rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix locking issue in iwldvm (rhbz 1046495)

This commit is contained in:
Josh Boyer 2014-03-12 09:26:17 -04:00
parent 3ed326af21
commit b949453eff
2 changed files with 57 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch Normal file
View File

@ -0,0 +1,48 @@
Bugzilla: 1046495
Upstream-status: Sent for 3.14 http://marc.info/?l=linux-wireless&m=139453882510796&w=2
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
There is a flow in which we send the host command in SYNC
mode, but we don't take priv->mutex.
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1046495
Cc: <stable@vger.kernel.org>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
---
drivers/net/wireless/iwlwifi/dvm/main.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index ba1b1ea..ea7e70c 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -252,13 +252,17 @@ static void iwl_bg_bt_runtime_config(struct work_struct *work)
struct iwl_priv *priv =
container_of(work, struct iwl_priv, bt_runtime_config);
+ mutex_lock(&priv->mutex);
if (test_bit(STATUS_EXIT_PENDING, &priv->status))
- return;
+ goto out;
/* dont send host command if rf-kill is on */
if (!iwl_is_ready_rf(priv))
- return;
+ goto out;
+
iwlagn_send_advance_bt_config(priv);
+out:
+ mutex_unlock(&priv->mutex);
}
static void iwl_bg_bt_full_concurrency(struct work_struct *work)
--
1.8.3.2
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

9
kernel.spec
View File

@ -803,6 +803,9 @@ Patch25040: iwlwifi-dvm-clear-IWL_STA_UCODE_INPROGRESS-when-asso.patch
#CVE-2014-2309 rhbz 1074471 1075064
Patch25041: ipv6-dont-set-DST_NOCOUNT-for-remotely-added-routes.patch
#rhbz 1046495
Patch25044: iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch
# END OF PATCH DEFINITIONS
%endif
@ -1552,6 +1555,9 @@ ApplyPatch iwlwifi-dvm-clear-IWL_STA_UCODE_INPROGRESS-when-asso.patch
#CVE-2014-2309 rhbz 1074471 1075064
ApplyPatch ipv6-dont-set-DST_NOCOUNT-for-remotely-added-routes.patch
#rhbz 1046495
ApplyPatch iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch
# END OF PATCH APPLICATIONS
%endif
@ -2364,6 +2370,9 @@ fi
# and build.
%changelog
* Wed Mar 12 2014 Josh Boyer <jwboyer@fedoraproject.org>
- Fix locking issue in iwldvm (rhbz 1046495)
* Tue Mar 11 2014 Josh Boyer <jwboyer@fedoraproject.org>
- CVE-2014-2309 ipv6: crash due to router advertisment flooding (rhbz 1074471 1075064)