[ 3.5.yuz extended stable ] Patch "cfg80211/mac80211: avoid state mishmash on deauth" has been added to staging queue

[Herton Ronaldo Krzesinski]

This is a note to let you know that I have just added a patch titled

    cfg80211/mac80211: avoid state mishmash on deauth

to the linux-3.5.y-queue branch of the 3.5.yuz extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.yuz tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Herton

------

>From 275f9f75e2e27d79e90e586f863fc7cbd5205996 Mon Sep 17 00:00:00 2001
From: Stanislaw Gruszka <sgruszka at redhat.com>
Date: Mon, 15 Oct 2012 14:52:41 +0200
Subject: [PATCH] cfg80211/mac80211: avoid state mishmash on deauth

commit 6863255bd0e48bc41ae5a066d5c771801e92735a upstream.

Avoid situation when we are on associate state in mac80211 and
on disassociate state in cfg80211. This can results on crash
during modules unload (like showed on this thread:
http://marc.info/?t=134373976300001&r=1&w=2) and possibly other
problems.

Reported-by: Pedro Francisco <pedrogfrancisco at gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka at redhat.com>
Signed-off-by: Johannes Berg <johannes.berg at intel.com>
[herton: use the patch for 3.6 stable]
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski at canonical.com>
---
 include/net/cfg80211.h |    1 +
 net/mac80211/mlme.c    |    5 +++--
 net/wireless/mlme.c    |   12 +++---------
 3 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 0289d4c..e225dcc 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1130,6 +1130,7 @@ struct cfg80211_deauth_request {
 	const u8 *ie;
 	size_t ie_len;
 	u16 reason_code;
+	bool local_state_change;
 };

 /**
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 92028de..6d79367 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3467,6 +3467,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 {
 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 	u8 frame_buf[DEAUTH_DISASSOC_LEN];
+	bool tx = !req->local_state_change;

 	mutex_lock(&ifmgd->mtx);

@@ -3483,11 +3484,11 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 	if (ifmgd->associated &&
 	    ether_addr_equal(ifmgd->associated->bssid, req->bssid))
 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
-				       req->reason_code, true, frame_buf);
+				       req->reason_code, tx, frame_buf);
 	else
 		ieee80211_send_deauth_disassoc(sdata, req->bssid,
 					       IEEE80211_STYPE_DEAUTH,
-					       req->reason_code, true,
+					       req->reason_code, tx,
 					       frame_buf);
 	mutex_unlock(&ifmgd->mtx);

diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index eb90988..b6626d9 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -441,20 +441,14 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 		.reason_code = reason,
 		.ie = ie,
 		.ie_len = ie_len,
+		.local_state_change = local_state_change,
 	};

 	ASSERT_WDEV_LOCK(wdev);

-	if (local_state_change) {
-		if (wdev->current_bss &&
-		    ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
-			cfg80211_unhold_bss(wdev->current_bss);
-			cfg80211_put_bss(&wdev->current_bss->pub);
-			wdev->current_bss = NULL;
-		}
-
+	if (local_state_change && (!wdev->current_bss ||
+	    !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
 		return 0;
-	}

 	return rdev->ops->deauth(&rdev->wiphy, dev, &req);
 }
--
1.7.9.5