Patch mac80211: fix non RCU-safe sta_list manipulation has been added to the 3.4-stable tree

2012-06-14 Thread gregkh 

This is a note to let you know that I've just added the patch titled

mac80211: fix non RCU-safe sta_list manipulation

to the 3.4-stable tree which can be found at:

http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
 mac80211-fix-non-rcu-safe-sta_list-manipulation.patch
and it can be found in the queue-3.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let stable@vger.kernel.org know about it.


From 794454ce72a298de6f4536ade597bdcc7dcde7c7 Mon Sep 17 00:00:00 2001
From: Arik Nemtsov a...@wizery.com
Date: Sun, 3 Jun 2012 23:32:32 +0300
Subject: mac80211: fix non RCU-safe sta_list manipulation

From: Arik Nemtsov a...@wizery.com

commit 794454ce72a298de6f4536ade597bdcc7dcde7c7 upstream.

sta_info_cleanup locks the sta_list using rcu_read_lock however
the delete operation isn't rcu safe. A race between sta_info_cleanup
timer being called and a STA being removed can occur which leads
to a panic while traversing sta_list. Fix this by switching to the
RCU-safe versions.

Reported-by: Eyal Shapira e...@wizery.com
Signed-off-by: Arik Nemtsov a...@wizery.com
Signed-off-by: John W. Linville linvi...@tuxdriver.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 net/mac80211/sta_info.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -378,7 +378,7 @@ static int sta_info_insert_finish(struct
/* make the station visible */
sta_info_hash_add(local, sta);
 
-   list_add(sta-list, local-sta_list);
+   list_add_rcu(sta-list, local-sta_list);
 
set_sta_flag(sta, WLAN_STA_INSERTED);
 
@@ -688,7 +688,7 @@ int __must_check __sta_info_destroy(stru
if (ret)
return ret;
 
-   list_del(sta-list);
+   list_del_rcu(sta-list);
 
mutex_lock(local-key_mtx);
for (i = 0; i  NUM_DEFAULT_KEYS; i++)


Patches currently in stable-queue which might be from a...@wizery.com are

queue-3.4/mac80211-fix-non-rcu-safe-sta_list-manipulation.patch
--
To unsubscribe from this list: send the line unsubscribe stable in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] mac80211: fix non RCU-safe sta_list manipulation

2012-06-04 Thread Johannes Berg 
On Sun, 2012-06-03 at 23:32 +0300, Arik Nemtsov wrote:
 sta_info_cleanup locks the sta_list using rcu_read_lock however
 the delete operation isn't rcu safe. A race between sta_info_cleanup
 timer being called and a STA being removed can occur which leads
 to a panic while traversing sta_list. Fix this by switching to the
 RCU-safe versions.

Good catch!

johannes


--
To unsubscribe from this list: send the line unsubscribe stable in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] mac80211: fix non RCU-safe sta_list manipulation

2012-06-03 Thread Arik Nemtsov 
sta_info_cleanup locks the sta_list using rcu_read_lock however
the delete operation isn't rcu safe. A race between sta_info_cleanup
timer being called and a STA being removed can occur which leads
to a panic while traversing sta_list. Fix this by switching to the
RCU-safe versions.

Cc: stable@vger.kernel.org
Reported-by: Eyal Shapira e...@wizery.com
Signed-off-by: Arik Nemtsov a...@wizery.com
---
 net/mac80211/sta_info.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f5c2b7e..a37c905 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -378,7 +378,7 @@ static int sta_info_insert_finish(struct sta_info *sta) 
__acquires(RCU)
/* make the station visible */
sta_info_hash_add(local, sta);
 
-   list_add(sta-list, local-sta_list);
+   list_add_rcu(sta-list, local-sta_list);
 
set_sta_flag(sta, WLAN_STA_INSERTED);
 
@@ -688,7 +688,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
if (ret)
return ret;
 
-   list_del(sta-list);
+   list_del_rcu(sta-list);
 
mutex_lock(local-key_mtx);
for (i = 0; i  NUM_DEFAULT_KEYS; i++)
-- 
1.7.9.5

--
To unsubscribe from this list: send the line unsubscribe stable in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html