[kernel/f18] Fix workqueue crash in mac80211 (rhbz 920218)

[Josh Boyer]

commit bf0fa1e0bc5cf81d0eba48419606ff87f6b116e5
Author: Josh Boyer <jwboyer at redhat.com>
Date:   Thu Mar 21 09:04:30 2013 -0400

    Fix workqueue crash in mac80211 (rhbz 920218)

 kernel.spec                                        |   11 ++++-
 ...211-Dont-restart-sta-timer-if-not-running.patch |   55 ++++++++++++++++++++
 2 files changed, 65 insertions(+), 1 deletions(-)
---
diff --git a/kernel.spec b/kernel.spec
index 8f4fdb8..7118f86 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -62,7 +62,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 201
+%global baserelease 202
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -789,6 +789,9 @@ Patch25004: 0002-KVM-x86-fix-for-buffer-overflow-in-handling-of-MSR_K.patch
 #CVE-2013-1797 rhbz 917013 923967
 Patch25005: 0003-KVM-x86-Convert-MSR_KVM_SYSTEM_TIME-to-use-gfn_to_hv.patch
 
+#rhbz 920218
+Patch25006: mac80211-Dont-restart-sta-timer-if-not-running.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1528,6 +1531,9 @@ ApplyPatch 0002-KVM-x86-fix-for-buffer-overflow-in-handling-of-MSR_K.patch
 #CVE-2013-1797 rhbz 917013 923967
 ApplyPatch 0003-KVM-x86-Convert-MSR_KVM_SYSTEM_TIME-to-use-gfn_to_hv.patch
 
+#rhbz 920218
+ApplyPatch mac80211-Dont-restart-sta-timer-if-not-running.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2385,6 +2391,9 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Thu Mar 21 2013 Josh Boyer <jwboyer at redhat.com>
+- Fix workqueue crash in mac80211 (rhbz 920218)
+
 * Thu Mar 21 2013 Peter Robinson <pbrobinson at fedoraproject.org>
 - Minor ARM config updates
 
diff --git a/mac80211-Dont-restart-sta-timer-if-not-running.patch b/mac80211-Dont-restart-sta-timer-if-not-running.patch
new file mode 100644
index 0000000..7727ad8
--- /dev/null
+++ b/mac80211-Dont-restart-sta-timer-if-not-running.patch
@@ -0,0 +1,55 @@
+From: Ben Greear <greearb at candelatech.com>
+
+I found another crash when deleting lots of virtual stations
+in a congested environment.  I think the problem is that
+the ieee80211_mlme_notify_scan_completed could call
+ieee80211_restart_sta_timer for a stopped interface
+that was about to be deleted.  Fix similar problem for
+mesh interfaces as well.
+
+Signed-off-by: Ben Greear <greearb at candelatech.com>
+---
+v4:  Fix up mesh as well, add check in calling code instead of
+    in the methods that mucks iwth the timers.
+
+:100644 100644 67fcfdf... 02e3d75... M	net/mac80211/mesh.c
+:100644 100644 aec786d... 1d237e9... M	net/mac80211/mlme.c
+ net/mac80211/mesh.c |    3 ++-
+ net/mac80211/mlme.c |    3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index 67fcfdf..02e3d75 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -779,7 +779,8 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
+ 
+ 	rcu_read_lock();
+ 	list_for_each_entry_rcu(sdata, &local->interfaces, list)
+-		if (ieee80211_vif_is_mesh(&sdata->vif))
++		if (ieee80211_sdata_running(sdata)
++		    && ieee80211_vif_is_mesh(&sdata->vif))
+ 			ieee80211_queue_work(&local->hw, &sdata->work);
+ 	rcu_read_unlock();
+ }
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index aec786d..1d237e9 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3054,7 +3054,8 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
+ 	/* Restart STA timers */
+ 	rcu_read_lock();
+ 	list_for_each_entry_rcu(sdata, &local->interfaces, list)
+-		ieee80211_restart_sta_timer(sdata);
++		if (ieee80211_sdata_running(sdata))
++			ieee80211_restart_sta_timer(sdata);
+ 	rcu_read_unlock();
+ }
+ 
+-- 
+1.7.3.4
+
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
\ No newline at end of file