Re: [PATCH] mac80211: Clean up work-queues on disassociation.

[Stanislaw Gruszka <sgruszka@redhat.com>]

On Tue, Feb 19, 2013 at 06:11:07PM -0800, greearb@candelatech.com wrote:
> From: Ben Greear <greearb@candelatech.com>
> 
> The monitor_work and beacon_connection_loss_work items were
> not being canceled on disassociation (and not on deletion
> either).  This leads to work-items trying to run after memory
> has been deleted.
> 
> I could not find a cleaner way to do this because the
> cancel_work_sync for these items must be done outside
> of the ifmgd->mtx.
> 
> In addition, re-order the quiesce code so that timers are
> always stopped before work-items are flushed.  This was
> not the problem I saw, but I think it may still be more
> correct.

I think this patch is quite complicated and simpler solution
can be used. We stop timers on disassociate, and since
we nullify ifmgd->associated under ifmgd->mtx, work procedures
will perform no action. The only thing we should care are works
queued to workqueue internals, and stop them before we remove
the interface, to stop workqueue code to use our freed
ifmgd->*_work data.

Regarding quiesce, I'm working on suspend/resume changes where this
function become not necessary, so I'll remove it.

Below is alternative fix proposition for the problem.

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index bdddb0b..15a24214 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3992,6 +3992,17 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
 {
 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
+	/*
+	 * We canceled timers during disassoc, but works still can be pending.
+	 * Even if we they do not perform action when unassociated, we should
+	 * assure we stop them, before freeing resources.
+	 */
+	cancel_work_sync(&ifmgd->request_smps_work);
+	cancel_work_sync(&ifmgd->monitor_work);
+	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
+	cancel_work_sync(&ifmgd->csa_connection_drop_work);
+	cancel_work_sync(&ifmgd->chswitch_work);
+
 	mutex_lock(&ifmgd->mtx);
 	if (ifmgd->assoc_data)
 		ieee80211_destroy_assoc_data(sdata, false);
-- 
1.7.11.7