linux-toradex.git/net/mac80211, branch v2.6.33.1

mac80211: do not transmit frames on unconfigured 4-addr vlan interfaces

2010-03-15T16:06:43+00:00

commit 3f0e0b220f80075ce15483b20458192c0ac27426 upstream.

If frames are transmitted on 4-addr ap vlan interfaces with no station,
they end up being transmitted unencrypted, even if the ap interface
uses WPA. This patch add some sanity checking to make sure that this
does not happen.

Signed-off-by: Felix Fietkau 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: Reset dynamic ps timer in Rx path.

2010-03-15T16:05:54+00:00

commit e15276a4b220c54db665cf46a92bd9ceb9aeb052 upstream.

The current mac80211 implementation enables power save if there
is no Tx traffic for a specific timeout. Hence, PS is triggered
even if there is a continuous Rx only traffic(like UDP) going on.
This makes the drivers to wait on the tim bit in the next beacon
to awake which leads to redundant sleep-wake cycles.
Fix this by restarting the dynamic ps timer on receiving every
data packet.

Signed-off-by: Vivek Natarajan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: quit addba_resp_timer if Tx BA session is torn down

2010-03-15T16:05:54+00:00

commit 3dc1de0bf23816ed557ac8addf680cd5ee57e805 upstream.

Make addba_resp_timer aware the HT_AGG_STATE_REQ_STOP_BA_MSK mask
so that when ___ieee80211_stop_tx_ba_session() is issued the timer
will quit. Otherwise when suspend happens before the timer expired,
the timer handler will be called immediately after resume and
messes up driver status.

Signed-off-by: Zhu Yi 
Acked-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'master' of ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

2010-02-14T19:56:38+00:00

mac80211: fix handling of null-rate control in rate_control_get_rate

2010-02-12T19:50:22+00:00

For hardware with IEEE80211_HW_HAS_RATE_CONTROL the rate controller is not
initialized. However, calling functions such as ieee80211_beacon_get result
in the rate_control_get_rate function getting called, which is accessing
(in this case uninitialized) rate control structures unconditionally.

Fix by exiting the function before setting the rates for HW with
IEEE80211_HW_HAS_RATE_CONTROL set. The initialization of the ieee80211_tx_info
struct is intentionally still executed.

Signed-off-by: Juuso Oikarinen 
Reviewed-by: Kalle Valo 
Cc: stable@kernel.org
Signed-off-by: John W. Linville

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

2010-02-10T20:35:24+00:00

mac80211: fix deferred hardware scan requests

2010-02-08T21:07:23+00:00

Reinette found the reason for the warnings that
happened occasionally when a hw-offloaded scan
finished; her description of the problem:

  mac80211 will defer the handling of scan requests if it is
  busy with management work at the time. The scan requests
  are deferred and run after the work has completed. When
  this occurs there are currently two problems.

  * The scan request for hardware scan is not fully populated
    with the band and channels to scan not initialized.

  * When the scan is queued the state is not correctly updated
    to reflect that a scan is in progress. The problem here is
    that when the driver completes the scan and calls
    ieee80211_scan_completed() a warning will be triggered
    since mac80211 was not aware that a scan was in progress.

The reason is that the queued scan work will start
the hw scan right away when the hw_scan_req struct
has already been allocated. However, in the first
pass it will not have been filled, which happens
at the same time as setting the bits. To fix this,
simply move the allocation after the pending work
test as well, so that the first iteration of the
scan work will call __ieee80211_start_scan() even
in the hardware scan case.

Bug-identified-by: Reinette Chatre 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: Fix probe request filtering in IBSS mode

2010-02-08T21:07:22+00:00

We only reply to probe request if either the requested SSID is the
broadcast SSID or if the requested SSID matches our own SSID. This
latter case was not properly handled since we were replying to different
SSID with the same length as our own SSID.

Signed-off-by: Benoit Papillault 
Cc: stable@kernel.org
Signed-off-by: John W. Linville

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

2010-01-28T13:42:33+00:00

mac80211: fix NULL pointer dereference when ftrace is enabled

2010-01-26T16:52:13+00:00

I got below kernel oops when I try to bring down the network interface if
ftrace is enabled. The root cause is drv_ampdu_action() is passed with a
NULL ssn pointer in the BA session tear down case. We need to check and
avoid dereferencing it in trace entry assignment.

BUG: unable to handle kernel NULL pointer dereference
Modules linked in: at (null)
IP: [] ftrace_raw_event_drv_ampdu_action+0x10a/0x160 [mac80211]
*pde = 00000000
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[...]
Call Trace:
 [] ? ftrace_raw_event_drv_ampdu_action+0x0/0x160 [mac80211]
 [] ? __ieee80211_stop_rx_ba_session+0xfc/0x220 [mac80211]
 [] ? ieee80211_sta_tear_down_BA_sessions+0x3b/0x50 [mac80211]
 [] ? ieee80211_set_disassoc+0xe6/0x230 [mac80211]
 [] ? ieee80211_set_disassoc+0x9c/0x230 [mac80211]
 [] ? ieee80211_mgd_deauth+0x158/0x170 [mac80211]
 [] ? ieee80211_deauth+0x1b/0x20 [mac80211]
 [] ? __cfg80211_mlme_deauth+0xe9/0x120 [cfg80211]
 [] ? __cfg80211_disconnect+0x170/0x1d0 [cfg80211]

Cc: Johannes Berg 
Cc: stable@kernel.org
Signed-off-by: Zhu Yi 
Signed-off-by: John W. Linville