Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f617435 authored by Eliad Peller's avatar Eliad Peller Committed by Johannes Berg
Browse files

mac80211: move roc cookie assignment earlier 



ieee80211_start_roc_work() might add a new roc
to existing roc, and tell cfg80211 it has already
started.

However, this might happen before the roc cookie
was set, resulting in REMAIN_ON_CHANNEL (started)
event with null cookie. Consequently, it can make
wpa_supplicant go out of sync.

Fix it by setting the roc cookie earlier.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarEliad Peller <eliad@wizery.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 53d8ab29

net/mac80211/cfg.c

+18 −18
Original line number Diff line number Diff line
@@ -2638,6 +2638,24 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local, 
	INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work);

	INIT_LIST_HEAD(&roc->dependents);



	/*

	 * cookie is either the roc cookie (for normal roc)

	 * or the SKB (for mgmt TX)

	 */

	if (!txskb) {

		/* local->mtx protects this */

		local->roc_cookie_counter++;

		roc->cookie = local->roc_cookie_counter;

		/* wow, you wrapped 64 bits ... more likely a bug */

		if (WARN_ON(roc->cookie == 0)) {

			roc->cookie = 1;

			local->roc_cookie_counter++;

		}

		*cookie = roc->cookie;

	} else {

		*cookie = (unsigned long)txskb;

	}



	/* if there's one pending or we're scanning, queue this one */

	if (!list_empty(&local->roc_list) ||

	    local->scanning || local->radar_detect_enabled)
@@ -2772,24 +2790,6 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local, 
	if (!queued)

		list_add_tail(&roc->list, &local->roc_list);



	/*

	 * cookie is either the roc cookie (for normal roc)

	 * or the SKB (for mgmt TX)

	 */

	if (!txskb) {

		/* local->mtx protects this */

		local->roc_cookie_counter++;

		roc->cookie = local->roc_cookie_counter;

		/* wow, you wrapped 64 bits ... more likely a bug */

		if (WARN_ON(roc->cookie == 0)) {

			roc->cookie = 1;

			local->roc_cookie_counter++;

		}

		*cookie = roc->cookie;

	} else {

		*cookie = (unsigned long)txskb;

	}



	return 0;

}