Johannes Berg 827d42c9ac mac80211: fix spurious delBA handling ... Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was commit d75636ef9c Author: Johannes Berg <johannes@sipsolutions.net> Date: Tue Feb 10 21:25:53 2009 +0100 mac80211: RX aggregation: clean up stop session and other parts were already present in the original commit d92684e660 Author: Ron Rindjunsky <ron.rindjunsky@intel.com> Date: Mon Jan 28 14:07:22 2008 +0200 mac80211: A-MPDU Tx add delBA from recipient support The first problem is that I moved a BUG_ON before various checks -- thereby making it possible to hit. As the comment indicates, the BUG_ON can be removed since the ampdu_action callback must already exist when the state is != IDLE. The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARN_ON may happen with non-HT drivers, while the race opens only for HT drivers. For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock 2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already. Reported-by: Lennert Buytenhek <buytenh@marvell.com> Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>		2009-11-30 13:55:51 -05:00
..
aes_ccm.c
aes_ccm.h
aes_cmac.c
aes_cmac.h
agg-rx.c
agg-tx.c	mac80211: fix spurious delBA handling	2009-11-30 13:55:51 -05:00
cfg.c
cfg.h
debugfs_key.c
debugfs_key.h
debugfs_netdev.c
debugfs_netdev.h
debugfs_sta.c
debugfs_sta.h
debugfs.c
debugfs.h
driver-ops.h
driver-trace.c
driver-trace.h
event.c
ht.c	mac80211: fix spurious delBA handling	2009-11-30 13:55:51 -05:00
ibss.c
ieee80211_i.h	mac80211: fix spurious delBA handling	2009-11-30 13:55:51 -05:00
iface.c
Kconfig
key.c
key.h
led.c
led.h
main.c
Makefile
mesh_hwmp.c
mesh_pathtbl.c
mesh_plink.c
mesh.c
mesh.h
michael.c
michael.h
mlme.c
pm.c
rate.c
rate.h
rc80211_minstrel_debugfs.c
rc80211_minstrel.c
rc80211_minstrel.h
rc80211_pid_algo.c
rc80211_pid_debugfs.c
rc80211_pid.h
rx.c
scan.c
spectmgmt.c
sta_info.c
sta_info.h
tkip.c
tkip.h
tx.c
util.c
wep.c
wep.h
wme.c
wme.h
wpa.c
wpa.h