b43: Workaround circular locking in hw-tkip key update callback
PATCH 1/1 b43: Workaround circular locking in hw-tkip key update callback
The TKIP key update callback is called from the RX path, where the driver mutex is already locked. This results in a circular locking bug. Avoid this by removing the lock.
Johannes noted that there is a separate bug: The callback still breaks on SDIO hardware, because SDIO hardware access needs to sleep, but we are not allowed to sleep in the callback due to mac80211's RCU locking.
Signed-off-by Michael Buesch <[email protected]>
Tested-by Larry Finger <[email protected]>
Reported-by [email protected]
Cc Johannes Berg <[email protected]>
Cc stable <[email protected]>
--- drivers/net/wireless/b43/main.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
drivers/net/wireless/b43/main.c +5 -8
@@ -856,22 +856,19 @@ static void b43_op_update_tkip_key(strucif (B43_WARN_ON (!modparam_hwtkip))return ; -mutex_lock (&wl->mutex); - +/* This is only called from the RX path through mac80211, where +* our mutex is already locked. */ +B43_WARN_ON (!mutex_is_locked (&wl->mutex)); dev = wl->current_dev; -if (!dev ||b43_status (dev) <B43_STAT_INITIALIZED ) - goto out_unlock; +B43_WARN_ON (!dev ||b43_status (dev) <B43_STAT_INITIALIZED );keymac_write (dev, index,NULL );/* First zero out mac to avoid race */ rx_tkip_phase1_write (dev, index, iv32, phase1key);/* only pairwise TKIP keys are supported right now */ if (WARN_ON (!sta)) - goto out_unlock; +return ;keymac_write (dev, index, sta->addr); - -out_unlock: -mutex_unlock (&wl->mutex); } static void do_key_write(struct b43_wldev *dev,
Signature · 1 line
Greetings, Michael.