From patchwork Wed Aug 14 10:35:53 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luis Henriques X-Patchwork-Id: 267030 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id DB8A92C01A2 for ; Wed, 14 Aug 2013 20:38:32 +1000 (EST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1V9YTC-0007Nn-Rr; Wed, 14 Aug 2013 10:38:26 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1V9YS1-0006JB-2f for kernel-team@lists.ubuntu.com; Wed, 14 Aug 2013 10:37:13 +0000 Received: from bl15-111-207.dsl.telepac.pt ([188.80.111.207] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1V9YS0-0004Oz-Rw; Wed, 14 Aug 2013 10:37:13 +0000 From: Luis Henriques To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Subject: [PATCH 04/75] iwlwifi: mvm: refuse connection to APs with BI < 16 Date: Wed, 14 Aug 2013 11:35:53 +0100 Message-Id: <1376476624-10011-5-git-send-email-luis.henriques@canonical.com> X-Mailer: git-send-email 1.8.3.2 In-Reply-To: <1376476624-10011-1-git-send-email-luis.henriques@canonical.com> References: <1376476624-10011-1-git-send-email-luis.henriques@canonical.com> X-Extended-Stable: 3.5 Cc: Johannes Berg X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com 3.5.7.19 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Johannes Berg commit 48bc13072109ea58465542aa1ee31b4e1065468a upstream. Due to a firmware bug, it crashes when the beacon interval is smaller than 16. Avoid this by refusing the station state change creating the AP station, causing mac80211 to abandon the attempt to connect to the AP, and eventually wpa_s to blacklist it. Reviewed-by: Emmanuel Grumbach Signed-off-by: Johannes Berg [ luis: backported to 3.5: - file renamed: drivers/net/wireless/iwlwifi/mvm/mac80211.c -> drivers/net/wireless/iwlwifi/iwl-mac80211.c - adjusted context - changed IWL_ERR 1st argument to 'priv' - removed redundant condition in 'if' statement ] Signed-off-by: Luis Henriques --- drivers/net/wireless/iwlwifi/iwl-mac80211.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c index a0b0b78..2c86c55 100644 --- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c +++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c @@ -776,9 +776,23 @@ int iwlagn_mac_sta_state(struct ieee80211_hw *hw, mutex_lock(&priv->mutex); if (vif->type == NL80211_IFTYPE_STATION) { if (old_state == IEEE80211_STA_NOTEXIST && - new_state == IEEE80211_STA_NONE) + new_state == IEEE80211_STA_NONE) { + /* + * Firmware bug - it'll crash if the beacon interval is less + * than 16. We can't avoid connecting at all, so refuse the + * station state change, this will cause mac80211 to abandon + * attempts to connect to this AP, and eventually wpa_s will + * blacklist the AP... + */ + if (vif->bss_conf.beacon_int < 16) { + IWL_ERR(priv, + "AP %pM beacon interval is %d, refusing due to firmware bug!\n", + sta->addr, vif->bss_conf.beacon_int); + ret = -EINVAL; + goto out_unlock; + } op = ADD; - else if (old_state == IEEE80211_STA_NONE && + } else if (old_state == IEEE80211_STA_NONE && new_state == IEEE80211_STA_NOTEXIST) op = REMOVE; else if (old_state == IEEE80211_STA_AUTH && @@ -846,6 +860,7 @@ int iwlagn_mac_sta_state(struct ieee80211_hw *hw, if (iwl_is_rfkill(priv)) ret = 0; +out_unlock: mutex_unlock(&priv->mutex); IWL_DEBUG_MAC80211(priv, "leave\n");