1. 11 Nov, 2014 5 commits
  2. 10 Nov, 2014 5 commits
  3. 06 Nov, 2014 1 commit
    • Ronald Wahl's avatar
      mac80211: Fix regression that triggers a kernel BUG with CCMP · 4f031fa9
      Ronald Wahl authored
      Commit 7ec7c4a9 (mac80211: port CCMP to
      cryptoapi's CCM driver) introduced a regression when decrypting empty
      packets (data_len == 0). This will lead to backtraces like:
      
      (scatterwalk_start) from [<c01312f4>] (scatterwalk_map_and_copy+0x2c/0xa8)
      (scatterwalk_map_and_copy) from [<c013a5a0>] (crypto_ccm_decrypt+0x7c/0x25c)
      (crypto_ccm_decrypt) from [<c032886c>] (ieee80211_aes_ccm_decrypt+0x160/0x170)
      (ieee80211_aes_ccm_decrypt) from [<c031c628>] (ieee80211_crypto_ccmp_decrypt+0x1ac/0x238)
      (ieee80211_crypto_ccmp_decrypt) from [<c032ef28>] (ieee80211_rx_handlers+0x870/0x1d24)
      (ieee80211_rx_handlers) from [<c0330c7c>] (ieee80211_prepare_and_rx_handle+0x8a0/0x91c)
      (ieee80211_prepare_and_rx_handle) from [<c0331260>] (ieee80211_rx+0x568/0x730)
      (ieee80211_rx) from [<c01d3054>] (__carl9170_rx+0x94c/0xa20)
      (__carl9170_rx) from [<c01d3324>] (carl9170_rx_stream+0x1fc/0x320)
      (carl9170_rx_stream) from [<c01cbccc>] (carl9170_usb_tasklet+0x80/0xc8)
      (carl9170_usb_tasklet) from [<c00199dc>] (tasklet_hi_action+0x88/0xcc)
      (tasklet_hi_action) from [<c00193c8>] (__do_softirq+0xcc/0x200)
      (__do_softirq) from [<c0019734>] (irq_exit+0x80/0xe0)
      (irq_exit) from [<c0009c10>] (handle_IRQ+0x64/0x80)
      (handle_IRQ) from [<c000c3a0>] (__irq_svc+0x40/0x4c)
      (__irq_svc) from [<c0009d44>] (arch_cpu_idle+0x2c/0x34)
      
      Such packets can appear for example when using the carl9170 wireless driver
      because hardware sometimes generates garbage when the internal FIFO overruns.
      
      This patch adds an additional length check.
      
      Cc: stable@vger.kernel.org
      Fixes: 7ec7c4a9 ("mac80211: port CCMP to cryptoapi's CCM driver")
      Acked-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
      Signed-off-by: default avatarRonald Wahl <ronald.wahl@raritan.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      4f031fa9
  4. 04 Nov, 2014 2 commits
  5. 03 Nov, 2014 2 commits
  6. 30 Oct, 2014 9 commits
  7. 29 Oct, 2014 5 commits
    • Luciano Coelho's avatar
      mac80211: schedule the actual switch of the station before CSA count 0 · ff1e417c
      Luciano Coelho authored
      Due to the time it takes to process the beacon that started the CSA
      process, we may be late for the switch if we try to reach exactly
      beacon 0.  To avoid that, use count - 1 when calculating the switch time.
      
      Cc: stable@vger.kernel.org
      Reported-by: default avatarJouni Malinen <j@w1.fi>
      Signed-off-by: default avatarLuciano Coelho <luciano.coelho@intel.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      ff1e417c
    • Luciano Coelho's avatar
      mac80211: use secondary channel offset IE also beacons during CSA · 84469a45
      Luciano Coelho authored
      If we are switching from an HT40+ to an HT40- channel (or vice-versa),
      we need the secondary channel offset IE to specify what is the
      post-CSA offset to be used.  This applies both to beacons and to probe
      responses.
      
      In ieee80211_parse_ch_switch_ie() we were ignoring this IE from
      beacons and using the *current* HT information IE instead.  This was
      causing us to use the same offset as before the switch.
      
      Fix that by using the secondary channel offset IE also for beacons and
      don't ever use the pre-switch offset.  Additionally, remove the
      "beacon" argument from ieee80211_parse_ch_switch_ie(), since it's not
      needed anymore.
      
      Cc: stable@vger.kernel.org
      Reported-by: default avatarJouni Malinen <j@w1.fi>
      Signed-off-by: default avatarLuciano Coelho <luciano.coelho@intel.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      84469a45
    • Felix Fietkau's avatar
      mac80211: flush keys for AP mode on ieee80211_do_stop · 10b68487
      Felix Fietkau authored
      Userspace can add keys to an AP mode interface before start_ap has been
      called. If there have been no calls to start_ap/stop_ap in the mean
      time, the keys will still be around when the interface is brought down.
      Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
      [adjust comments, fix AP_VLAN case]
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      10b68487
    • Junjie Mao's avatar
      mac80211_hwsim: release driver when ieee80211_register_hw fails · 805dbe17
      Junjie Mao authored
      The driver is not released when ieee80211_register_hw fails in
      mac80211_hwsim_create_radio, leading to the access to the unregistered (and
      possibly freed) device in platform_driver_unregister:
      
      [    0.447547] mac80211_hwsim: ieee80211_register_hw failed (-2)
      [    0.448292] ------------[ cut here ]------------
      [    0.448854] WARNING: CPU: 0 PID: 1 at ../include/linux/kref.h:47 kobject_get+0x33/0x50()
      [    0.449839] CPU: 0 PID: 1 Comm: swapper Not tainted 3.17.0-00001-gdd46990-dirty #2
      [    0.450813] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
      [    0.451512]  00000000 00000000 78025e38 7967c6c6 78025e68 7905e09b 7988b480 00000000
      [    0.452579]  00000001 79887d62 0000002f 79170bb3 79170bb3 78397008 79ac9d74 00000001
      [    0.453614]  78025e78 7905e15d 00000009 00000000 78025e84 79170bb3 78397000 78025e8c
      [    0.454632] Call Trace:
      [    0.454921]  [<7967c6c6>] dump_stack+0x16/0x18
      [    0.455453]  [<7905e09b>] warn_slowpath_common+0x6b/0x90
      [    0.456067]  [<79170bb3>] ? kobject_get+0x33/0x50
      [    0.456612]  [<79170bb3>] ? kobject_get+0x33/0x50
      [    0.457155]  [<7905e15d>] warn_slowpath_null+0x1d/0x20
      [    0.457748]  [<79170bb3>] kobject_get+0x33/0x50
      [    0.458274]  [<7925824f>] get_device+0xf/0x20
      [    0.458779]  [<7925b5cd>] driver_detach+0x3d/0xa0
      [    0.459331]  [<7925a3ff>] bus_remove_driver+0x8f/0xb0
      [    0.459927]  [<7925bf80>] ? class_unregister+0x40/0x80
      [    0.460660]  [<7925bad7>] driver_unregister+0x47/0x50
      [    0.461248]  [<7925c033>] ? class_destroy+0x13/0x20
      [    0.461824]  [<7925d07b>] platform_driver_unregister+0xb/0x10
      [    0.462507]  [<79b51ba0>] init_mac80211_hwsim+0x3e8/0x3f9
      [    0.463161]  [<79b30c58>] do_one_initcall+0x106/0x1a9
      [    0.463758]  [<79b517b8>] ? if_spi_init_module+0xac/0xac
      [    0.464393]  [<79b517b8>] ? if_spi_init_module+0xac/0xac
      [    0.465001]  [<79071935>] ? parse_args+0x2f5/0x480
      [    0.465569]  [<7906b41e>] ? __usermodehelper_set_disable_depth+0x3e/0x50
      [    0.466345]  [<79b30dd9>] kernel_init_freeable+0xde/0x17d
      [    0.466972]  [<79b304d6>] ? do_early_param+0x7a/0x7a
      [    0.467546]  [<79677b1b>] kernel_init+0xb/0xe0
      [    0.468072]  [<79075f42>] ? schedule_tail+0x12/0x40
      [    0.468658]  [<79686580>] ret_from_kernel_thread+0x20/0x30
      [    0.469303]  [<79677b10>] ? rest_init+0xc0/0xc0
      [    0.469829] ---[ end trace ad8ac403ff8aef5c ]---
      [    0.470509] ------------[ cut here ]------------
      [    0.471047] WARNING: CPU: 0 PID: 1 at ../kernel/locking/lockdep.c:3161 __lock_acquire.isra.22+0x7aa/0xb00()
      [    0.472163] DEBUG_LOCKS_WARN_ON(id >= MAX_LOCKDEP_KEYS)
      [    0.472774] CPU: 0 PID: 1 Comm: swapper Tainted: G        W      3.17.0-00001-gdd46990-dirty #2
      [    0.473815] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
      [    0.474492]  78025de0 78025de0 78025da0 7967c6c6 78025dd0 7905e09b 79888931 78025dfc
      [    0.475515]  00000001 79888a93 00000c59 7907f33a 7907f33a 78028000 fffe9d09 00000000
      [    0.476519]  78025de8 7905e10e 00000009 78025de0 79888931 78025dfc 78025e24 7907f33a
      [    0.477523] Call Trace:
      [    0.477821]  [<7967c6c6>] dump_stack+0x16/0x18
      [    0.478352]  [<7905e09b>] warn_slowpath_common+0x6b/0x90
      [    0.478976]  [<7907f33a>] ? __lock_acquire.isra.22+0x7aa/0xb00
      [    0.479658]  [<7907f33a>] ? __lock_acquire.isra.22+0x7aa/0xb00
      [    0.480417]  [<7905e10e>] warn_slowpath_fmt+0x2e/0x30
      [    0.480479]  [<7907f33a>] __lock_acquire.isra.22+0x7aa/0xb00
      [    0.480479]  [<79078aa5>] ? sched_clock_cpu+0xb5/0xf0
      [    0.480479]  [<7907fd06>] lock_acquire+0x56/0x70
      [    0.480479]  [<7925b5e8>] ? driver_detach+0x58/0xa0
      [    0.480479]  [<79682d11>] mutex_lock_nested+0x61/0x2a0
      [    0.480479]  [<7925b5e8>] ? driver_detach+0x58/0xa0
      [    0.480479]  [<7925b5e8>] ? driver_detach+0x58/0xa0
      [    0.480479]  [<7925b5e8>] driver_detach+0x58/0xa0
      [    0.480479]  [<7925a3ff>] bus_remove_driver+0x8f/0xb0
      [    0.480479]  [<7925bf80>] ? class_unregister+0x40/0x80
      [    0.480479]  [<7925bad7>] driver_unregister+0x47/0x50
      [    0.480479]  [<7925c033>] ? class_destroy+0x13/0x20
      [    0.480479]  [<7925d07b>] platform_driver_unregister+0xb/0x10
      [    0.480479]  [<79b51ba0>] init_mac80211_hwsim+0x3e8/0x3f9
      [    0.480479]  [<79b30c58>] do_one_initcall+0x106/0x1a9
      [    0.480479]  [<79b517b8>] ? if_spi_init_module+0xac/0xac
      [    0.480479]  [<79b517b8>] ? if_spi_init_module+0xac/0xac
      [    0.480479]  [<79071935>] ? parse_args+0x2f5/0x480
      [    0.480479]  [<7906b41e>] ? __usermodehelper_set_disable_depth+0x3e/0x50
      [    0.480479]  [<79b30dd9>] kernel_init_freeable+0xde/0x17d
      [    0.480479]  [<79b304d6>] ? do_early_param+0x7a/0x7a
      [    0.480479]  [<79677b1b>] kernel_init+0xb/0xe0
      [    0.480479]  [<79075f42>] ? schedule_tail+0x12/0x40
      [    0.480479]  [<79686580>] ret_from_kernel_thread+0x20/0x30
      [    0.480479]  [<79677b10>] ? rest_init+0xc0/0xc0
      [    0.480479] ---[ end trace ad8ac403ff8aef5d ]---
      [    0.495478] BUG: unable to handle kernel paging request at 00200200
      [    0.496257] IP: [<79682de5>] mutex_lock_nested+0x135/0x2a0
      [    0.496923] *pde = 00000000
      [    0.497290] Oops: 0002 [#1]
      [    0.497653] CPU: 0 PID: 1 Comm: swapper Tainted: G        W      3.17.0-00001-gdd46990-dirty #2
      [    0.498659] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
      [    0.499321] task: 78028000 ti: 78024000 task.ti: 78024000
      [    0.499955] EIP: 0060:[<79682de5>] EFLAGS: 00010097 CPU: 0
      [    0.500620] EIP is at mutex_lock_nested+0x135/0x2a0
      [    0.501145] EAX: 00200200 EBX: 78397434 ECX: 78397460 EDX: 78025e70
      [    0.501816] ESI: 00000246 EDI: 78028000 EBP: 78025e8c ESP: 78025e54
      [    0.502497]  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
      [    0.503076] CR0: 8005003b CR2: 00200200 CR3: 01b9d000 CR4: 00000690
      [    0.503773] Stack:
      [    0.503998]  00000000 00000001 00000000 7925b5e8 78397460 7925b5e8 78397474 78397460
      [    0.504944]  00200200 11111111 78025e70 78397000 79ac9d74 00000001 78025ea0 7925b5e8
      [    0.505451]  79ac9d74 fffffffe 00000001 78025ebc 7925a3ff 7a251398 78025ec8 7925bf80
      [    0.505451] Call Trace:
      [    0.505451]  [<7925b5e8>] ? driver_detach+0x58/0xa0
      [    0.505451]  [<7925b5e8>] ? driver_detach+0x58/0xa0
      [    0.505451]  [<7925b5e8>] driver_detach+0x58/0xa0
      [    0.505451]  [<7925a3ff>] bus_remove_driver+0x8f/0xb0
      [    0.505451]  [<7925bf80>] ? class_unregister+0x40/0x80
      [    0.505451]  [<7925bad7>] driver_unregister+0x47/0x50
      [    0.505451]  [<7925c033>] ? class_destroy+0x13/0x20
      [    0.505451]  [<7925d07b>] platform_driver_unregister+0xb/0x10
      [    0.505451]  [<79b51ba0>] init_mac80211_hwsim+0x3e8/0x3f9
      [    0.505451]  [<79b30c58>] do_one_initcall+0x106/0x1a9
      [    0.505451]  [<79b517b8>] ? if_spi_init_module+0xac/0xac
      [    0.505451]  [<79b517b8>] ? if_spi_init_module+0xac/0xac
      [    0.505451]  [<79071935>] ? parse_args+0x2f5/0x480
      [    0.505451]  [<7906b41e>] ? __usermodehelper_set_disable_depth+0x3e/0x50
      [    0.505451]  [<79b30dd9>] kernel_init_freeable+0xde/0x17d
      [    0.505451]  [<79b304d6>] ? do_early_param+0x7a/0x7a
      [    0.505451]  [<79677b1b>] kernel_init+0xb/0xe0
      [    0.505451]  [<79075f42>] ? schedule_tail+0x12/0x40
      [    0.505451]  [<79686580>] ret_from_kernel_thread+0x20/0x30
      [    0.505451]  [<79677b10>] ? rest_init+0xc0/0xc0
      [    0.505451] Code: 89 d8 e8 cf 9b 9f ff 8b 4f 04 8d 55 e4 89 d8 e8 72 9d 9f ff 8d 43 2c 89 c1 89 45 d8 8b 43 30 8d 55 e4 89 53 30 89 4d e4 89 45 e8 <89> 10 8b 55 dc 8b 45 e0 89 7d ec e8 db af 9f ff eb 11 90 31 c0
      [    0.505451] EIP: [<79682de5>] mutex_lock_nested+0x135/0x2a0 SS:ESP 0068:78025e54
      [    0.505451] CR2: 0000000000200200
      [    0.505451] ---[ end trace ad8ac403ff8aef5e ]---
      [    0.505451] Kernel panic - not syncing: Fatal exception
      
      Fixes: 9ea92774 ("mac80211_hwsim: Register and bind to driver")
      Reported-by: default avatarFengguang Wu <fengguang.wu@intel.com>
      Signed-off-by: default avatarJunjie Mao <eternal.n08@gmail.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      805dbe17
    • Emmanuel Grumbach's avatar
      iwlwifi: mvm: initialize the cur_ucode upon boot · 7b358f06
      Emmanuel Grumbach authored
      mvm->cur_ucode wasn't set before we actually load the
      firmware. This caused issues when we boot in RFKILL since
      we get an RFKILL interrupt upon boot even before we load
      any firmware.
      This leads to issues since iwl_mvm_set_hw_rfkill_state
      (the RFKILL interrupts handler in mvm) relies on this
      variable.
      
      Fix this.
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      7b358f06
  8. 27 Oct, 2014 2 commits
  9. 23 Oct, 2014 9 commits