summaryrefslogtreecommitdiffstats
path: root/net/wireless
Commit message (Collapse)AuthorAgeFilesLines
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2015-12-172-2/+8
|\ | | | | | | | | | | | | | | | | | | | | Conflicts: drivers/net/geneve.c Here we had an overlapping change, where in 'net' the extraneous stats bump was being removed whilst in 'net-next' the final argument to udp_tunnel6_xmit_skb() was being changed. Signed-off-by: David S. Miller <davem@davemloft.net>
| * nl80211: Fix potential memory leak in nl80211_connectOla Olsson2015-12-151-1/+3
| | | | | | | | | | | | | | Free cached keys if the last early return path is taken. Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * nl80211: Fix potential memory leak in nl80211_set_wowlanOla Olsson2015-12-151-0/+1
| | | | | | | | | | | | | | | | | | Compared to cfg80211_rdev_free_wowlan in core.h, the error goto label lacks the freeing of nd_config. Fix that. Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * nl80211: fix a few memory leaks in reg.cOla Olsson2015-12-151-1/+4
| | | | | | | | | | | | | | | | | | | | | | The first leak occurs when entering the default case in the switch for the initiator in set_regdom. The second leaks a platform_device struct if the platform registration in regulatory_init succeeds but the sub sequent regulatory hint fails due to no memory. Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: reg: Refactor calculation of bandwidth flagsMichal Sojka2015-12-041-54/+37
| | | | | | | | | | | | | | The same piece of code appears at two places. Make a function from it. Signed-off-by: Michal Sojka <sojkam1@fel.cvut.cz> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: handle add_station auth/assoc flag quirksJohannes Berg2015-12-041-4/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a new station is added to AP/GO interfaces the default behaviour is for it to be added authenticated and associated, due to backwards compatibility. To prevent that, the driver must be able to do that (setting the NL80211_FEATURE_FULL_AP_CLIENT_STATE feature flag) and userspace must set the flag mask to auth|assoc and clear the set. Handle this quirk in the API entirely in nl80211, and always push the full flags to the drivers. NL80211_FEATURE_FULL_AP_CLIENT_STATE is still required for userspace to be allowed to set the mask including those bits, but after checking that add both flags to the mask and set in case userspace didn't set them otherwise. This obsoletes the mac80211 code handling this difference, no other driver is currently using these flags. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: use NL80211_ATTR_STA_AID in nl82011_set_stationAyala Beker2015-12-041-2/+2
| | | | | | | | | | | | | | | | Fix nl80211_set_station() to use the value of NL80211_ATTR_STA_AID attribute instead of NL80211_ATTR_PEER_AID attribute. Signed-off-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: Add support for aborting an ongoing scanVidyullatha Kanchanapally2015-12-043-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement new functionality for aborting an ongoing scan. Add NL80211_CMD_ABORT_SCAN to the nl80211 interface. After aborting the scan, driver shall provide the scan status by calling cfg80211_scan_done(). Reviewed-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: Vidyullatha Kanchanapally <vkanchan@qti.qualcomm.com> Signed-off-by: Sunil Dutt <usdutt@qti.qualcomm.com> [change command to take wdev instead of netdev so that it can be used on p2p-device scans] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: Remove unused cfg80211_can_use_iftype_chan()Michal Sojka2015-12-042-121/+0
| | | | | | | | | | | | | | | | Last caller of this function was removed in 3.17 in commit 97dc94f1d933c9df2c0b327066ea130c0e92083f. Signed-off-by: Michal Sojka <sojkam1@fel.cvut.cz> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: reg: Remove unused function parameterMichal Sojka2015-12-041-4/+3
| | | | | | | | | | Signed-off-by: Michal Sojka <sojkam1@fel.cvut.cz> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: ocb: Fix null pointer deref if join_ocb is unimplementedOla Olsson2015-12-041-0/+3
| | | | | | | | | | Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | lib80211: ratelimit key index mismatchJohannes Berg2015-12-042-4/+4
| | | | | | | | | | | | | | | | | | This indicates a driver key selection issue, but even then there's no point in printing it all the time, so ratelimit it. Also remove the priv pointer from it -- people debugging will only have a single device anyway and it's useless as anything but a cookie. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: replace ieee80211_ie_split() with an inlineJohannes Berg2015-12-041-7/+0
| | | | | | | | | | | | | | | | | | The function is a very simple wrapper around another one, just adds a few default parameters, so replace it with a static inline instead of using EXPORT_SYMBOL, reducing the module size slightly. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: add complete data to station add/change tracingJohannes Berg2015-12-041-0/+38
| | | | | | | | | | | | | | | | Complete the tracepoint with the missing data - it's not printed by default (a lot of it is dynamic arrays) but will be recorded and be available during post-processing. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: Add missing tracing to cfg80211Ilan Peer2015-12-043-5/+108
|/ | | | | | | | | | | | Add missing tracing for: 1. start_radar_detection() 2. set_mcast_rates() 3. set_coalesce() Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: allow AID/listen interval changes for unassociated stationAyala Beker2015-11-031-9/+18
| | | | | | | | | | | | | | | Currently, cfg80211 rejects updates of AID and listen interval parameters for existing entries. This information is known only at association stage and as a result it's impossible to update entries that were added unassociated. Fix this by allowing updates of these properies for stations that the driver (or mac80211) assigned unassociated state. This then fixes mac80211's use of NL80211_FEATURE_FULL_AP_CLIENT_STATE. Signed-off-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* nl80211: Fix potential memory leak from parse_acl_dataOla Olsson2015-11-031-6/+6
| | | | | | | | | | | If parse_acl_data succeeds but the subsequent parsing of smps attributes fails, there will be a memory leak due to early returns. Fix that by moving the ACL parsing later. Cc: stable@vger.kernel.org Fixes: 18998c381b19b ("cfg80211: allow requesting SMPS mode on ap start") Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: fix reg_ignore_cell_hint return typeJohannes Berg2015-10-161-1/+2
| | | | | | | The return type should be enum reg_request_treatment for both branches of the #ifdef. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: reduce chan_reg_rule_print_dbg() ifdefJohannes Berg2015-10-161-9/+2
| | | | | | | The function is void and static, so just ifdef its contents instead of duplicating the declaration. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: fix antenna gain in chan_reg_rule_print_dbg()Johannes Berg2015-10-161-2/+2
| | | | | | | | Printing "N/A mBi" is strange - print just "N/A" instead. Also add a missing opening parenthesis. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: centralize freeing ignored requestsJohannes Berg2015-10-161-29/+35
| | | | | | | | | | | | Instead of having a lot of places that free ignored requests and then return REG_REQ_OK, make reg_process_hint() process REG_REQ_IGNORE by freeing the request, and let functions it calls return that instead of freeing. This also fixes a leak when a second (different) country IE hint was ignored. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: clarify 'treatment' handling in reg_process_hint()Johannes Berg2015-10-161-7/+9
| | | | | | | This function can only deal with treatment values OK and ALREADY_SET so make the callees not return anything else and warn if they do. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: rename reg_regdb_query() to reg_query_builtin()Johannes Berg2015-10-161-3/+3
| | | | | | The new name better reflects the functionality. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: make CRDA support optionalJohannes Berg2015-10-163-73/+114
| | | | | | | | If there's a built-in regulatory database, there may be little point in also calling out to CRDA and failing if the system is configured that way. Allow removing CRDA support to save ~1K kernel size. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: remove useless reg_timeout schedulingJohannes Berg2015-10-151-8/+2
| | | | | | | | | | | When the functions reg_set_rd_driver() and reg_set_rd_country_ie() return with an error, the calling function already restores data by calling restore_regulatory_settings(), so there's no need to also schedule a timeout (which would lead to other side effects such as indicating CRDA failed, which clearly isn't true.) Remove the scheduling. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: search built-in database directlyJohannes Berg2015-10-151-44/+58
| | | | | | | | | Instead of searching the built-in database only in the worker, search it directly and return an error if the entry cannot be found (or memory cannot be allocated.) This means that builtin database queries no longer rely on the timeout. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: rename reg_call_crda to reg_query_databaseJohannes Berg2015-10-151-5/+5
| | | | | | | The new name is more appropriate since in the case of a built-in database it may not really rely on CRDA. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: fix reg_call_crda() return value bugJohannes Berg2015-10-151-31/+30
| | | | | | | | The function reg_call_crda() can't actually validly return REG_REQ_IGNORE as it does now when calling CRDA fails since that return value isn't handled properly. Fix that. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: reg: remove useless non-NULL checkJohannes Berg2015-10-151-3/+0
| | | | | | | There's no way that the alpha2 pointer can be NULL, so no point in checking that it isn't. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: fix gHz to GHzJohannes Berg2015-10-152-2/+2
| | | | | | There's no "g" prefix, only "G" (1e9) that was clearly intended here. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: Add multiple scan plans for scheduled scanAvraham Stern2015-10-133-15/+170
| | | | | | | | | | | | | | | | | | | | | | | Add the option to configure multiple 'scan plans' for scheduled scan. Each 'scan plan' defines the number of scan cycles and the interval between scans. The scan plans are executed in the order they were configured. The last scan plan will always run infinitely and thus defines only the interval between scans. The maximum number of scan plans supported by the device and the maximum number of iterations in a single scan plan are advertised to userspace so it can configure the scan plans appropriately. When scheduled scan results are received there is no way to know which scan plan is being currently executed, so there is no way to know when the next scan iteration will start. This is not a problem, however. The scan start timestamp is only used for flushing old scan results, and there is no difference between flushing all results received until the end of the previous iteration or the start of the current one, since no results will be received in between. Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* nl80211: allow BSS data to include CLOCK_BOOTTIME timestampDmitry Shmidt2015-10-134-39/+47
| | | | | | | | | | | | | | | | | | | For location and connectivity services, userspace would often like to know the time when the BSS was last seen. The current "last seen" value is calculated in a way that makes it less useful, especially if the system suspended in the meantime. Add the ability for the driver to report a real CLOCK_BOOTTIME stamp that can then be reported to userspace (if present). Drivers wishing to use this must be converted to the new API to call cfg80211_inform_bss_data() or cfg80211_inform_bss_frame_data(). They need to ensure the reported value is accurate enough even when the frame might have been buffered in the device (e.g. firmware.) Signed-off-by: Dmitry Shmidt <dimitrysh@google.com> [modified to use struct, inlines] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* Merge tag 'mac80211-next-for-davem-2015-10-05' of ↵David S. Miller2015-10-073-4/+210
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg says: ==================== For the current cycle, we have the following right now: * many internal fixes, API improvements, cleanups, etc. * full AP client state tracking in cfg80211/mac80211 from Ayala * VHT support (in mac80211) for mesh * some A-MSDU in A-MPDU support from Emmanuel * show current TX power to userspace (from Rafał) * support for netlink dump in vendor commands (myself) ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * cfg80211: allow changing station capabilities for unassociated stationsAyala Beker2015-09-291-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, cfg80211 rejects capability updates for existing entries and as a result it's impossible to update entries that were added unassociated, but that is necessary to go through the full station states from userspace, adding a station before authentication etc. Fix this by allowing updates to capabilities for stations that the driver (or mac80211) assigned unassociated state. Drivers setting the full station state support flag must use the new station type for proper operation. Signed-off-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * net/wireless: enable wiphy device to suspend/resume asynchronouslyFu, Zhonghui2015-09-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Now, PM core supports asynchronous suspend/resume mode for devices during system suspend/resume, and the power state transition of one device may be completed in separate kernel thread. PM core ensures all power state transition timing dependency between devices. This patch enables wiphy device to suspend/resume asynchronously. This can take advantage of multicore and improve system suspend/resume speed. Signed-off-by: Zhonghui Fu <zhonghui.fu@linux.intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * nl80211: put current TX power in interface infoRafał Miłecki2015-09-221-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | Many drivers implement reading current TX power (using either cfg80211 or ieee80211 op) but userspace can't get it using nl80211. Right now the only way to access it is to call some wext ioctl. Let's put TX power in interface info reply (callback is wdev specific) just like we do with current channel. To be consistent (e.g. NL80211_CMD_SET_WIPHY) let's use mBm as na unit. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * nl80211: support vendor dumpit commandsJohannes Berg2015-09-221-0/+192
| | | | | | | | | | | | | | In order to transfer many items in vendor commands, support the dumpit netlink method for them. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * wireless: make __freq_reg_info staticJohannes Berg2015-09-221-2/+2
| | | | | | | | | | | | As pointed out by sparse, this symbol should be static, make it so. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: regulatory: restore proper user alpha2Maciej S. Szmigiero2015-09-041-1/+1
|/ | | | | | | | | | | | | | | | | | restore_regulatory_settings() should restore alpha2 as computed in restore_alpha2(), not raw user_alpha2 to behave as described in the comment just above that code. This fixes endless loop of calling CRDA for "00" and "97" countries after resume from suspend on my laptop. Looks like others had the same problem, too: http://ath9k-devel.ath9k.narkive.com/knY5W6St/ath9k-and-crda-messages-in-logs https://bugs.launchpad.net/ubuntu/+source/linux/+bug/899335 https://forum.porteus.org/viewtopic.php?t=4975&p=36436 https://forums.opensuse.org/showthread.php/483356-Authentication-Regulatory-Domain-issues-ath5k-12-2 Signed-off-by: Maciej Szmigiero <mail@maciej.szmigiero.name> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* nl80211: Allow setting multicast rate on OCB interfacesBertold Van den Bergh2015-08-141-1/+2
| | | | | | | | Allow setting multicast rate on OCB interfaces. Current behaviour results in EOPNOTSUPP when attempting this. Signed-off-by: Bertold Van den Bergh <bertold.vandenbergh@esat.kuleuven.be> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: propagate set_wiphy failure to userspaceMichal Kazior2015-08-141-0/+1
| | | | | | | | | | | If driver failed to setup wiphy params (e.g. rts threshold, fragmentation treshold) userspace wasn't properly notified about this. This could lead to user confusion who would think the command succeeded even if that wasn't the case. Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: regulatory: handle 5 and 10 MHz channels properlyMatthias May2015-08-141-11/+53
| | | | | | | | | | | | The original assumption of 20MHz wide channels hasn't been true since the addition of support for 5 and 10 MHz channels. Change the code to no longer disable all channels that don't fit into the 20MHz grid, but instead set the appropriate flags to disable operation on specific bandwidths. Signed-off-by: Matthias May <matthias.may@neratec.com> [reword commit message] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* Merge branch 'mac80211' into mac80211-nextJohannes Berg2015-07-174-25/+53
|\ | | | | | | | | | | | | This is necessary to merge the new TDLS and mesh patches, as they depend on some fixes. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: use RTNL locked reg_can_beacon for IR-relaxationArik Nemtsov2015-07-174-22/+50
| | | | | | | | | | | | | | | | | | | | | | | | The RTNL is required to check for IR-relaxation conditions that allow more channels to beacon. Export an RTNL locked version of reg_can_beacon and use it where possible in AP/STA interface type flows, where IR-relaxation may be applicable. Fixes: 06f207fc5418 ("cfg80211: change GO_CONCURRENT to IR_CONCURRENT for STA") Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * wireless: regulatory: reduce log level of CRDA related messagesThomas Petazzoni2015-07-171-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | With a basic Linux userspace, the messages "Calling CRDA to update world regulatory domain" appears 10 times after boot every second or so, followed by a final "Exceeded CRDA call max attempts. Not calling CRDA". For those of us not having the corresponding userspace parts, having those messages repeatedly displayed at boot time is a bit annoying, so this commit reduces their log level to pr_debug(). Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | wireless: remove superfluous if statement in regulatory codeJohn Linville2015-07-171-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit eeca9fce1d71 ('cfg80211: Schedule timeout for all CRDA calls') left behind a superfluous check after it removed some earlier code. In reg_process_hint, the test of "treatment == REG_REQ_IGNORE || treatment == REG_REQ_ALREADY_SET" is superfluous because the code in the if-then branch is identical to the code after the if statement. Coverity CID #1295939 I also removed the unnecessary assignment of treatment in this case, and added a comment reminding any future patch authors to ensure that treatment is properly assigned before it is used after the switch. Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | cfg80211: allow mgmt_frame_register callback to sleepJohannes Berg2015-07-174-15/+72
|/ | | | | | | | | | | | | | | This callback is currently not allowed to sleep, which makes it more difficult to implement proper driver methods in mac80211 than it has to be. Instead of doing asynchronous work here in mac80211, make it possible for the callback to sleep by doing some asynchronous work in cfg80211. This also enables improvements to other drivers, like ath6kl, that would like to sleep in this callback. While at it, also fix the code to call the driver on the implicit unregistration when an interface is removed, and do that also when a P2P-Device wdev is destroyed (otherwise we leak the structs.) Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2015-06-131-0/+2
|\
| * cfg80211: wext: clear sinfo struct before calling driverJohannes Berg2015-06-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Until recently, mac80211 overwrote all the statistics it could provide when getting called, but it now relies on the struct having been zeroed by the caller. This was always the case in nl80211, but wext used a static struct which could even cause values from one device leak to another. Using a static struct is OK (as even documented in a comment) since the whole usage of this function and its return value is always locked under RTNL. Not clearing the struct for calling the driver has always been wrong though, since drivers were free to only fill values they could report, so calling this for one device and then for another would always have leaked values from one to the other. Fix this by initializing the structure in question before the driver method call. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=99691 Cc: stable@vger.kernel.org Reported-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Reported-by: Alexander Kaltsas <alexkaltsas@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | cfg80211: ignore netif running state when changing iftypeMichal Kazior2015-05-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It was possible for mac80211 to be coerced into an unexpected flow causing sdata union to become corrupted. Station pointer was put into sdata->u.vlan.sta memory location while it was really master AP's sdata->u.ap.next_beacon. This led to station entry being later freed as next_beacon before __sta_info_flush() in ieee80211_stop_ap() and a subsequent invalid pointer dereference crash. The problem was that ieee80211_ptr->use_4addr wasn't cleared on interface type changes. This could be reproduced with the following steps: # host A and host B have just booted; no # wpa_s/hostapd running; all vifs are down host A> iw wlan0 set type station host A> iw wlan0 set 4addr on host A> printf 'interface=wlan0\nssid=4addrcrash\nchannel=1\nwds_sta=1' > /tmp/hconf host A> hostapd -B /tmp/conf host B> iw wlan0 set 4addr on host B> ifconfig wlan0 up host B> iw wlan0 connect -w hostAssid host A> pkill hostapd # host A crashed: [ 127.928192] BUG: unable to handle kernel NULL pointer dereference at 00000000000006c8 [ 127.929014] IP: [<ffffffff816f4f32>] __sta_info_flush+0xac/0x158 ... [ 127.934578] [<ffffffff8170789e>] ieee80211_stop_ap+0x139/0x26c [ 127.934578] [<ffffffff8100498f>] ? dump_trace+0x279/0x28a [ 127.934578] [<ffffffff816dc661>] __cfg80211_stop_ap+0x84/0x191 [ 127.934578] [<ffffffff816dc7ad>] cfg80211_stop_ap+0x3f/0x58 [ 127.934578] [<ffffffff816c5ad6>] nl80211_stop_ap+0x1b/0x1d [ 127.934578] [<ffffffff815e53f8>] genl_family_rcv_msg+0x259/0x2b5 Note: This isn't a revert of f8cdddb8d61d ("cfg80211: check iface combinations only when iface is running") as far as functionality is considered because b6a550156bc ("cfg80211/mac80211: move more combination checks to mac80211") moved the logic somewhere else already. Fixes: f8cdddb8d61d ("cfg80211: check iface combinations only when iface is running") Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-15 15:39:19 +0000