1 files changed, 56 insertions, 54 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 6ac49231efa9..e9ba6fcc0e45 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -136,7 +136,6 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta = NULL;
         enum ieee80211_key_alg alg;
-        int ret;
         struct ieee80211_key *key;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -170,12 +169,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 
         ieee80211_key_link(key, sdata, sta);
 
-        ret = 0;
-
-        if (sta)
-                sta_info_put(sta);
-
-        return ret;
+        return 0;
 }
 
 static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
@@ -184,7 +178,6 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
         int ret;
-        struct ieee80211_key *key;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -195,21 +188,18 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
 
                 ret = 0;
                 if (sta->key) {
-                        key = sta->key;
-                        ieee80211_key_free(key);
+                        ieee80211_key_free(sta->key);
                         WARN_ON(sta->key);
                 } else
                         ret = -ENOENT;
 
-                sta_info_put(sta);
                 return ret;
         }
 
         if (!sdata->keys[key_idx])
                 return -ENOENT;
 
-        key = sdata->keys[key_idx];
-        ieee80211_key_free(key);
+        ieee80211_key_free(sdata->keys[key_idx]);
         WARN_ON(sdata->keys[key_idx]);
 
         return 0;
@@ -292,8 +282,6 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
         err = 0;
 
  out:
-        if (sta)
-                sta_info_put(sta);
         return err;
 }
 
@@ -311,7 +299,7 @@ static int ieee80211_config_default_key(struct wiphy *wiphy,
 
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
 
         sinfo->filled = STATION_INFO_INACTIVE_TIME |
                         STATION_INFO_RX_BYTES |
@@ -340,16 +328,20 @@ static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct sta_info *sta;
+        int ret = -ENOENT;
+
+        rcu_read_lock();
 
         sta = sta_info_get_by_idx(local, idx, dev);
-        if (!sta)
-                return -ENOENT;
+        if (sta) {
+                ret = 0;
+                memcpy(mac, sta->addr, ETH_ALEN);
+                sta_set_sinfo(sta, sinfo);
+        }
 
-        memcpy(mac, sta->addr, ETH_ALEN);
-        sta_set_sinfo(sta, sinfo);
-        sta_info_put(sta);
+        rcu_read_unlock();
 
-        return 0;
+        return ret;
 }
 
 static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
@@ -357,16 +349,21 @@ static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct sta_info *sta;
+        int ret = -ENOENT;
 
-        sta = sta_info_get(local, mac);
-        if (!sta)
-                return -ENOENT;
+        rcu_read_lock();
 
         /* XXX: verify sta->dev == dev */
-        sta_set_sinfo(sta, sinfo);
-        sta_info_put(sta);
 
-        return 0;
+        sta = sta_info_get(local, mac);
+        if (sta) {
+                ret = 0;
+                sta_set_sinfo(sta, sinfo);
+        }
+
+        rcu_read_unlock();
+
+        return ret;
 }
 
 /*
@@ -559,8 +556,8 @@ static void ieee80211_send_layer2_update(struct sta_info *sta)
         msg->xid_info[1] = 1;   /* LLC types/classes: Type 1 LLC */
         msg->xid_info[2] = 0;   /* XID sender's receive window size (RW) */
 
-        skb->dev = sta->dev;
-        skb->protocol = eth_type_trans(skb, sta->dev);
+        skb->dev = sta->sdata->dev;
+        skb->protocol = eth_type_trans(skb, sta->sdata->dev);
         memset(skb->cb, 0, sizeof(skb->cb));
         netif_rx(skb);
 }
@@ -572,7 +569,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
         u32 rates;
         int i, j;
         struct ieee80211_supported_band *sband;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
 
         if (params->station_flags & STATION_FLAG_CHANGED) {
                 sta->flags &= ~WLAN_STA_AUTHORIZED;
@@ -644,14 +641,13 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         if (ieee80211_vif_is_mesh(&sdata->vif))
-                sta = mesh_plink_add(mac, DEFAULT_RATES, dev);
+                sta = mesh_plink_add(mac, DEFAULT_RATES, sdata);
         else
-                sta = sta_info_add(local, dev, mac, GFP_KERNEL);
+                sta = sta_info_add(sdata, mac);
 
         if (IS_ERR(sta))
                 return PTR_ERR(sta);
 
-        sta->dev = sdata->dev;
         if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN ||
             sdata->vif.type == IEEE80211_IF_TYPE_AP)
                 ieee80211_send_layer2_update(sta);
@@ -662,15 +658,14 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 
         rate_control_rate_init(sta, local);
 
-        sta_info_put(sta);
-
         return 0;
 }
 
 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *mac)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
 
         if (mac) {
@@ -679,10 +674,14 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
                 if (!sta)
                         return -ENOENT;
 
-                sta_info_free(sta);
-                sta_info_put(sta);
+                sta_info_unlink(&sta);
+
+                if (sta) {
+                        synchronize_rcu();
+                        sta_info_destroy(sta);
+                }
         } else
-                sta_info_flush(local, dev);
+                sta_info_flush(local, sdata);
 
         return 0;
 }
@@ -701,21 +700,19 @@ static int ieee80211_change_station(struct wiphy *wiphy,
         if (!sta)
                 return -ENOENT;
 
-        if (params->vlan && params->vlan != sta->dev) {
+        if (params->vlan && params->vlan != sta->sdata->dev) {
                 vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
                 if (vlansdata->vif.type != IEEE80211_IF_TYPE_VLAN ||
                     vlansdata->vif.type != IEEE80211_IF_TYPE_AP)
                         return -EINVAL;
 
-                sta->dev = params->vlan;
+                sta->sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
                 ieee80211_send_layer2_update(sta);
         }
 
         sta_apply_parameters(local, sta, params);
 
-        sta_info_put(sta);
-
         return 0;
 }
 
@@ -735,23 +732,26 @@ static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
         if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
                 return -ENOTSUPP;
 
+        rcu_read_lock();
         sta = sta_info_get(local, next_hop);
-        if (!sta)
+        if (!sta) {
+                rcu_read_unlock();
                 return -ENOENT;
+        }
 
         err = mesh_path_add(dst, dev);
-        if (err)
+        if (err) {
+                rcu_read_unlock();
                 return err;
+        }
 
-        rcu_read_lock();
         mpath = mesh_path_lookup(dst, dev);
         if (!mpath) {
                 rcu_read_unlock();
-                sta_info_put(sta);
                 return -ENXIO;
         }
         mesh_path_fix_nexthop(mpath, sta);
-        sta_info_put(sta);
+
         rcu_read_unlock();
         return 0;
 }
@@ -760,7 +760,7 @@ static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *dst)
 {
         if (dst)
-                return mesh_path_del(dst, dev);
+                return mesh_path_del(dst, dev, false);
 
         mesh_path_flush(dev);
         return 0;
@@ -781,20 +781,22 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
         if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
                 return -ENOTSUPP;
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, next_hop);
-        if (!sta)
+        if (!sta) {
+                rcu_read_unlock();
                 return -ENOENT;
+        }
 
-        rcu_read_lock();
         mpath = mesh_path_lookup(dst, dev);
         if (!mpath) {
                 rcu_read_unlock();
-                sta_info_put(sta);
                 return -ENOENT;
         }
 
         mesh_path_fix_nexthop(mpath, sta);
-        sta_info_put(sta);
+
         rcu_read_unlock();
         return 0;
 }