<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/net/wireless/core.c, branch v3.14-rc2</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>Merge remote-tracking branch 'wireless-next/master' into mac80211-next</title>
<updated>2013-12-16T10:23:45+00:00</updated>
<author>
<name>Johannes Berg</name>
<email>johannes.berg@intel.com</email>
</author>
<published>2013-12-16T10:23:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=c4de673b775e4db48cd2db6277e0c6714332ca0c'/>
<id>c4de673b775e4db48cd2db6277e0c6714332ca0c</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless</title>
<updated>2013-12-06T14:50:45+00:00</updated>
<author>
<name>John W. Linville</name>
<email>linville@tuxdriver.com</email>
</author>
<published>2013-12-06T14:50:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=e08fd975bf26aa8063cadd245817e042f570472d'/>
<id>e08fd975bf26aa8063cadd245817e042f570472d</id>
<content type='text'>
Conflicts:
	drivers/net/wireless/brcm80211/Kconfig
	net/mac80211/util.c
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Conflicts:
	drivers/net/wireless/brcm80211/Kconfig
	net/mac80211/util.c
</pre>
</div>
</content>
</entry>
<entry>
<title>cfg80211: don't "leak" uncompleted scans</title>
<updated>2013-12-05T18:06:47+00:00</updated>
<author>
<name>Eliad Peller</name>
<email>eliad@wizery.com</email>
</author>
<published>2013-12-05T16:30:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=4a58e7c38443154fce1b47910e1a9184f65c5d72'/>
<id>4a58e7c38443154fce1b47910e1a9184f65c5d72</id>
<content type='text'>
___cfg80211_scan_done() can be called in some cases
(e.g. on NETDEV_DOWN) before the low level driver
notified scan completion (which is indicated by
passing leak=true).

Clearing rdev-&gt;scan_req in this case is buggy, as
scan_done_wk might have already being queued/running
(and can't be flushed as it takes rtnl()).

If a new scan will be requested at this stage, the
scan_done_wk will try freeing it (instead of the
previous scan), and this will later result in
a use after free.

Simply remove the "leak" option, and replace it with
a standard WARN_ON.

An example backtrace after such crash:
Unable to handle kernel paging request at virtual address fffffee5
pgd = c0004000
[fffffee5] *pgd=9fdf6821, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] SMP ARM
PC is at cfg80211_scan_done+0x28/0xc4 [cfg80211]
LR is at __ieee80211_scan_completed+0xe4/0x2dc [mac80211]
[&lt;bf0077b0&gt;] (cfg80211_scan_done+0x28/0xc4 [cfg80211])
[&lt;bf0973d4&gt;] (__ieee80211_scan_completed+0xe4/0x2dc [mac80211])
[&lt;bf0982cc&gt;] (ieee80211_scan_work+0x94/0x4f0 [mac80211])
[&lt;c005fd10&gt;] (process_one_work+0x1b0/0x4a8)
[&lt;c0060404&gt;] (worker_thread+0x138/0x37c)
[&lt;c0066d70&gt;] (kthread+0xa4/0xb0)

Signed-off-by: Eliad Peller &lt;eliad@wizery.com&gt;
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
___cfg80211_scan_done() can be called in some cases
(e.g. on NETDEV_DOWN) before the low level driver
notified scan completion (which is indicated by
passing leak=true).

Clearing rdev-&gt;scan_req in this case is buggy, as
scan_done_wk might have already being queued/running
(and can't be flushed as it takes rtnl()).

If a new scan will be requested at this stage, the
scan_done_wk will try freeing it (instead of the
previous scan), and this will later result in
a use after free.

Simply remove the "leak" option, and replace it with
a standard WARN_ON.

An example backtrace after such crash:
Unable to handle kernel paging request at virtual address fffffee5
pgd = c0004000
[fffffee5] *pgd=9fdf6821, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] SMP ARM
PC is at cfg80211_scan_done+0x28/0xc4 [cfg80211]
LR is at __ieee80211_scan_completed+0xe4/0x2dc [mac80211]
[&lt;bf0077b0&gt;] (cfg80211_scan_done+0x28/0xc4 [cfg80211])
[&lt;bf0973d4&gt;] (__ieee80211_scan_completed+0xe4/0x2dc [mac80211])
[&lt;bf0982cc&gt;] (ieee80211_scan_work+0x94/0x4f0 [mac80211])
[&lt;c005fd10&gt;] (process_one_work+0x1b0/0x4a8)
[&lt;c0060404&gt;] (worker_thread+0x138/0x37c)
[&lt;c0066d70&gt;] (kthread+0xa4/0xb0)

Signed-off-by: Eliad Peller &lt;eliad@wizery.com&gt;
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>cfg80211: stop sched scan only when needed</title>
<updated>2013-12-05T16:15:38+00:00</updated>
<author>
<name>Barak Bercovitz</name>
<email>barak@wizery.com</email>
</author>
<published>2013-12-05T09:21:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=24d584d70e478bf2e815135e8bf60f72685046f7'/>
<id>24d584d70e478bf2e815135e8bf60f72685046f7</id>
<content type='text'>
cfg80211_leave stops sched scan when any station vif
is leaving. Add an explicit check and call it only
when the relevant vif (the one we scan on) is leaving.

Signed-off-by: Barak Bercovitz &lt;barak@wizery.com&gt;
[Eliad - changed the commit message a bit]
Signed-off-by: Eliad Peller &lt;eliad@wizery.com&gt;
[Johannes - add ASSERT_RTNL since that protects the pointer]
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
cfg80211_leave stops sched scan when any station vif
is leaving. Add an explicit check and call it only
when the relevant vif (the one we scan on) is leaving.

Signed-off-by: Barak Bercovitz &lt;barak@wizery.com&gt;
[Eliad - changed the commit message a bit]
Signed-off-by: Eliad Peller &lt;eliad@wizery.com&gt;
[Johannes - add ASSERT_RTNL since that protects the pointer]
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>cfg80211: disable CSA for all drivers</title>
<updated>2013-12-02T10:53:44+00:00</updated>
<author>
<name>Simon Wunderlich</name>
<email>sw@simonwunderlich.de</email>
</author>
<published>2013-11-26T15:07:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=dda444d52496aa8ddc501561bca580f1374a96a9'/>
<id>dda444d52496aa8ddc501561bca580f1374a96a9</id>
<content type='text'>
The channel switch announcement code has some major locking problems
which can cause a deadlock in worst case. A series of fixes has been
proposed, but these are non-trivial and need to be tested first.
Therefore disable CSA completely for 3.13.

Signed-off-by: Simon Wunderlich &lt;sw@simonwunderlich.de&gt;
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The channel switch announcement code has some major locking problems
which can cause a deadlock in worst case. A series of fixes has been
proposed, but these are non-trivial and need to be tested first.
Therefore disable CSA completely for 3.13.

Signed-off-by: Simon Wunderlich &lt;sw@simonwunderlich.de&gt;
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>cfg80211: move regulatory flags to their own variable</title>
<updated>2013-11-25T19:51:46+00:00</updated>
<author>
<name>Luis R. Rodriguez</name>
<email>mcgrof@do-not-panic.com</email>
</author>
<published>2013-11-11T21:15:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=a2f73b6c5db3c272d87eaebb5bed355d75a0f25f'/>
<id>a2f73b6c5db3c272d87eaebb5bed355d75a0f25f</id>
<content type='text'>
We'll expand this later, this will make it easier to
classify and review what things are related to regulatory
or not.

Coccinelle only missed 4 hits, which I had to do manually,
supplying the SmPL in case of merge conflicts.

@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags |= WIPHY_FLAG_CUSTOM_REGULATORY
+wiphy-&gt;regulatory_flags |= REGULATORY_CUSTOM_REG
@@
expression e;
@@
-e-&gt;flags |= WIPHY_FLAG_CUSTOM_REGULATORY
+e-&gt;regulatory_flags |= REGULATORY_CUSTOM_REG
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp;= ~WIPHY_FLAG_CUSTOM_REGULATORY
+wiphy-&gt;regulatory_flags &amp;= ~REGULATORY_CUSTOM_REG
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp; WIPHY_FLAG_CUSTOM_REGULATORY
+wiphy-&gt;regulatory_flags &amp; REGULATORY_CUSTOM_REG

@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags |= WIPHY_FLAG_STRICT_REGULATORY
+wiphy-&gt;regulatory_flags |= REGULATORY_STRICT_REG
@@
expression e;
@@
-e-&gt;flags |= WIPHY_FLAG_STRICT_REGULATORY
+e-&gt;regulatory_flags |= REGULATORY_STRICT_REG
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp;= ~WIPHY_FLAG_STRICT_REGULATORY
+wiphy-&gt;regulatory_flags &amp;= ~REGULATORY_STRICT_REG
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp; WIPHY_FLAG_STRICT_REGULATORY
+wiphy-&gt;regulatory_flags &amp; REGULATORY_STRICT_REG

@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags |= WIPHY_FLAG_DISABLE_BEACON_HINTS
+wiphy-&gt;regulatory_flags |= REGULATORY_DISABLE_BEACON_HINTS
@@
expression e;
@@
-e-&gt;flags |= WIPHY_FLAG_DISABLE_BEACON_HINTS
+e-&gt;regulatory_flags |= REGULATORY_DISABLE_BEACON_HINTS
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp;= ~WIPHY_FLAG_DISABLE_BEACON_HINTS
+wiphy-&gt;regulatory_flags &amp;= ~REGULATORY_DISABLE_BEACON_HINTS
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp; WIPHY_FLAG_DISABLE_BEACON_HINTS
+wiphy-&gt;regulatory_flags &amp; REGULATORY_DISABLE_BEACON_HINTS

Generated-by: Coccinelle SmPL
Cc: Julia Lawall &lt;julia.lawall@lip6.fr&gt;
Cc: Peter Senna Tschudin &lt;peter.senna@gmail.com&gt;
Cc: Mihir Shete &lt;smihir@qti.qualcomm.com&gt;
Cc: Henri Bahini &lt;hbahini@qca.qualcomm.com&gt;
Cc: Tushnim Bhattacharyya &lt;tushnimb@qca.qualcomm.com&gt;
Signed-off-by: Luis R. Rodriguez &lt;mcgrof@do-not-panic.com&gt;
[fix up whitespace damage, overly long lines]
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We'll expand this later, this will make it easier to
classify and review what things are related to regulatory
or not.

Coccinelle only missed 4 hits, which I had to do manually,
supplying the SmPL in case of merge conflicts.

@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags |= WIPHY_FLAG_CUSTOM_REGULATORY
+wiphy-&gt;regulatory_flags |= REGULATORY_CUSTOM_REG
@@
expression e;
@@
-e-&gt;flags |= WIPHY_FLAG_CUSTOM_REGULATORY
+e-&gt;regulatory_flags |= REGULATORY_CUSTOM_REG
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp;= ~WIPHY_FLAG_CUSTOM_REGULATORY
+wiphy-&gt;regulatory_flags &amp;= ~REGULATORY_CUSTOM_REG
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp; WIPHY_FLAG_CUSTOM_REGULATORY
+wiphy-&gt;regulatory_flags &amp; REGULATORY_CUSTOM_REG

@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags |= WIPHY_FLAG_STRICT_REGULATORY
+wiphy-&gt;regulatory_flags |= REGULATORY_STRICT_REG
@@
expression e;
@@
-e-&gt;flags |= WIPHY_FLAG_STRICT_REGULATORY
+e-&gt;regulatory_flags |= REGULATORY_STRICT_REG
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp;= ~WIPHY_FLAG_STRICT_REGULATORY
+wiphy-&gt;regulatory_flags &amp;= ~REGULATORY_STRICT_REG
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp; WIPHY_FLAG_STRICT_REGULATORY
+wiphy-&gt;regulatory_flags &amp; REGULATORY_STRICT_REG

@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags |= WIPHY_FLAG_DISABLE_BEACON_HINTS
+wiphy-&gt;regulatory_flags |= REGULATORY_DISABLE_BEACON_HINTS
@@
expression e;
@@
-e-&gt;flags |= WIPHY_FLAG_DISABLE_BEACON_HINTS
+e-&gt;regulatory_flags |= REGULATORY_DISABLE_BEACON_HINTS
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp;= ~WIPHY_FLAG_DISABLE_BEACON_HINTS
+wiphy-&gt;regulatory_flags &amp;= ~REGULATORY_DISABLE_BEACON_HINTS
@@
struct wiphy *wiphy;
@@
-wiphy-&gt;flags &amp; WIPHY_FLAG_DISABLE_BEACON_HINTS
+wiphy-&gt;regulatory_flags &amp; REGULATORY_DISABLE_BEACON_HINTS

Generated-by: Coccinelle SmPL
Cc: Julia Lawall &lt;julia.lawall@lip6.fr&gt;
Cc: Peter Senna Tschudin &lt;peter.senna@gmail.com&gt;
Cc: Mihir Shete &lt;smihir@qti.qualcomm.com&gt;
Cc: Henri Bahini &lt;hbahini@qca.qualcomm.com&gt;
Cc: Tushnim Bhattacharyya &lt;tushnimb@qca.qualcomm.com&gt;
Signed-off-by: Luis R. Rodriguez &lt;mcgrof@do-not-panic.com&gt;
[fix up whitespace damage, overly long lines]
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>cfg80211: don't allow drivers to unset NL80211_FEATURE_SCAN_FLUSH</title>
<updated>2013-11-25T19:50:40+00:00</updated>
<author>
<name>Johannes Berg</name>
<email>johannes.berg@intel.com</email>
</author>
<published>2013-10-26T15:14:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=00c3a6ed649c3305b52ff51e187717365aa39d4a'/>
<id>00c3a6ed649c3305b52ff51e187717365aa39d4a</id>
<content type='text'>
As the flag is entirely implemented in cfg80211, it should
have been a global feature flag (which I believe didn't
exist at the time). However, there's no reason to allow
drivers to unset the flag, so don't allow it and remove
the validation of NL80211_SCAN_FLAG_FLUSH.

Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
As the flag is entirely implemented in cfg80211, it should
have been a global feature flag (which I believe didn't
exist at the time). However, there's no reason to allow
drivers to unset the flag, so don't allow it and remove
the validation of NL80211_SCAN_FLAG_FLUSH.

Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>cfg80211: disable 5/10 MHz support for all drivers</title>
<updated>2013-11-25T15:50:11+00:00</updated>
<author>
<name>Johannes Berg</name>
<email>johannes.berg@intel.com</email>
</author>
<published>2013-11-17T09:37:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=9f16d84ad73ea04145a5dc85c8f1067915b37eea'/>
<id>9f16d84ad73ea04145a5dc85c8f1067915b37eea</id>
<content type='text'>
Due to nl80211 API breakage, 5/10 MHz support is broken for
all drivers. Fixing it requires adding new API, but that
can't be done as a bugfix commit since that would require
either updating all APIs in the trees needing the bugfix or
cause different kernels to have incompatible API.

Therefore, just disable 5/10 MHz support for all drivers.

Cc: stable@vger.kernel.org [3.12]
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Due to nl80211 API breakage, 5/10 MHz support is broken for
all drivers. Fixing it requires adding new API, but that
can't be done as a bugfix commit since that would require
either updating all APIs in the trees needing the bugfix or
cause different kernels to have incompatible API.

Therefore, just disable 5/10 MHz support for all drivers.

Cc: stable@vger.kernel.org [3.12]
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>cfg80211: don't add p2p device while in RFKILL</title>
<updated>2013-10-09T16:40:16+00:00</updated>
<author>
<name>Emmanuel Grumbach</name>
<email>emmanuel.grumbach@intel.com</email>
</author>
<published>2013-09-17T12:20:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=f38dd58ccca0d612e62509f75e99952dcf316cb2'/>
<id>f38dd58ccca0d612e62509f75e99952dcf316cb2</id>
<content type='text'>
Since P2P device doesn't have a netdev associated to it,
we cannot prevent the user to start it when in RFKILL.
So refuse to even add it when in RFKILL.

Signed-off-by: Emmanuel Grumbach &lt;emmanuel.grumbach@intel.com&gt;
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Since P2P device doesn't have a netdev associated to it,
we cannot prevent the user to start it when in RFKILL.
So refuse to even add it when in RFKILL.

Signed-off-by: Emmanuel Grumbach &lt;emmanuel.grumbach@intel.com&gt;
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>cfg80211: fix sysfs registration race</title>
<updated>2013-09-26T18:03:45+00:00</updated>
<author>
<name>Johannes Berg</name>
<email>johannes.berg@intel.com</email>
</author>
<published>2013-09-26T18:03:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=aa5f66d5a1df1c2b04bccdcb19711675c765d7c4'/>
<id>aa5f66d5a1df1c2b04bccdcb19711675c765d7c4</id>
<content type='text'>
My locking rework/race fixes caused a regression in the
registration, causing uevent notifications for wireless
devices before the device is really fully registered and
available in nl80211.

Fix this by moving the device_add() under rtnl and move
the rfkill to afterwards (it can't be under rtnl.)

Reported-and-tested-by: Maxime Bizon &lt;mbizon@freebox.fr&gt;
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
My locking rework/race fixes caused a regression in the
registration, causing uevent notifications for wireless
devices before the device is really fully registered and
available in nl80211.

Fix this by moving the device_add() under rtnl and move
the rfkill to afterwards (it can't be under rtnl.)

Reported-and-tested-by: Maxime Bizon &lt;mbizon@freebox.fr&gt;
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
