[PATCH] mac80211: fix virtual interface locking

Florian Lohoff noticed a bug in mac80211: when bringing the
master interface down while other virtual interfaces are up
we call dev_close() under a spinlock which is not allowed.
This patch removes the sub_if_lock used by mac80211 in favour
of using an RCU list. All list manipulations are already done
under rtnl so are well protected against each other, and the
read-side locks we took in the RX and TX code are already in
RCU read-side critical sections.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Cc: Florian Lohoff <flo@rfc822.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Michal Piotrowski <michal.k.k.piotrowski@gmail.com>
Cc: Satyam Sharma <satyam@infradead.org>
Signed-off-by: Michael Wu <flamingice@sourmilk.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 7 insertions, 3 deletions

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 38394c40f6ad..244c80d0c8fb 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -295,8 +295,12 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
 
-        read_lock(&local->sub_if_lock);
-        list_for_each_entry(sdata, &local->sub_if_list, list) {
+        /*
+         * virtual interfaces are protected by RCU
+         */
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 struct ieee80211_if_ap *ap;
                 if (sdata->dev == local->mdev ||
                     sdata->type != IEEE80211_IF_TYPE_AP)
@@ -309,7 +313,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
                 }
                 total += skb_queue_len(&ap->ps_bc_buf);
         }
-        read_unlock(&local->sub_if_lock);
+        rcu_read_unlock();
 
         read_lock_bh(&local->sta_lock);
         list_for_each_entry(sta, &local->sta_list, list) {