Re: [PATCH] cfg80211: fix race condition with wiphy_apply_custom_regulatory()

["Luis R. Rodriguez" <lrodriguez@atheros.com>]

On Tue, May 05, 2009 at 08:47:57AM -0700, Alan Jenkins wrote:
> On 5/4/09, Luis R. Rodriguez <lrodriguez@atheros.com> wrote:
> > On Sat, May 02, 2009 at 07:29:43AM -0700, Alan Jenkins wrote:
> >> On 5/1/09, Luis R. Rodriguez <lrodriguez@atheros.com> wrote:
> >> > We forgot to lock using the cfg80211_mutex in
> >> > wiphy_apply_custom_regulatory(). Without the lock
> >> > there is possible race between processing a reply from CRDA
> >> > and a driver calling wiphy_apply_custom_regulatory(). During
> >> > the processing of the reply from CRDA we free last_request and
> >> > wiphy_apply_custom_regulatory() eventually accesses an
> >> > element from last_request in the through freq_reg_info_regd().
> >> >
> >> > This is very difficult to reproduce (I haven't), it takes us
> >> > 3 hours and you need to be banging hard, but the race is obvious
> >> > by looking at the code.
> >> >
> >> > This should only affect those who use this caller, which currently
> >> > is ath5k, ath9k, and ar9170.
> >> >
> >> > EIP: 0060:[<f8ebec50>] EFLAGS: 00210282 CPU: 1
> >> > EIP is at freq_reg_info_regd+0x24/0x121 [cfg80211]
> >>
> >> This looks like the same bug I reported seeing on bootup (100% of the
> >> time).  I'll test wireless-testing again for V9 of the rfkill rewrite,
> >> so at that point I'll try to confirm that this patch fixes my problem.
> >
> > Any luck?
> 
> Ugh, sorry, I can't reproduce it to test the patch.
> 
> I reported that it went away after making CFG80211 built-in, but I
> can't get it back now, even if I turn that back into a module.  Maybe
> I overwrote the original config, or maybe I was being dumb and it only
> happened once in the first place.  I'm confident I'm using the same
> source code (v2.6.30-rc2-21665-gca0be26, clean tree), so that's not
> it.

I don't think its easy to reproduce. Anyway thanks for testing.

  Luis