Re: [RFC] mac80211: fix possible tid_rx->reorder_timer use after free

[Johannes Berg <johannes@sipsolutions.net>]

On Mon, 2012-03-19 at 14:40 +0100, Stanislaw Gruszka wrote:

> > > +static void ieee80211_free_tid_rx(struct tid_ampdu_rx *tid_rx)
> > >  {
> > > -	struct tid_ampdu_rx *tid_rx =
> > > -		container_of(h, struct tid_ampdu_rx, rcu_head);
> > >  	int i;
> > >  
> > >  	for (i = 0; i < tid_rx->buf_size; i++)
> > > @@ -90,10 +88,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
> > >  		ieee80211_send_delba(sta->sdata, sta->sta.addr,
> > >  				     tid, WLAN_BACK_RECIPIENT, reason);
> > >  
> > > +	synchronize_rcu();
> > > +
> > >  	del_timer_sync(&tid_rx->session_timer);
> > >  	del_timer_sync(&tid_rx->reorder_timer);
> > >  
> > > -	call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
> > > +	ieee80211_free_tid_rx(tid_rx);
> > 
> > Hmmm. That synchronize_rcu() could become rather expensive. I've been
> > trying to reduce our use of synchronize_rcu() now.
> 
> Expensive in what sense? Since we are in process context we are allowed
> to sleep, and some other processes will run while we sleep.

It takes a long time, and we have to wait for it. So for example, it
could delay roaming by another 100ms or however long it takes (yes, it
can take a very long time, we've seen up to 200ms I think)

johannes