23 May, 2014

1 commit


19 May, 2014

1 commit


14 May, 2014

1 commit


05 May, 2014

1 commit

  • cfg80211 is notified about connection failures by
    __cfg80211_connect_result() call. However, this
    function currently does not free cfg80211 sme.

    This results in hanging connection attempts in some cases

    e.g. when mac80211 authentication attempt is denied,
    we have this function call:
    ieee80211_rx_mgmt_auth() -> cfg80211_rx_mlme_mgmt() ->
    cfg80211_process_auth() -> cfg80211_sme_rx_auth() ->
    __cfg80211_connect_result()

    but cfg80211_sme_free() is never get called.

    Fixes: ceca7b712 ("cfg80211: separate internal SME implementation")
    Cc: stable@vger.kernel.org (3.10+)
    Signed-off-by: Eliad Peller
    Signed-off-by: Johannes Berg

    Eliad Peller
     

29 Apr, 2014

1 commit


25 Apr, 2014

1 commit


09 Apr, 2014

1 commit

  • Wdev->ssid_len has already been set in cfg80211_connect() and is equal
    to connect->ssid_len. Use wdev->ssid_len instead of connect->ssid_len
    so it will be consistent with previous ssid assignment statement.

    If bss is found in cfg80211_get_conn_bss(), wdev->conn->state is set
    to CFG80211_CONN_AUTHENTICATE_NEXT in there. So it's not needed to set
    it manually to CFG80211_CONN_AUTHENTICATE_NEXT if bss is found in that
    function.

    Signed-off-by: Zhao, Gang
    Signed-off-by: Johannes Berg

    Zhao, Gang
     

20 Mar, 2014

1 commit


06 Feb, 2014

1 commit

  • Due to the previous commit, when a scan finishes, it is in theory
    possible to hit the following sequence:
    1. interface starts being removed
    2. scan is cancelled by driver and cfg80211 is notified
    3. scan done work is scheduled
    4. interface is removed completely, rdev->scan_req is freed,
    event sent to userspace but scan done work remains pending
    5. new scan is requested on another virtual interface
    6. scan done work runs, freeing the still-running scan

    To fix this situation, hang on to the scan done message and block
    new scans while that is the case, and only send the message from
    the work function, regardless of whether the scan_req is already
    freed from interface removal. This makes step 5 above impossible
    and changes step 6 to be
    5. scan done work runs, sending the scan done message

    As this can't work for wext, so we send the message immediately,
    but this shouldn't be an issue since we still return -EBUSY.

    Signed-off-by: Johannes Berg

    Johannes Berg
     

14 Jan, 2014

1 commit


09 Jan, 2014

1 commit


07 Jan, 2014

1 commit


19 Dec, 2013

1 commit

  • This allows QoS mapping from external networks to be implemented as
    defined in IEEE Std 802.11-2012, 10.24.9. APs can use this to advertise
    DSCP ranges and exceptions for mapping frames to a specific UP over
    Wi-Fi.

    The payload of the QoS Map Set element (IEEE Std 802.11-2012, 8.4.2.97)
    is sent to the driver through the new NL80211_ATTR_QOS_MAP attribute to
    configure the local behavior either on the AP (based on local
    configuration) or on a station (based on information received from the
    AP).

    Signed-off-by: Kyeyoon Park
    Signed-off-by: Jouni Malinen
    Signed-off-by: Johannes Berg

    Kyeyoon Park
     

05 Dec, 2013

1 commit

  • cfg80211 allows re-association in managed mode and if a user
    wants to re-associate to the same AP network after the time
    period of IEEE80211_SCAN_RESULT_EXPIRE, cfg80211 warns with
    the following message on receiving the connect result event.

    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 13984 at net/wireless/sme.c:658
    __cfg80211_connect_result+0x3a6/0x3e0 [cfg80211]()
    Call Trace:
    [] dump_stack+0x46/0x58
    [] warn_slowpath_common+0x87/0xb0
    [] warn_slowpath_null+0x15/0x20
    [] __cfg80211_connect_result+0x3a6/0x3e0 [cfg80211]
    [] ? update_rq_clock+0x2b/0x50
    [] ? update_curr+0x1/0x160
    [] cfg80211_process_wdev_events+0xb2/0x1c0 [cfg80211]
    [] ? pick_next_task_fair+0x63/0x170
    [] cfg80211_process_rdev_events+0x38/0x90 [cfg80211]
    [] cfg80211_event_work+0x1d/0x30 [cfg80211]
    [] process_one_work+0x17f/0x420
    [] worker_thread+0x11a/0x370
    [] ? rescuer_thread+0x2f0/0x2f0
    [] kthread+0xbb/0xc0
    [] ? kthread_create_on_node+0x120/0x120
    [] ret_from_fork+0x7c/0xb0
    [] ? kthread_create_on_node+0x120/0x120
    ---[ end trace 61f3bddc9c4981f7 ]---

    The reason is that, in connect result event cfg80211 unholds
    the BSS to which the device is associated (and was held so
    far). So, for the event with status successful, when cfg80211
    wants to get that BSS from the device's BSS list it gets a
    NULL BSS because the BSS has been expired and unheld already.

    Fix it by reshuffling the code.

    Signed-off-by: Ujjal Roy
    Signed-off-by: Johannes Berg

    Ujjal Roy
     

09 Oct, 2013

1 commit


14 Aug, 2013

1 commit

  • Neil Brown reports that with libertas, my recent cfg80211
    SME changes in commit ceca7b7121795ef81bd598a240d53a92566
    ("cfg80211: separate internal SME implementation") broke
    libertas suspend because it we now asked it to disconnect
    while already disconnected.

    The problematic change is in cfg80211_disconnect() as it
    previously checked the SME state and now calls the driver
    disconnect operation unconditionally.

    Fix this by checking if there's a current_bss indicating
    a connection, and do nothing if not.

    Reported-and-tested-by: Neil Brown
    Signed-off-by: Johannes Berg

    Johannes Berg
     

16 Jul, 2013

1 commit

  • When splitting the SME implementation from the MLME code,
    I introduced a few bugs:
    * association failures no longer sent a connect-failure event
    * getting disassociated from the AP caused deauth to be sent
    but state wasn't cleaned up, leading to warnings
    * authentication failures weren't cleaned up properly, causing
    new connection attempts to warn and fail

    Fix these bugs.

    Signed-off-by: Johannes Berg

    Johannes Berg
     

24 Jun, 2013

2 commits


20 Jun, 2013

1 commit

  • This fixes the potential issue that the BSS struct that we use
    and later assign to wdev->current_bss is removed from the scan
    list while associating.

    Also warn when we don't have a BSS struct in connect_result
    unless it's from a driver that only has the connect() API.

    Signed-off-by: Johannes Berg

    Johannes Berg
     

04 Jun, 2013

1 commit

  • The current internal SME implementation in cfg80211 is
    very mixed up with the MLME handling, which has been
    causing issues for a long time. There are three things
    that the implementation has to provide:
    * a basic SME implementation for nl80211's connect()
    call (for drivers implementing auth/assoc, which is
    really just mac80211) and wireless extensions
    * MLME events for the userspace SME
    * SME events (connected, disconnected etc.) for all
    different SME implementation possibilities (driver,
    cfg80211 and userspace)

    To achieve these goals it isn't necessary to track the
    software SME's connection status outside of it's state
    (which is the part that caused many issues.) Instead,
    track it only in the SME data (wdev->conn) and in the
    general case only track whether the wdev is connected
    or not (via wdev->current_bss.)

    Also separate the internal implementation to not have
    callbacks from the SME events, but rather call it from
    the API functions that the driver (or rather mac80211)
    calls. This separates the code better.

    Signed-off-by: Johannes Berg

    Johannes Berg
     

25 May, 2013

3 commits

  • By making all the API functions require wdev locking we
    can clean up the API a bit, getting rid of the locking
    version of each function. This also decreases the size
    of cfg80211 by a small amount.

    Signed-off-by: Johannes Berg

    Johannes Berg
     
  • By making all the API functions require wdev locking we
    can clean up the API a bit, getting rid of the locking
    version of each function. This also decreases the size
    of cfg80211 by a small amount.

    Signed-off-by: Johannes Berg

    Johannes Berg
     
  • Virtually all code paths in cfg80211 already (need to) hold
    the RTNL. As such, there's little point in having another
    four mutexes for various parts of the code, they just cause
    lock ordering issues (and much of the time, the RTNL and a
    few of the others need thus be held.)

    Simplify all this by getting rid of the extra four mutexes
    and just use the RTNL throughout. Only a few code changes
    were needed to do this and we can get rid of a work struct
    for bonus points.

    Signed-off-by: Johannes Berg

    Johannes Berg
     

24 May, 2013

1 commit

  • If a P2P-Device is present and another virtual interface triggers
    the connection work, the system crash because it tries to check
    if the P2P-Device's netdev (which doesn't exist) is up. Skip any
    wdevs that have no netdev to fix this.

    Cc: stable@vger.kernel.org
    Reported-by: YanBo
    Signed-off-by: Johannes Berg

    Johannes Berg
     

17 May, 2013

1 commit

  • When the interface goes down, there's no need to call
    cfg80211_mlme_down() after __cfg80211_disconnect() as
    the latter will call the former (if appropriate.)

    Also, in __cfg80211_disconnect(), if the cfg80211 SME
    isn't used, __cfg80211_disconnected() may still need
    to be called (depending on the current state) so that
    the SME state gets cleared.

    Signed-off-by: Johannes Berg

    Johannes Berg
     

10 Apr, 2013

1 commit


31 Mar, 2013

1 commit

  • Introduced in f9f475292dbb0e7035fb6661d1524761ea0888d9
    ("cfg80211: always check for scan end on P2P device")

    cfg80211_conn_scan() which requires sched_scan_mtx to be held can be called
    from cfg80211_conn_work(). Without this we are hitting multiple warnings like
    the following:

    WARNING: at net/wireless/sme.c:88 cfg80211_conn_scan+0x1dc/0x3a0 [cfg80211]()
    Hardware name: 0578A21
    Modules linked in: ...
    Pid: 620, comm: kworker/3:1 Not tainted 3.9.0-rc4-next-20130328+ #326
    Call Trace:
    [] warn_slowpath_common+0x72/0xa0
    [] warn_slowpath_null+0x22/0x30
    [] cfg80211_conn_scan+0x1dc/0x3a0 [cfg80211]
    [] cfg80211_conn_do_work+0x94/0x380 [cfg80211]
    [] cfg80211_conn_work+0xa2/0x130 [cfg80211]
    [] process_one_work+0x198/0x450

    Signed-off-by: Artem Savkov
    Signed-off-by: Johannes Berg

    Artem Savkov
     

30 Mar, 2013

1 commit


24 Mar, 2013

1 commit

  • If a P2P device wdev is removed while it has a scan, then the
    scan completion might crash later as it is already freed by
    that time. To avoid the crash always check the scan completion
    when the P2P device is being removed for some reason. If the
    driver already canceled it, don't want and free it, otherwise
    warn and leak it to avoid later crashes.

    In order to do this, locking needs to be changed away from the
    rdev mutex (which can't always be guaranteed). For now, use
    the sched_scan_mtx instead, I'll rename it to just scan_mtx in
    a later patch.

    Signed-off-by: Johannes Berg

    Johannes Berg
     

20 Mar, 2013

1 commit

  • If wpa_supplicant and iw/iwconfig are used together, very
    rarely the system crashes. It seems to be related to the
    connection parameters not being set up, but it's not all
    clear to me how this happens. In any case, checking that
    the conn pointer exists here is probably a good idea.

    Signed-off-by: Johannes Berg

    Johannes Berg
     

06 Mar, 2013

2 commits


12 Feb, 2013

1 commit


17 Jan, 2013

1 commit


03 Jan, 2013

1 commit


30 Nov, 2012

1 commit

  • When a BSS struct is updated, the IEs are currently
    overwritten or freed. This can lead to races if some
    other CPU is accessing the BSS struct and using the
    IEs concurrently.

    Fix this by always allocating the IEs in a new struct
    that holds the data and length and protecting access
    to this new struct with RCU.

    Signed-off-by: Johannes Berg

    Johannes Berg
     

18 Oct, 2012

2 commits

  • This will allow adding central tracing like in mac80211.

    Signed-off-by: Hila Gonen
    Reviewed-by: Emmanuel Grumbach
    Reviewed-by: Johannes Berg
    Signed-off-by: Johannes Berg

    Hila Gonen
     
  • Add an NL80211_SCAN_FLAG_FLUSH flag that causes old bss cache
    entries to be flushed on scan completion. This is useful for
    collecting guaranteed fresh scan/survey result (e.g. on resume).

    For normal scan, flushing only happens on successful completion
    of a scan; i.e. it does not happen if the scan is aborted.
    For scheduled scan, previous scan results are flushed everytime
    when we get new scan results.

    This feature is enabled by default. Drivers can disable it by
    unsetting the NL80211_FEATURE_SCAN_FLUSH flag.

    Signed-off-by: Sam Leffler
    Tested-by: Amitkumar Karwar
    Signed-off-by: Amitkumar Karwar
    Signed-off-by: Bing Zhao
    [invert polarity of feature flag to account for old kernels]
    Signed-off-by: Johannes Berg

    Sam Leffler
     

17 Oct, 2012

1 commit