linux-toradex.git/net/mac80211/sta_info.c, branch v3.4.89

mac80211: fix AP powersave TX vs. wakeup race

2014-03-24T04:37:04+00:00

commit 1d147bfa64293b2723c4fec50922168658e613ba upstream.

There is a race between the TX path and the STA wakeup: while
a station is sleeping, mac80211 buffers frames until it wakes
up, then the frames are transmitted. However, the RX and TX
path are concurrent, so the packet indicating wakeup can be
processed while a packet is being transmitted.

This can lead to a situation where the buffered frames list
is emptied on the one side, while a frame is being added on
the other side, as the station is still seen as sleeping in
the TX path.

As a result, the newly added frame will not be send anytime
soon. It might be sent much later (and out of order) when the
station goes to sleep and wakes up the next time.

Additionally, it can lead to the crash below.

Fix all this by synchronising both paths with a new lock.
Both path are not fastpath since they handle PS situations.

In a later patch we'll remove the extra skb queue locks to
reduce locking overhead.

BUG: unable to handle kernel
NULL pointer dereference at 000000b0
IP: [] ieee80211_report_used_skb+0x11/0x3e0 [mac80211]
*pde = 00000000
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
EIP: 0060:[] EFLAGS: 00210282 CPU: 1
EIP is at ieee80211_report_used_skb+0x11/0x3e0 [mac80211]
EAX: e5900da0 EBX: 00000000 ECX: 00000001 EDX: 00000000
ESI: e41d00c0 EDI: e5900da0 EBP: ebe458e4 ESP: ebe458b0
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
CR0: 8005003b CR2: 000000b0 CR3: 25a78000 CR4: 000407d0
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
Process iperf (pid: 3934, ti=ebe44000 task=e757c0b0 task.ti=ebe44000)
iwlwifi 0000:02:00.0: I iwl_pcie_enqueue_hcmd Sending command LQ_CMD (#4e), seq: 0x0903, 92 bytes at 3[3]:9
Stack:
 e403b32c ebe458c4 00200002 00200286 e403b338 ebe458cc c10960bb e5900da0
 ff76a6ec ebe458d8 00000000 e41d00c0 e5900da0 ebe458f0 ff6f1b75 e403b210
 ebe4598c ff723dc1 00000000 ff76a6ec e597c978 e403b758 00000002 00000002
Call Trace:
 [] ieee80211_free_txskb+0x15/0x20 [mac80211]
 [] invoke_tx_handlers+0x1661/0x1780 [mac80211]
 [] ieee80211_tx+0x75/0x100 [mac80211]
 [] ieee80211_xmit+0x8f/0xc0 [mac80211]
 [] ieee80211_subif_start_xmit+0x4fe/0xe20 [mac80211]
 [] dev_hard_start_xmit+0x450/0x950
 [] sch_direct_xmit+0xa9/0x250
 [] __qdisc_run+0x4b/0x150
 [] dev_queue_xmit+0x2c2/0xca0

Reported-by: Yaara Rozenblum 
Signed-off-by: Emmanuel Grumbach 
Reviewed-by: Stanislaw Gruszka 
[reword commit log, use a separate lock]
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

mac80211: use del_timer_sync for final sta cleanup timer deletion

2013-01-17T16:51:04+00:00

commit a56f992cdabc63f56b4b142885deebebf936ff76 upstream.

This is a very old bug, but there's nothing that prevents the
timer from running while the module is being removed when we
only do del_timer() instead of del_timer_sync().

The timer should normally not be running at this point, but
it's not clearly impossible (or we could just remove this.)

Tested-by: Ben Greear 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

mac80211: call skb_dequeue/ieee80211_free_txskb instead of __skb_queue_purge

2012-11-26T19:37:41+00:00

commit 1f98ab7fef48a2968f37f422c256c9fbd978c3f0 upstream.

Fixes more wifi status skb leaks, leading to hostapd/wpa_supplicant hangs.

Signed-off-by: Felix Fietkau 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

mac80211: sync acccess to tx_filtered/ps_tx_buf queues

2012-11-26T19:37:40+00:00

commit 987c285c2ae2e4e32aca3a9b3252d28171c75711 upstream.

These are accessed without a lock when ending STA PSM. If the
sta_cleanup timer accesses these lists at the same time, we might crash.

This may fix some mysterious crashes we had during
ieee80211_sta_ps_deliver_wakeup.

Signed-off-by: Arik Nemtsov 
Signed-off-by: Ido Yariv 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix non RCU-safe sta_list manipulation

2012-06-17T18:21:25+00:00

commit 794454ce72a298de6f4536ade597bdcc7dcde7c7 upstream.

sta_info_cleanup locks the sta_list using rcu_read_lock however
the delete operation isn't rcu safe. A race between sta_info_cleanup
timer being called and a STA being removed can occur which leads
to a panic while traversing sta_list. Fix this by switching to the
RCU-safe versions.

Reported-by: Eyal Shapira 
Signed-off-by: Arik Nemtsov 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: use compare_ether_addr on MAC addresses instead of memcmp

2012-03-05T20:38:31+00:00

Because of the constant size and guaranteed 16 bit alignment, the inline
compare_ether_addr function is much cheaper than calling memcmp.

Signed-off-by: Felix Fietkau 
Acked-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: handle non-bufferable MMPDUs correctly

2012-02-29T19:14:54+00:00

This renames the IEEE80211_TX_CTL_POLL_RESPONSE
TX flag to IEEE80211_TX_CTL_NO_PS_BUFFER and also
uses it for non-bufferable MMPDUs (all MMPDUs but
deauth, disassoc and action frames.)

Previously, mac80211 would let the MMPDU through
but not set the flag so drivers supporting some
hardware aids for avoiding the PS races would
then reject the frame.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: fix sta_info_flush() return value

2012-02-27T19:06:42+00:00

The comment for sta_info_flush() states
"Returns the number of removed STA entries"
but that isn't actually true. Consequently,
the warning when a station is still around
on interface removal can never trigger and
this delayed finding the timer issue the
previous patch fixed. Fix the return value
here to make that warning useful again.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: add #ifdef CONFIG_MAC80211_VERBOSE_DEBUG for a debug printk

2012-02-08T20:26:33+00:00

When not debugging mac80211 code, station state transitions do not need to
show up in the kernel log.

Signed-off-by: Felix Fietkau 
Signed-off-by: John W. Linville

mac80211: remove dummy STA support

2012-02-06T19:50:37+00:00

The dummy STA support was added because I didn't
want to change the driver API at the time. Now
that we have state transitions triggering station
add/remove in the driver, we only call add once a
station reaches ASSOCIATED, so we can remove the
dummy station stuff again.

While at it, tighten the RX check and accept only
port control (EAP) frames from the AP station if
it's not associated yet -- in other cases there's
no race.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville