Patch "mac80211: fix locking in update_vlan_tailroom_need_count()" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

mac80211: fix locking in update_vlan_tailroom_need_count()

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mac80211-fix-locking-in-update_vlan_tailroom_need_count.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Johannes Berg <[email protected]>
Date: Wed, 17 Jun 2015 13:54:54 +0200
Subject: mac80211: fix locking in update_vlan_tailroom_need_count()

From: Johannes Berg <[email protected]>

[ Upstream commit 51f458d9612177f69c2e2c437034ae15f93078e7 ]

Unfortunately, Michal's change to fix AP_VLAN crypto tailroom caused a locking issue that was reported by lockdep, but only in a few cases - the issue was a classic ABBA deadlock caused by taking the mtx after the key_mtx, where normally they're taken the other way around.

As the key mutex protects the field in question (I'm adding a few annotations to make that clear) only the iteration needs to be protected, but we can also iterate the interface list with just RCU protection while holding the key mutex.

---
 net/mac80211/key.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

@@ -66,12 +66,15 @@ update_vlan_tailroom_need_count(struct i
 	if (sdata->vif.type != NL80211_IFTYPE_AP)
 		return;
 
-	mutex_lock(&sdata->local->mtx);
+	/* crypto_tx_tailroom_needed_cnt is protected by this */
+	assert_key_lock(sdata->local);
 
-	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+	rcu_read_lock();
+
+	list_for_each_entry_rcu(vlan, &sdata->u.ap.vlans, u.vlan.list)
 		vlan->crypto_tx_tailroom_needed_cnt += delta;
 
-	mutex_unlock(&sdata->local->mtx);
+	rcu_read_unlock();
 }
 
 static void increment_tailroom_need_count(struct ieee80211_sub_if_data *sdata)

@@ -95,6 +98,8 @@ static void increment_tailroom_need_coun
 	 * http://mid.gmane.org/[email protected]
 	 */
 
+	assert_key_lock(sdata->local);
+
 	update_vlan_tailroom_need_count(sdata, 1);
 
 	if (!sdata->crypto_tx_tailroom_needed_cnt++) {

@@ -109,6 +114,8 @@ static void increment_tailroom_need_coun
 static void decrease_tailroom_need_count(struct ieee80211_sub_if_data *sdata,
 					 int delta)
 {
+	assert_key_lock(sdata->local);
+
 	WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt < delta);
 
 	update_vlan_tailroom_need_count(sdata, -delta);

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/mac80211-fix-locking-in-update_vlan_tailroom_need_count.patch