linux-stable.git/net/mac80211, branch v3.5.2

mac80211: cancel mesh path timer

2012-08-15T14:52:47+00:00

commit dd4c9260e7f23f2e951cbfb2726e468c6d30306c upstream.

The mesh path timer needs to be canceled when
leaving the mesh as otherwise it could fire
after the interface has been removed already.

Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

mac80211: fail authentication when AP denied authentication

2012-08-09T15:22:52+00:00

commit dac211ec10d268b9d09000093a9fa2ac1773894f upstream.

ieee80211_rx_mgmt_auth() doesn't handle denied authentication
properly - it authenticates the station and waits for association
(for 5 seconds) instead of failing the authentication.

Fix it by destroying auth_data and bailing out instead.

Signed-off-by: Eliad Peller 
Acked-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix read outside array bounds

2012-08-09T15:22:52+00:00

commit 353d09c6ceedc1cb0c54fe5002c0ca80b6ee6e4f upstream.

ieee802_1d_to_ac is defined as a const int[8],
but the tid parameter has a range from 0 to 15.

Signed-off-by: Christian Lamparter 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix crash with single-queue drivers

2012-08-09T15:22:51+00:00

commit a6f38ac3cc853189705006cc1e0f17ce8467a1df upstream.

Larry (and some others I think) reported that with
single-queue drivers mac80211 crashes when waking
the queues. This happens because we allocate just
a single queue for each virtual interface in case
the driver doesn't have at least 4 queues, but the
code stopping/waking the virtual interface queues
wasn't taking this into account.

Reported-by: Larry Finger 
Tested-by: Larry Finger 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

mac80211: destroy assoc_data correctly if assoc fails

2012-07-09T19:01:00+00:00

If association failed due to internal error (e.g. no
supported rates IE), we call ieee80211_destroy_assoc_data()
with assoc=true, while we actually reject the association.

This results in the BSSID not being zeroed out.

After passing assoc=false, we no longer have to call
sta_info_destroy_addr() explicitly. While on it, move
the "associated" message after the assoc_success check.

Cc: stable@vger.kernel.org [3.4+]
Signed-off-by: Eliad Peller 
Reviewed-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: correct size the argument to kzalloc in minstrel_ht

2012-07-09T18:59:58+00:00

msp has type struct minstrel_ht_sta_priv not struct minstrel_ht_sta.

(This incorporates the fixup originally posted as "mac80211: fix kzalloc
memory corruption introduced in minstrel_ht". -- JWL)

Reported-by: Fengguang Wu 
Reported-by: Dan Carpenter 
Signed-off-by: Thomas Huehn 
Acked-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: correct behaviour on unrecognised action frames

2012-06-27T18:48:13+00:00

When receiving an "individually addressed" action frame, the
receiver is required to return it to the sender. mac80211
gets this wrong as it also returns group addressed (mcast)
frames to the sender. Fix this and update the reference to
the new 802.11 standards version since things were shuffled
around significantly.

Cc: stable@kernel.org
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: clear ifmgd->bssid only after building DELBA

2012-06-21T19:44:25+00:00

ieee80211_set_disassoc() clears ifmgd->bssid before
building DELBA frames, resulting in frames with invalid
bssid ("00:00:00:00:00:00").

Fix it by clearing ifmgd->bssid only after building
all the needed frames.

After this change, we no longer need to save the
bssid (before clearing it), so remove the local array.

Reported-by: Ido Yariv 
Cc: stable@vger.kernel.org
Signed-off-by: Eliad Peller 
Signed-off-by: Johannes Berg

mac80211: stop polling in disassociation

2012-06-13T08:17:55+00:00

Stop connection monitor poll during disassociation.
This clears the polling flags and if a scan was
deferred it will be run.

Without this fix, if a scan was deferred due to
connection monitoring while disassociation happens,
this scan blocks further scan requests until interface
down/up which causes problems connecting to another AP.

Signed-off-by: David Spinadel 
Signed-off-by: Johannes Berg

mac80211: check sdata_running on ieee80211_set_bitrate_mask

2012-06-13T08:17:54+00:00

Otherwise, we might call the driver callback before
the interface was uploaded.

Solves the following warning:
WARNING: at net/mac80211/driver-ops.h:12 ieee80211_set_bitrate_mask+0xbc/0x18c [mac80211]()
wlan0:  Failed check-sdata-in-driver check, flags: 0x0
Modules linked in: wlcore_sdio wl12xx wl18xx wlcore mac80211 cfg80211 [last unloaded: cfg80211]
[] (unwind_backtrace+0x0/0x12c) from [] (dump_stack+0x20/0x24)
[] (dump_stack+0x20/0x24) from [] (warn_slowpath_common+0x5c/0x74)
[] (warn_slowpath_common+0x5c/0x74) from [] (warn_slowpath_fmt+0x40/0x48)
[] (warn_slowpath_fmt+0x40/0x48) from [] (ieee80211_set_bitrate_mask+0xbc/0x18c [mac80211])
[] (ieee80211_set_bitrate_mask+0xbc/0x18c [mac80211]) from [] (nl80211_set_tx_bitrate_mask+0x350/0x358 [cfg80211])
[] (nl80211_set_tx_bitrate_mask+0x350/0x358 [cfg80211]) from [] (genl_rcv_msg+0x1a8/0x1e8)
[] (genl_rcv_msg+0x1a8/0x1e8) from [] (netlink_rcv_skb+0x5c/0xc0)
[] (netlink_rcv_skb+0x5c/0xc0) from [] (genl_rcv+0x28/0x34)
[] (genl_rcv+0x28/0x34) from [] (netlink_unicast+0x158/0x234)
[] (netlink_unicast+0x158/0x234) from [] (netlink_sendmsg+0x218/0x298)
[] (netlink_sendmsg+0x218/0x298) from [] (sock_sendmsg+0xa4/0xc0)
[] (sock_sendmsg+0xa4/0xc0) from [] (__sys_sendmsg+0x1d8/0x254)
[] (__sys_sendmsg+0x1d8/0x254) from [] (sys_sendmsg+0x4c/0x70)
[] (sys_sendmsg+0x4c/0x70) from [] (ret_fast_syscall+0x0/0x3c)

Note that calling the driver can also result
in undefined behaviour since it doesn't have
to deal with calls while down.

Signed-off-by: Eliad Peller 
[removed timestamps, added note - Johannes]
Signed-off-by: Johannes Berg