summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2012-05-31 15:09:27 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-06-17 11:21:25 -0700
commitd4bb7f49f4d5ea7a287899178df55b4725bb32d2 (patch)
treec64f85367ff571a42d3a5fcb76c871a9632463a1 /net
parent721632c39add11e5d5fa5dd8b956dcae63d02b17 (diff)
downloadlinux-3.10-d4bb7f49f4d5ea7a287899178df55b4725bb32d2.tar.gz
linux-3.10-d4bb7f49f4d5ea7a287899178df55b4725bb32d2.tar.bz2
linux-3.10-d4bb7f49f4d5ea7a287899178df55b4725bb32d2.zip
mac80211: clean up remain-on-channel on interface stop
commit 71ecfa1893034eeb1c93e02e22ee2ad26d080858 upstream. When any interface goes down, it could be the one that we were doing a remain-on-channel with. We therefore need to cancel the remain-on-channel and flush the related work structs so they don't run after the interface has been removed or even destroyed. It's also possible in this case that an off-channel SKB was never transmitted, so free it if this is the case. Note that this can also happen if the driver finishes the off-channel period without ever starting it. Reported-by: Nirav Shah <nirav.j2.shah@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/mac80211/iface.c12
-rw-r--r--net/mac80211/offchannel.c16
2 files changed, 28 insertions, 0 deletions
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index c20051b7ffc..48f937e1ecf 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -514,6 +514,18 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
ieee80211_configure_filter(local);
break;
default:
+ mutex_lock(&local->mtx);
+ if (local->hw_roc_dev == sdata->dev &&
+ local->hw_roc_channel) {
+ /* ignore return value since this is racy */
+ drv_cancel_remain_on_channel(local);
+ ieee80211_queue_work(&local->hw, &local->hw_roc_done);
+ }
+ mutex_unlock(&local->mtx);
+
+ flush_work(&local->hw_roc_start);
+ flush_work(&local->hw_roc_done);
+
flush_work(&sdata->work);
/*
* When we get here, the interface is marked down.
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index f054e94901a..935aa4b6dee 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -234,6 +234,22 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
return;
}
+ /* was never transmitted */
+ if (local->hw_roc_skb) {
+ u64 cookie;
+
+ cookie = local->hw_roc_cookie ^ 2;
+
+ cfg80211_mgmt_tx_status(local->hw_roc_dev, cookie,
+ local->hw_roc_skb->data,
+ local->hw_roc_skb->len, false,
+ GFP_KERNEL);
+
+ kfree_skb(local->hw_roc_skb);
+ local->hw_roc_skb = NULL;
+ local->hw_roc_skb_for_status = NULL;
+ }
+
if (!local->hw_roc_for_tx)
cfg80211_remain_on_channel_expired(local->hw_roc_dev,
local->hw_roc_cookie,