Johannes Berg 827d42c9ac mac80211: fix spurious delBA handling ... Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was commit d75636ef9c Author: Johannes Berg <johannes@sipsolutions.net> Date: Tue Feb 10 21:25:53 2009 +0100 mac80211: RX aggregation: clean up stop session and other parts were already present in the original commit d92684e660 Author: Ron Rindjunsky <ron.rindjunsky@intel.com> Date: Mon Jan 28 14:07:22 2008 +0200 mac80211: A-MPDU Tx add delBA from recipient support The first problem is that I moved a BUG_ON before various checks -- thereby making it possible to hit. As the comment indicates, the BUG_ON can be removed since the ampdu_action callback must already exist when the state is != IDLE. The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARN_ON may happen with non-HT drivers, while the race opens only for HT drivers. For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock 2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already. Reported-by: Lennert Buytenhek <buytenh@marvell.com> Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>		2009-11-30 13:55:51 -05:00
..
ath	ath9k: set ps_default as false	2009-11-23 16:17:21 -05:00
b43	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	2009-11-18 14:54:45 -08:00
b43legacy	…
hostap	…
ipw2x00	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	2009-11-18 14:54:45 -08:00
iwlwifi	mac80211: fix spurious delBA handling	2009-11-30 13:55:51 -05:00
iwmc3200wifi	…
libertas	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	2009-11-18 14:54:45 -08:00
libertas_tf	…
orinoco	…
p54	p54usb: Remove DMA buffer from stack	2009-11-13 17:33:49 -05:00
prism54	…
rt2x00	…
rtl818x	…
wl12xx	…
zd1211rw	…
Kconfig	…
Makefile	…
adm8211.c	…
adm8211.h	…
airo.c	…
airo.h	…
airo_cs.c	…
arlan-main.c	…
arlan-proc.c	…
arlan.h	…
at76c50x-usb.c	…
at76c50x-usb.h	…
atmel.c	…
atmel.h	…
atmel_cs.c	…
atmel_pci.c	…
i82586.h	…
i82593.h	…
mac80211_hwsim.c	…
mwl8k.c	…
netwave_cs.c	…
ray_cs.c	…
ray_cs.h	…
rayctl.h	…
rndis_wlan.c	…
strip.c	…
wavelan.c	…
wavelan.h	…
wavelan.p.h	…
wavelan_cs.c	…
wavelan_cs.h	…
wavelan_cs.p.h	…
wl3501.h	…
wl3501_cs.c	…
zd1201.c	…
zd1201.h	…