Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ac9efbe authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'mac80211-next-for-davem-2016-12-09' of... 

Merge tag 'mac80211-next-for-davem-2016-12-09' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next



Johannes Berg says:

====================
Three fixes:
 * fix a logic bug introduced by a previous cleanup
 * fix nl80211 attribute confusing (trying to use
   a single attribute for two purposes)
 * fix a long-standing BSS leak that happens when an
   association attempt is abandoned
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 524a64c7 e6f462df

include/net/cfg80211.h

+11 −0
Original line number Diff line number Diff line
@@ -4685,6 +4685,17 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, 
 */

void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);



/**

 * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt

 * @dev: network device

 * @bss: The BSS entry with which association was abandoned.

 *

 * Call this whenever - for reasons reported through other API, like deauth RX,

 * an association attempt was abandoned.

 * This function may sleep. The caller must hold the corresponding wdev's mutex.

 */

void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss);



/**

 * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame

 * @dev: network device

include/uapi/linux/nl80211.h

+6 −1
Original line number Diff line number Diff line
@@ -323,7 +323,7 @@ 
 * @NL80211_CMD_GET_SCAN: get scan results

 * @NL80211_CMD_TRIGGER_SCAN: trigger a new scan with the given parameters

 *	%NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the

 *	probe requests at CCK rate or not. %NL80211_ATTR_MAC can be used to

 *	probe requests at CCK rate or not. %NL80211_ATTR_BSSID can be used to

 *	specify a BSSID to scan for; if not included, the wildcard BSSID will

 *	be used.

 * @NL80211_CMD_NEW_SCAN_RESULTS: scan notification (as a reply to
@@ -1977,6 +1977,9 @@ enum nl80211_commands { 
 * @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED: Indicates whether or not multicast

 *	packets should be send out as unicast to all stations (flag attribute).

 *

 * @NL80211_ATTR_BSSID: The BSSID of the AP. Note that %NL80211_ATTR_MAC is also

 *	used in various commands/events for specifying the BSSID.

 *

 * @NUM_NL80211_ATTR: total number of nl80211_attrs available

 * @NL80211_ATTR_MAX: highest attribute number currently defined

 * @__NL80211_ATTR_AFTER_LAST: internal use
@@ -2381,6 +2384,8 @@ enum nl80211_attrs { 


	NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED,



	NL80211_ATTR_BSSID,



	/* add attributes here, update the policy in nl80211.c */



	__NL80211_ATTR_AFTER_LAST,

net/mac80211/mlme.c

+12 −9
Original line number Diff line number Diff line
@@ -2518,7 +2518,7 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata, 
}



static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,

					 bool assoc)

					 bool assoc, bool abandon)

{

	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
@@ -2541,6 +2541,9 @@ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata, 
		mutex_lock(&sdata->local->mtx);

		ieee80211_vif_release_channel(sdata);

		mutex_unlock(&sdata->local->mtx);



		if (abandon)

			cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);

	}



	kfree(assoc_data);
@@ -2773,7 +2776,7 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, 
			   bssid, reason_code,

			   ieee80211_get_reason_code_string(reason_code));



		ieee80211_destroy_assoc_data(sdata, false);

		ieee80211_destroy_assoc_data(sdata, false, true);



		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);

		return;
@@ -3182,14 +3185,14 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, 
	if (status_code != WLAN_STATUS_SUCCESS) {

		sdata_info(sdata, "%pM denied association (code=%d)\n",

			   mgmt->sa, status_code);

		ieee80211_destroy_assoc_data(sdata, false);

		ieee80211_destroy_assoc_data(sdata, false, false);

		event.u.mlme.status = MLME_DENIED;

		event.u.mlme.reason = status_code;

		drv_event_callback(sdata->local, sdata, &event);

	} else {

		if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {

			/* oops -- internal error -- send timeout for now */

			ieee80211_destroy_assoc_data(sdata, false);

			ieee80211_destroy_assoc_data(sdata, false, false);

			cfg80211_assoc_timeout(sdata->dev, bss);

			return;

		}
@@ -3202,7 +3205,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, 
		 * recalc after assoc_data is NULL but before associated

		 * is set can cause the interface to go idle

		 */

		ieee80211_destroy_assoc_data(sdata, true);

		ieee80211_destroy_assoc_data(sdata, true, false);



		/* get uapsd queues configuration */

		uapsd_queues = 0;
@@ -3901,7 +3904,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata) 
				.u.mlme.status = MLME_TIMEOUT,

			};



			ieee80211_destroy_assoc_data(sdata, false);

			ieee80211_destroy_assoc_data(sdata, false, false);

			cfg80211_assoc_timeout(sdata->dev, bss);

			drv_event_callback(sdata->local, sdata, &event);

		}
@@ -4040,7 +4043,7 @@ void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata) 
					       WLAN_REASON_DEAUTH_LEAVING,

					       false, frame_buf);

		if (ifmgd->assoc_data)

			ieee80211_destroy_assoc_data(sdata, false);

			ieee80211_destroy_assoc_data(sdata, false, true);

		if (ifmgd->auth_data)

			ieee80211_destroy_auth_data(sdata, false);

		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
@@ -4949,7 +4952,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, 
					       IEEE80211_STYPE_DEAUTH,

					       req->reason_code, tx,

					       frame_buf);

		ieee80211_destroy_assoc_data(sdata, false);

		ieee80211_destroy_assoc_data(sdata, false, true);

		ieee80211_report_disconnect(sdata, frame_buf,

					    sizeof(frame_buf), true,

					    req->reason_code);
@@ -5024,7 +5027,7 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata) 
	sdata_lock(sdata);

	if (ifmgd->assoc_data) {

		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;

		ieee80211_destroy_assoc_data(sdata, false);

		ieee80211_destroy_assoc_data(sdata, false, false);

		cfg80211_assoc_timeout(sdata->dev, bss);

	}

	if (ifmgd->auth_data)

net/wireless/core.h

+1 −0
Original line number Diff line number Diff line
@@ -410,6 +410,7 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev); 
void cfg80211_sme_deauth(struct wireless_dev *wdev);

void cfg80211_sme_auth_timeout(struct wireless_dev *wdev);

void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev);

void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev);



/* internal helpers */

bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);

net/wireless/mlme.c

+12 −0
Original line number Diff line number Diff line
@@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss) 
}

EXPORT_SYMBOL(cfg80211_assoc_timeout);



void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)

{

	struct wireless_dev *wdev = dev->ieee80211_ptr;

	struct wiphy *wiphy = wdev->wiphy;



	cfg80211_sme_abandon_assoc(wdev);



	cfg80211_unhold_bss(bss_from_pub(bss));

	cfg80211_put_bss(wiphy, bss);

}

EXPORT_SYMBOL(cfg80211_abandon_assoc);



void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)

{

	struct wireless_dev *wdev = dev->ieee80211_ptr;