summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/mac80211_hwsim.c
Commit message (Collapse)AuthorAgeFilesLines
* mac80211_hwsim: propagate genlmsg_reply return codeLi RongQing2019-02-221-1/+1
| | | | | | | genlmsg_reply can fail, so propagate its return code Signed-off-by: Li RongQing <lirongqing@baidu.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* mac80211_hwsim: check that n_limits makes senseJohannes Berg2019-01-191-0/+5
| | | | | | | | | | | Under certain circumstances, radios created via netlink could have n_limits be zero and no possible interface types, which makes no sense. Reject this early to prevent a WARN_ON() in cfg80211. Fixes: 99e3a44bac37 ("mac80211_hwsim: allow setting iftype support") Reported-by: syzbot+73fd8b0aa60c67fa4b60@syzkaller.appspotmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* Merge tag 'mac80211-next-for-davem-2018-12-19' of ↵David S. Miller2018-12-191-78/+179
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg says: ==================== This time we have too many changes to list, highlights: * virt_wifi - wireless control simulation on top of another network interface * hwsim configurability to test capabilities similar to real hardware * various mesh improvements * various radiotap vendor data fixes in mac80211 * finally the nl_set_extack_cookie_u64() we talked about previously, used for * peer measurement APIs, right now only with FTM (flight time measurement) for location * made nl80211 radio/interface announcements more complete * various new HE (802.11ax) things: updates, TWT support, ... ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * mac80211_hwsim: fix overwriting of if_combinationJames Prestwood2018-12-181-6/+7
| | | | | | | | | | | | | | | | | | Moved setting if_combination.num_different_channels/radar_detect_widths into an else after use_chanctx. In the case of use_chanctx, these two settings were getting overwritten. Signed-off-by: James Prestwood <james.prestwood@linux.intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: fixes kernel crash during mac80211_hwsim initJames Prestwood2018-12-051-0/+1
| | | | | | | | | | | | | | | | | | Creating radios during startup follows a different code path than HWSIM_CMD_NEW_RADIO. The problem was that param.iftypes was not being set to the deafult before calling mac80211_hwsim_new_radio Signed-off-by: James Prestwood <james.prestwood@linux.intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: allow configurable cipher typesJames Prestwood2018-11-091-0/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The mac80211_hwsim driver does not specify supported cipher types, which in turn enables all ciphers to be supported in software. (see net/mac80211/main.c:ieee80211_init_cipher_suites). Allowing ciphers to be configurable is valuable for simulating older drivers that may not support all ciphers. This patch adds a new attribute: - HWSIM_ATTR_CIPHER_SUPPORT A u32 array/list of supported cipher types This only allows enabling/disabling cipher types listed in the (new) "hwsim_ciphers" array in mac80211_hwsim.c. Any unknown cipher type will result in -EINVAL. Signed-off-by: James Prestwood <james.prestwood@linux.intel.com> [fix some indentation, change to hwsim_known_ciphers(), add error messages, validate length better] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: allow setting iftype supportJames Prestwood2018-11-091-66/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The mac80211_hwsim driver hard codes its supported interface types. For testing purposes it would be valuable to allow changing these supported types in order to simulate actual drivers than support a limited set of iftypes. A new attribute was added to allow this: - HWSIM_ATTR_IFTYPE_SUPPORT A u32 bit field of supported NL80211_IFTYPE_* bits This will only enable/disable iftypes that mac80211_hwsim already supports. In order to accomplish this, the ieee80211_iface_limit structure needed to be built dynamically to only include limit rules for iftypes that the user requested to enable. Signed-off-by: James Prestwood <james.prestwood@linux.intel.com> [fix some indentation, add netlink error string] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: move HWSIM_ATTR_RADIO_NAME parsing lastJohannes Berg2018-11-091-13/+10
| | | | | | | | | | | | | | Avoid the need to kfree() the name in many places by moving the name parsing last. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | mac80211_hwsim: Timer should be initialized before device registeredVasyl Vavrychuk2018-11-091-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Otherwise if network manager starts configuring Wi-Fi interface immidiatelly after getting notification of its creation, we will get NULL pointer dereference: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff95ae94c8>] hrtimer_active+0x28/0x50 ... Call Trace: [<ffffffff95ae9997>] ? hrtimer_try_to_cancel+0x27/0x110 [<ffffffff95ae9a95>] ? hrtimer_cancel+0x15/0x20 [<ffffffffc0803bf0>] ? mac80211_hwsim_config+0x140/0x1c0 [mac80211_hwsim] Cc: stable@vger.kernel.org Signed-off-by: Vasyl Vavrychuk <vasyl.vavrychuk@globallogic.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | mac80211_hwsim: fix module init error paths for netlinkAlexey Khoroshilov2018-11-091-5/+7
|/ | | | | | | | | | | | There is no unregister netlink notifier and family on error paths in init_mac80211_hwsim(). Also there is an error path where hwsim_class is not destroyed. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Fixes: 62759361eb49 ("mac80211-hwsim: Provide multicast event for HWSIM_CMD_NEW_RADIO") Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* mac80211_hwsim: drop now unused work-queue from hwsimMartin Willi2018-10-081-10/+1
| | | | | | | | | | The work-queue was used for deferred destruction of hwsim radios; this does not work well with namespaces about to exit. The one remaining user has been migrated, so drop the now unused work-queue instance. Signed-off-by: Martin Willi <martin@strongswan.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2018-10-031-19/+17
|\ | | | | | | | | | | | | Minor conflict in net/core/rtnetlink.c, David Ahern's bug fix in 'net' overlapped the renaming of a netlink attribute in net-next. Signed-off-by: David S. Miller <davem@davemloft.net>
| * mac80211_hwsim: do not omit multicast announce of first added radioMartin Willi2018-09-261-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | The allocation of hwsim radio identifiers uses a post-increment from 0, so the first radio has idx 0. This idx is explicitly excluded from multicast announcements ever since, but it is unclear why. Drop that idx check and announce the first radio as well. This makes userspace happy if it relies on these events. Signed-off-by: Martin Willi <martin@strongswan.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: fix race in radio destruction from netlink notifierMartin Willi2018-09-261-13/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The asynchronous destruction from a work-queue of radios tagged with destroy-on-close may race with the owning namespace about to exit, resulting in potential use-after-free of that namespace. Instead of using a work-queue, move radios about to destroy to a temporary list, which can be worked on synchronously after releasing the lock. This should be safe to do from the netlink socket notifier, as the namespace is guaranteed to not get released. Signed-off-by: Martin Willi <martin@strongswan.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: fix locking when iterating radios during ns exitMartin Willi2018-09-261-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The cleanup of radios during namespace exit has recently been reworked to directly delete a radio while temporarily releasing the spinlock, fixing a race condition between the work-queue execution and namespace exits. However, the temporary unlock allows unsafe modifications on the iterated list, resulting in a potential crash when continuing the iteration of additional radios. Move radios about to destroy to a temporary list, and clean that up after releasing the spinlock once iteration is complete. Fixes: 8cfd36a0b53a ("mac80211_hwsim: fix use-after-free bug in hwsim_exit_net") Signed-off-by: Martin Willi <martin@strongswan.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | wireless: align to draft 11ax D3.0Shaul Triebitz2018-09-051-11/+7
|/ | | | | | | | | | Align to new 11ax draft D3.0. Change/add new MAC and PHY capabilities and update drivers' 11ax capabilities and mac80211's debugfs accordingly. Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* Merge tag 'mac80211-for-davem-2018-09-03' of ↵David S. Miller2018-09-031-3/+9
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Here are quite a large number of fixes, notably: * various A-MSDU building fixes (currently only affects mt76) * syzkaller & spectre fixes in hwsim * TXQ vs. teardown fix that was causing crashes * embed WMM info in reg rule, bad code here had been causing crashes * one compilation issue with fix from Arnd (rfkill-gpio includes) * fixes for a race and bad data during/after channel switch * nl80211: a validation fix, attribute type & unit fixes along with other small fixes. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_customJinbum Park2018-08-281-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | User controls @idx which to be used as index of hwsim_world_regdom_custom. So, It can be exploited via Spectre-like attack. (speculative execution) This kind of attack leaks address of hwsim_world_regdom_custom, It leads an attacker to bypass security mechanism such as KASLR. So sanitize @idx before using it to prevent attack. I leveraged strategy [1] to find and exploit this gadget. [1] https://github.com/jinb-park/linux-exploit/tree/master/exploit-remaining-spectre-gadget/ Signed-off-by: Jinbum Park <jinb.park7@gmail.com> [johannes: unwrap URL] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_XDanek Duvall2018-08-281-3/+0
| | | | | | | | | | | | | | | | | | | | | | The mac80211_hwsim driver intends to say that it supports up to four STBC receive streams, but instead it ends up saying something undefined. The IEEE80211_VHT_CAP_RXSTBC_X macros aren't independent bits that can be ORed together, but values. In this case, _4 is the appropriate one to use. Signed-off-by: Danek Duvall <duvall@comfychair.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: require at least one channelJohannes Berg2018-08-151-0/+5
| | | | | | | | | | | | | | | | | | Syzbot continues to try to create mac80211_hwsim radios, and manages to pass parameters that are later checked with WARN_ON in cfg80211 - catch another one in hwsim directly. Reported-by: syzbot+2a12f11c306afe871c1f@syzkaller.appspotmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | mac80211_hwsim: Add support for HEIlan Peer2018-07-091-0/+123
|/ | | | | | | | | Add support for HE in mac8011_hwsim, conforming with P802.11ax_D2.0. Signed-off-by: Liad Kaufman <liad.kaufman@intel.com> Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* mac80211_hwsim: fix module init error pathsJohannes Berg2018-06-151-2/+9
| | | | | | | | | | | We didn't free the workqueue on any errors, nor did we correctly check for rhashtable allocation errors, nor did we free the hashtable on error. Reported-by: Colin King <colin.king@canonical.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
* net: remove unnecessary genlmsg_cancel() callsYueHaibing2018-05-291-1/+0
| | | | | | | | | | the message be freed immediately, no need to trim it back to the previous size. Inspired by commit 7a9b3ec1e19f ("nl80211: remove unnecessary genlmsg_cancel() calls") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2018-05-261-2/+2
|\ | | | | | | | | | | | | Lots of easy overlapping changes in the confict resolutions here. Signed-off-by: David S. Miller <davem@davemloft.net>
| * mac80211_hwsim: Fix radio dump for radio idx 0Andrew Zaborowski2018-05-221-2/+2
| | | | | | | | | | | | | | | | | | | | Since 6335698e24ec11e1324b916177da6721df724dd8 the radio with idx of 0 will not get dumped in HWSIM_CMD_GET_RADIO because of the last_idx checks. Offset cb->args[0] by 1 similarly to what is done in nl80211.c. Fixes: 6335698e24ec ("mac80211_hwsim: add generation count for netlink dump operation") Signed-off-by: Andrew Zaborowski <andrew.zaborowski@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | Merge remote-tracking branch 'net-next/master' into mac80211-nextJohannes Berg2018-05-231-0/+1
|\ \ | |/ | | | | | | | | | | Bring in net-next which had pulled in net, so I have the changes from mac80211 and can apply a patch that would otherwise conflict. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: fix a possible memory leak in hwsim_new_radio_nl()YueHaibing2018-05-071-0/+1
| | | | | | | | | | | | | | | | | | 'hwname' should be freed before leaving from the error handling cases, otherwise it will cause mem leak Fixes: cb1a5bae5684 ("mac80211_hwsim: add permanent mac address option for new radios") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | mac80211_hwsim: indicate support for powersave.Bjoern Johansson2018-04-191-0/+1
|/ | | | | | | | | | | | | | | Without this, higher layers in the kernel will return an error code when trying to set the power state because the driver doesn't indicate power state support. This in turn causes VTS (Android Vendor Test Suite) failures because the WiFi HAL can't enable power saving mode. Signed-off-by: Bjoern Johansson <bjoernj@google.com> Signed-off-by: Lingfeng Yang <lfy@google.com> Signed-off-by: Roman Kiryanov <rkir@google.com> [johannes: remove remaining code, it was useless even as a skeleton since it didn't even have the right function arguments] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* mac80211_hwsim: use DEFINE_IDAMatthew Wilcox2018-04-111-1/+1
| | | | | | | | | This is preferred to opencoding an IDA_INIT. Link: http://lkml.kernel.org/r/20180313132639.17387-2-willy@infradead.org Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge tag 'mac80211-next-for-davem-2018-03-29' of ↵David S. Miller2018-03-291-3/+7
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg says: ==================== We have a fair number of patches, but many of them are from the first bullet here: * EAPoL-over-nl80211 from Denis - this will let us fix some long-standing issues with bridging, races with encryption and more * DFS offload support from the qtnfmac folks * regulatory database changes for the new ETSI adaptivity requirements * various other fixes and small enhancements ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * mac80211_hwsim: fix use-after-free bug in hwsim_exit_netBenjamin Beichler2018-03-211-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | When destroying a net namespace, all hwsim interfaces, which are not created in default namespace are deleted. But the async deletion of the interfaces could last longer than the actual destruction of the namespace, which results to an use after free bug. Therefore use synchronous deletion in this case. Fixes: 100cb9ff40e0 ("mac80211_hwsim: Allow managing radios from non-initial namespaces") Reported-by: syzbot+70ce058e01259de7bb1d@syzkaller.appspotmail.com Signed-off-by: Benjamin Beichler <benjamin.beichler@uni-rostock.de> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: fix secondary MAC address assignmentJohannes Berg2018-03-211-1/+1
| | | | | | | | | | | | | | | | | | | | OR'ing in 0x40 before a memcpy() to overwrite the value doesn't do much good - flip the order of operations are reported and tested by Jouni. Fixes: cb1a5bae5684 ("mac80211_hwsim: add permanent mac address option for new radios") Reported-by: Jouni Malinen <j@w1.fi> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | net: Drop pernet_operations::asyncKirill Tkhai2018-03-271-1/+0
| | | | | | | | | | | | | | | | Synchronous pernet_operations are not allowed anymore. All are asynchronous. So, drop the structure member. Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2018-03-231-0/+1
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fun set of conflict resolutions here... For the mac80211 stuff, these were fortunately just parallel adds. Trivially resolved. In drivers/net/phy/phy.c we had a bug fix in 'net' that moved the function phy_disable_interrupts() earlier in the file, whilst in 'net-next' the phy_error() call from this function was removed. In net/ipv4/xfrm4_policy.c, David Ahern's changes to remove the 'rt_table_id' member of rtable collided with a bug fix in 'net' that added a new struct member "rt_mtu_locked" which needs to be copied over here. The mlxsw driver conflict consisted of net-next separating the span code and definitions into separate files, whilst a 'net' bug fix made some changes to that moved code. The mlx5 infiniband conflict resolution was quite non-trivial, the RDMA tree's merge commit was used as a guide here, and here are their notes: ==================== Due to bug fixes found by the syzkaller bot and taken into the for-rc branch after development for the 4.17 merge window had already started being taken into the for-next branch, there were fairly non-trivial merge issues that would need to be resolved between the for-rc branch and the for-next branch. This merge resolves those conflicts and provides a unified base upon which ongoing development for 4.17 can be based. Conflicts: drivers/infiniband/hw/mlx5/main.c - Commit 42cea83f9524 (IB/mlx5: Fix cleanup order on unload) added to for-rc and commit b5ca15ad7e61 (IB/mlx5: Add proper representors support) add as part of the devel cycle both needed to modify the init/de-init functions used by mlx5. To support the new representors, the new functions added by the cleanup patch needed to be made non-static, and the init/de-init list added by the representors patch needed to be modified to match the init/de-init list changes made by the cleanup patch. Updates: drivers/infiniband/hw/mlx5/mlx5_ib.h - Update function prototypes added by representors patch to reflect new function names as changed by cleanup patch drivers/infiniband/hw/mlx5/ib_rep.c - Update init/de-init stage list to match new order from cleanup patch ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * mac80211_hwsim: Set wmediumd for new radiosAndrew Zaborowski2018-03-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Set the wmediumd to the net's wmediumd when the radio gets created. Radios created after HWSIM_CMD_REGISTER don't currently get their data->wmediumd set and the userspace would need to reconnect to netlink to be able to call HWSIM_CMD_REGISTER again. Alternatively I think data->netgroup and data->wmedium could be replaced with a pointer to hwsim_net. Signed-off-by: Andrew Zaborowski <andrew.zaborowski@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | net: Convert hwsim_net_opsKirill Tkhai2018-03-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | These pernet_operations allocate and destroy IDA identifier, and these actions are synchronized by IDA subsystem locks. Exit method removes mac80211_hwsim_data enteries from the lists, and this is synchronized by hwsim_radio_lock with the rest parallel pernet_operations. Also it queues destroy_radio() work, and these work already may be executed in parallel with any pernet_operations (as it's a work :). So, we may mark these pernet_operations as async. Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | mac80211_hwsim: Make hwsim_netgroup IDAKirill Tkhai2018-03-021-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hwsim_netgroup counter is declarated as int, and it is incremented every time a new net is created. After sizeof(int) net are created, it will overflow, and different net namespaces will have the same identifier. This patch fixes the problem by introducing IDA instead of int counter. IDA guarantees, all the net namespaces have the uniq identifier. Note, that after we do ida_simple_remove() in hwsim_exit_net(), and we destroy the ID, later there may be executed destroy_radio() from the workqueue. But destroy_radio() does not use the ID, so it's OK. Out of bounds of this patch, just as a report to wireless subsystem maintainer, destroy_radio() increaments hwsim_radios_generation without hwsim_radio_lock, so this may need one more patch to fix. Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2018-02-241-1/+1
|\ \ | |/
| * Merge tag 'mac80211-for-davem-2018-02-22' of ↵David S. Miller2018-02-221-1/+1
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Various fixes across the tree, the shortlog basically says it all: cfg80211: fix cfg80211_beacon_dup -> old bug in this code cfg80211: clear wep keys after disconnection -> certain ways of disconnecting left the keys mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4 -> alignment issues with using 14 bytes mac80211: Do not disconnect on invalid operating class -> if the AP has a bogus operating class, let it be mac80211: Fix sending ADDBA response for an ongoing session -> don't send the same frame twice cfg80211: use only 1Mbps for basic rates in mesh -> interop issue with old versions of our code mac80211_hwsim: don't use WQ_MEM_RECLAIM -> it causes splats because it flushes work on a non-reclaim WQ regulatory: add NUL to request alpha2 -> nla_put_string() issue from Kees mac80211: mesh: fix wrong mesh TTL offset calculation -> protocol issue mac80211: fix a possible leak of station stats -> error path might leak memory mac80211: fix calling sleeping function in atomic context -> percpu allocations need to be made with gfp flags ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| | * mac80211_hwsim: don't use WQ_MEM_RECLAIMJohannes Berg2018-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We're obviously not part of a memory reclaim path, so don't set the flag. This also causes a warning in check_flush_dependency() since we end up in a code path that flushes a non-reclaim workqueue, and we shouldn't do that if we were really part of reclaim. Reported-by: syzbot+41cdaf4232c50e658934@syzkaller.appspotmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | | mac80211_hwsim: add generation count for netlink dump operationBenjamin Beichler2018-01-311-7/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | Make the dump operation aware of changes on radio list and corresponding inconsistent dumps. Changed variable name for better understanding. Signed-off-by: Benjamin Beichler <benjamin.beichler@uni-rostock.de> [compress ternary operator] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | | mac80211_hwsim: add nl_err_msg in hwsim_new_radio in netlink caseBenjamin Beichler2018-01-311-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a NL_ERR_MSG in case of creating a radio by a netlink message to give clear output to the creating process instead of creating only a debug message in kernel log. The same function is used for the creation while module load, so keep the old message, although it should never be thrown while load, because the module controls all mac addresses. Signed-off-by: Benjamin Beichler <benjamin.beichler@uni-rostock.de> [remove message, add missing braces] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | | mac80211_hwsim: add permanent mac address option for new radiosBenjamin Beichler2018-01-311-9/+34
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If simulation needs predictable permanent mac addresses of hwsim wireless phy, this patch add the ability to create a new radio with a user defined permanent mac address. Allowed mac addresses needs to be locally administrated mac addresses (as also the former fixed 42:* and 02:* were). To do not break the operation with legacy software using hwsim, the new address is set twice. The problem here is, the netlink call backs use wiphy->addresses[1] as identification of a radio and not the proposed permanent address (wiphy->addresses[0]). This design decision is not documented in the kernel repo, therefore this patch simply reproduces this, but with the same address. Signed-off-by: Benjamin Beichler <benjamin.beichler@uni-rostock.de> [make pointer const] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | Merge tag 'mac80211-next-for-davem-2018-01-22' of ↵David S. Miller2018-01-221-18/+76
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg says: ==================== Less than a handful of changes: * possible memory leak fix in hwsim * speed up hwsim * add hwsim userspace rate control API * code cleanups ==================== A conflict was resolved in mac80211_hwsim.c, mostly of the simple overlapping changes category. One adding a rhashtable and another adding a workqueue. Signed-off-by: David S. Miller <davem@davemloft.net>
| * | mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl()weiyongjun (A)2018-01-221-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'hwname' is malloced in hwsim_new_radio_nl() and should be freed before leaving from the error handling cases, otherwise it will cause memory leak. Fixes: ff4dd73dd2b4 ("mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Reviewed-by: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * | mac80211_hwsim: add hwsim_tx_rate_flags to netlink attributesBenjamin Beichler2018-01-151-1/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For correct interpretation of a tx rate, the corresponding rate flags are needed (e.g. whether a HT-MCS rate or a legacy rate) and moreover for more correct simulation the other infos of the flags are important (like short-GI). Keeping compatibility, the flags are not integrated into the existing hwsim_tx_rate, but transmitted as an additional netlink attribute. Signed-off-by: Benjamin Beichler <benjamin.beichler@uni-rostock.de> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * | mac80211_hwsim: add hashtable with mac address keys for faster lookupBenjamin Beichler2018-01-151-16/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a rhastable for mac address lookup of hwsim radios. This especially improve the speed on reception of a netlink message with a new frame. Although redundant, we keep holding a normal list for all radios, since the rhashtable_walk interface adds a lot of overhead for iterating over all radios and the doc of rhashtable recommend a redundant structure for stable walks in such situations. Since rhashtable is rcu protected we do not need a lock for delivering frames and thus improving this scenario. Signed-off-by: Benjamin Beichler <benjamin.beichler@uni-rostock.de> [remove hash function, it would cause alignment issues] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2018-01-171-2/+15
|\ \ \ | |/ / |/| / | |/ | | | | | | | | Overlapping changes all over. The mini-qdisc bits were a little bit tricky, however. Signed-off-by: David S. Miller <davem@davemloft.net>
| * mac80211_hwsim: validate number of different channelsJohannes Berg2018-01-151-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When creating a new radio on the fly, hwsim allows this to be done with an arbitrary number of channels, but cfg80211 only supports a limited number of simultaneous channels, leading to a warning. Fix this by validating the number - this requires moving the define for the maximum out to a visible header file. Reported-by: syzbot+8dd9051ff19940290931@syzkaller.appspotmail.com Fixes: b59ec8dd4394 ("mac80211_hwsim: fix number of channels in interface combinations") Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * mac80211_hwsim: add workqueue to wait for deferred radio deletion on mod unloadBenjamin Beichler2018-01-151-2/+10
| | | | | | | | | | | | | | | | | | | | When closing multiple wmediumd instances with many radios and try to unload the mac80211_hwsim module, it may happen that the work items live longer than the module. To wait especially for this deletion work items, add a work queue, otherwise flush_scheduled_work would be necessary. Signed-off-by: Benjamin Beichler <benjamin.beichler@uni-rostock.de> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
OpenPOWER on IntegriCloud