Skip to content
Snippets Groups Projects
  1. Feb 06, 2014
  2. Jan 15, 2014
  3. Jan 13, 2014
  4. Jan 09, 2014
  5. Jan 06, 2014
  6. Dec 30, 2013
  7. Dec 19, 2013
  8. Dec 16, 2013
  9. Dec 05, 2013
    • Eliad Peller's avatar
      cfg80211: don't "leak" uncompleted scans · 4a58e7c3
      Eliad Peller authored
      
      ___cfg80211_scan_done() can be called in some cases
      (e.g. on NETDEV_DOWN) before the low level driver
      notified scan completion (which is indicated by
      passing leak=true).
      
      Clearing rdev->scan_req in this case is buggy, as
      scan_done_wk might have already being queued/running
      (and can't be flushed as it takes rtnl()).
      
      If a new scan will be requested at this stage, the
      scan_done_wk will try freeing it (instead of the
      previous scan), and this will later result in
      a use after free.
      
      Simply remove the "leak" option, and replace it with
      a standard WARN_ON.
      
      An example backtrace after such crash:
      Unable to handle kernel paging request at virtual address fffffee5
      pgd = c0004000
      [fffffee5] *pgd=9fdf6821, *pte=00000000, *ppte=00000000
      Internal error: Oops: 17 [#1] SMP ARM
      PC is at cfg80211_scan_done+0x28/0xc4 [cfg80211]
      LR is at __ieee80211_scan_completed+0xe4/0x2dc [mac80211]
      [<bf0077b0>] (cfg80211_scan_done+0x28/0xc4 [cfg80211])
      [<bf0973d4>] (__ieee80211_scan_completed+0xe4/0x2dc [mac80211])
      [<bf0982cc>] (ieee80211_scan_work+0x94/0x4f0 [mac80211])
      [<c005fd10>] (process_one_work+0x1b0/0x4a8)
      [<c0060404>] (worker_thread+0x138/0x37c)
      [<c0066d70>] (kthread+0xa4/0xb0)
      
      Signed-off-by: default avatarEliad Peller <eliad@wizery.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      4a58e7c3
    • Barak Bercovitz's avatar
      cfg80211: stop sched scan only when needed · 24d584d7
      Barak Bercovitz authored
      
      cfg80211_leave stops sched scan when any station vif
      is leaving. Add an explicit check and call it only
      when the relevant vif (the one we scan on) is leaving.
      
      Signed-off-by: default avatarBarak Bercovitz <barak@wizery.com>
      [Eliad - changed the commit message a bit]
      Signed-off-by: default avatarEliad Peller <eliad@wizery.com>
      [Johannes - add ASSERT_RTNL since that protects the pointer]
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      24d584d7
    • Janusz Dziedzic's avatar
      cfg80211: in bitrate_mask, rename mcs to ht_mcs · d1e33e65
      Janusz Dziedzic authored
      
      Rename NL80211_TXRATE_MCS to NL80211_TXRATE_HT and also
      rename mcs to ht_mcs in struct cfg80211_bitrate_mask.
      
      Signed-off-by: default avatarJanusz Dziedzic <janusz.dziedzic@tieto.com>
      [reword commit message]
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      d1e33e65
    • Janusz Dziedzic's avatar
      nl80211: allow setting bitrate mask back to default · b9243ab0
      Janusz Dziedzic authored
      
      Allow setting the bitrate masks back to default by
      omitting the NL80211_ATTR_TX_RATES attribute.
      
      Signed-off-by: default avatarJanusz Dziedzic <janusz.dziedzic@tieto.com>
      [rephrase commit message]
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      b9243ab0
    • Ujjal Roy's avatar
      cfg80211: fix WARN_ON for re-association to the expired BSS · 4c4d684a
      Ujjal Roy authored
      
      cfg80211 allows re-association in managed mode and if a user
      wants to re-associate to the same AP network after the time
      period of IEEE80211_SCAN_RESULT_EXPIRE, cfg80211 warns with
      the following message on receiving the connect result event.
      
      ------------[ cut here ]------------
      WARNING: CPU: 0 PID: 13984 at net/wireless/sme.c:658
               __cfg80211_connect_result+0x3a6/0x3e0 [cfg80211]()
      Call Trace:
       [<ffffffff81747a41>] dump_stack+0x46/0x58
       [<ffffffff81045847>] warn_slowpath_common+0x87/0xb0
       [<ffffffff81045885>] warn_slowpath_null+0x15/0x20
       [<ffffffffa05345f6>] __cfg80211_connect_result+0x3a6/0x3e0 [cfg80211]
       [<ffffffff8107168b>] ? update_rq_clock+0x2b/0x50
       [<ffffffff81078c01>] ? update_curr+0x1/0x160
       [<ffffffffa05133d2>] cfg80211_process_wdev_events+0xb2/0x1c0 [cfg80211]
       [<ffffffff81079303>] ? pick_next_task_fair+0x63/0x170
       [<ffffffffa0513518>] cfg80211_process_rdev_events+0x38/0x90 [cfg80211]
       [<ffffffffa050f03d>] cfg80211_event_work+0x1d/0x30 [cfg80211]
       [<ffffffff8105f21f>] process_one_work+0x17f/0x420
       [<ffffffff8105f90a>] worker_thread+0x11a/0x370
       [<ffffffff8105f7f0>] ? rescuer_thread+0x2f0/0x2f0
       [<ffffffff8106638b>] kthread+0xbb/0xc0
       [<ffffffff810662d0>] ? kthread_create_on_node+0x120/0x120
       [<ffffffff817574bc>] ret_from_fork+0x7c/0xb0
       [<ffffffff810662d0>] ? kthread_create_on_node+0x120/0x120
      ---[ end trace 61f3bddc9c4981f7 ]---
      
      The reason is that, in connect result event cfg80211 unholds
      the BSS to which the device is associated (and was held so
      far). So, for the event with status successful, when cfg80211
      wants to get that BSS from the device's BSS list it gets a
      NULL BSS because the BSS has been expired and unheld already.
      
      Fix it by reshuffling the code.
      
      Signed-off-by: default avatarUjjal Roy <royujjal@gmail.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      4c4d684a
  10. Dec 04, 2013
  11. Dec 03, 2013
  12. Dec 02, 2013
  13. Nov 25, 2013
Loading