Merge tag 'mac80211-for-davem-2016-02-23' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211

Johannes Berg says:

====================
Another small set of fixes:
 * stop critical protocol session on disconnect to avoid
   it getting stuck
 * wext: fix two RTNL message ordering issues
 * fix an uninitialized value (found by KASAN)
 * fix an out-of-bounds access (also found by KASAN)
 * clear connection keys when freeing them in all cases
   (IBSS, all other places already did so)
 * fix expected throughput unit to get consistent values
 * set default TX aggregation timeout to 0 in minstrel
   to avoid (really just hide) issues and perform better
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

7 files changed, 60 insertions, 20 deletions

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 10ad4ac1fa0b..367784be5df2 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -291,7 +291,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
         }
 
         /* prepare A-MPDU MLME for Rx aggregation */
-        tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
+        tid_agg_rx = kzalloc(sizeof(*tid_agg_rx), GFP_KERNEL);
         if (!tid_agg_rx)
                 goto end;
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 3ece7d1034c8..b54f398cda5d 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -711,7 +711,7 @@ static u32 minstrel_get_expected_throughput(void *priv_sta)
          * computing cur_tp
          */
         tmp_mrs = &mi->r[idx].stats;
-        tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_ewma);
+        tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_ewma) * 10;
         tmp_cur_tp = tmp_cur_tp * 1200 * 8 / 1024;
 
         return tmp_cur_tp;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 3928dbd24e25..409b3640da6c 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 index)
             (max_tp_group != MINSTREL_CCK_GROUP))
                 return;
 
+        max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
+        max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
+        max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
+
         if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) {
                 cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
                                                     mrs->prob_ewma);
                 if (cur_tp_avg > tmp_tp_avg)
                         mi->max_prob_rate = index;
 
-                max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
-                max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
-                max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
                 max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
                                                         max_gpr_idx,
                                                         max_gpr_prob);
@@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 index)
         } else {
                 if (mrs->prob_ewma > tmp_prob)
                         mi->max_prob_rate = index;
-                if (mrs->prob_ewma > mg->rates[mg->max_group_prob_rate].prob_ewma)
+                if (mrs->prob_ewma > max_gpr_prob)
                         mg->max_group_prob_rate = index;
         }
 }
@@ -691,7 +692,7 @@ minstrel_aggr_check(struct ieee80211_sta *pubsta, struct sk_buff *skb)
         if (likely(sta->ampdu_mlme.tid_tx[tid]))
                 return;
 
-        ieee80211_start_tx_ba_session(pubsta, tid, 5000);
+        ieee80211_start_tx_ba_session(pubsta, tid, 0);
 }
 
 static void
@@ -1334,7 +1335,8 @@ static u32 minstrel_ht_get_expected_throughput(void *priv_sta)
         prob = mi->groups[i].rates[j].prob_ewma;
 
         /* convert tp_avg from pkt per second in kbps */
-        tp_avg = minstrel_ht_get_tp_avg(mi, i, j, prob) * AVG_PKT_SIZE * 8 / 1024;
+        tp_avg = minstrel_ht_get_tp_avg(mi, i, j, prob) * 10;
+        tp_avg = tp_avg * AVG_PKT_SIZE * 8 / 1024;
 
         return tp_avg;
 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index b0915515640e..8f0bac7e03c4 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1147,6 +1147,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 return NOTIFY_DONE;
         }
 
+        wireless_nlevent_flush();
+
         return NOTIFY_OK;
 }
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d4786f2802aa..711cb7ad6ae0 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7547,7 +7547,7 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
 
                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
                     no_ht) {
-                        kfree(connkeys);
+                        kzfree(connkeys);
                         return -EINVAL;
                 }
         }
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 8020b5b094d4..d49ed7666d4c 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -917,6 +917,12 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
 
         nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
 
+        /* stop critical protocol if supported */
+        if (rdev->ops->crit_proto_stop && rdev->crit_proto_nlportid) {
+                rdev->crit_proto_nlportid = 0;
+                rdev_crit_proto_stop(rdev, wdev);
+        }
+
         /*
          * Delete all the keys ... pairwise keys can't really
          * exist any more anyway, but default keys might.
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index c8717c1d082e..b50ee5d622e1 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -342,6 +342,40 @@ static const int compat_event_type_size[] = {
 
 /* IW event code */
 
+void wireless_nlevent_flush(void)
+{
+        struct sk_buff *skb;
+        struct net *net;
+
+        ASSERT_RTNL();
+
+        for_each_net(net) {
+                while ((skb = skb_dequeue(&net->wext_nlevents)))
+                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
+                                    GFP_KERNEL);
+        }
+}
+EXPORT_SYMBOL_GPL(wireless_nlevent_flush);
+
+static int wext_netdev_notifier_call(struct notifier_block *nb,
+                                     unsigned long state, void *ptr)
+{
+        /*
+         * When a netdev changes state in any way, flush all pending messages
+         * to avoid them going out in a strange order, e.g. RTM_NEWLINK after
+         * RTM_DELLINK, or with IFF_UP after without IFF_UP during dev_close()
+         * or similar - all of which could otherwise happen due to delays from
+         * schedule_work().
+         */
+        wireless_nlevent_flush();
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block wext_netdev_notifier = {
+        .notifier_call = wext_netdev_notifier_call,
+};
+
 static int __net_init wext_pernet_init(struct net *net)
 {
         skb_queue_head_init(&net->wext_nlevents);
@@ -360,7 +394,12 @@ static struct pernet_operations wext_pernet_ops = {
 
 static int __init wireless_nlevent_init(void)
 {
-        return register_pernet_subsys(&wext_pernet_ops);
+        int err = register_pernet_subsys(&wext_pernet_ops);
+
+        if (err)
+                return err;
+
+        return register_netdevice_notifier(&wext_netdev_notifier);
 }
 
 subsys_initcall(wireless_nlevent_init);
@@ -368,17 +407,8 @@ subsys_initcall(wireless_nlevent_init);
 /* Process events generated by the wireless layer or the driver. */
 static void wireless_nlevent_process(struct work_struct *work)
 {
-        struct sk_buff *skb;
-        struct net *net;
-
         rtnl_lock();
-
-        for_each_net(net) {
-                while ((skb = skb_dequeue(&net->wext_nlevents)))
-                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
-                                    GFP_KERNEL);
-        }
-
+        wireless_nlevent_flush();
         rtnl_unlock();
 }