From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from he.sipsolutions.net ([78.46.109.217]:56310 "EHLO sipsolutions.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752427Ab0BFOUR (ORCPT ); Sat, 6 Feb 2010 09:20:17 -0500 Subject: [PATCH v2] mac80211: fix deauth race From: Johannes Berg To: linville@tuxdriver.com Cc: linux-wireless@vger.kernel.org In-Reply-To: <1265465415.4041.25.camel@johannes.local> References: <1265465415.4041.25.camel@johannes.local> Content-Type: text/plain; charset="UTF-8" Date: Sat, 06 Feb 2010 15:20:13 +0100 Message-ID: <1265466013.4041.26.camel@johannes.local> Mime-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org List-ID: When userspace requests a deauth while the authentication work is pending in the auth (not probe) state, we do not properly abort the work and then things get confused. Fix that and also improve the checks here to include the correct virtual interface, just in case two virtual interfaces would ever try to connect to the same BSS. Also fix a bug -- need to use list_del_rcu instead of just list_del to free a work item. Signed-off-by: Johannes Berg --- net/mac80211/mlme.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- wireless-testing.orig/net/mac80211/mlme.c 2010-02-06 15:07:37.000000000 +0100 +++ wireless-testing/net/mac80211/mlme.c 2010-02-06 15:18:58.000000000 +0100 @@ -2007,12 +2007,18 @@ int ieee80211_mgd_deauth(struct ieee8021 mutex_lock(&local->work_mtx); list_for_each_entry(wk, &local->work_list, list) { - if (wk->type != IEEE80211_WORK_DIRECT_PROBE) + if (wk->sdata != sdata) continue; + + if (wk->type != IEEE80211_WORK_DIRECT_PROBE && + wk->type != IEEE80211_WORK_AUTH) + continue; + if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN)) continue; - not_auth_yet = true; - list_del(&wk->list); + + not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE; + list_del_rcu(&wk->list); free_work(wk); break; }