linux-stable.git/net/mac80211, branch v3.3.3

mac80211: fix possible tid_rx->reorder_timer use after free

2012-04-13T16:13:52+00:00

commit d72308bff5c2fa207949a5925b020bce74495e33 upstream.

Is possible that we will arm the tid_rx->reorder_timer after
del_timer_sync() in ___ieee80211_stop_rx_ba_session(). We need to stop
timer after RCU grace period finish, so move it to
ieee80211_free_tid_rx(). Timer will not be armed again, as
rcu_dereference(sta->ampdu_mlme.tid_rx[tid]) will return NULL.

Debug object detected problem with the following warning:
ODEBUG: free active (active state 0) object type: timer_list hint: sta_rx_agg_reorder_timer_expired+0x0/0xf0 [mac80211]

Bug report (with all warning messages):
https://bugzilla.redhat.com/show_bug.cgi?id=804007

Reported-by: "jan p. springer" 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: Fix a warning on changing to monitor mode from STA

2012-02-21T19:45:27+00:00

nothing needs to be done for monitor/AP_VLAN mode on calling
ieee80211_bss_info_change_notify -> drv_bss_info_changed with the change
flag 'BSS_CHANGED_IDLE'. 'wl1271' seems to use BSS_CHANGED_IDLE only for
STA and IBSS mode. further the non-idle state of the monitor mode is
taken care by the 'count' variable which counts non-idle interfaces.
ieee80211_idle_off(local, "in use") will be called.
this fixes the following WARNING when we have initially STA mode
(network manager running) and not associated, and change it to monitor
mode with network manager disabled and bringing up the monitor mode.
this changes the idle state from 'true' (STA unassociated) to 'false'
(MONITOR mode)
exposed by the commit 405385f8ce7a2ed8f82e216d88b5282142e1288b
"mac80211: set bss_conf.idle when vif is connected"

	WARNING: net/mac80211/main.c:212
	ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]()
	Hardware name: 64756D6
	Pid: 3835, comm: ifconfig Tainted: G           O
	3.3.0-rc3-wl #9
	Call Trace:
	  [] warn_slowpath_common+0x72/0xa0
	  [] ?
	  ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]
	  [] ?
	  ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]
	  [] warn_slowpath_null+0x22/0x30
	  []
	  ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]
	  [] __ieee80211_recalc_idle+0x113/0x430
	  [mac80211]
	  [] ieee80211_do_open+0x156/0x7e0 [mac80211]
	  [] ?
	  ieee80211_check_concurrent_iface+0x25/0x180 [mac80211]
	  [] ? raw_notifier_call_chain+0x1f/0x30
	  [] ieee80211_open+0x40/0x80 [mac80211]
	  [] __dev_open+0x96/0xe0
	  [] ? _raw_spin_unlock_bh+0x35/0x40
	  [] __dev_change_flags+0x109/0x170
	  [] dev_change_flags+0x23/0x60
	  [] devinet_ioctl+0x6a0/0x770

 ieee80211 phy0: device no longer idle - in use

Cc: Eliad Peller 
Signed-off-by: Mohammed Shafi Shajakhan 
Signed-off-by: John W. Linville

mac80211: zero initialize count field in ieee80211_tx_rate

2012-02-21T19:45:26+00:00

rate control algorithms concludes the rate as invalid
with rate[i].idx < -1 , while they do also check for rate[i].count is
non-zero. it would be safer to zero initialize the 'count' field.
recently we had a ath9k rate control crash where the ath9k rate control
in ath_tx_status assumed to check only for rate[i].count being non-zero
in one instance and ended up in using invalid rate index for
'connection monitoring NULL func frames' which eventually lead to the crash.
thanks to Pavel Roskin for fixing it and finding the root cause.
https://bugzilla.redhat.com/show_bug.cgi?id=768639

Cc: stable@vger.kernel.org
Cc: Pavel Roskin 
Signed-off-by: Mohammed Shafi Shajakhan 
Signed-off-by: John W. Linville

mac80211: do not call rate control .tx_status before .rate_init

2012-02-15T18:56:06+00:00

Most rate control implementations assume .get_rate and .tx_status are only
called once the per-station data has been fully initialized.
minstrel_ht crashes if this assumption is violated.

Signed-off-by: Felix Fietkau 
Tested-by: Arend van Spriel 
Signed-off-by: John W. Linville

mac80211: call rate control only after init

2012-02-15T18:56:06+00:00

There are situations where we don't have the
necessary rate control information yet for
station entries, e.g. when associating. This
currently doesn't really happen due to the
dummy station handling; explicitly disabling
rate control when it's not initialised will
allow us to remove dummy stations.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: Fix a rwlock bad magic bug

2012-02-09T20:16:04+00:00

read_lock(&tpt_trig->trig.leddev_list_lock) is accessed via the path
ieee80211_open (->) ieee80211_do_open (->) ieee80211_mod_tpt_led_trig
(->) ieee80211_start_tpt_led_trig (->) tpt_trig_timer before initializing
it.
the intilization of this read/write lock happens via the path
ieee80211_led_init (->) led_trigger_register, but we are doing
'ieee80211_led_init'  after 'ieeee80211_if_add' where we
register netdev_ops.
so we access leddev_list_lock before initializing it and causes the
following bug in chrome laptops with AR928X cards with the following
script

while true
do
sudo modprobe -v ath9k
sleep 3
sudo modprobe -r ath9k
sleep 3
done

	BUG: rwlock bad magic on CPU#1, wpa_supplicant/358, f5b9eccc
	Pid: 358, comm: wpa_supplicant Not tainted 3.0.13 #1
	Call Trace:

	[<8137b9df>] rwlock_bug+0x3d/0x47
	[<81179830>] do_raw_read_lock+0x19/0x29
	[<8137f063>] _raw_read_lock+0xd/0xf
	[] tpt_trig_timer+0xc3/0x145 [mac80211]
	[] ieee80211_mod_tpt_led_trig+0x152/0x174 [mac80211]
	[] ieee80211_do_open+0x11e/0x42e [mac80211]
	[] ? ieee80211_check_concurrent_iface+0x26/0x13c [mac80211]
	[] ieee80211_open+0x48/0x4c [mac80211]
	[<812dbed8>] __dev_open+0x82/0xab
	[<812dc0c9>] __dev_change_flags+0x9c/0x113
	[<812dc1ae>] dev_change_flags+0x18/0x44
	[<8132144f>] devinet_ioctl+0x243/0x51a
	[<81321ba9>] inet_ioctl+0x93/0xac
	[<812cc951>] sock_ioctl+0x1c6/0x1ea
	[<812cc78b>] ? might_fault+0x20/0x20
	[<810b1ebb>] do_vfs_ioctl+0x46e/0x4a2
	[<810a6ebb>] ? fget_light+0x2f/0x70
	[<812ce549>] ? sys_recvmsg+0x3e/0x48
	[<810b1f35>] sys_ioctl+0x46/0x69
	[<8137fa77>] sysenter_do_call+0x12/0x2

Cc: 
Cc: Gary Morain 
Cc: Paul Stewart 
Cc: Abhijit Pradhan 
Cc: Vasanthakumar Thiagarajan 
Cc: Rajkumar Manoharan 
Acked-by: Johannes Berg 
Tested-by: Mohammed Shafi Shajakhan 
Signed-off-by: Mohammed Shafi Shajakhan 
Signed-off-by: John W. Linville

mac80211: timeout a single frame in the rx reorder buffer

2012-02-01T20:26:00+00:00

The current code checks for stored_mpdu_num > 1, causing
the reorder_timer to be triggered indefinitely, but the
frame is never timed-out (until the next packet is received)

Signed-off-by: Eliad Peller 
Cc: 
Acked-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: set bss_conf.idle when vif is connected

2012-01-24T19:47:09+00:00

__ieee80211_recalc_idle() iterates through the vifs,
sets bss_conf.idle = true if they are disconnected,
and increases "count" if they are not (which later
gets evaluated in order to determine whether the
device is idle).

However, the loop doesn't set bss_conf.idle = false
(along with increasing "count"), causing the device
idle state and the vif idle state to get out of sync
in some cases.

Signed-off-by: Eliad Peller 
Signed-off-by: John W. Linville

mac80211: update oper_channel on ibss join

2012-01-24T19:47:09+00:00

Commit 13c40c5 ("mac80211: Add HT operation modes for IBSS") broke
ibss operation by mistakenly removing the local->oper_channel
update (causing ibss to start on the wrong channel). fix it.

Signed-off-by: Eliad Peller 
Acked-by: Simon Wunderlich 
Signed-off-by: John W. Linville

mac80211: fix work removal on deauth request

2012-01-18T19:38:06+00:00

When deauth is requested while an auth or assoc
work item is in progress, we currently delete it
without regard for any state it might need to
clean up. Fix it by cleaning up for those items.

In the case Pontus found, the problem manifested
itself as such:

authenticate with 00:23:69:aa:dd:7b (try 1)
authenticated
failed to insert Dummy STA entry for the AP (error -17)
deauthenticating from 00:23:69:aa:dd:7b by local choice (reason=2)

It could also happen differently if the driver
uses the tx_sync callback.

We can't just call the ->done() method of the work
items because that will lock up due to the locking
in cfg80211. This fix isn't very clean, but that
seems acceptable since I have patches pending to
remove this code completely.

Cc: stable@vger.kernel.org
Reported-by: Pontus Fuchs 
Tested-by: Pontus Fuchs 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville