package/kernel/mac80211/patches/317-brcmfmac-Fix-race-condition-in-msgbuf-ioctl-processi.patch

   1 From: Hante Meuleman <meuleman@broadcom.com>
   2 Date: Fri, 6 Mar 2015 18:40:41 +0100
   3 Subject: [PATCH] brcmfmac: Fix race condition in msgbuf ioctl processing.
   4
   5 Msgbuf is using a wait_event_timeout to wait for the response on
   6 an ioctl. The wakeup routine uses waitqueue_active to see if
   7 wait_event_timeout has been called. There is a chance that the
   8 response arrives before wait_event_timeout is called, this
   9 will result in situation that wait_event_timeout never gets
  10 woken again and assumed result will be a timeout. This patch
  11 removes that errornous situation by always setting the
  12 ctl_completed var before checking for queue active.
  13
  14 Reviewed-by: Arend Van Spriel <arend@broadcom.com>
  15 Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
  16 Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
  17 Signed-off-by: Arend van Spriel <arend@broadcom.com>
  18 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  19 ---
  20
  21 --- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
  22 +++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
  23 @@ -481,10 +481,9 @@ static int brcmf_msgbuf_ioctl_resp_wait(
  24
  25  static void brcmf_msgbuf_ioctl_resp_wake(struct brcmf_msgbuf *msgbuf)
  26  {
  27 -       if (waitqueue_active(&msgbuf->ioctl_resp_wait)) {
  28 -               msgbuf->ctl_completed = true;
  29 +       msgbuf->ctl_completed = true;
  30 +       if (waitqueue_active(&msgbuf->ioctl_resp_wait))
  31                 wake_up(&msgbuf->ioctl_resp_wait);
  32 -       }
  33  }
  34
  35