1. 10 Feb, 2014 1 commit
  2. 09 Feb, 2014 2 commits
    • David S. Miller's avatar
      Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless · 872c7e6f
      David S. Miller authored
      John W. Linville says:
      
      ====================
      Please pull this batch of fixes intended for the 3.14 stream!
      
      For the mac80211 bits, Johannes says:
      
      "This is just a collection of small fixes, the commit logs explain the
      details. The only thing that isn't strictly a fix is the 5/10 MHz
      enabling, I had forgotten this and there's little point in waiting
      longer. The patch simply removes the force-disable code that I put in
      when there was a problem with the userspace API (that has long been
      fixed.)"
      
      For the iwlwifi bits, Emmanuel says:
      
      "I have an important fix that disables A band in case the driver thought
      it was enabled, and the firmware disagreed. We ended up making the
      firmware unhappy. I also fix the station table in AP mode and fix the
      scan while we have BT working.
      Johannes removes a static variable that could potentially lead to to
      issues on multi-device setups and disables scheduled scan to avoid
      issues with old versions of wpa_supplicant.
      A small fix from David on scan and a few new device IDs for 7265."
      
      On top of that...
      
      Oleksij Rempel adds a USB ID to the ar5523 driver and changes the
      default powersave setting for ath9k_htc to "off", due to observed
      stability issues (based on an equivalent ath9k patch).
      
      Stanislaw Gruszka similarly disables powersave for a couple of rt2x00
      drivers.  He also fixes a couple of scheduling while atomic issues
      in ath9k_htc.
      
      Sujith Manoharan rounds-out the powersave disables with one for ath9k.
      He also fixes a build prolem with ath9k on ARM and fixes an ath9k Tx
      power calculation.
      
      Finally, Andrea Merello fixes a couple of lingering DMA mapping
      problems in the rtl8180 driver.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      872c7e6f
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · f41f0319
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter/nftables/IPVS fixes for net
      
      The following patchset contains Netfilter/IPVS fixes, mostly nftables
      fixes, most relevantly they are:
      
      * Fix a crash in the h323 conntrack NAT helper due to expectation list
        corruption, from Alexey Dobriyan.
      
      * A couple of RCU race fixes for conntrack, one manifests by hitting BUG_ON
        in nf_nat_setup_info() and the destroy path, patches from Andrey Vagin and
        me.
      
      * Dump direction attribute in nft_ct only if it is set, from Arturo
        Borrero.
      
      * Fix IPVS bug in its own connection tracking system that may lead to
        copying only 4 bytes of the IPv6 address when initializing the
        ip_vs_conn object, from Michal Kubecek.
      
      * Fix -EBUSY errors in nftables when deleting the rules, chain and tables
        in a row due mixture of asynchronous and synchronous object releasing,
        from me.
      
      * Three fixes for the nf_tables set infrastructure when using intervals and
        mappings, from me.
      
      * Four patches to fixing the nf_tables log, reject and ct expressions from
        the new inet table, from Patrick McHardy.
      
      * Fix memory overrun in the map that is used to dynamically allocate names
        from anonymous sets, also from Patrick.
      
      * Fix a potential oops if you dump a set with NFPROTO_UNSPEC and a table
        name, from Patrick McHardy.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f41f0319
  3. 07 Feb, 2014 24 commits
  4. 06 Feb, 2014 13 commits
    • andrea.merello's avatar
      rtl8180: Add error check for pci_map_single return value in TX path · 348f7d4a
      andrea.merello authored
      Orignal code will not detect a DMA mapping failure, causing the HW
      to attempt a DMA from an invalid address.
      
      This patch add the error check and eventually simply drops the TX
      packet if we can't map it for DMA.
      Signed-off-by: default avatarandrea merello <andrea.merello@gmail.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      348f7d4a
    • andrea.merello's avatar
      rtl8180: Add error check for pci_map_single return value in RX path · 2b4db05e
      andrea.merello authored
      In original code the old RX DMA buffer is unmapped and processed and at the end
      of the isr a new buffer is mapped with pci_map_single and attached to the RX
      descriptor.
      
      If pci_map_single fails then the RX descriptor remains with no valid DMA buffer
      attached.
      In this condition the DMA will target where it shouldn't with obvious evil
      consequences.
      
      Simply avoiding re-arming the descriptor will prevent buggy DMA but it will
      result soon in RX stuck.
      
      This patch move the DMA mapping of the new buffer at the beginning of the ISR
      (and it adds error check for pci_map_single success/fail).
      
      If the DMA mapping fails then we do not unmap the old buffer and we re-arm the
      descriptor without processing it, with the old DMA buffer still attached.
      
      In this way we lose the currently RX-ed packet, but whenever next calls to
      pci_map_single will succeed again,then the RX process will go on without stuck.
      Signed-off-by: default avatarandrea merello <andrea.merello@gmail.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      2b4db05e
    • John W. Linville's avatar
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: fix racy rule deletion · 0165d932
      Pablo Neira Ayuso authored
      We may lost race if we flush the rule-set (which happens asynchronously
      via call_rcu) and we try to remove the table (that userspace assumes
      to be empty).
      
      Fix this by recovering synchronous rule and chain deletion. This was
      introduced time ago before we had no batch support, and synchronous
      rule deletion performance was not good. Now that we have the batch
      support, we can just postpone the purge of old rule in a second step
      in the commit phase. All object deletions are synchronous after this
      patch.
      
      As a side effect, we save memory as we don't need rcu_head per rule
      anymore.
      
      Cc: Patrick McHardy <kaber@trash.net>
      Reported-by: default avatarArturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      0165d932
    • Patrick McHardy's avatar
      netfilter: nf_tables: fix log/queue expressions for NFPROTO_INET · b8ecbee6
      Patrick McHardy authored
      The log and queue expressions both store the family during ->init() and
      use it to deliver packets. This is wrong when used in NFPROTO_INET since
      they should both deliver to the actual AF of the packet, not the dummy
      NFPROTO_INET.
      
      Use the family from the hook ops to fix this.
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      b8ecbee6
    • Johannes Berg's avatar
      mac80211: fix virtual monitor interface iteration · fab57a6c
      Johannes Berg authored
      During channel context assignment, the interface should
      be found by interface iteration, so we need to assign the
      pointer before the channel context.
      Reported-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      Tested-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      fab57a6c
    • Johannes Berg's avatar
      mac80211: fix fragmentation code, particularly for encryption · 338f977f
      Johannes Berg authored
      The "new" fragmentation code (since my rewrite almost 5 years ago)
      erroneously sets skb->len rather than using skb_trim() to adjust
      the length of the first fragment after copying out all the others.
      This leaves the skb tail pointer pointing to after where the data
      originally ended, and thus causes the encryption MIC to be written
      at that point, rather than where it belongs: immediately after the
      data.
      
      The impact of this is that if software encryption is done, then
       a) encryption doesn't work for the first fragment, the connection
          becomes unusable as the first fragment will never be properly
          verified at the receiver, the MIC is practically guaranteed to
          be wrong
       b) we leak up to 8 bytes of plaintext (!) of the packet out into
          the air
      
      This is only mitigated by the fact that many devices are capable
      of doing encryption in hardware, in which case this can't happen
      as the tail pointer is irrelevant in that case. Additionally,
      fragmentation is not used very frequently and would normally have
      to be configured manually.
      
      Fix this by using skb_trim() properly.
      
      Cc: stable@vger.kernel.org
      Fixes: 2de8e0d9 ("mac80211: rewrite fragmentation")
      Reported-by: default avatarJouni Malinen <j@w1.fi>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      338f977f
    • Sujith Manoharan's avatar
      mac80211: Fix IBSS disconnect · d4c80d9d
      Sujith Manoharan authored
      Currently, when a station leaves an IBSS network, the
      corresponding BSS is not dropped from cfg80211 if there are
      other active stations in the network. But, the small
      window that is present when trying to determine a station's
      status based on IEEE80211_IBSS_MERGE_INTERVAL introduces
      a race.
      
      Instead of trying to keep the BSS, always remove it when
      leaving an IBSS network. There is not much benefit to retain
      the BSS entry since it will be added with a subsequent join
      operation.
      
      This fixes an issue where a dangling BSS entry causes ath9k
      to wait for a beacon indefinitely.
      
      Cc: <stable@vger.kernel.org>
      Reported-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
      Signed-off-by: default avatarSujith Manoharan <c_manoha@qca.qualcomm.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      d4c80d9d
    • Emmanuel Grumbach's avatar
      mac80211: release the channel in error path in start_ap · 0297ea17
      Emmanuel Grumbach authored
      When the driver cannot start the AP or when the assignement
      of the beacon goes wrong, we need to unassign the vif.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      0297ea17
    • Johannes Berg's avatar
      cfg80211: send scan results from work queue · f9d15d16
      Johannes Berg authored
      Due to the previous commit, when a scan finishes, it is in theory
      possible to hit the following sequence:
       1. interface starts being removed
       2. scan is cancelled by driver and cfg80211 is notified
       3. scan done work is scheduled
       4. interface is removed completely, rdev->scan_req is freed,
          event sent to userspace but scan done work remains pending
       5. new scan is requested on another virtual interface
       6. scan done work runs, freeing the still-running scan
      
      To fix this situation, hang on to the scan done message and block
      new scans while that is the case, and only send the message from
      the work function, regardless of whether the scan_req is already
      freed from interface removal. This makes step 5 above impossible
      and changes step 6 to be
       5. scan done work runs, sending the scan done message
      
      As this can't work for wext, so we send the message immediately,
      but this shouldn't be an issue since we still return -EBUSY.
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      f9d15d16
    • Johannes Berg's avatar
      cfg80211: fix scan done race · a617302c
      Johannes Berg authored
      When an interface/wdev is removed, any ongoing scan should be
      cancelled by the driver. This will make it call cfg80211, which
      only queues a work struct. If interface/wdev removal is quick
      enough, this can leave the scan request pending and processed
      only after the interface is gone, causing a use-after-free.
      
      Fix this by making sure the scan request is not pending after
      the interface is destroyed. We can't flush or cancel the work
      item due to locking concerns, but when it'll run it shouldn't
      find anything to do. This leaves a potential issue, if a new
      scan gets requested before the work runs, it prematurely stops
      the running scan, potentially causing another crash. I'll fix
      that in the next patch.
      
      This was particularly observed with P2P_DEVICE wdevs, likely
      because freeing them is quicker than freeing netdevs.
      Reported-by: default avatarAndrei Otcheretianski <andrei.otcheretianski@intel.com>
      Fixes: 4a58e7c3 ("cfg80211: don't "leak" uncompleted scans")
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      a617302c
    • Emmanuel Grumbach's avatar
      mac80211: avoid deadlock revealed by lockdep · 8ffcc704
      Emmanuel Grumbach authored
      sdata->u.ap.request_smps_work can’t be flushed synchronously
      under wdev_lock(wdev) since ieee80211_request_smps_ap_work
      itself locks the same lock.
      While at it, reset the driver_smps_mode when the ap is
      stopped to its default: OFF.
      
      This solves:
      
      ======================================================
      [ INFO: possible circular locking dependency detected ]
      3.12.0-ipeer+ #2 Tainted: G           O
      -------------------------------------------------------
      rmmod/2867 is trying to acquire lock:
        ((&sdata->u.ap.request_smps_work)){+.+...}, at: [<c105b8d0>] flush_work+0x0/0x90
      
      but task is already holding lock:
        (&wdev->mtx){+.+.+.}, at: [<f9b32626>] cfg80211_stop_ap+0x26/0x230 [cfg80211]
      
      which lock already depends on the new lock.
      
      the existing dependency chain (in reverse order) is:
      
      -> #1 (&wdev->mtx){+.+.+.}:
              [<c10aefa9>] lock_acquire+0x79/0xe0
              [<c1607a1a>] mutex_lock_nested+0x4a/0x360
              [<fb06288b>] ieee80211_request_smps_ap_work+0x2b/0x50 [mac80211]
              [<c105cdd8>] process_one_work+0x198/0x450
              [<c105d469>] worker_thread+0xf9/0x320
              [<c10669ff>] kthread+0x9f/0xb0
              [<c1613397>] ret_from_kernel_thread+0x1b/0x28
      
      -> #0 ((&sdata->u.ap.request_smps_work)){+.+...}:
              [<c10ae9df>] __lock_acquire+0x183f/0x1910
              [<c10aefa9>] lock_acquire+0x79/0xe0
              [<c105b917>] flush_work+0x47/0x90
              [<c105d867>] __cancel_work_timer+0x67/0xe0
              [<c105d90f>] cancel_work_sync+0xf/0x20
              [<fb0765cc>] ieee80211_stop_ap+0x8c/0x340 [mac80211]
              [<f9b3268c>] cfg80211_stop_ap+0x8c/0x230 [cfg80211]
              [<f9b0d8f9>] cfg80211_leave+0x79/0x100 [cfg80211]
              [<f9b0da72>] cfg80211_netdev_notifier_call+0xf2/0x4f0 [cfg80211]
              [<c160f2c9>] notifier_call_chain+0x59/0x130
              [<c106c6de>] __raw_notifier_call_chain+0x1e/0x30
              [<c106c70f>] raw_notifier_call_chain+0x1f/0x30
              [<c14f8213>] call_netdevice_notifiers_info+0x33/0x70
              [<c14f8263>] call_netdevice_notifiers+0x13/0x20
              [<c14f82a4>] __dev_close_many+0x34/0xb0
              [<c14f83fe>] dev_close_many+0x6e/0xc0
              [<c14f9c77>] rollback_registered_many+0xa7/0x1f0
              [<c14f9dd4>] unregister_netdevice_many+0x14/0x60
              [<fb06f4d9>] ieee80211_remove_interfaces+0xe9/0x170 [mac80211]
              [<fb055116>] ieee80211_unregister_hw+0x56/0x110 [mac80211]
              [<fa3e9396>] iwl_op_mode_mvm_stop+0x26/0xe0 [iwlmvm]
              [<f9b9d8ca>] _iwl_op_mode_stop+0x3a/0x70 [iwlwifi]
              [<f9b9d96f>] iwl_opmode_deregister+0x6f/0x90 [iwlwifi]
              [<fa405179>] __exit_compat+0xd/0x19 [iwlmvm]
              [<c10b8bf9>] SyS_delete_module+0x179/0x2b0
              [<c1613421>] sysenter_do_call+0x12/0x32
      
      Fixes: 687da132 ("mac80211: implement SMPS for AP")
      Cc: <stable@vger.kernel.org> [3.13]
      Reported-by: default avatarIlan Peer <ilan.peer@intel.com>
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      8ffcc704
    • Johannes Berg's avatar
      cfg80211: re-enable 5/10 MHz support · 5a6aa705
      Johannes Berg authored
      Unfortunately I forgot this during the merge window, but the
      patch seems small enough to go in as a fix. The userspace API
      bug that was the reason for disabling it has long been fixed.
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      5a6aa705