summaryrefslogtreecommitdiffstats
path: root/net
Commit message (Collapse)AuthorAgeFilesLines
* net: dsa: move dsa slave destroy code to slave.cNeil Armstrong2015-12-073-2/+13
| | | | | | | | | | | Move dsa slave dedicated code from dsa_switch_destroy to a new dsa_slave_destroy function in slave.c. Add the netif_carrier_off and phy_disconnect calls in order to correctly cleanup the netdev state and PHY state machine. Signed-off-by: Frode Isaksen <fisaksen@baylibre.com> Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: dsa: Add missing master netdev dev_put() callsNeil Armstrong2015-12-071-1/+5
| | | | | | | Upon probe failure or unbinding, add missing dev_put() calls. Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: dsa: cleanup resources upon module removalNeil Armstrong2015-12-071-0/+8
| | | | | | | | | Make sure that we unassign the master_netdev dsa_ptr to make the packet processing go through the regular Ethernet receive path. Suggested-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: dsa: remove DSA link pollingNeil Armstrong2015-12-071-43/+0
| | | | | | | | | Since no more DSA driver uses the polling callback, and since the phylib handles the link detection, remove the link polling work and timer code. Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge tag 'mac80211-next-for-davem-2015-12-07' of ↵David S. Miller2015-12-0724-939/+1174
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg says: ==================== This pull request got a bit bigger than I wanted, due to needing to reshuffle and fix some bugs. I merged mac80211 to get the right base for some of these changes. * new mac80211 API for upcoming driver changes: EOSP handling, key iteration * scan abort changes allowing to cancel an ongoing scan * VHT IBSS 80+80 MHz support * re-enable full AP client state tracking after fixes * various small fixes (that weren't relevant for mac80211) * various cleanups ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * mac80211: handle HW ROC expired properlyIlan Peer2015-12-071-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In case of HW ROC, when the driver reports that the ROC expired, it is not sufficient to purge the ROCs based on the remaining time, as it possible that the device finished the ROC session before the actual requested duration. To handle such cases, in case of ROC expired notification from the driver, complete all the ROCs which are marked with hw_begun, regardless of the remaining duration. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: reject zero cookie in mgmt-tx/roc cancelJohannes Berg2015-12-041-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When cancelling, you can cancel "any" (first in list) mgmt-tx or remain-on-channel operation by using the value 0 for the cookie along with the *opposite* operation, i.e. * cancel the first mgmt-tx by cancelling roc with 0 cookie * cancel the first roc by cancelling mgmt-tx with 0 cookie This isn't really that bad since userspace should only pass cookies that we gave it, but could lead to hard-to-debug issues so better prevent it and reject zero values since we never hand those out. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: Allow a STA to join an IBSS with 80+80 MHz channelJouni Malinen2015-12-041-0/+1
| | | | | | | | | | | | | | | | | | While it was possible to create an IBSS with 80+80 MHz channel, joining such an IBSS resulted in falling back to 20 MHz channel with VHT disabled due to a missing switch case for 80+80. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: reg: Refactor calculation of bandwidth flagsMichal Sojka2015-12-041-54/+37
| | | | | | | | | | | | | | The same piece of code appears at two places. Make a function from it. Signed-off-by: Michal Sojka <sojkam1@fel.cvut.cz> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: rewrite remain-on-channel logicJohannes Berg2015-12-043-291/+316
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Jouni found a bug in the remain-on-channel logic: when a short item is queued, a long item is combined with it extending the original one, and then the long item is deleted, the timeout doesn't go back to the short one, and the short item ends up taking a long time. In this case, this showed as blocking scan when running two test cases back to back - the scan from the second was delayed even though all the remain-on-channel items should long have been gone. Fixing this with the current data structures turns out to be a bit complicated, we just remove the long item from the dependents list right now and don't recalculate the timeouts. There's a somewhat similar bug where we delete the short item and all the dependents go with it; to fix this we'd have to move them from the dependents to the real list. Instead of trying to do that, rewrite the code to not have all this complexity in the data structures: use a single list and allow more than one entry in it being marked as started. This makes the code a bit more complex, the worker needs to understand that it might need to just remove one of the started items, while keeping the device off-channel, but that's not more complicated than the nested data structures. This then fixes both issues described, and makes it easier to also limit the overall off-channel time when combining. TODO: as before, with hardware remain-on-channel, deleting an item after combining results in cancelling them all - we can keep track of the time elapsed and only cancel after that to fix this. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: simplify ack_skb handlingJohannes Berg2015-12-043-18/+13
| | | | | | | | | | | | | | | | | | | | Since the cookie is assigned inside ieee80211_make_ack_skb() now, we no longer need to return the ack_skb as the cookie and can simplify the function's return and the callers. Also rename it to ieee80211_attach_ack_skb() to more accurately reflect its purpose. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: move off-channel/mgmt-tx code to offchannel.cJohannes Berg2015-12-043-495/+502
| | | | | | | | | | | | | | This is quite a bit of code that logically depends here since it has to deal with all the remain-on-channel logic. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: fix mgmt-tx abort cookie and leakJohannes Berg2015-12-041-3/+2
| | | | | | | | | | | | | | | | | | | | If a mgmt-tx operation is aborted before it runs, the wrong cookie is reported back to userspace, and the ack_skb gets leaked since the frame is freed directly instead of freeing it using ieee80211_free_txskb(). Fix that. Fixes: 3b79af973cf4 ("mac80211: stop using pointers as userspace cookies") Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: catch queue stop underflowJohannes Berg2015-12-041-2/+5
| | | | | | | | | | | | | | | | If some code stops the queues more times than having started (for when refcounting is used), warn on and reset the counter to 0 to avoid blocking forever. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: properly free TX skbs when monitor TX failsJohannes Berg2015-12-041-1/+1
| | | | | | | | | | | | | | We need to free all skbs here, not just the one we peeked from the list. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: properly free skb when r-o-c for TX failsJohannes Berg2015-12-041-1/+1
| | | | | | | | | | | | | | When freeing the TX skb for an off-channel TX, use the correct API to also free the ACK skb that might have been allocated. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * Revert "mac80211: don't advertise NL80211_FEATURE_FULL_AP_CLIENT_STATE"Johannes Berg2015-12-041-1/+2
| | | | | | | | | | | | | | This reverts commit 45bb780a2147b9995f3d288c44ecb87ca8a330e2, the previous two patches fixed the functionality. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: handle add_station auth/assoc flag quirksJohannes Berg2015-12-042-14/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a new station is added to AP/GO interfaces the default behaviour is for it to be added authenticated and associated, due to backwards compatibility. To prevent that, the driver must be able to do that (setting the NL80211_FEATURE_FULL_AP_CLIENT_STATE feature flag) and userspace must set the flag mask to auth|assoc and clear the set. Handle this quirk in the API entirely in nl80211, and always push the full flags to the drivers. NL80211_FEATURE_FULL_AP_CLIENT_STATE is still required for userspace to be allowed to set the mask including those bits, but after checking that add both flags to the mask and set in case userspace didn't set them otherwise. This obsoletes the mac80211 code handling this difference, no other driver is currently using these flags. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: use NL80211_ATTR_STA_AID in nl82011_set_stationAyala Beker2015-12-041-2/+2
| | | | | | | | | | | | | | | | Fix nl80211_set_station() to use the value of NL80211_ATTR_STA_AID attribute instead of NL80211_ATTR_PEER_AID attribute. Signed-off-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: Add support for aborting an ongoing scanVidyullatha Kanchanapally2015-12-041-0/+6
| | | | | | | | | | | | | | | | | | | | This commit adds implementation for abort scan in mac80211. Reviewed-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: Vidyullatha Kanchanapally <vkanchan@qti.qualcomm.com> Signed-off-by: Sunil Dutt <usdutt@qti.qualcomm.com> [adjust to wdev change in previous patch and clean up code a bit] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: Add support for aborting an ongoing scanVidyullatha Kanchanapally2015-12-043-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement new functionality for aborting an ongoing scan. Add NL80211_CMD_ABORT_SCAN to the nl80211 interface. After aborting the scan, driver shall provide the scan status by calling cfg80211_scan_done(). Reviewed-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: Vidyullatha Kanchanapally <vkanchan@qti.qualcomm.com> Signed-off-by: Sunil Dutt <usdutt@qti.qualcomm.com> [change command to take wdev instead of netdev so that it can be used on p2p-device scans] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: add new IEEE80211_VIF_GET_NOA_UPDATE flagJanusz.Dziedzic@tieto.com2015-12-041-2/+4
| | | | | | | | | | | | | | | | | | Add new VIF flag, that will allow get NOA update notification when driver will request this, even this is not pure P2P vif (eg. STA vif). Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: Remove unused cfg80211_can_use_iftype_chan()Michal Sojka2015-12-042-121/+0
| | | | | | | | | | | | | | | | Last caller of this function was removed in 3.17 in commit 97dc94f1d933c9df2c0b327066ea130c0e92083f. Signed-off-by: Michal Sojka <sojkam1@fel.cvut.cz> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: reg: Remove unused function parameterMichal Sojka2015-12-041-4/+3
| | | | | | | | | | Signed-off-by: Michal Sojka <sojkam1@fel.cvut.cz> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: add atomic uploaded keys iteratorEliad Peller2015-12-043-4/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add ieee80211_iter_keys_rcu() to iterate over uploaded keys in atomic context (when rcu is locked) The station removal code removes the keys only after calling synchronize_net(), so it's not safe to iterate the keys at this point (and postponing the actual key deletion with call_rcu() might result in some badly-ordered ops calls). Add a flag to indicate a station is being removed, and skip the configured keys if it's set. Signed-off-by: Eliad Peller <eliadx.peller@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: allow the driver to send EOSP when neededEmmanuel Grumbach2015-12-042-43/+126
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This can happen when the driver needs to send less frames than expected and then needs to close the SP. Mac80211 still needs to set the more_data properly based on its buffer state (ps_tx_buffer and buffered frames on other TIDs). To that end, refactor the code that delivers frames upon uAPSD trigger frames to be able to get only the more_data bit without actually delivering those frames in case the driver is just asking to set a NDP with EOSP and MORE_DATA bit properly set. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: ocb: Fix null pointer deref if join_ocb is unimplementedOla Olsson2015-12-041-0/+3
| | | | | | | | | | Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: remove string from unaligned packet warningJohannes Berg2015-12-041-2/+1
| | | | | | | | | | | | | | | | | | This really should never happen except very early in the process of bringing up a new driver, at which point you'll have to add more debugging in the driver and this string isn't useful. Remove it and save some size (when it's even compiled in.) Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * lib80211: ratelimit key index mismatchJohannes Berg2015-12-042-4/+4
| | | | | | | | | | | | | | | | | | This indicates a driver key selection issue, but even then there's no point in printing it all the time, so ratelimit it. Also remove the priv pointer from it -- people debugging will only have a single device anyway and it's useless as anything but a cookie. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: mesh: print MAC address instead of pointerJohannes Berg2015-12-041-2/+2
| | | | | | | | | | | | | | | | | | | | There's no point in printing the mpath pointer since it can't be used for anything - print the MAC address instead (like in the forwarding case.) Signed-off-by: Johannes Berg <johannes.berg@intel.com> Acked-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: replace ieee80211_ie_split() with an inlineJohannes Berg2015-12-041-7/+0
| | | | | | | | | | | | | | | | | | The function is a very simple wrapper around another one, just adds a few default parameters, so replace it with a static inline instead of using EXPORT_SYMBOL, reducing the module size slightly. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: add complete data to station add/change tracingJohannes Berg2015-12-041-0/+38
| | | | | | | | | | | | | | | | Complete the tracepoint with the missing data - it's not printed by default (a lot of it is dynamic arrays) but will be recorded and be available during post-processing. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * cfg80211: Add missing tracing to cfg80211Ilan Peer2015-12-043-5/+108
| | | | | | | | | | | | | | | | | | | | | | | | Add missing tracing for: 1. start_radar_detection() 2. set_mcast_rates() 3. set_coalesce() Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211: allow driver to prevent two stations w/ same addressJohannes Berg2015-12-042-2/+17
| | | | | | | | | | | | | | | | | | Some devices or drivers cannot deal with having the same station address for different virtual interfaces, say as a client to two virtual AP interfaces. Rather than requiring each driver with a limitation like that to enforce it, add a hardware flag for it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * Merge remote-tracking branch 'mac80211/master' into HEADJohannes Berg2015-12-046-15/+21
| |\ | | | | | | | | | | | | | | | | | | I want to get the full off-channel bugfix since later code depends on it, as well as the AP client state change so I can revert it correctly. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | | af_unix: fix unix_dgram_recvmsg entry lockingRainer Weikusat2015-12-061-15/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current unix_dgram_recvsmg code acquires the u->readlock mutex in order to protect access to the peek offset prior to calling __skb_recv_datagram for actually receiving data. This implies that a blocking reader will go to sleep with this mutex held if there's presently no data to return to userspace. Two non-desirable side effects of this are that a later non-blocking read call on the same socket will block on the ->readlock mutex until the earlier blocking call releases it (or the readers is interrupted) and that later blocking read calls will wait longer than the effective socket read timeout says they should: The timeout will only start 'ticking' once such a reader hits the schedule_timeout in wait_for_more_packets (core.c) while the time it already had to wait until it could acquire the mutex is unaccounted for. The patch avoids both by using the __skb_try_recv_datagram and __skb_wait_for_more packets functions created by the first patch to implement a unix_dgram_recvmsg read loop which releases the readlock mutex prior to going to sleep and reacquires it as needed afterwards. Non-blocking readers will thus immediately return with -EAGAIN if there's no data available regardless of any concurrent blocking readers and all blocking readers will end up sleeping via schedule_timeout, thus honouring the configured socket receive timeout. Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | core: enable more fine-grained datagram reception controlRainer Weikusat2015-12-061-29/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The __skb_recv_datagram routine in core/ datagram.c provides a general skb reception factility supposed to be utilized by protocol modules providing datagram sockets. It encompasses both the actual recvmsg code and a surrounding 'sleep until data is available' loop. This is inconvenient if a protocol module has to use additional locking in order to maintain some per-socket state the generic datagram socket code is unaware of (as the af_unix code does). The patch below moves the recvmsg proper code into a new __skb_try_recv_datagram routine which doesn't sleep and renames wait_for_more_packets to __skb_wait_for_more_packets, both routines being exported interfaces. The original __skb_recv_datagram routine is reimplemented on top of these two functions such that its user-visible behaviour remains unchanged. Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | net: constify netif_is_* helpers net_device paramJiri Pirko2015-12-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | As suggested by Eric, these helpers should have const dev param. Suggested-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | batman-adv: Act on NETDEV_*_TYPE_CHANGE eventsAndrew Lunn2015-12-051-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A network interface can change type. It may change from a type which batman does not support, e.g. hdlc, to one it does, e.g. hdlc-eth. When an interface changes type, it sends two notifications. Handle these notifications. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv6: Only act upon NETDEV_*_TYPE_CHANGE if we have ipv6 addressesAndrew Lunn2015-12-051-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | An interface changing type may not have IPv6 addresses. Don't call the address configuration type change in this case. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2015-12-0372-298/+605
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: drivers/net/ethernet/renesas/ravb_main.c kernel/bpf/syscall.c net/ipv4/ipmr.c All three conflicts were cases of overlapping changes. Signed-off-by: David S. Miller <davem@davemloft.net>
| * \ \ Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds2015-12-0370-298/+596
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull networking fixes from David Miller: "A lot of Thanksgiving turkey leftovers accumulated, here goes: 1) Fix bluetooth l2cap_chan object leak, from Johan Hedberg. 2) IDs for some new iwlwifi chips, from Oren Givon. 3) Fix rtlwifi lockups on boot, from Larry Finger. 4) Fix memory leak in fm10k, from Stephen Hemminger. 5) We have a route leak in the ipv6 tunnel infrastructure, fix from Paolo Abeni. 6) Fix buffer pointer handling in arm64 bpf JIT,f rom Zi Shen Lim. 7) Wrong lockdep annotations in tcp md5 support, fix from Eric Dumazet. 8) Work around some middle boxes which prevent proper handling of TCP Fast Open, from Yuchung Cheng. 9) TCP repair can do huge kmalloc() requests, build paged SKBs instead. From Eric Dumazet. 10) Fix msg_controllen overflow in scm_detach_fds, from Daniel Borkmann. 11) Fix device leaks on ipmr table destruction in ipv4 and ipv6, from Nikolay Aleksandrov. 12) Fix use after free in epoll with AF_UNIX sockets, from Rainer Weikusat. 13) Fix double free in VRF code, from Nikolay Aleksandrov. 14) Fix skb leaks on socket receive queue in tipc, from Ying Xue. 15) Fix ifup/ifdown crach in xgene driver, from Iyappan Subramanian. 16) Fix clearing of persistent array maps in bpf, from Daniel Borkmann. 17) In TCP, for the cross-SYN case, we don't initialize tp->copied_seq early enough. From Eric Dumazet. 18) Fix out of bounds accesses in bpf array implementation when updating elements, from Daniel Borkmann. 19) Fill gaps in RCU protection of np->opt in ipv6 stack, from Eric Dumazet. 20) When dumping proxy neigh entries, we have to accomodate NULL device pointers properly, from Konstantin Khlebnikov. 21) SCTP doesn't release all ipv6 socket resources properly, fix from Eric Dumazet. 22) Prevent underflows of sch->q.qlen for multiqueue packet schedulers, also from Eric Dumazet. 23) Fix MAC and unicast list handling in bnxt_en driver, from Jeffrey Huang and Michael Chan. 24) Don't actively scan radar channels, from Antonio Quartulli" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (110 commits) net: phy: reset only targeted phy bnxt_en: Setup uc_list mac filters after resetting the chip. bnxt_en: enforce proper storing of MAC address bnxt_en: Fixed incorrect implementation of ndo_set_mac_address net: lpc_eth: remove irq > NR_IRQS check from probe() net_sched: fix qdisc_tree_decrease_qlen() races openvswitch: fix hangup on vxlan/gre/geneve device deletion ipv4: igmp: Allow removing groups from a removed interface ipv6: sctp: implement sctp_v6_destroy_sock() arm64: bpf: add 'store immediate' instruction ipv6: kill sk_dst_lock ipv6: sctp: add rcu protection around np->opt net/neighbour: fix crash at dumping device-agnostic proxy entries sctp: use GFP_USER for user-controlled kmalloc sctp: convert sack_needed and sack_generation to bits ipv6: add complete rcu protection around np->opt bpf: fix allocation warnings in bpf maps and integer overflow mvebu: dts: enable IP checksum with jumbo frames for Armada 38x on Port0 net: mvneta: enable setting custom TX IP checksum limit net: mvneta: fix error path for building skb ...
| | * \ \ Merge tag 'mac80211-for-davem-2015-12-02' of ↵David S. Miller2015-12-036-15/+21
| | |\ \ \ | | | | |/ | | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== A small set of fixes for 4.4: * fix scanning in mac80211 to not actively scan radar channels (from Antonio) * fix uninitialized variable in remain-on-channel that could lead to treating frame TX as remain-on-channel and not sending the frame at all * remove NL80211_FEATURE_FULL_AP_CLIENT_STATE again, it was broken and needs more work, we'll enable it later * fix call_rcu() induced use-after-reset/free in mesh (that was suddenly causing issues in certain tests) * always request block-ack window size 64 as we found some APs will otherwise crash (really ...) * fix P2P-Device teardown sequence to avoid restarting with uninitialized data ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| | | * | mac80211: fix off-channel mgmt-tx uninitialized variable usageJohannes Berg2015-12-021-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the last change here, I neglected to update the cookie in one code path: when a mgmt-tx has no real cookie sent to userspace as it doesn't wait for a response, but is off-channel. The original code used the SKB pointer as the cookie and always assigned the cookie to the TX SKB in ieee80211_start_roc_work(), but my change turned this around and made the code rely on a valid cookie being passed in. Unfortunately, the off-channel no-wait TX path wasn't assigning one at all, resulting in an uninitialized stack value being used. This wasn't handed back to userspace as a cookie (since in the no-wait case there isn't a cookie), but it was tested for non-zero to distinguish between mgmt-tx and off-channel. Fix this by assigning a dummy non-zero cookie unconditionally, and get rid of a misleading comment and some dead code while at it. I'll clean up the ACK SKB handling separately later. Fixes: 3b79af973cf4 ("mac80211: stop using pointers as userspace cookies") Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| | | * | mac80211: do not actively scan DFS channelsAntonio Quartulli2015-12-021-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DFS channels should not be actively scanned as we can't be sure if we are allowed or not. If the current channel is in the DFS band, active scan might be performed after CSA, but we have no guarantee about other channels, therefore it is safer to prevent active scanning at all. Cc: stable@vger.kernel.org Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| | | * | mac80211: don't teardown sdata on sdata stopEliad Peller2015-12-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Interfaces are being initialized (setup) on addition, and torn down on removal. However, p2p device is being torn down when stopped, resulting in the next p2p start operation being done on uninitialized interface. Solve it by calling ieee80211_teardown_sdata() only on interface removal (for the non-netdev case). Signed-off-by: Eliad Peller <eliadx.peller@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> [squashed in fix to call teardown after unregister] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| | | * | mac80211: always set the buf_size in AddBA req to 64Gregory Greenman2015-11-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Advertising reordering window in ADDBA less than 64 can crash some APs, an example is LinkSys WRT120N (with FW v1.0.07 build 002 Jun 18 2012). On the other hand, a driver may need to limit Tx A-MPDU size for its own reasons, like specific HW limitations. Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| | | * | mac80211: ensure we don't update tx power on a non-running sdataEmmanuel Grumbach2015-11-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can't update the Tx power on the device unless it is running. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=101521. Cc: stable@vger.kernel.org Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| | | * | mac80211: mesh: fix call_rcu() usageJohannes Berg2015-11-171-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When using call_rcu(), the called function may be delayed quite significantly, and without a matching rcu_barrier() there's no way to be sure it has finished. Therefore, global state that could be gone/freed/reused should never be touched in the callback. Fix this in mesh by moving the atomic_dec() into the caller; that's not really a problem since we already unlinked the path and it will be destroyed anyway. This fixes a crash Jouni observed when running certain tests in a certain order, in which the mesh interface was torn down, the memory reused for a function pointer (work struct) and running that then crashed since the pointer had been decremented by 1, resulting in an invalid instruction byte stream. Cc: stable@vger.kernel.org Fixes: eb2b9311fd00 ("mac80211: mesh path table implementation") Reported-by: Jouni Malinen <j@w1.fi> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| | | * | mac80211: don't advertise NL80211_FEATURE_FULL_AP_CLIENT_STATEJohannes Berg2015-11-171-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For now, this feature doesn't actually work. To avoid shipping a kernel that has it enabled but where it can't be used disable it for now - we can re-enable it when it's fixed. This partially reverts 44674d9c2267 ("mac80211: advertise support for full station state in AP mode"). Cc: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
OpenPOWER on IntegriCloud