linux/net/mac80211
Johannes Berg 7a7c0a6438 mac80211: fix TX aggregation start/stop callback race
When starting or stopping an aggregation session, one of the steps
is that the driver calls back to mac80211 that the start/stop can
proceed. This is handled by queueing up a fake SKB and processing
it from the normal iface/sdata work. Since this isn't flushed when
disassociating, the following race is possible:

 * associate
 * start aggregation session
 * driver callback
 * disassociate
 * associate again to the same AP
 * callback processing runs, leading to a WARN_ON() that
   the TID hadn't requested aggregation

If the second association isn't to the same AP, there would only
be a message printed ("Could not find station: <addr>"), but the
same race could happen.

Fix this by not going the whole detour with a fake SKB etc. but
simply looking up the aggregation session in the driver callback,
marking it with a START_CB/STOP_CB bit and then scheduling the
regular aggregation work that will now process these bits as well.
This also simplifies the code and gets rid of the whole problem
with allocation failures of said skb, which could have left the
session in limbo.

Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-05-30 09:08:40 +02:00
..
aes_ccm.c mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_ccm.h mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_cmac.c mac80211: aes-cmac: switch to shash CMAC driver 2017-02-08 09:19:33 +01:00
aes_cmac.h mac80211: aes-cmac: switch to shash CMAC driver 2017-02-08 09:19:33 +01:00
aes_gcm.c mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_gcm.h mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_gmac.c mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_gmac.h mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
agg-rx.c mac80211: Use setup_timer instead of init_timer 2017-03-06 13:23:05 +01:00
agg-tx.c mac80211: fix TX aggregation start/stop callback race 2017-05-30 09:08:40 +02:00
cfg.c mac80211: Fix possible sband related NULL pointer de-reference 2017-04-28 12:28:44 +02:00
chan.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-01-17 15:19:37 -05:00
debug.h
debugfs_key.c mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
debugfs_key.h
debugfs_netdev.c mac80211: multicast to unicast conversion 2016-12-13 16:05:11 +01:00
debugfs_netdev.h
debugfs_sta.c mac80211: add back lost debugfs files 2017-02-07 10:40:50 +01:00
debugfs_sta.h
debugfs.c mac80211: check for allocation failure in debugfs code 2017-02-08 10:05:07 +01:00
debugfs.h
driver-ops.c mac80211: add offset_tsf driver op and use it for mesh 2016-09-30 13:45:44 +02:00
driver-ops.h mac80211: add offset_tsf driver op and use it for mesh 2016-09-30 13:45:44 +02:00
ethtool.c mac80211: move station statistics into sub-structs 2015-10-21 10:08:22 +02:00
fils_aead.c Some more updates: 2017-02-10 14:31:51 -05:00
fils_aead.h mac80211: FILS AEAD protection for station mode association frames 2016-10-27 16:03:25 +02:00
ht.c mac80211: fix TX aggregation start/stop callback race 2017-05-30 09:08:40 +02:00
ibss.c mac80211: fix IBSS presp allocation size 2017-05-08 11:25:04 +02:00
ieee80211_i.h mac80211: fix TX aggregation start/stop callback race 2017-05-30 09:08:40 +02:00
iface.c mac80211: fix TX aggregation start/stop callback race 2017-05-30 09:08:40 +02:00
Kconfig mac80211: fils_aead: Use crypto api CMAC shash rather than bare cipher 2017-02-08 09:19:17 +01:00
key.c mac80211: don't call drv_set_default_unicast_key() for VLANs 2016-12-13 15:57:59 +01:00
key.h mac80211: aes-cmac: switch to shash CMAC driver 2017-02-08 09:19:33 +01:00
led.c
led.h
main.c mac80211: disentangle iflist_mtx and chanctx_mtx 2017-04-26 23:17:44 +02:00
Makefile Makefile: drop -D__CHECK_ENDIAN__ from cflags 2016-12-16 00:13:43 +02:00
mesh_hwmp.c mac80211: fix mesh fail_avg check 2017-03-06 09:21:46 +01:00
mesh_pathtbl.c mac80211: Use setup_timer instead of init_timer for mesh path 2017-03-16 10:54:04 +01:00
mesh_plink.c mac80211: Fix possible sband related NULL pointer de-reference 2017-04-28 12:28:44 +02:00
mesh_ps.c mac80211: mesh: separate plid and aid concepts 2015-07-17 15:47:11 +02:00
mesh_sync.c mac80211: Use appropriate name for functions and messages 2016-12-13 16:22:27 +01:00
mesh.c mac80211: Fix possible sband related NULL pointer de-reference 2017-04-28 12:28:44 +02:00
mesh.h mac80211: Use appropriate name for functions and messages 2016-12-13 16:22:27 +01:00
michael.c
michael.h
mlme.c mac80211: bail out from prep_connection() if a reconfig is ongoing 2017-05-08 11:23:50 +02:00
ocb.c mac80211: remove rx_stats.last_rx update after sta alloc 2016-04-06 13:18:15 +02:00
offchannel.c mac80211: fix CMD_FRAME for AP_VLAN 2016-10-12 09:19:12 +02:00
pm.c cfg80211: add request id to cfg80211_sched_scan_*() api 2017-04-28 14:51:43 +02:00
rate.c mac80211: Fix possible sband related NULL pointer de-reference 2017-04-28 12:28:44 +02:00
rate.h mac80211: make rate control tx status API more extensible 2017-04-28 10:57:33 +02:00
rc80211_minstrel_debugfs.c mac80211: minstrel: store probability variance instead of standard deviation 2016-12-15 11:07:52 +01:00
rc80211_minstrel_ht_debugfs.c mac80211: minstrel: store probability variance instead of standard deviation 2016-12-15 11:07:52 +01:00
rc80211_minstrel_ht.c mac80211: make rate control tx status API more extensible 2017-04-28 10:57:33 +02:00
rc80211_minstrel_ht.h mac80211: minstrel_ht: move supported bitrate mask out of group data 2016-12-15 11:07:52 +01:00
rc80211_minstrel.c mac80211: make rate control tx status API more extensible 2017-04-28 10:57:33 +02:00
rc80211_minstrel.h mac80211: minstrel: make prob_ewma u16 instead of u32 2016-12-15 11:07:53 +01:00
rx.c mac80211: strictly check mesh address extension mode 2017-05-17 14:24:29 +02:00
scan.c cfg80211: add request id to cfg80211_sched_scan_*() api 2017-04-28 14:51:43 +02:00
spectmgmt.c ieee80211: rename CCFS1/CCFS2 to CCFS0/CCFS1 2017-03-06 09:21:43 +01:00
sta_info.c mac80211: Fix possible sband related NULL pointer de-reference 2017-04-28 12:28:44 +02:00
sta_info.h mac80211: fix TX aggregation start/stop callback race 2017-05-30 09:08:40 +02:00
status.c mac80211: add ieee80211_tx_status_ext 2017-04-28 11:08:21 +02:00
tdls.c mac80211: Fix possible sband related NULL pointer de-reference 2017-04-28 12:28:44 +02:00
tkip.c mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
tkip.h mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
trace_msg.h
trace.c
trace.h cfg80211: fix NAN bands definition 2017-02-09 15:17:30 +01:00
tx.c mac80211: Fix possible sband related NULL pointer de-reference 2017-04-28 12:28:44 +02:00
util.c cfg80211: add request id to cfg80211_sched_scan_*() api 2017-04-28 14:51:43 +02:00
vht.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-01-17 15:19:37 -05:00
wep.c mac80211: Add RX flag to indicate ICV stripped 2017-01-12 10:15:18 +01:00
wep.h
wme.c mac80211: preserve more bits when building QoS header 2016-10-12 14:17:13 +02:00
wme.h
wpa.c mac80211: Add RX flag to indicate ICV stripped 2017-01-12 10:15:18 +01:00
wpa.h