aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndres Salomon <dilinger@queued.net>2011-10-26 13:19:26 -0400
committerJohn W. Linville <linville@tuxdriver.com>2011-11-02 15:23:12 -0400
commit3209e061ad04465b3999091f315049c95ac6cbcb (patch)
tree91e1eb2eb2b0b6e8d1a0514a4de15f0c1fe8e542
parent93348928f2c980718434b1bc42f9d7638d665db4 (diff)
libertas: ensure we clean up a scan request properly
Commit 2e30168b ("libertas: terminate scan when stopping interface") adds cleanup code to lbs_eth_stop to call cfg80211_scan_done if there's an outstanding cfg80211_scan_request. However, it assumes that the scan request was allocated via the cfg80211 stack. Libertas has its own internal allocation method, kept track of with priv->internal_scan. This doesn't set scan_req->wiphy, amongst other things, which results in hitting a BUG() when we call cfg80211_scan_done on the request. This provides a function to take care of the low-level scan_req cleanup details. We simply call that to deal with finishing up scan requests. The bug we were hitting was: [ 964.321495] kernel BUG at net/wireless/core.h:87! [ 964.329970] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 964.341963] pgd = dcf80000 ... [ 964.849998] 9fe0: 00000000 beb417b8 4018e280 401e822c 60000010 00000004 00000000 00000000 [ 964.865007] [<c003104c>] (__bug+0x1c/0x28) from [<c0384ffc>] (cfg80211_scan_done+0x54/0x6c) [ 964.895324] [<c0384ffc>] (cfg80211_scan_done+0x54/0x6c) from [<bf028bac>] (lbs_eth_stop+0x10c/0x188 [libertas]) [ 964.895324] [<bf028bac>] (lbs_eth_stop+0x10c/0x188 [libertas]) from [<c03002a0>] (__dev_close_many+0x94/0xc4) [ 964.918995] [<c03002a0>] (__dev_close_many+0x94/0xc4) from [<c030037c>] (dev_close_many+0x78/0xe0) Signed-off-by: Andres Salomon <dilinger@queued.net> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--drivers/net/wireless/libertas/cfg.c25
-rw-r--r--drivers/net/wireless/libertas/cfg.h1
-rw-r--r--drivers/net/wireless/libertas/main.c6
3 files changed, 20 insertions, 12 deletions
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index ff6378276ff0..4fcd653bddc4 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -728,15 +728,9 @@ static void lbs_scan_worker(struct work_struct *work)
728 le16_to_cpu(scan_cmd->hdr.size), 728 le16_to_cpu(scan_cmd->hdr.size),
729 lbs_ret_scan, 0); 729 lbs_ret_scan, 0);
730 730
731 if (priv->scan_channel >= priv->scan_req->n_channels) { 731 if (priv->scan_channel >= priv->scan_req->n_channels)
732 /* Mark scan done */ 732 /* Mark scan done */
733 if (priv->internal_scan) 733 lbs_scan_done(priv);
734 kfree(priv->scan_req);
735 else
736 cfg80211_scan_done(priv->scan_req, false);
737
738 priv->scan_req = NULL;
739 }
740 734
741 /* Restart network */ 735 /* Restart network */
742 if (carrier) 736 if (carrier)
@@ -774,6 +768,21 @@ static void _internal_start_scan(struct lbs_private *priv, bool internal,
774 lbs_deb_leave(LBS_DEB_CFG80211); 768 lbs_deb_leave(LBS_DEB_CFG80211);
775} 769}
776 770
771/*
772 * Clean up priv->scan_req. Should be used to handle the allocation details.
773 */
774void lbs_scan_done(struct lbs_private *priv)
775{
776 WARN_ON(!priv->scan_req);
777
778 if (priv->internal_scan)
779 kfree(priv->scan_req);
780 else
781 cfg80211_scan_done(priv->scan_req, false);
782
783 priv->scan_req = NULL;
784}
785
777static int lbs_cfg_scan(struct wiphy *wiphy, 786static int lbs_cfg_scan(struct wiphy *wiphy,
778 struct net_device *dev, 787 struct net_device *dev,
779 struct cfg80211_scan_request *request) 788 struct cfg80211_scan_request *request)
diff --git a/drivers/net/wireless/libertas/cfg.h b/drivers/net/wireless/libertas/cfg.h
index a02ee151710e..558168ce634d 100644
--- a/drivers/net/wireless/libertas/cfg.h
+++ b/drivers/net/wireless/libertas/cfg.h
@@ -16,6 +16,7 @@ int lbs_reg_notifier(struct wiphy *wiphy,
16void lbs_send_disconnect_notification(struct lbs_private *priv); 16void lbs_send_disconnect_notification(struct lbs_private *priv);
17void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event); 17void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event);
18 18
19void lbs_scan_done(struct lbs_private *priv);
19void lbs_scan_deinit(struct lbs_private *priv); 20void lbs_scan_deinit(struct lbs_private *priv);
20int lbs_disconnect(struct lbs_private *priv, u16 reason); 21int lbs_disconnect(struct lbs_private *priv, u16 reason);
21 22
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index b03779bcd547..39a6a7a40244 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -255,10 +255,8 @@ static int lbs_eth_stop(struct net_device *dev)
255 255
256 lbs_update_mcast(priv); 256 lbs_update_mcast(priv);
257 cancel_delayed_work_sync(&priv->scan_work); 257 cancel_delayed_work_sync(&priv->scan_work);
258 if (priv->scan_req) { 258 if (priv->scan_req)
259 cfg80211_scan_done(priv->scan_req, false); 259 lbs_scan_done(priv);
260 priv->scan_req = NULL;
261 }
262 260
263 netif_carrier_off(priv->dev); 261 netif_carrier_off(priv->dev);
264 262