Return-path: Received: from he.sipsolutions.net ([78.46.109.217]:43341 "EHLO sipsolutions.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751070Ab1K1ISE (ORCPT ); Mon, 28 Nov 2011 03:18:04 -0500 Subject: [PATCH v4] mac80211: fix race condition caused by late addBA response From: Johannes Berg To: Nikolay Martynov Cc: linville@tuxdriver.com, linux-wireless@vger.kernel.org, Norbert Preining , Emmanuel Grumbach In-Reply-To: <1322394800.4044.33.camel@jlt3.sipsolutions.net> (sfid-20111127_125325_960390_524B9CCE) References: <1322378621-14647-1-git-send-email-mar.kolya@gmail.com> <1322378621-14647-2-git-send-email-mar.kolya@gmail.com> (sfid-20111127_082402_823149_B8E64ABA) <1322394638.4044.32.camel@jlt3.sipsolutions.net> (sfid-20111127_125046_228715_1E6D1B75) <1322394800.4044.33.camel@jlt3.sipsolutions.net> (sfid-20111127_125325_960390_524B9CCE) Content-Type: text/plain; charset="UTF-8" Date: Mon, 28 Nov 2011 09:18:00 +0100 Message-ID: <1322468280.4060.1.camel@jlt3.sipsolutions.net> (sfid-20111128_091809_354262_54B31041) Mime-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org List-ID: From: Nikolay Martynov If addBA responses comes in just after addba_resp_timer has expired mac80211 will still accept it and try to open the aggregation session. This causes drivers to be confused and in some cases even crash. This patch fixes the race condition and makes sure that if addba_resp_timer has expired addBA response is not longer accepted and we do not try to open half-closed session. Cc: stable@vger.kernel.org Signed-off-by: Nikolay Martynov [some adjustments] Signed-off-by: Johannes Berg --- v3: adjust message v4: adjust message again net/mac80211/agg-tx.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) --- a/net/mac80211/agg-tx.c 2011-11-27 12:51:16.000000000 +0100 +++ b/net/mac80211/agg-tx.c 2011-11-28 09:17:14.000000000 +0100 @@ -762,11 +762,27 @@ void ieee80211_process_addba_resp(struct goto out; } - del_timer(&tid_tx->addba_resp_timer); + del_timer_sync(&tid_tx->addba_resp_timer); #ifdef CONFIG_MAC80211_HT_DEBUG printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid); #endif + + /* + * addba_resp_timer may have fired before we got here, and + * caused WANT_STOP to be set. If the stop then was already + * processed further, STOPPING might be set. + */ + if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) || + test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { +#ifdef CONFIG_MAC80211_HT_DEBUG + printk(KERN_DEBUG + "got addBA resp for tid %d but we already gave up\n", + tid); +#endif + goto out; + } + /* * IEEE 802.11-2007 7.3.1.14: * In an ADDBA Response frame, when the Status Code field