diff options
author | Andres Salomon <dilinger@queued.net> | 2011-10-26 13:19:26 -0400 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2011-11-02 15:23:12 -0400 |
commit | 3209e061ad04465b3999091f315049c95ac6cbcb (patch) | |
tree | 91e1eb2eb2b0b6e8d1a0514a4de15f0c1fe8e542 /drivers | |
parent | 93348928f2c980718434b1bc42f9d7638d665db4 (diff) |
libertas: ensure we clean up a scan request properly
Commit 2e30168b ("libertas: terminate scan when stopping interface")
adds cleanup code to lbs_eth_stop to call cfg80211_scan_done if there's
an outstanding cfg80211_scan_request. However, it assumes that the
scan request was allocated via the cfg80211 stack. Libertas has
its own internal allocation method, kept track of with
priv->internal_scan. This doesn't set scan_req->wiphy, amongst other
things, which results in hitting a BUG() when we call cfg80211_scan_done
on the request.
This provides a function to take care of the low-level scan_req cleanup
details. We simply call that to deal with finishing up scan requests.
The bug we were hitting was:
[ 964.321495] kernel BUG at net/wireless/core.h:87!
[ 964.329970] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 964.341963] pgd = dcf80000
...
[ 964.849998] 9fe0: 00000000 beb417b8 4018e280 401e822c 60000010 00000004 00000000 00000000
[ 964.865007] [<c003104c>] (__bug+0x1c/0x28) from [<c0384ffc>] (cfg80211_scan_done+0x54/0x6c)
[ 964.895324] [<c0384ffc>] (cfg80211_scan_done+0x54/0x6c) from [<bf028bac>] (lbs_eth_stop+0x10c/0x188 [libertas])
[ 964.895324] [<bf028bac>] (lbs_eth_stop+0x10c/0x188 [libertas]) from [<c03002a0>] (__dev_close_many+0x94/0xc4)
[ 964.918995] [<c03002a0>] (__dev_close_many+0x94/0xc4) from [<c030037c>] (dev_close_many+0x78/0xe0)
Signed-off-by: Andres Salomon <dilinger@queued.net>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/net/wireless/libertas/cfg.c | 25 | ||||
-rw-r--r-- | drivers/net/wireless/libertas/cfg.h | 1 | ||||
-rw-r--r-- | drivers/net/wireless/libertas/main.c | 6 |
3 files changed, 20 insertions, 12 deletions
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c index ff6378276ff0..4fcd653bddc4 100644 --- a/drivers/net/wireless/libertas/cfg.c +++ b/drivers/net/wireless/libertas/cfg.c | |||
@@ -728,15 +728,9 @@ static void lbs_scan_worker(struct work_struct *work) | |||
728 | le16_to_cpu(scan_cmd->hdr.size), | 728 | le16_to_cpu(scan_cmd->hdr.size), |
729 | lbs_ret_scan, 0); | 729 | lbs_ret_scan, 0); |
730 | 730 | ||
731 | if (priv->scan_channel >= priv->scan_req->n_channels) { | 731 | if (priv->scan_channel >= priv->scan_req->n_channels) |
732 | /* Mark scan done */ | 732 | /* Mark scan done */ |
733 | if (priv->internal_scan) | 733 | lbs_scan_done(priv); |
734 | kfree(priv->scan_req); | ||
735 | else | ||
736 | cfg80211_scan_done(priv->scan_req, false); | ||
737 | |||
738 | priv->scan_req = NULL; | ||
739 | } | ||
740 | 734 | ||
741 | /* Restart network */ | 735 | /* Restart network */ |
742 | if (carrier) | 736 | if (carrier) |
@@ -774,6 +768,21 @@ static void _internal_start_scan(struct lbs_private *priv, bool internal, | |||
774 | lbs_deb_leave(LBS_DEB_CFG80211); | 768 | lbs_deb_leave(LBS_DEB_CFG80211); |
775 | } | 769 | } |
776 | 770 | ||
771 | /* | ||
772 | * Clean up priv->scan_req. Should be used to handle the allocation details. | ||
773 | */ | ||
774 | void lbs_scan_done(struct lbs_private *priv) | ||
775 | { | ||
776 | WARN_ON(!priv->scan_req); | ||
777 | |||
778 | if (priv->internal_scan) | ||
779 | kfree(priv->scan_req); | ||
780 | else | ||
781 | cfg80211_scan_done(priv->scan_req, false); | ||
782 | |||
783 | priv->scan_req = NULL; | ||
784 | } | ||
785 | |||
777 | static int lbs_cfg_scan(struct wiphy *wiphy, | 786 | static int lbs_cfg_scan(struct wiphy *wiphy, |
778 | struct net_device *dev, | 787 | struct net_device *dev, |
779 | struct cfg80211_scan_request *request) | 788 | struct cfg80211_scan_request *request) |
diff --git a/drivers/net/wireless/libertas/cfg.h b/drivers/net/wireless/libertas/cfg.h index a02ee151710e..558168ce634d 100644 --- a/drivers/net/wireless/libertas/cfg.h +++ b/drivers/net/wireless/libertas/cfg.h | |||
@@ -16,6 +16,7 @@ int lbs_reg_notifier(struct wiphy *wiphy, | |||
16 | void lbs_send_disconnect_notification(struct lbs_private *priv); | 16 | void lbs_send_disconnect_notification(struct lbs_private *priv); |
17 | void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event); | 17 | void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event); |
18 | 18 | ||
19 | void lbs_scan_done(struct lbs_private *priv); | ||
19 | void lbs_scan_deinit(struct lbs_private *priv); | 20 | void lbs_scan_deinit(struct lbs_private *priv); |
20 | int lbs_disconnect(struct lbs_private *priv, u16 reason); | 21 | int lbs_disconnect(struct lbs_private *priv, u16 reason); |
21 | 22 | ||
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c index b03779bcd547..39a6a7a40244 100644 --- a/drivers/net/wireless/libertas/main.c +++ b/drivers/net/wireless/libertas/main.c | |||
@@ -255,10 +255,8 @@ static int lbs_eth_stop(struct net_device *dev) | |||
255 | 255 | ||
256 | lbs_update_mcast(priv); | 256 | lbs_update_mcast(priv); |
257 | cancel_delayed_work_sync(&priv->scan_work); | 257 | cancel_delayed_work_sync(&priv->scan_work); |
258 | if (priv->scan_req) { | 258 | if (priv->scan_req) |
259 | cfg80211_scan_done(priv->scan_req, false); | 259 | lbs_scan_done(priv); |
260 | priv->scan_req = NULL; | ||
261 | } | ||
262 | 260 | ||
263 | netif_carrier_off(priv->dev); | 261 | netif_carrier_off(priv->dev); |
264 | 262 | ||