[PATCH] d80211: fix softlockup in hw_scan card when rmmod

[PATCH] d80211: fix softlockup in hw_scan card when rmmod

[Hong Liu]

The local->scan_work.data is not clear after scan is completed.

This will cause softlockup when removing driver module because 
the local->scan_work is not initialized for hw_scan card
and we are trying to cancel the scan_work with an uninitialized timer_list.



Signed-off-by: Hong Liu <hong.liu@intel.com>

diff --git a/net/d80211/ieee80211.c b/net/d80211/ieee80211.c
diff --git a/net/d80211/ieee80211_sta.c b/net/d80211/ieee80211_sta.c
index 507d071..3b55427 100644
--- a/net/d80211/ieee80211_sta.c
+++ b/net/d80211/ieee80211_sta.c
@@ -3641,6 +3641,7 @@ void ieee80211_scan_completed(struct iee
 	printk(KERN_DEBUG "%s: scan completed\n", dev->name);
 	spin_lock_bh(&local->ifsta_data_lock);
 	local->sta_scanning = 0;
+	local->scan_work.data = NULL;
 	local->last_scan_completed = jiffies;
 	spin_unlock_bh(&local->ifsta_data_lock);
 

Re: [PATCH] d80211: fix softlockup in hw_scan card when rmmod

[Jiri Benc]

On Wed, 20 Dec 2006 14:43:51 +0800, Hong Liu wrote:
> The local->scan_work.data is not clear after scan is completed.
> 
> This will cause softlockup when removing driver module because 
> the local->scan_work is not initialized for hw_scan card
> and we are trying to cancel the scan_work with an uninitialized timer_list.

I think this is a better fix:
---
Subject: [PATCH] d80211: do not cancel uninitialized work

When ops->hw_scan is set, scan_work is never initialized thus canceling it
causes weird problems.

Signed-off-by: Jiri Benc <jbenc@suse.cz>

---
 net/d80211/ieee80211.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

--- dscape.orig/net/d80211/ieee80211.c
+++ dscape/net/d80211/ieee80211.c
@@ -2082,7 +2082,8 @@ void ieee80211_if_shutdown(struct net_de
 	case IEEE80211_IF_TYPE_IBSS:
 		sdata->u.sta.state = IEEE80211_DISABLED;
 		cancel_delayed_work(&sdata->u.sta.work);
-		if (local->scan_work.data == sdata->dev) {
+		if (!local->ops->hw_scan &&
+		    local->scan_work.data == sdata->dev) {
 			local->sta_scanning = 0;
 			cancel_delayed_work(&local->scan_work);
 			flush_scheduled_work();
@@ -4660,7 +4661,7 @@ void ieee80211_unregister_hw(struct ieee
 
 	if (local->stat_time)
 		del_timer_sync(&local->stat_timer);
-	if (local->scan_work.data) {
+	if (!local->ops->hw_scan && local->scan_work.data) {
 		local->sta_scanning = 0;
 		cancel_delayed_work(&local->scan_work);
 		flush_scheduled_work();


Thanks,

 Jiri

-- 
Jiri Benc
SUSE Labs