Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 71ecfa18 authored by Johannes Berg's avatar Johannes Berg Committed by John W. Linville
Browse files

mac80211: clean up remain-on-channel on interface stop 



When any interface goes down, it could be the one that we
were doing a remain-on-channel with. We therefore need to
cancel the remain-on-channel and flush the related work
structs so they don't run after the interface has been
removed or even destroyed.

It's also possible in this case that an off-channel SKB
was never transmitted, so free it if this is the case.
Note that this can also happen if the driver finishes
the off-channel period without ever starting it.

Cc: stable@kernel.org
Reported-by: default avatarNirav Shah <nirav.j2.shah@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 1ae2fc25

net/mac80211/iface.c

+12 −0
Original line number Original line Diff line number Diff line
@@ -637,6 +637,18 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, 
		ieee80211_configure_filter(local);

		ieee80211_configure_filter(local);

		break;

		break;

	default:

	default:

		mutex_lock(&local->mtx);

		if (local->hw_roc_dev == sdata->dev &&

		    local->hw_roc_channel) {

			/* ignore return value since this is racy */

			drv_cancel_remain_on_channel(local);

			ieee80211_queue_work(&local->hw, &local->hw_roc_done);

		}

		mutex_unlock(&local->mtx);



		flush_work(&local->hw_roc_start);

		flush_work(&local->hw_roc_done);



		flush_work(&sdata->work);

		flush_work(&sdata->work);

		/*

		/*

		 * When we get here, the interface is marked down.

		 * When we get here, the interface is marked down.

net/mac80211/offchannel.c

+16 −0
Original line number Original line Diff line number Diff line
@@ -234,6 +234,22 @@ static void ieee80211_hw_roc_done(struct work_struct *work) 
		return;

		return;

	}

	}





	/* was never transmitted */

	if (local->hw_roc_skb) {

		u64 cookie;



		cookie = local->hw_roc_cookie ^ 2;



		cfg80211_mgmt_tx_status(local->hw_roc_dev, cookie,

					local->hw_roc_skb->data,

					local->hw_roc_skb->len, false,

					GFP_KERNEL);



		kfree_skb(local->hw_roc_skb);

		local->hw_roc_skb = NULL;

		local->hw_roc_skb_for_status = NULL;

	}



	if (!local->hw_roc_for_tx)

	if (!local->hw_roc_for_tx)

		cfg80211_remain_on_channel_expired(local->hw_roc_dev,

		cfg80211_remain_on_channel_expired(local->hw_roc_dev,

						   local->hw_roc_cookie,

						   local->hw_roc_cookie,