* [PATCH 0/2] two mac80211 fixes @ 2012-02-25 20:40 Johannes Berg 2012-02-25 20:40 ` [PATCH 1/2] mac80211: fix auth/assoc data & timer leak Johannes Berg 2012-02-25 20:40 ` [PATCH 2/2] mac80211: fix sta_info_flush() return value Johannes Berg 0 siblings, 2 replies; 4+ messages in thread From: Johannes Berg @ 2012-02-25 20:40 UTC (permalink / raw) To: John Linville; +Cc: linux-wireless One fix for a bug introduced in my auth/assoc redesign, and a fix for a buglet that masked a warning we should have gotten in the other case which would have helped debugging it. johannes ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 1/2] mac80211: fix auth/assoc data & timer leak 2012-02-25 20:40 [PATCH 0/2] two mac80211 fixes Johannes Berg @ 2012-02-25 20:40 ` Johannes Berg 2012-02-25 20:48 ` [PATCH 1/2 v2] " Johannes Berg 2012-02-25 20:40 ` [PATCH 2/2] mac80211: fix sta_info_flush() return value Johannes Berg 1 sibling, 1 reply; 4+ messages in thread From: Johannes Berg @ 2012-02-25 20:40 UTC (permalink / raw) To: John Linville; +Cc: linux-wireless From: Johannes Berg <johannes.berg@intel.com> When removing an interface while it is in the process of authenticating or associating, we leak the auth_data or assoc_data, and leave the timer pending. The timer then crashes the system when it fires as its data is gone. Fix this by explicitly deleting all the data when the interface is removed. This uncovered another bug -- this problem should have been detected by the sta_info_flush() warning but that function doesn't ever return non-zero, I'll fix that in a separate patch. Reported-by: Hieu Nguyen <hieux.c.nguyen@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> --- net/mac80211/ieee80211_i.h | 1 + net/mac80211/iface.c | 2 ++ net/mac80211/mlme.c | 12 ++++++++++++ 3 files changed, 15 insertions(+), 0 deletions(-) diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index feddd8a..38bfca3 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1181,6 +1181,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb); void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata); void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata); +void ieee80211_mgd_teardown(struct ieee80211_sub_if_data *sdata); /* IBSS code */ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local); diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index a495587..e2e45dc 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -654,6 +654,8 @@ static void ieee80211_teardown_sdata(struct net_device *dev) if (ieee80211_vif_is_mesh(&sdata->vif)) mesh_rmc_free(sdata); + else if (sdata->vif.type == NL80211_IFTYPE_STATION) + ieee80211_mgd_teardown(sdata); flushed = sta_info_flush(local, sdata); WARN_ON(flushed); diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 2d8a2b6..b1c40f7 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -3532,6 +3532,18 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata, return 0; } +void ieee80211_mgd_teardown(struct ieee80211_sub_if_data *sdata) +{ + struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; + + mutex_lock(&ifmgd->mtx); + if (ifmgd->assoc_data) + ieee80211_destroy_assoc_data(sdata, false); + if (ifmgd->auth_data) + ieee80211_destroy_auth_data(sdata, false); + mutex_unlock(&ifmgd->mtx); +} + void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif, enum nl80211_cqm_rssi_threshold_event rssi_event, gfp_t gfp) ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 1/2 v2] mac80211: fix auth/assoc data & timer leak 2012-02-25 20:40 ` [PATCH 1/2] mac80211: fix auth/assoc data & timer leak Johannes Berg @ 2012-02-25 20:48 ` Johannes Berg 0 siblings, 0 replies; 4+ messages in thread From: Johannes Berg @ 2012-02-25 20:48 UTC (permalink / raw) To: John Linville; +Cc: linux-wireless From: Johannes Berg <johannes.berg@intel.com> When removing an interface while it is in the process of authenticating or associating, we leak the auth_data or assoc_data, and leave the timer pending. The timer then crashes the system when it fires as its data is gone. Fix this by explicitly deleting all the data when the interface is removed. This uncovered another bug -- this problem should have been detected by the sta_info_flush() warning but that function doesn't ever return non-zero, I'll fix that in a separate patch. Reported-by: Hieu Nguyen <hieux.c.nguyen@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> --- v2: also delete timer diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index feddd8a..38bfca3 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1181,6 +1181,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb); void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata); void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata); +void ieee80211_mgd_teardown(struct ieee80211_sub_if_data *sdata); /* IBSS code */ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local); diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index a495587..e2e45dc 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -654,6 +654,8 @@ static void ieee80211_teardown_sdata(struct net_device *dev) if (ieee80211_vif_is_mesh(&sdata->vif)) mesh_rmc_free(sdata); + else if (sdata->vif.type == NL80211_IFTYPE_STATION) + ieee80211_mgd_teardown(sdata); flushed = sta_info_flush(local, sdata); WARN_ON(flushed); diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 2d8a2b6..be35827 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -3532,6 +3532,19 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata, return 0; } +void ieee80211_mgd_teardown(struct ieee80211_sub_if_data *sdata) +{ + struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; + + mutex_lock(&ifmgd->mtx); + if (ifmgd->assoc_data) + ieee80211_destroy_assoc_data(sdata, false); + if (ifmgd->auth_data) + ieee80211_destroy_auth_data(sdata, false); + del_timer_sync(&ifmgd->timer); + mutex_unlock(&ifmgd->mtx); +} + void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif, enum nl80211_cqm_rssi_threshold_event rssi_event, gfp_t gfp) ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 2/2] mac80211: fix sta_info_flush() return value 2012-02-25 20:40 [PATCH 0/2] two mac80211 fixes Johannes Berg 2012-02-25 20:40 ` [PATCH 1/2] mac80211: fix auth/assoc data & timer leak Johannes Berg @ 2012-02-25 20:40 ` Johannes Berg 1 sibling, 0 replies; 4+ messages in thread From: Johannes Berg @ 2012-02-25 20:40 UTC (permalink / raw) To: John Linville; +Cc: linux-wireless From: Johannes Berg <johannes.berg@intel.com> The comment for sta_info_flush() states "Returns the number of removed STA entries" but that isn't actually true. Consequently, the warning when a station is still around on interface removal can never trigger and this delayed finding the timer issue the previous patch fixed. Fix the return value here to make that warning useful again. Signed-off-by: Johannes Berg <johannes.berg@intel.com> --- net/mac80211/sta_info.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index 4034ee6..98613c8 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -865,8 +865,10 @@ int sta_info_flush(struct ieee80211_local *local, mutex_lock(&local->sta_mtx); list_for_each_entry_safe(sta, tmp, &local->sta_list, list) { - if (!sdata || sdata == sta->sdata) + if (!sdata || sdata == sta->sdata) { WARN_ON(__sta_info_destroy(sta)); + ret++; + } } mutex_unlock(&local->sta_mtx); ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-02-25 20:48 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2012-02-25 20:40 [PATCH 0/2] two mac80211 fixes Johannes Berg 2012-02-25 20:40 ` [PATCH 1/2] mac80211: fix auth/assoc data & timer leak Johannes Berg 2012-02-25 20:48 ` [PATCH 1/2 v2] " Johannes Berg 2012-02-25 20:40 ` [PATCH 2/2] mac80211: fix sta_info_flush() return value Johannes Berg
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).