2017-11-30 06:22:55

by Xinming Hu

Subject: [PATCH] mwifiex: cfg80211: do not change virtual interface during scan processing

From: Limin Zhu <[email protected]>

(1) Change virtual interface operation in cfg80211 process reset and
reinitilize private data structure.
(2) Scan result event processed in main process will dereference private
data structure concurrently, ocassionly crash the kernel.

The cornel case could be trigger by below steps:
(1) wpa_cli mlan0 scan
(2) ./hostapd mlan0.conf

Cfg80211 asynchronous scan procedure is not all the time operated
under rtnl lock, here we add the protect to serialize the cfg80211
scan and change_virtual interface operation.

Signed-off-by: Limin Zhu <[email protected]>
Signed-off-by: Xinming Hu <[email protected]>
---
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 4d45df8..ce4432c 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -1116,6 +1116,12 @@ static int mwifiex_deinit_priv_params(struct mwifiex_private *priv)
struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
enum nl80211_iftype curr_iftype = dev->ieee80211_ptr->iftype;

+ if (priv->scan_request) {
+ mwifiex_dbg(priv->adapter, ERROR,
+ "change virtual interface: scan in process\n");
+ return -EBUSY;
+ }
+
switch (curr_iftype) {
case NL80211_IFTYPE_ADHOC:
switch (type) {
--
1.9.1

2017-12-07 13:31:50

by Kalle Valo

Subject: Re: mwifiex: cfg80211: do not change virtual interface during scan processing

Xinming Hu <[email protected]> wrote:

> From: Limin Zhu <[email protected]>
>
> (1) Change virtual interface operation in cfg80211 process reset and
> reinitilize private data structure.
> (2) Scan result event processed in main process will dereference private
> data structure concurrently, ocassionly crash the kernel.
>
> The cornel case could be trigger by below steps:
> (1) wpa_cli mlan0 scan
> (2) ./hostapd mlan0.conf
>
> Cfg80211 asynchronous scan procedure is not all the time operated
> under rtnl lock, here we add the protect to serialize the cfg80211
> scan and change_virtual interface operation.
>
> Signed-off-by: Limin Zhu <[email protected]>
> Signed-off-by: Xinming Hu <[email protected]>

Patch applied to wireless-drivers-next.git, thanks.

c61cfe49f0f0 mwifiex: cfg80211: do not change virtual interface during scan processing

--
https://patchwork.kernel.org/patch/10084299/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches