linux-toradex.git/net/mac80211, branch v3.3.5

mac80211: fix AP mode EAP tx for VLAN stations

2012-05-07T15:53:37+00:00

commit 66f2c99af3d6f2d0aa1120884cf1c60613ef61c0 upstream.

EAP frames for stations in an AP VLAN are sent on the main AP interface
to avoid race conditions wrt. moving stations.
For that to work properly, sta_info_get_bss must be used instead of
sta_info_get when sending EAP packets.
Previously this was only done for cooked monitor injected packets, so
this patch adds a check for tx->skb->protocol to the same place.

Signed-off-by: Felix Fietkau 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix logic error in ibss channel type check

2012-04-27T17:16:37+00:00

commit 6741e7f048dacc92e37c5d724ff5c64e45f6c2c9 upstream.

The broken check leads to rate control attempting to use HT40 while
the driver is configured for HT20. This leads to interesting hardware
issues.

HT40 can only be used if the channel type is either HT40- or HT40+
and if the channel type of the cell matches the local type.

Signed-off-by: Felix Fietkau 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix possible tid_rx->reorder_timer use after free

2012-04-13T16:13:52+00:00

commit d72308bff5c2fa207949a5925b020bce74495e33 upstream.

Is possible that we will arm the tid_rx->reorder_timer after
del_timer_sync() in ___ieee80211_stop_rx_ba_session(). We need to stop
timer after RCU grace period finish, so move it to
ieee80211_free_tid_rx(). Timer will not be armed again, as
rcu_dereference(sta->ampdu_mlme.tid_rx[tid]) will return NULL.

Debug object detected problem with the following warning:
ODEBUG: free active (active state 0) object type: timer_list hint: sta_rx_agg_reorder_timer_expired+0x0/0xf0 [mac80211]

Bug report (with all warning messages):
https://bugzilla.redhat.com/show_bug.cgi?id=804007

Reported-by: "jan p. springer" 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: Fix a warning on changing to monitor mode from STA

2012-02-21T19:45:27+00:00

nothing needs to be done for monitor/AP_VLAN mode on calling
ieee80211_bss_info_change_notify -> drv_bss_info_changed with the change
flag 'BSS_CHANGED_IDLE'. 'wl1271' seems to use BSS_CHANGED_IDLE only for
STA and IBSS mode. further the non-idle state of the monitor mode is
taken care by the 'count' variable which counts non-idle interfaces.
ieee80211_idle_off(local, "in use") will be called.
this fixes the following WARNING when we have initially STA mode
(network manager running) and not associated, and change it to monitor
mode with network manager disabled and bringing up the monitor mode.
this changes the idle state from 'true' (STA unassociated) to 'false'
(MONITOR mode)
exposed by the commit 405385f8ce7a2ed8f82e216d88b5282142e1288b
"mac80211: set bss_conf.idle when vif is connected"

	WARNING: net/mac80211/main.c:212
	ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]()
	Hardware name: 64756D6
	Pid: 3835, comm: ifconfig Tainted: G           O
	3.3.0-rc3-wl #9
	Call Trace:
	  [] warn_slowpath_common+0x72/0xa0
	  [] ?
	  ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]
	  [] ?
	  ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]
	  [] warn_slowpath_null+0x22/0x30
	  []
	  ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]
	  [] __ieee80211_recalc_idle+0x113/0x430
	  [mac80211]
	  [] ieee80211_do_open+0x156/0x7e0 [mac80211]
	  [] ?
	  ieee80211_check_concurrent_iface+0x25/0x180 [mac80211]
	  [] ? raw_notifier_call_chain+0x1f/0x30
	  [] ieee80211_open+0x40/0x80 [mac80211]
	  [] __dev_open+0x96/0xe0
	  [] ? _raw_spin_unlock_bh+0x35/0x40
	  [] __dev_change_flags+0x109/0x170
	  [] dev_change_flags+0x23/0x60
	  [] devinet_ioctl+0x6a0/0x770

 ieee80211 phy0: device no longer idle - in use

Cc: Eliad Peller 
Signed-off-by: Mohammed Shafi Shajakhan 
Signed-off-by: John W. Linville

mac80211: zero initialize count field in ieee80211_tx_rate

2012-02-21T19:45:26+00:00

rate control algorithms concludes the rate as invalid
with rate[i].idx < -1 , while they do also check for rate[i].count is
non-zero. it would be safer to zero initialize the 'count' field.
recently we had a ath9k rate control crash where the ath9k rate control
in ath_tx_status assumed to check only for rate[i].count being non-zero
in one instance and ended up in using invalid rate index for
'connection monitoring NULL func frames' which eventually lead to the crash.
thanks to Pavel Roskin for fixing it and finding the root cause.
https://bugzilla.redhat.com/show_bug.cgi?id=768639

Cc: stable@vger.kernel.org
Cc: Pavel Roskin 
Signed-off-by: Mohammed Shafi Shajakhan 
Signed-off-by: John W. Linville

mac80211: do not call rate control .tx_status before .rate_init

2012-02-15T18:56:06+00:00

Most rate control implementations assume .get_rate and .tx_status are only
called once the per-station data has been fully initialized.
minstrel_ht crashes if this assumption is violated.

Signed-off-by: Felix Fietkau 
Tested-by: Arend van Spriel 
Signed-off-by: John W. Linville

mac80211: call rate control only after init

2012-02-15T18:56:06+00:00

There are situations where we don't have the
necessary rate control information yet for
station entries, e.g. when associating. This
currently doesn't really happen due to the
dummy station handling; explicitly disabling
rate control when it's not initialised will
allow us to remove dummy stations.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: Fix a rwlock bad magic bug

2012-02-09T20:16:04+00:00

read_lock(&tpt_trig->trig.leddev_list_lock) is accessed via the path
ieee80211_open (->) ieee80211_do_open (->) ieee80211_mod_tpt_led_trig
(->) ieee80211_start_tpt_led_trig (->) tpt_trig_timer before initializing
it.
the intilization of this read/write lock happens via the path
ieee80211_led_init (->) led_trigger_register, but we are doing
'ieee80211_led_init'  after 'ieeee80211_if_add' where we
register netdev_ops.
so we access leddev_list_lock before initializing it and causes the
following bug in chrome laptops with AR928X cards with the following
script

while true
do
sudo modprobe -v ath9k
sleep 3
sudo modprobe -r ath9k
sleep 3
done

	BUG: rwlock bad magic on CPU#1, wpa_supplicant/358, f5b9eccc
	Pid: 358, comm: wpa_supplicant Not tainted 3.0.13 #1
	Call Trace:

	[<8137b9df>] rwlock_bug+0x3d/0x47
	[<81179830>] do_raw_read_lock+0x19/0x29
	[<8137f063>] _raw_read_lock+0xd/0xf
	[] tpt_trig_timer+0xc3/0x145 [mac80211]
	[] ieee80211_mod_tpt_led_trig+0x152/0x174 [mac80211]
	[] ieee80211_do_open+0x11e/0x42e [mac80211]
	[] ? ieee80211_check_concurrent_iface+0x26/0x13c [mac80211]
	[] ieee80211_open+0x48/0x4c [mac80211]
	[<812dbed8>] __dev_open+0x82/0xab
	[<812dc0c9>] __dev_change_flags+0x9c/0x113
	[<812dc1ae>] dev_change_flags+0x18/0x44
	[<8132144f>] devinet_ioctl+0x243/0x51a
	[<81321ba9>] inet_ioctl+0x93/0xac
	[<812cc951>] sock_ioctl+0x1c6/0x1ea
	[<812cc78b>] ? might_fault+0x20/0x20
	[<810b1ebb>] do_vfs_ioctl+0x46e/0x4a2
	[<810a6ebb>] ? fget_light+0x2f/0x70
	[<812ce549>] ? sys_recvmsg+0x3e/0x48
	[<810b1f35>] sys_ioctl+0x46/0x69
	[<8137fa77>] sysenter_do_call+0x12/0x2

Cc: 
Cc: Gary Morain 
Cc: Paul Stewart 
Cc: Abhijit Pradhan 
Cc: Vasanthakumar Thiagarajan 
Cc: Rajkumar Manoharan 
Acked-by: Johannes Berg 
Tested-by: Mohammed Shafi Shajakhan 
Signed-off-by: Mohammed Shafi Shajakhan 
Signed-off-by: John W. Linville

mac80211: timeout a single frame in the rx reorder buffer

2012-02-01T20:26:00+00:00

The current code checks for stored_mpdu_num > 1, causing
the reorder_timer to be triggered indefinitely, but the
frame is never timed-out (until the next packet is received)

Signed-off-by: Eliad Peller 
Cc: 
Acked-by: Johannes Berg 
Signed-off-by: John W. Linville

mac80211: set bss_conf.idle when vif is connected

2012-01-24T19:47:09+00:00

__ieee80211_recalc_idle() iterates through the vifs,
sets bss_conf.idle = true if they are disconnected,
and increases "count" if they are not (which later
gets evaluated in order to determine whether the
device is idle).

However, the loop doesn't set bss_conf.idle = false
(along with increasing "count"), causing the device
idle state and the vif idle state to get out of sync
in some cases.

Signed-off-by: Eliad Peller 
Signed-off-by: John W. Linville