linux-toradex.git/net/wireless/scan.c, branch v2.6.32.31

cfg80211: don't get expired BSSes

2010-08-10T17:20:43+00:00

commit ccb6c1360f8dd43303c659db718e7e0b24175db5 upstream.

When kernel-internal users use cfg80211_get_bss()
to get a reference to a BSS struct, they may end
up getting one that would have been removed from
the list if there had been any userspace access
to the list. This leads to inconsistencies and
problems.

Fix it by making cfg80211_get_bss() ignore BSSes
that cfg80211_bss_expire() would remove.

Fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2180

Reported-by: Jiajia Zheng 
Tested-by: Jiajia Zheng 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

cfg80211: minimal error handling for wext-compat freq scanning

2009-09-14T18:36:04+00:00

Signed-off-by: Holger Schurig 
Signed-off-by: John W. Linville

cfg80211: use cfg80211_wext_freq() for freq conversion

2009-09-14T18:36:04+00:00

WEXT's "struct iw_freq" can also be used to handle a channel. This patch now
uses cfg80211_wext_freq() instead of hand-converting the frequency. That
allows user-space to specify channels as well, like with SIOCSIWFREQ.

Signed-off-by: Holger Schurig 
Signed-off-by: John W. Linville

cfg80211: allow scanning on specified frequencies when using wext-compatibility

2009-09-09T15:25:27+00:00

Handles the case when SIOCSIWSCAN specified iw_scan_req.num_channels and
iw_scan_req.channels[].

Signed-off-by: Holger Schurig 
Signed-off-by: John W. Linville

cfg80211: fix looping soft lockup in find_ie()

2009-09-02T19:29:04+00:00

The find_ie() function uses a size_t for the len parameter, and
directly uses len as a loop variable.  If any received packets
are malformed, it is possible for the decrease of len to overflow,
and since the result is unsigned, the loop will not terminate.
Change it to a signed int so the loop conditional works for
negative values.

This fixes the following soft lockup:

[38573.102007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230]
[38573.102007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan]
[38573.102007] irq event stamp: 2547724535
[38573.102007] hardirqs last  enabled at (2547724534): [] restore_all_notrace+0x0/0x18
[38573.102007] hardirqs last disabled at (2547724535): [] apic_timer_interrupt+0x28/0x34
[38573.102007] softirqs last  enabled at (92950144): [] __do_softirq+0x108/0x210
[38573.102007] softirqs last disabled at (92950274): [] _spin_lock_bh+0x14/0x80
[38573.102007]
[38573.102007] Pid: 2230, comm: phy0 Tainted: G        W  (2.6.31-rc7-wl #8) MacBook1,1
[38573.102007] EIP: 0060:[] EFLAGS: 00010292 CPU: 0
[38573.102007] EIP is at cmp_ies+0x30/0x180 [cfg80211]
[38573.102007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014
[38573.102007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c
[38573.102007]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[38573.102007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0
[38573.102007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[38573.102007] DR6: ffff0ff0 DR7: 00000400
[38573.102007] Call Trace:
[38573.102007]  [] cmp_bss+0xed/0x100 [cfg80211]
[38573.102007]  [] cfg80211_bss_update+0x84/0x410 [cfg80211]
[38573.102007]  [] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211]
[38573.102007]  [] ieee80211_bss_info_update+0x4f/0x180 [mac80211]
[38573.102007]  [] ieee80211_rx_bss_info+0x88/0xf0 [mac80211]
[38573.102007]  [] ? ieee802_11_parse_elems+0x27/0x30 [mac80211]
[38573.102007]  [] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211]
[38573.102007]  [] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211]
[38573.102007]  [] ? sched_clock+0x27/0xa0
[38573.102007]  [] ? sched_clock+0x27/0xa0
[38573.102007]  [] ? mark_held_locks+0x60/0x80
[38573.102007]  [] ? _spin_unlock_irqrestore+0x55/0x70
[38573.102007]  [] ? sub_preempt_count+0x85/0xc0
[38573.102007]  [] ? _spin_unlock_irqrestore+0x3e/0x70
[38573.102007]  [] ? skb_dequeue+0x4f/0x70
[38573.102007]  [] ieee80211_sta_work+0x91/0xb80 [mac80211]
[38573.102007]  [] ? sched_clock+0x27/0xa0
[38573.102007]  [] ? sub_preempt_count+0x85/0xc0
[38573.102007]  [] worker_thread+0x18f/0x320
[38573.102007]  [] ? worker_thread+0x12e/0x320
[38573.102007]  [] ? _spin_unlock_irqrestore+0x55/0x70
[38573.102007]  [] ? ieee80211_sta_work+0x0/0xb80 [mac80211]
[38573.102007]  [] ? autoremove_wake_function+0x0/0x50
[38573.102007]  [] ? worker_thread+0x0/0x320
[38573.102007]  [] kthread+0x84/0x90
[38573.102007]  [] ? kthread+0x0/0x90
[38573.102007]  [] kernel_thread_helper+0x7/0x10

Cc: stable@kernel.org
Signed-off-by: Bob Copeland 
Signed-off-by: John W. Linville

cfg80211: check lost scans later, fix bug

2009-08-28T18:40:25+00:00

When we lose a scan, cfg80211 tries to clean up after
the driver. However, it currently does this too early,
it does this in GOING_DOWN already instead of DOWN, so
it may happen with mac80211. Besides fixing this, also
make it more robust by leaking the scan request so if
the driver later actually finishes the scan, it won't
crash. Also check in ___cfg80211_scan_done whether a
scan request is still pending and exit if not.

Reported-by: Felix Fietkau 
Signed-off-by: Johannes Berg 
Tested-by: Felix Fietkau 
Signed-off-by: John W. Linville

cfg80211: check for and abort dangling scan requests

2009-08-14T13:14:07+00:00

If you trigger a scan request on an interface and then
take it down, or rmmod the module or unplug the device
the driver might "forget" to cancel the scan request.
That is a bug in the driver, but the current behaviour
is that we just hang endlessly waiting for the netdev
refcount to become 0 which it never will. To improve
robustness, check for this situation in cfg80211, warn
about it and clean up behind the driver. I don't just
clean up silently because it's likely that the driver
also has some internal state it has now leaked.

Additionally, this fixes a locking bug, clearing the
scan_req pointer should be done under the rdev lock.

Finally, we also need to _wait_ for the scan work and
not just abort it since it might be pending and wanting
to do a cleanup.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

cfg80211: fix alignment problem in scan request

2009-08-14T13:13:44+00:00

The memory layout for scan requests was rather wrong,
we put the scan SSIDs before the channels which could
lead to the channel pointers being unaligned in memory.
It turns out that using a pointer to the channel array
isn't necessary anyway since we can embed a zero-length
array into the struct.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

nl80211: add generation number to all dumps

2009-08-14T13:13:43+00:00

In order for userspace to be able to figure out whether
it obtained a consistent snapshot of data or not when
using netlink dumps, we need to have a generation number
in each dump message that indicates whether the list has
changed or not -- its value is arbitrary.

This patch adds such a number to all dumps, this needs
some mac80211 involvement to keep track of a generation
number to start with when adding/removing mesh paths or
stations.

The wiphy and netdev lists can be fully handled within
cfg80211, of course, but generation numbers need to be
stored there as well.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2009-08-13T00:44:53+00:00

Conflicts:
	arch/microblaze/include/asm/socket.h