kernel.git/net/mac80211, branch linux-2.6.27.y

mac80211: initialize sta->last_rx in sta_info_alloc

2011-04-30T14:53:24Z

commit 8bc8aecdc5e26cfda12dbd6867af4aa67836da6a upstream. This field is used to determine the inactivity time. When in AP mode, hostapd uses it for kicking out inactive clients after a while. Without this patch, hostapd immediately deauthenticates a new client if it checks the inactivity time before the client sends its first data frame. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman

mac80211: pid, fix memory corruption

2009-06-12T03:01:36Z

commit a8659597bf744b0f8d2560e2a734b5c941569e0e upstream pid doesn't count with some band having more bitrates than the one associated the first time. Fix that by counting the maximal available bitrate count and allocate big enough space. Secondly, fix touching uninitialized memory which causes panics. Index sucked from this random memory points to the hell. The fix is to sort the rates on each band change. Also remove a comment which is wrong now. This version also contains half of mac80211: avoid NULL ptr deref when finding max_rates in PID and minstrel patch by John W. Linville, which is namely: - if (sband->n_bitrates > max_rates) + if (sband && sband->n_bitrates > max_rates) to fix oopses on one band devices. Signed-off-by: Jiri Slaby Cc: John W. Linville Signed-off-by: Greg Kroah-Hartman

mac80211: fix a buffer overrun in station debug code

2009-02-17T17:46:29Z

commit 013cd397532e5803a1625954a884d021653da720 upstream. net/mac80211/debugfs_sta.c The trailing zero was written to state[4], it's out of bounds. Signed-off-by: Jianjun Kong Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

mac80211: decrement ref count to netdev after launching mesh discovery

2009-02-02T16:28:07Z

commit 5dc306f3bd1d4cfdf79df39221b3036eab1ddcf3 upstream. After launching mesh discovery in tx path, reference count was not being decremented. This was preventing module unload. Signed-off-by: Brian Cavagnolo Signed-off-by: Andrey Yurovsky Acked-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman

ath9k/mac80211: disallow fragmentation in ath9k, report to userspace

2008-10-22T21:21:05Z

commit 4233df6b748193d45f79fb7448991a473061a65d upstream As I've reported, ath9k currently fails utterly when fragmentation is enabled. This makes ath9k "support" hardware fragmentation by not supporting fragmentation at all to avoid the double-free issue. The patch also changes mac80211 to report errors from the driver operation to userspace. That hack in ath9k should be removed once the rate control algorithm it has is fixed, and we can at that time consider removing the hw fragmentation support entirely since it's not used by any driver. Signed-off-by: Johannes Berg Acked-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman

mac80211: fix two issues in debugfs

2008-10-18T17:49:11Z

Not in trees above 2.6.27 as it is fixed differently in .28. This fixes RHBZ 466264, whenever the master interface is renamed this code would BUG_ON. Also fixes a separately reported bug with the debugfs dir being NULL. This patch is not applicable to the next kernel version because both these issues have been fixed, the first one by not having the master interface have a ieee80211_ptr at all, and the second one by also leaving the function early. Signed-off-by: Johannes Berg Cc: John Linville Signed-off-by: Greg Kroah-Hartman

Revert "mac80211: Use IWEVASSOCREQIE instead of IWEVCUSTOM"

2008-09-05T19:38:09Z

This reverts commit 087d833e5a9f67ba933cb32eaf5a2279c1a5b47c, which was reported to break wireless at least in some combinations with 32bit user space and a 64bit kernel. Alex Williamnson bisected it to this commit. Reported-and-bisected-by: Alex Williamson Acked-by: John W. Linville Cc: David Miller Cc: Jouni Malinen Signed-off-by: Linus Torvalds

mac80211: Fix debugfs union misuse and pointer corruption

2008-09-02T21:39:50Z

debugfs union in struct ieee80211_sub_if_data is misused by including a common default_key dentry as a union member. This ends occupying the same memory area with the first dentry in other union members (structures; usually drop_unencrypted). Consequently, debugfs operations on default_key symlinks and drop_unencrypted entry are using the same dentry pointer even though they are supposed to be separate ones. This can lead to removing entries incorrectly or potentially leaving something behind since one of the dentry pointers gets lost. Fix this by moving the default_key dentry to a new struct (common_debugfs) that contains dentries (more to be added in future) that are shared by all vif types. The debugfs union must only be used for vif type-specific entries to avoid this type of pointer corruption. Signed-off-by: Jouni Malinen Acked-by: Johannes Berg Signed-off-by: John W. Linville

mac80211: quiet chatty IBSS merge message

2008-08-27T00:33:34Z

It seems obvious that this #ifndef should be the opposite polarity... Signed-off-by: John W. Linville

mac80211: don't send empty extended rates IE

2008-08-27T00:06:33Z

The association request includes a list of supported data rates. 802.11b: 4 supported rates. 802.11g: 12 (8 + 4) supported rates. 802.11a: 8 supported rates. The rates tag of the assoc request has room for only 8 rates. In case of 802.11g an extended rate tag is appended. However in net/wireless/mlme.c an extended (empty) rate tag is also appended if the number of rates is exact 8. This empty (length=0) extended rates tag causes some APs to deny association with code 18 (unsupported rates). These APs include my ZyXEL G-570U, and according to Tomas Winkler som Cisco APs. 'If count == 8' has been used to check for the need for an extended rates tag. But count would also be equal to 8 if the for loop exited because of no more supported rates. Therefore a check for count being less than rates_len would seem more correct. Thanks to: * Dan Williams for newbie guidance * Tomas Winkler for confirming the problem Signed-off-by: Jan-Espen Pettersen Signed-off-by: John W. Linville