[kernel] Fix locking issue in iwldvm (rhbz 1046495)

[Josh Boyer]

commit 196742ef065a645c51af71086e9cbc71a407c94b
Author: Josh Boyer <jwboyer at fedoraproject.org>
Date:   Wed Mar 12 09:26:17 2014 -0400

    Fix locking issue in iwldvm (rhbz 1046495)

 ...mutex-when-sending-SYNC-BT-config-command.patch |   48 ++++++++++++++++++++
 kernel.spec                                        |    7 +++
 2 files changed, 55 insertions(+), 0 deletions(-)
---
diff --git a/iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch b/iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch
new file mode 100644
index 0000000..ee06d9f
--- /dev/null
+++ b/iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch
@@ -0,0 +1,48 @@
+Bugzilla: 1046495
+Upstream-status: Sent for 3.14 http://marc.info/?l=linux-wireless&m=139453882510796&w=2
+
+From: Emmanuel Grumbach <emmanuel.grumbach at intel.com>
+
+There is a flow in which we send the host command in SYNC
+mode, but we don't take priv->mutex.
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1046495
+
+Cc: <stable at vger.kernel.org>
+Reviewed-by: Johannes Berg <johannes.berg at intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach at intel.com>
+---
+ drivers/net/wireless/iwlwifi/dvm/main.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
+index ba1b1ea..ea7e70c 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/main.c
++++ b/drivers/net/wireless/iwlwifi/dvm/main.c
+@@ -252,13 +252,17 @@ static void iwl_bg_bt_runtime_config(struct work_struct *work)
+ 	struct iwl_priv *priv =
+ 		container_of(work, struct iwl_priv, bt_runtime_config);
+ 
++	mutex_lock(&priv->mutex);
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+-		return;
++		goto out;
+ 
+ 	/* dont send host command if rf-kill is on */
+ 	if (!iwl_is_ready_rf(priv))
+-		return;
++		goto out;
++
+ 	iwlagn_send_advance_bt_config(priv);
++out:
++	mutex_unlock(&priv->mutex);
+ }
+ 
+ static void iwl_bg_bt_full_concurrency(struct work_struct *work)
+-- 
+1.8.3.2
+
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff --git a/kernel.spec b/kernel.spec
index 11c5f37..cfb4594 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -643,6 +643,9 @@ Patch25036: ppc64le_module_fix.patch
 #CVE-2014-2309 rhbz 1074471 1075064
 Patch25037: ipv6-dont-set-DST_NOCOUNT-for-remotely-added-routes.patch
 
+#rhbz 1046495
+Patch25044: iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1293,6 +1296,9 @@ ApplyPatch ppc64le_module_fix.patch
 #CVE-2014-2309 rhbz 1074471 1075064
 ApplyPatch ipv6-dont-set-DST_NOCOUNT-for-remotely-added-routes.patch
 
+#rhbz 1046495
+ApplyPatch iwlwifi-dvm-take-mutex-when-sending-SYNC-BT-config-command.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2073,6 +2079,7 @@ fi
 #                                    ||     ||
 %changelog
 * Wed Mar 12 2014 Josh Boyer <jwboyer at fedoraproject.org> - 3.14.0-0.rc6.git2.1
+- Fix locking issue in iwldvm (rhbz 1046495)
 - Linux v3.14-rc6-26-g33807f4
 
 * Wed Mar 12 2014 Peter Robinson <pbrobinson at fedoraproject.org>