pull request: iwlwifi 2014-03-11

Hi John,

One more bugfix - this bug has been there forever, so it might not be all that much important. Your call.

We were sending a host command while the mutex wasn't held. This led to hard-to-catch races.

Please pull - thanks.

The following changes since commit acfcd9ed588465e48efe5ceb67177096d51c95a9:

iwlwifi: fix and add 7265 series HW IDs (2014-03-04 19:30:06 +0200)

are available in the git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes.git for-john

for you to fetch changes up to 82e5a649453a3cf23516277abb84273768a1592b:

iwlwifi: dvm: take mutex when sending SYNC BT config command (2014-03-11 13:15:16 +0200)

----------------------------------------------------------------
Emmanuel Grumbach (1):
iwlwifi: dvm: take mutex when sending SYNC BT config command

 drivers/net/wireless/iwlwifi/dvm/main.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

From: Emmanuel Grumbach <[email protected]>

There is a flow in which we send the host command in SYNC mode, but we don't take priv->mutex.

---
 drivers/net/wireless/iwlwifi/dvm/main.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

index ba1b1ea..ea7e70c 100644
@@ -252,13 +252,17 @@ static void iwl_bg_bt_runtime_config(struct work_struct *work)
 	struct iwl_priv *priv =
 		container_of(work, struct iwl_priv, bt_runtime_config);
 
+	mutex_lock(&priv->mutex);
 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-		return;
+		goto out;
 
 	/* dont send host command if rf-kill is on */
 	if (!iwl_is_ready_rf(priv))
-		return;
+		goto out;
+
 	iwlagn_send_advance_bt_config(priv);
+out:
+	mutex_unlock(&priv->mutex);
 }
 
 static void iwl_bg_bt_full_concurrency(struct work_struct *work)

1.8.3.2

Pulling now (for -next)...

John W. Linville		Someday the world will need a hero, and you
[email protected]			might be all we have.  Be ready.