Re: [PATCH] cfg80211: fix race condition with wiphy_apply_custom_regulatory()

["Luis R. Rodriguez" <lrodriguez@atheros.com>]

On Sat, May 02, 2009 at 07:29:43AM -0700, Alan Jenkins wrote:
> On 5/1/09, Luis R. Rodriguez <lrodriguez@atheros.com> wrote:
> > We forgot to lock using the cfg80211_mutex in
> > wiphy_apply_custom_regulatory(). Without the lock
> > there is possible race between processing a reply from CRDA
> > and a driver calling wiphy_apply_custom_regulatory(). During
> > the processing of the reply from CRDA we free last_request and
> > wiphy_apply_custom_regulatory() eventually accesses an
> > element from last_request in the through freq_reg_info_regd().
> >
> > This is very difficult to reproduce (I haven't), it takes us
> > 3 hours and you need to be banging hard, but the race is obvious
> > by looking at the code.
> >
> > This should only affect those who use this caller, which currently
> > is ath5k, ath9k, and ar9170.
> >
> > EIP: 0060:[<f8ebec50>] EFLAGS: 00210282 CPU: 1
> > EIP is at freq_reg_info_regd+0x24/0x121 [cfg80211]
> 
> This looks like the same bug I reported seeing on bootup (100% of the
> time).  I'll test wireless-testing again for V9 of the rfkill rewrite,
> so at that point I'll try to confirm that this patch fixes my problem.

Any luck?

  Luis