[kernel/f20] Fix locking issue in iwldvm (rhbz 1046495)

[Josh Boyer]

commit 873a763e63a6b4396e7ce7284771fc29680195ff
Author: Josh Boyer <jwboyer at fedoraproject.org>
Date:   Wed Mar 12 09:26:17 2014 -0400

    Fix locking issue in iwldvm (rhbz 1046495)

 ...mutex-when-sending-SYNC-BT-config-command.patch |   48 ++++++++++++++++++++
 kernel.spec                                        |    9 ++++
 2 files changed, 57 insertions(+), 0 deletions(-)
---
diff --git a/iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch b/iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch
new file mode 100644
index 0000000..ee06d9f
--- /dev/null
+++ b/iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch
@@ -0,0 +1,48 @@
+Bugzilla: 1046495
+Upstream-status: Sent for 3.14 http://marc.info/?l=linux-wireless&m=139453882510796&w=2
+
+From: Emmanuel Grumbach <emmanuel.grumbach at intel.com>
+
+There is a flow in which we send the host command in SYNC
+mode, but we don't take priv->mutex.
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1046495
+
+Cc: <stable at vger.kernel.org>
+Reviewed-by: Johannes Berg <johannes.berg at intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach at intel.com>
+---
+ drivers/net/wireless/iwlwifi/dvm/main.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
+index ba1b1ea..ea7e70c 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/main.c
++++ b/drivers/net/wireless/iwlwifi/dvm/main.c
+@@ -252,13 +252,17 @@ static void iwl_bg_bt_runtime_config(struct work_struct *work)
+ 	struct iwl_priv *priv =
+ 		container_of(work, struct iwl_priv, bt_runtime_config);
+ 
++	mutex_lock(&priv->mutex);
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+-		return;
++		goto out;
+ 
+ 	/* dont send host command if rf-kill is on */
+ 	if (!iwl_is_ready_rf(priv))
+-		return;
++		goto out;
++
+ 	iwlagn_send_advance_bt_config(priv);
++out:
++	mutex_unlock(&priv->mutex);
+ }
+ 
+ static void iwl_bg_bt_full_concurrency(struct work_struct *work)
+-- 
+1.8.3.2
+
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff --git a/kernel.spec b/kernel.spec
index 146b975..89cf3d0 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -797,6 +797,9 @@ Patch25040: iwlwifi-dvm-clear-IWL_STA_UCODE_INPROGRESS-when-asso.patch
 #CVE-2014-2309 rhbz 1074471 1075064
 Patch25041: ipv6-dont-set-DST_NOCOUNT-for-remotely-added-routes.patch
 
+#rhbz 1046495
+Patch25044: iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1550,6 +1553,9 @@ ApplyPatch iwlwifi-dvm-clear-IWL_STA_UCODE_INPROGRESS-when-asso.patch
 #CVE-2014-2309 rhbz 1074471 1075064
 ApplyPatch ipv6-dont-set-DST_NOCOUNT-for-remotely-added-routes.patch
 
+#rhbz 1046495
+ApplyPatch iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2361,6 +2367,9 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Wed Mar 12 2014 Josh Boyer <jwboyer at fedoraproject.org>
+- Fix locking issue in iwldvm (rhbz 1046495)
+
 * Tue Mar 11 2014 Josh Boyer <jwboyer at fedoraproject.org>
 - CVE-2014-2309 ipv6: crash due to router advertisment flooding (rhbz 1074471 1075064)