diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2017-09-06 15:01:42 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2017-09-06 15:22:02 +0200 |
| commit | bde59c475e0883e4c4294bcd9b9c7e08ae18c828 (patch) | |
| tree | 2bc99ff875407d538dd1c6c8f2cced8878528ad9 /net/mac80211/ht.c | |
| parent | 98e93e968e4947cd71c2eb69e323682daa453ee7 (diff) | |
| download | linux-bde59c475e0883e4c4294bcd9b9c7e08ae18c828.tar.gz linux-bde59c475e0883e4c4294bcd9b9c7e08ae18c828.tar.bz2 linux-bde59c475e0883e4c4294bcd9b9c7e08ae18c828.zip | |
mac80211: fix deadlock in driver-managed RX BA session start
When an RX BA session is started by the driver, and it has to tell
mac80211 about it, the corresponding bit in tid_rx_manage_offl gets
set and the BA session work is scheduled. Upon testing this bit, it
will call __ieee80211_start_rx_ba_session(), thus deadlocking as it
already holds the ampdu_mlme.mtx, which that acquires again.
Fix this by adding ___ieee80211_start_rx_ba_session(), a version of
the function that requires the mutex already held.
Cc: stable@vger.kernel.org
Fixes: 699cb58c8a52 ("mac80211: manage RX BA session offload without SKB queue")
Reported-by: Matteo Croce <mcroce@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/mac80211/ht.c')
| -rw-r--r-- | net/mac80211/ht.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c index 4cba7fca10d4..d6d0b4201e40 100644 --- a/net/mac80211/ht.c +++ b/net/mac80211/ht.c @@ -351,9 +351,9 @@ void ieee80211_ba_session_work(struct work_struct *work) if (test_and_clear_bit(tid, sta->ampdu_mlme.tid_rx_manage_offl)) - __ieee80211_start_rx_ba_session(sta, 0, 0, 0, 1, tid, - IEEE80211_MAX_AMPDU_BUF, - false, true); + ___ieee80211_start_rx_ba_session(sta, 0, 0, 0, 1, tid, + IEEE80211_MAX_AMPDU_BUF, + false, true); if (test_and_clear_bit(tid + IEEE80211_NUM_TIDS, sta->ampdu_mlme.tid_rx_manage_offl)) |