linux.git/net/mac80211, branch v3.3-rc4

mac80211: Fix a rwlock bad magic bug

2012-02-09T20:16:04+00:00

read_lock(&tpt_trig->trig.leddev_list_lock) is accessed via the path
ieee80211_open (->) ieee80211_do_open (->) ieee80211_mod_tpt_led_trig
(->) ieee80211_start_tpt_led_trig (->) tpt_trig_timer before initializing
it.
the intilization of this read/write lock happens via the path
ieee80211_led_init (->) led_trigger_register, but we are doing
'ieee80211_led_init'  after 'ieeee80211_if_add' where we
register netdev_ops.
so we access leddev_list_lock before initializing it and causes the
following bug in chrome laptops with AR928X cards with the following
script

while true
do
sudo modprobe -v ath9k
sleep 3
sudo modprobe -r ath9k
sleep 3
done

	BUG: rwlock bad magic on CPU#1, wpa_supplicant/358, f5b9eccc
	Pid: 358, comm: wpa_supplicant Not tainted 3.0.13 #1
	Call Trace:

	[<8137b9df>] rwlock_bug+0x3d/0x47
	[<81179830>] do_raw_read_lock+0x19/0x29
	[<8137f063>] _raw_read_lock+0xd/0xf
	[] tpt_trig_timer+0xc3/0x145 [mac80211]
	[] ieee80211_mod_tpt_led_trig+0x152/0x174 [mac80211]
	[] ieee80211_do_open+0x11e/0x42e [mac80211]
	[] ? ieee80211_check_concurrent_iface+0x26/0x13c [mac80211]
	[] ieee80211_open+0x48/0x4c [mac80211]
	[<812dbed8>] __dev_open+0x82/0xab
	[<812dc0c9>] __dev_change_flags+0x9c/0x113
	[<812dc1ae>] dev_change_flags+0x18/0x44
	[<8132144f>] devinet_ioctl+0x243/0x51a
	[<81321ba9>] inet_ioctl+0x93/0xac
	[<812cc951>] sock_ioctl+0x1c6/0x1ea
	[<812cc78b>] ? might_fault+0x20/0x20
	[<810b1ebb>] do_vfs_ioctl+0x46e/0x4a2
	[<810a6ebb>] ? fget_light+0x2f/0x70
	[<812ce549>] ? sys_recvmsg+0x3e/0x48
	[<810b1f35>] sys_ioctl+0x46/0x69
	[<8137fa77>] sysenter_do_call+0x12/0x2

Cc: 
Cc: Gary Morain 
Cc: Paul Stewart 
Cc: Abhijit Pradhan 
Cc: Vasanthakumar Thiagarajan 
Cc: Rajkumar Manoharan 
Acked-by: Johannes Berg 
Tested-by: Mohammed Shafi Shajakhan 
Signed-off-by: Mohammed Shafi Shajakhan 
Signed-off-by: John W. Linville

mac80211: timeout a single frame in the rx reorder buffer

2012-02-01T20:26:00+00:00

The current code checks for stored_mpdu_num > 1, causing
the reorder_timer to be triggered indefinitely, but the
frame is never timed-out (until the next packet is received)

Signed-off-by: Eliad Peller 
Cc: 
Acked-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: set bss_conf.idle when vif is connected

2012-01-24T19:47:09+00:00

__ieee80211_recalc_idle() iterates through the vifs,
sets bss_conf.idle = true if they are disconnected,
and increases "count" if they are not (which later
gets evaluated in order to determine whether the
device is idle).

However, the loop doesn't set bss_conf.idle = false
(along with increasing "count"), causing the device
idle state and the vif idle state to get out of sync
in some cases.

Signed-off-by: Eliad Peller 
Signed-off-by: John W. Linville

mac80211: update oper_channel on ibss join

2012-01-24T19:47:09+00:00

Commit 13c40c5 ("mac80211: Add HT operation modes for IBSS") broke
ibss operation by mistakenly removing the local->oper_channel
update (causing ibss to start on the wrong channel). fix it.

Signed-off-by: Eliad Peller 
Acked-by: Simon Wunderlich 
Signed-off-by: John W. Linville

mac80211: fix work removal on deauth request

2012-01-18T19:38:06+00:00

When deauth is requested while an auth or assoc
work item is in progress, we currently delete it
without regard for any state it might need to
clean up. Fix it by cleaning up for those items.

In the case Pontus found, the problem manifested
itself as such:

authenticate with 00:23:69:aa:dd:7b (try 1)
authenticated
failed to insert Dummy STA entry for the AP (error -17)
deauthenticating from 00:23:69:aa:dd:7b by local choice (reason=2)

It could also happen differently if the driver
uses the tx_sync callback.

We can't just call the ->done() method of the work
items because that will lock up due to the locking
in cfg80211. This fix isn't very clean, but that
seems acceptable since I have patches pending to
remove this code completely.

Cc: stable@vger.kernel.org
Reported-by: Pontus Fuchs 
Tested-by: Pontus Fuchs 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: Use the right headroom size for mesh mgmt frames

2012-01-18T19:38:06+00:00

Use local->tx_headroom instad of local->hw.extra_tx_headroom.
local->tx_headroom is the max of hw.extra_tx_headroom required by the
driver and the headroom required by mac80211 for status reporting.  On
drivers where hw.extra_tx_headroom is smaller than what mac80211
requires (e.g. ath5k), we would not reserve sufficient buffer space to
report tx status.

Also, don't reserve local->tx_headroom + local->hw.extra_tx_headroom.

Reported-by: Simon Morgenthaler 
Reported-by: Kai Scharwies 
Signed-off-by: Javier Cardona 
Signed-off-by: John W. Linville

mac80211: fix debugfs key->station symlink

2012-01-18T19:38:05+00:00

Since stations moved into a virtual interface
subdirectory, this link has been broken. Fix it.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: Fix possible race between sta_unblock and network softirq

2012-01-17T15:12:27+00:00

All other code paths in sta_unblock synchronize with the network
softirq by using local_bh_disable/enable. Do the same around
ieee80211_sta_ps_deliver_wakeup.

Signed-off-by: Helmut Schaa 
Signed-off-by: John W. Linville

mac80211: fix tx->skb NULL pointer dereference

2012-01-16T20:01:16+00:00

In function ieee80211_tx_h_encrypt the var info was
initialized from tx->skb, since the fucntion
is called after the function ieee80211_tx_h_fragment
tx->skb is not valid anymore.

Signed-off-by: Yoni Divinsky 
Signed-off-by: John W. Linville

Net, mac80211: Fix resource leak in ieee80211_rx_h_mesh_fwding()

2012-01-16T20:01:15+00:00

We may leak the 'fwd_skb' we skb_copy() in ieee80211_rx_h_mesh_fwding() if
we take the 'else' branch in the 'if' statement just below. If we take
that branch we'll end up returning from the function and since we've not
assigned 'fwd_skb' to anything at that point, we leak it when the variable
goes out of scope.

The simple fix seems to be to just kfree_skb(fwd_skb); just before we
return. That is what this patch does.

Signed-off-by: Jesper Juhl 
Signed-off-by: John W. Linville