linux.git/net/wireless, branch v2.6.31

cfg80211: fix regression on beacon world roaming feature

2009-08-03T20:31:21+00:00

A regression was added through patch a4ed90d6:

"cfg80211: respect API on orig_flags on channel for beacon hint"

We did indeed respect _orig flags but the intention was not clearly
stated in the commit log. This patch fixes firmware issues picked
up by iwlwifi when we lift passive scan of beaconing restrictions
on channels its EEPROM has been configured to always enable.

By doing so though we also disallowed beacon hints on devices
registering their wiphy with custom world regulatory domains
enabled, this happens to be currently ath5k, ath9k and ar9170.
The passive scan and beacon restrictions on those devices would
never be lifted even if we did find a beacon and the hardware did
support such enhancements when world roaming.

Since Johannes indicates iwlwifi firmware cannot be changed to
allow beacon hinting we set up a flag now to specifically allow
drivers to disable beacon hints for devices which cannot use them.

We enable the flag on iwlwifi to disable beacon hints and by default
enable it for all other drivers. It should be noted beacon hints lift
passive scan flags and beacon restrictions when we receive a beacon from
an AP on any 5 GHz non-DFS channels, and channels 12-14 on the 2.4 GHz
band. We don't bother with channels 1-11 as those channels are allowed
world wide.

This should fix world roaming for ath5k, ath9k and ar9170, thereby
improving scan time when we receive the first beacon from any AP,
and also enabling beaconing operation (AP/IBSS/Mesh) on cards which
would otherwise not be allowed to do so. Drivers not using custom
regulatory stuff (wiphy_apply_custom_regulatory()) were not affected
by this as the orig_flags for the channels would have been cleared
upon wiphy registration.

I tested this with a world roaming ath5k card.

Cc: Jouni Malinen 
Signed-off-by: Luis R. Rodriguez 
Reviewed-by: Johannes Berg 
Signed-off-by: John W. Linville

cfg80211: add two missing NULL pointer checks

2009-08-03T20:31:21+00:00

These pointers can be NULL, the is_mesh() case isn't
ever hit in the current kernel, but cmp_ies() can be
hit under certain conditions.

Signed-off-by: Johannes Berg 
Cc: stable@kernel.org [2.6.29, 2.6.30]
Signed-off-by: John W. Linville

cfg80211: double free in __cfg80211_scan_done

2009-07-21T16:07:44+00:00

This patch fixes a double free corruption in __cfg80211_scan_done:

 ================================================
 BUG kmalloc-512: Object already free
 ------------------------------------------------

 INFO: Allocated in load_elf_binary+0x18b/0x19af age=6
 INFO: Freed in load_elf_binary+0x104e/0x19af age=5
 INFO: Slab 0xffffea0001bae4c0 objects=14 used=7
 INFO: Object 0xffff88007e8a9918 @offset=6424 fp=0xffff88007e8a9488

 Bytes b4 0xffff88007e8a9908:  00 00 00 00 00 00 00 00 5a 5a
 [...]
 Pid: 28705, comm: rmmod Tainted: P         C 2.6.31-rc2-wl #1
 Call Trace:
  [] print_trailer+0x14e/0x16e
  [] object_err+0x42/0x61
  [] __slab_free+0x2af/0x396
  [] ? wiphy_unregister+0x92/0x142 [cfg80211]
  [] kfree+0x13c/0x17a
  [] ? wiphy_unregister+0x92/0x142 [cfg80211]
  [] wiphy_unregister+0x92/0x142 [cfg80211]
  [] ieee80211_unregister_hw+0xc8/0xff [mac80211]
  [] p54_unregister_common+0x31/0x66 [p54common]
  [...]
 FIX kmalloc-512: Object at 0xffff88007e8a9918 not freed

The code path which leads to the *funny* double free:

       request = rdev->scan_req;
       dev = dev_get_by_index(&init_net, request->ifidx);
	/*
	 * the driver was unloaded recently and
	 * therefore dev_get_by_index will return NULL!
	 */
        if (!dev)
                goto out;
	[...]
	rdev->scan_req = NULL; /* not executed... */
	[...]
 out:
        kfree(request);

Signed-off-by: Christian Lamparter 
Signed-off-by: John W. Linville

nl80211: Memory leak fixed

2009-07-21T16:07:42+00:00

Potential memory leak via msg pointer in nl80211_get_key() function.

Signed-off-by: Niko Jokinen 
Signed-off-by: Luciano Coelho 
Signed-off-by: John W. Linville

cfg80211: fix refcount leak

2009-07-07T16:55:28+00:00

The code in cfg80211's cfg80211_bss_update erroneously
grabs a reference to the BSS, which means that it will
never be freed.

Signed-off-by: Johannes Berg 
Cc: stable@kernel.org [2.6.29, 2.6.30]
Signed-off-by: John W. Linville

Wireless: nl80211, fix lock imbalance

2009-07-07T16:55:25+00:00

Don't forget to unlock cfg80211_mutex in one fail path of
nl80211_set_wiphy.

Signed-off-by: Jiri Slaby 
Signed-off-by: John W. Linville

cfg80211: validate station settings

2009-06-19T15:50:24+00:00

When I disallowed interfering with stations on non-AP interfaces,
I not only forget mesh but also managed interfaces which need
this for the authorized flag. Let's actually validate everything
properly.

This fixes an nl80211 regression introduced by the interfering,
under which wpa_supplicant -Dnl80211 could not properly connect.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

cfg80211: allow setting station parameters in mesh

2009-06-19T15:50:24+00:00

Mesh Point interfaces can also set parameters, for example plink_open is
used to manually establish peer links from user-space (currently via
iw).  Add Mesh Point to the check in nl80211_set_station.

Signed-off-by: Andrey Yurovsky 
Signed-off-by: John W. Linville

cfg80211: allow adding/deleting stations on mesh

2009-06-19T15:50:23+00:00

Commit b2a151a288 added a check that prevents adding or deleting
stations on non-AP interfaces.  Adding and deleting stations is
supported for Mesh Point interfaces, so add Mesh Point to that check as
well.

Signed-off-by: Andrey Yurovsky 
Signed-off-by: John W. Linville

cfg80211: fix rfkill locking problem

2009-06-10T17:28:41+00:00

rfkill currently requires a global lock within the
rfkill_register() function, and holds that lock over
calls to the set_block() methods. This means that we
cannot hold a lock around rfkill_register() that we
also require in set_block(), directly or indirectly.
Fix cfg80211 to register rfkill outside the block
locked by its global lock. Much of what cfg80211 does
in the locked block doesn't need to be locked anyway.

Reported-by: Vasanthakumar Thiagarajan 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville