linux-stable.git/net/wireless/scan.c, branch v3.14

cfg80211: send scan results from work queue

2014-02-06T08:55:19+00:00

Due to the previous commit, when a scan finishes, it is in theory
possible to hit the following sequence:
 1. interface starts being removed
 2. scan is cancelled by driver and cfg80211 is notified
 3. scan done work is scheduled
 4. interface is removed completely, rdev->scan_req is freed,
    event sent to userspace but scan done work remains pending
 5. new scan is requested on another virtual interface
 6. scan done work runs, freeing the still-running scan

To fix this situation, hang on to the scan done message and block
new scans while that is the case, and only send the message from
the work function, regardless of whether the scan_req is already
freed from interface removal. This makes step 5 above impossible
and changes step 6 to be
 5. scan done work runs, sending the scan done message

As this can't work for wext, so we send the message immediately,
but this shouldn't be an issue since we still return -EBUSY.

Signed-off-by: Johannes Berg

cfg80211: Add a function to get the number of supported channels

2014-01-09T13:24:24+00:00

Add a utility function to get the number of channels supported by
the device, and update the places in the code that need this data.

Signed-off-by: Ilan Peer 
[replace another occurrence in libertas, fix kernel-doc, fix bugs]
Signed-off-by: Johannes Berg

cfg80211: don't "leak" uncompleted scans

2013-12-05T18:06:47+00:00

___cfg80211_scan_done() can be called in some cases
(e.g. on NETDEV_DOWN) before the low level driver
notified scan completion (which is indicated by
passing leak=true).

Clearing rdev->scan_req in this case is buggy, as
scan_done_wk might have already being queued/running
(and can't be flushed as it takes rtnl()).

If a new scan will be requested at this stage, the
scan_done_wk will try freeing it (instead of the
previous scan), and this will later result in
a use after free.

Simply remove the "leak" option, and replace it with
a standard WARN_ON.

An example backtrace after such crash:
Unable to handle kernel paging request at virtual address fffffee5
pgd = c0004000
[fffffee5] *pgd=9fdf6821, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] SMP ARM
PC is at cfg80211_scan_done+0x28/0xc4 [cfg80211]
LR is at __ieee80211_scan_completed+0xe4/0x2dc [mac80211]
[] (cfg80211_scan_done+0x28/0xc4 [cfg80211])
[] (__ieee80211_scan_completed+0xe4/0x2dc [mac80211])
[] (ieee80211_scan_work+0x94/0x4f0 [mac80211])
[] (process_one_work+0x1b0/0x4a8)
[] (worker_thread+0x138/0x37c)
[] (kthread+0xa4/0xb0)

Signed-off-by: Eliad Peller 
Signed-off-by: Johannes Berg

cfg80211: fix scheduled scan pointer access

2013-10-21T09:59:15+00:00

Since rdev->sched_scan_req is dereferenced outside the
lock protecting it, this might be done at the wrong
time, causing crashes. Move the dereference to where
it should be - inside the RTNL locked section.

Cc: stable@vger.kernel.org [3.8+]
Reviewed-by: Emmanuel Grumbach 
Signed-off-by: Johannes Berg

wireless: scan: Remove comment to compare_ether_addr

2013-09-04T02:34:48+00:00

This function is being removed, so remove the reference to it.

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

nl80211: add scan width to bss and scan request structs

2013-07-16T06:58:01+00:00

To allow scanning and working with 5 MHz and 10 MHz BSS, extend the
inform bss commands and add wrappers to take 5 and 10 MHz bss into
account.

Signed-off-by: Simon Wunderlich 
Signed-off-by: Mathias Kretschmer 
Signed-off-by: Johannes Berg

wireless: add comments about bss refcounting

2013-06-24T13:54:45+00:00

Should help the next person that tries to understand
the bss refcounting logic.

Signed-off-by: Ben Greear 
Signed-off-by: Johannes Berg

cfg80211: vastly simplify locking

2013-05-24T22:02:15+00:00

Virtually all code paths in cfg80211 already (need to) hold
the RTNL. As such, there's little point in having another
four mutexes for various parts of the code, they just cause
lock ordering issues (and much of the time, the RTNL and a
few of the others need thus be held.)

Simplify all this by getting rid of the extra four mutexes
and just use the RTNL throughout. Only a few code changes
were needed to do this and we can get rid of a work struct
for bonus points.

Signed-off-by: Johannes Berg

cfg80211: move cfg80211_get_dev_from_ifindex under wext

2013-05-24T22:02:13+00:00

The function is only used and needed by the wext code
for scanning, so move it there.

Signed-off-by: Johannes Berg

cfg80211: always check for scan end on P2P device

2013-03-24T10:15:58+00:00

If a P2P device wdev is removed while it has a scan, then the
scan completion might crash later as it is already freed by
that time. To avoid the crash always check the scan completion
when the P2P device is being removed for some reason. If the
driver already canceled it, don't want and free it, otherwise
warn and leak it to avoid later crashes.

In order to do this, locking needs to be changed away from the
rdev mutex (which can't always be guaranteed). For now, use
the sched_scan_mtx instead, I'll rename it to just scan_mtx in
a later patch.

Signed-off-by: Johannes Berg