linux-toradex.git/net/mac80211, branch v3.4.3

mac80211: fix non RCU-safe sta_list manipulation

2012-06-17T18:21:25+00:00

commit 794454ce72a298de6f4536ade597bdcc7dcde7c7 upstream.

sta_info_cleanup locks the sta_list using rcu_read_lock however
the delete operation isn't rcu safe. A race between sta_info_cleanup
timer being called and a STA being removed can occur which leads
to a panic while traversing sta_list. Fix this by switching to the
RCU-safe versions.

Reported-by: Eyal Shapira 
Signed-off-by: Arik Nemtsov 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: clean up remain-on-channel on interface stop

2012-06-17T18:21:25+00:00

commit 71ecfa1893034eeb1c93e02e22ee2ad26d080858 upstream.

When any interface goes down, it could be the one that we
were doing a remain-on-channel with. We therefore need to
cancel the remain-on-channel and flush the related work
structs so they don't run after the interface has been
removed or even destroyed.

It's also possible in this case that an off-channel SKB
was never transmitted, so free it if this is the case.
Note that this can also happen if the driver finishes
the off-channel period without ever starting it.

Reported-by: Nirav Shah 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix error in station state transitions during reconfig

2012-06-17T18:21:25+00:00

commit bd34ab62a3297bd7685da11b0cbe05ae4cd8b02c upstream.

As part of hardware reconfig mac80211 tries
to restore the station state to its values
before the hardware reconfig, but it only
goes to the last-state - 1. Fix this
off-by-one error.

Signed-off-by: Meenakshi Venkataraman 
Reviewed-by: Emmanuel Grumbach 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix ADDBA declined after suspend with wowlan

2012-06-09T15:36:08+00:00

commit 7b21aea04d084916ac4e0e8852dcc9cd60ec0d1d upstream.

WLAN_STA_BLOCK_BA is set while suspending but doesn't get cleared
when resuming in case of wowlan. This causes further ADDBA requests
received to be rejected. Fix it by clearing it in the wowlan path
as well.

Signed-off-by: Eyal Shapira 
Reviewed-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix AP mode EAP tx for VLAN stations

2012-04-30T18:40:05+00:00

EAP frames for stations in an AP VLAN are sent on the main AP interface
to avoid race conditions wrt. moving stations.
For that to work properly, sta_info_get_bss must be used instead of
sta_info_get when sending EAP packets.
Previously this was only done for cooked monitor injected packets, so
this patch adds a check for tx->skb->protocol to the same place.

Signed-off-by: Felix Fietkau 
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville

mac80211: call ieee80211_mgd_stop() on interface stop

2012-04-24T18:42:42+00:00

ieee80211_mgd_teardown() is called on netdev removal, which
occurs after the vif was already removed from the low-level
driver, resulting in the following warning:

[ 4809.014734] ------------[ cut here ]------------
[ 4809.019861] WARNING: at net/mac80211/driver-ops.h:12 ieee80211_bss_info_change_notify+0x200/0x2c8 [mac80211]()
[ 4809.030388] wlan0:  Failed check-sdata-in-driver check, flags: 0x4
[ 4809.036862] Modules linked in: wlcore_sdio(-) wl12xx wlcore mac80211 cfg80211 [last unloaded: cfg80211]
[ 4809.046849] [] (unwind_backtrace+0x0/0x12c)
[ 4809.055937] [] (dump_stack+0x20/0x24)
[ 4809.065385] [] (warn_slowpath_common+0x5c/0x74)
[ 4809.075589] [] (warn_slowpath_fmt+0x40/0x48)
[ 4809.088291] [] (ieee80211_bss_info_change_notify+0x200/0x2c8 [mac80211])
[ 4809.102844] [] (ieee80211_destroy_auth_data+0x80/0xa4 [mac80211])
[ 4809.116276] [] (ieee80211_mgd_teardown+0x5c/0x74 [mac80211])
[ 4809.129331] [] (ieee80211_teardown_sdata+0xb0/0xd8 [mac80211])
[ 4809.141595] [] (rollback_registered_many+0x228/0x2f0)
[ 4809.153056] [] (unregister_netdevice_many+0x28/0x50)
[ 4809.165696] [] (ieee80211_remove_interfaces+0xb4/0xdc [mac80211])
[ 4809.179151] [] (ieee80211_unregister_hw+0x50/0xf0 [mac80211])
[ 4809.191043] [] (wlcore_remove+0x5c/0x7c [wlcore])
[ 4809.201491] [] (platform_drv_remove+0x24/0x28)
[ 4809.212029] [] (__device_release_driver+0x8c/0xcc)
[ 4809.222738] [] (device_release_driver+0x30/0x3c)
[ 4809.233099] [] (bus_remove_device+0x10c/0x128)
[ 4809.242620] [] (device_del+0x11c/0x17c)
[ 4809.252150] [] (platform_device_del+0x28/0x68)
[ 4809.263051] [] (wl1271_remove+0x3c/0x50 [wlcore_sdio])
[ 4809.273590] [] (sdio_bus_remove+0x48/0xf8)
[ 4809.283754] [] (__device_release_driver+0x8c/0xcc)
[ 4809.293729] [] (driver_detach+0x9c/0xc4)
[ 4809.303163] [] (bus_remove_driver+0xc4/0xf4)
[ 4809.312973] [] (driver_unregister+0x70/0x7c)
[ 4809.323220] [] (sdio_unregister_driver+0x24/0x2c)
[ 4809.334213] [] (wl1271_exit+0x14/0x1c [wlcore_sdio])
[ 4809.344930] [] (sys_delete_module+0x228/0x2a8)
[ 4809.354734] ---[ end trace 515290ccf5feb522 ]---

Rename ieee80211_mgd_teardown() to ieee80211_mgd_stop(),
and call it on ieee80211_do_stop().

Signed-off-by: Eliad Peller 
Signed-off-by: John W. Linville

mac80211: fix logic error in ibss channel type check

2012-04-17T18:17:04+00:00

The broken check leads to rate control attempting to use HT40 while
the driver is configured for HT20. This leads to interesting hardware
issues.

HT40 can only be used if the channel type is either HT40- or HT40+
and if the channel type of the cell matches the local type.

Signed-off-by: Felix Fietkau 
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville

mac80211: fix truncated packets in cooked monitor rx

2012-04-17T18:17:04+00:00

Cooked monitor rx was recently changed to use ieee80211_add_rx_radiotap_header
instead of generating only limited radiotap information.
ieee80211_add_rx_radiotap_header assumes that FCS info is still present if
the hardware supports receiving it, however when cooked monitor rx packets
are processed, FCS info has already been stripped.
Fix this by adding an extra flag indicating FCS presence.

Signed-off-by: Felix Fietkau 
Signed-off-by: John W. Linville

mac80211: fix association beacon wait timeout

2012-04-09T19:54:46+00:00

The TU_TO_EXP_TIME() macro already includes the
"jiffies +" piece of the calculation, so don't
add jiffies again.

Reported-by: Oliver Hartkopp 
Signed-off-by: Johannes Berg 
Tested-by: Oliver Hartkopp 
Signed-off-by: John W. Linville

Merge branch 'akpm' (Andrew's patch-bomb)

2012-04-05T22:30:34+00:00

Merge batch of fixes from Andrew Morton:
 "The simple_open() cleanup was held back while I wanted for laggards to
  merge things.

  I still need to send a few checkpoint/restore patches.  I've been
  wobbly about merging them because I'm wobbly about the overall
  prospects for success of the project.  But after speaking with Pavel
  at the LSF conference, it sounds like they're further toward
  completion than I feared - apparently davem is at the "has stopped
  complaining" stage regarding the net changes.  So I need to go back
  and re-review those patchs and their (lengthy) discussion."

* emailed from Andrew Morton : (16 patches)
  memcg swap: use mem_cgroup_uncharge_swap fix
  backlight: add driver for DA9052/53 PMIC v1
  C6X: use set_current_blocked() and block_sigmask()
  MAINTAINERS: add entry for sparse checker
  MAINTAINERS: fix REMOTEPROC F: typo
  alpha: use set_current_blocked() and block_sigmask()
  simple_open: automatically convert to simple_open()
  scripts/coccinelle/api/simple_open.cocci: semantic patch for simple_open()
  libfs: add simple_open()
  hugetlbfs: remove unregister_filesystem() when initializing module
  drivers/rtc/rtc-88pm860x.c: fix rtc irq enable callback
  fs/xattr.c:setxattr(): improve handling of allocation failures
  fs/xattr.c:listxattr(): fall back to vmalloc() if kmalloc() failed
  fs/xattr.c: suppress page allocation failure warnings from sys_listxattr()
  sysrq: use SEND_SIG_FORCED instead of force_sig()
  proc: fix mount -t proc -o AAA