc = 1;
+        bss_conf->assoc = 1;
         /*
          * For now just always ask the driver to update the basic rateset
          * when we have associated, we aren't checking whether it actually
@@ -848,9 +849,15 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         /* Tell the driver to monitor connection quality (if supported) */
         if ((local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI) &&
-            sdata->vif.bss_conf.cqm_rssi_thold)
+            bss_conf->cqm_rssi_thold)
                 bss_info_changed |= BSS_CHANGED_CQM;
 
+        /* Enable ARP filtering */
+        if (bss_conf->arp_filter_enabled != sdata->arp_filter_state) {
+                bss_conf->arp_filter_enabled = sdata->arp_filter_state;
+                bss_info_changed |= BSS_CHANGED_ARP_FILTER;
+        }
+
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
         mutex_lock(&local->iflist_mtx);
@@ -932,6 +939,12 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_hw_config(local, config_changed);
 
+        /* Disable ARP filtering */
+        if (sdata->vif.bss_conf.arp_filter_enabled) {
+                sdata->vif.bss_conf.arp_filter_enabled = false;
+                changed |= BSS_CHANGED_ARP_FILTER;
+        }
+
         /* The BSSID (not really interesting) and HT changed */
         changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
         ieee80211_bss_info_change_notify(sdata, changed);
@@ -2018,18 +2031,9 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
                         cfg80211_send_assoc_timeout(wk->sdata->dev,
                                                     wk->filter_ta);
                         return WORK_DONE_DESTROY;
-                } else {
-                        mutex_unlock(&wk->sdata->u.mgd.mtx);
-#ifdef CONFIG_INET
-                        /*
-                         * configure ARP filter IP addresses to the driver,
-                         * intentionally outside the mgd mutex.
-                         */
-                        rtnl_lock();
-                        ieee80211_set_arp_filter(wk->sdata);
-                        rtnl_unlock();
-#endif
                 }
+
+                mutex_unlock(&wk->sdata->u.mgd.mtx);
         }
 
         cfg80211_send_rx_assoc(wk->sdata->dev, skb->data, skb->len);