diff options
| author |   Johannes Berg <johannes.berg@intel.com> | 2017-09-06 15:01:42 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2017-09-06 15:22:02 +0200 |
| commit | bde59c475e0883e4c4294bcd9b9c7e08ae18c828 (patch) | |
| tree | 2bc99ff875407d538dd1c6c8f2cced8878528ad9 /net/mac80211/ieee80211_i.h | |
| parent | mac80211: Complete ampdu work schedule during session tear down (diff) | |
| download | linux-dev-bde59c475e0883e4c4294bcd9b9c7e08ae18c828.tar.xz linux-dev-bde59c475e0883e4c4294bcd9b9c7e08ae18c828.zip | |
mac80211: fix deadlock in driver-managed RX BA session start
When an RX BA session is started by the driver, and it has to tell
mac80211 about it, the corresponding bit in tid_rx_manage_offl gets
set and the BA session work is scheduled. Upon testing this bit, it
will call __ieee80211_start_rx_ba_session(), thus deadlocking as it
already holds the ampdu_mlme.mtx, which that acquires again.
Fix this by adding ___ieee80211_start_rx_ba_session(), a version of
the function that requires the mutex already held.
Cc: stable@vger.kernel.org
Fixes: 699cb58c8a52 ("mac80211: manage RX BA session offload without SKB queue")
Reported-by: Matteo Croce <mcroce@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to '')
| -rw-r--r-- | net/mac80211/ieee80211_i.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index 2197c62a0a6e..9675814f64db 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1760,6 +1760,10 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta, u8 dialog_token, u16 timeout, u16 start_seq_num, u16 ba_policy, u16 tid, u16 buf_size, bool tx, bool auto_seq); +void ___ieee80211_start_rx_ba_session(struct sta_info *sta, + u8 dialog_token, u16 timeout, + u16 start_seq_num, u16 ba_policy, u16 tid, + u16 buf_size, bool tx, bool auto_seq); void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta, enum ieee80211_agg_stop_reason reason); void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata, |