cfg80211: keep track of current_bss for userspace SME

When a userspace SME is active, we're currently not
keeping track of the BSS properly for reporting the
current link and for internal use. Additionally, it
looks like there is a possible BSS leak in that the
BSS never gets removed from auth_bsses[]. To fix it,
pass the BSS struct to __cfg80211_connect_result in
this case.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 18 insertions, 17 deletions

diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index d2b5d4ce0a00..3728d2b88b25 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -182,7 +182,7 @@ void cfg80211_conn_work(struct work_struct *work)
                                         wdev->conn->params.bssid,
                                         NULL, 0, NULL, 0,
                                         WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                        false);
+                                        false, NULL);
                 wdev_unlock(wdev);
         }
 
@@ -247,7 +247,7 @@ static void __cfg80211_sme_scan_done(struct net_device *dev)
                                         wdev->conn->params.bssid,
                                         NULL, 0, NULL, 0,
                                         WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                        false);
+                                        false, NULL);
         }
 }
 
@@ -305,7 +305,7 @@ void cfg80211_sme_rx_auth(struct net_device *dev,
                 schedule_work(&rdev->conn_work);
         } else if (status_code != WLAN_STATUS_SUCCESS) {
                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
-                                          status_code, false);
+                                          status_code, false, NULL);
         } else if (wdev->sme_state == CFG80211_SME_CONNECTING &&
                  wdev->conn->state == CFG80211_CONN_AUTHENTICATING) {
                 wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
@@ -316,10 +316,10 @@ void cfg80211_sme_rx_auth(struct net_device *dev,
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                const u8 *req_ie, size_t req_ie_len,
                                const u8 *resp_ie, size_t resp_ie_len,
-                               u16 status, bool wextev)
+                               u16 status, bool wextev,
+                               struct cfg80211_bss *bss)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_bss *bss;
 #ifdef CONFIG_WIRELESS_EXT
         union iwreq_data wrqu;
 #endif
@@ -361,6 +361,12 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         }
 #endif
 
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
+                wdev->current_bss = NULL;
+        }
+
         if (status == WLAN_STATUS_SUCCESS &&
             wdev->sme_state == CFG80211_SME_IDLE)
                 goto success;
@@ -368,12 +374,6 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         if (wdev->sme_state != CFG80211_SME_CONNECTING)
                 return;
 
-        if (wdev->current_bss) {
-                cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
-                wdev->current_bss = NULL;
-        }
-
         if (wdev->conn)
                 wdev->conn->state = CFG80211_CONN_IDLE;
 
@@ -386,10 +386,12 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 return;
         }
 
-        bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
-                               wdev->ssid, wdev->ssid_len,
-                               WLAN_CAPABILITY_ESS,
-                               WLAN_CAPABILITY_ESS);
+ success:
+        if (!bss)
+                bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                                       wdev->ssid, wdev->ssid_len,
+                                       WLAN_CAPABILITY_ESS,
+                                       WLAN_CAPABILITY_ESS);
 
         if (WARN_ON(!bss))
                 return;
@@ -397,7 +399,6 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         cfg80211_hold_bss(bss_from_pub(bss));
         wdev->current_bss = bss_from_pub(bss);
 
- success:
         wdev->sme_state = CFG80211_SME_CONNECTED;
         cfg80211_upload_connect_keys(wdev);
 }
@@ -788,7 +789,7 @@ int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
         else if (wdev->sme_state == CFG80211_SME_CONNECTING)
                 __cfg80211_connect_result(dev, NULL, NULL, 0, NULL, 0,
                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          wextev);
+                                          wextev, NULL);
 
         return 0;
 }