This repository has been archived on 2022-02-17. You can view files and clone it, but cannot push or open issues or pull requests.

Johannes Berg 827d42c9ac mac80211: fix spurious delBA handling ... Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was commit d75636ef9c Author: Johannes Berg <johannes@sipsolutions.net> Date: Tue Feb 10 21:25:53 2009 +0100 mac80211: RX aggregation: clean up stop session and other parts were already present in the original commit d92684e660 Author: Ron Rindjunsky <ron.rindjunsky@intel.com> Date: Mon Jan 28 14:07:22 2008 +0200 mac80211: A-MPDU Tx add delBA from recipient support The first problem is that I moved a BUG_ON before various checks -- thereby making it possible to hit. As the comment indicates, the BUG_ON can be removed since the ampdu_action callback must already exist when the state is != IDLE. The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARN_ON may happen with non-HT drivers, while the race opens only for HT drivers. For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock 2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already. Reported-by: Lennert Buytenhek <buytenh@marvell.com> Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>		2009-11-30 13:55:51 -05:00
..
ath	ath9k: set ps_default as false	2009-11-23 16:17:21 -05:00
b43	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	2009-11-18 14:54:45 -08:00
b43legacy	headers: remove sched.h from interrupt.h	2009-10-11 11:20:58 -07:00
hostap	headers: remove sched.h from interrupt.h	2009-10-11 11:20:58 -07:00
ipw2x00	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	2009-11-18 14:54:45 -08:00
iwlwifi	mac80211: fix spurious delBA handling	2009-11-30 13:55:51 -05:00
iwmc3200wifi	headers: remove sched.h from interrupt.h	2009-10-11 11:20:58 -07:00
libertas	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	2009-11-18 14:54:45 -08:00
libertas_tf
orinoco
p54	p54usb: Remove DMA buffer from stack	2009-11-13 17:33:49 -05:00
prism54	headers: remove sched.h from interrupt.h	2009-10-11 11:20:58 -07:00
rt2x00	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	2009-11-09 09:51:42 -08:00
rtl818x	rtl8187: Fix sparse warnings	2009-11-10 16:21:15 -05:00
wl12xx	Merge branch 'master' of /home/davem/src/GIT/linux-2.6/	2009-09-24 15:13:11 -07:00
zd1211rw	Merge branch 'master' of /home/davem/src/GIT/linux-2.6/	2009-09-24 15:13:11 -07:00
adm8211.c
adm8211.h	mac80211: fix ADM8211_SYNCTL_RFtype define	2009-10-07 16:33:51 -04:00
airo.c	airo: Reorder tests, check bounds before element	2009-10-27 16:29:49 -04:00
airo.h
airo_cs.c
arlan-main.c
arlan-proc.c	sysctl: remove "struct file *" argument of ->proc_handler	2009-09-24 07:21:04 -07:00
arlan.h
at76c50x-usb.c
at76c50x-usb.h
atmel.c
atmel.h
atmel_cs.c
atmel_pci.c
i82586.h
i82593.h
Kconfig	Kconfig: STRIP: Remove stale bits of STRIP help text	2009-10-01 14:49:14 -07:00
mac80211_hwsim.c	mac80211_hwsim: Fix initial beacon timer configuration	2009-09-29 17:25:16 -04:00
Makefile
mwl8k.c
netwave_cs.c
ray_cs.c	ray_cs: Fix copy_from_user handling	2009-10-29 09:01:07 -07:00
ray_cs.h
rayctl.h
rndis_wlan.c
strip.c
wavelan.c
wavelan.h
wavelan.p.h
wavelan_cs.c
wavelan_cs.h
wavelan_cs.p.h
wl3501.h
wl3501_cs.c
zd1201.c
zd1201.h