1 files changed, 107 insertions, 83 deletions

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index b01e467b76c6..a6701ed87f0d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -533,10 +533,13 @@ static inline u16 seq_sub(u16 sq1, u16 sq2)
 
 static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
                                             struct tid_ampdu_rx *tid_agg_rx,
-                                            int index,
-                                            struct sk_buff_head *frames)
+                                            int index)
 {
+        struct ieee80211_local *local = hw_to_local(hw);
         struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
+        struct ieee80211_rx_status *status;
+
+        lockdep_assert_held(&tid_agg_rx->reorder_lock);
 
         if (!skb)
                 goto no_frame;
@@ -544,7 +547,9 @@ static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
         /* release the frame from the reorder ring buffer */
         tid_agg_rx->stored_mpdu_num--;
         tid_agg_rx->reorder_buf[index] = NULL;
-        __skb_queue_tail(frames, skb);
+        status = IEEE80211_SKB_RXCB(skb);
+        status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
+        skb_queue_tail(&local->rx_skb_queue, skb);
 
 no_frame:
         tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
@@ -552,15 +557,16 @@ no_frame:
 
 static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
                                              struct tid_ampdu_rx *tid_agg_rx,
-                                             u16 head_seq_num,
-                                             struct sk_buff_head *frames)
+                                             u16 head_seq_num)
 {
         int index;
 
+        lockdep_assert_held(&tid_agg_rx->reorder_lock);
+
         while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                         tid_agg_rx->buf_size;
-                ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
+                ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
         }
 }
 
@@ -576,11 +582,12 @@ static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
 
 static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
-                                          struct tid_ampdu_rx *tid_agg_rx,
-                                          struct sk_buff_head *frames)
+                                          struct tid_ampdu_rx *tid_agg_rx)
 {
         int index, j;
 
+        lockdep_assert_held(&tid_agg_rx->reorder_lock);
+
         /* release the buffer until next missing frame */
         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                 tid_agg_rx->buf_size;
@@ -606,8 +613,7 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
                                 wiphy_debug(hw->wiphy,
                                             "release an RX reorder frame due to timeout on earlier frames\n");
 #endif
-                        ieee80211_release_reorder_frame(hw, tid_agg_rx,
-                                                        j, frames);
+                        ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
 
                         /*
                          * Increment the head seq# also for the skipped slots.
@@ -617,31 +623,11 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
                         skipped = 0;
                 }
         } else while (tid_agg_rx->reorder_buf[index]) {
-                ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
+                ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                         tid_agg_rx->buf_size;
         }
 
-        /*
-         * Disable the reorder release timer for now.
-         *
-         * The current implementation lacks a proper locking scheme
-         * which would protect vital statistic and debug counters
-         * from being updated by two different but concurrent BHs.
-         *
-         * More information about the topic is available from:
-         * - thread: http://marc.info/?t=128635927000001
-         *
-         * What was wrong:
-         * =>  http://marc.info/?l=linux-wireless&m=128636170811964
-         * "Basically the thing is that until your patch, the data
-         *  in the struct didn't actually need locking because it
-         *  was accessed by the RX path only which is not concurrent."
-         *
-         * List of what needs to be fixed:
-         * => http://marc.info/?l=linux-wireless&m=128656352920957
-         *
-
         if (tid_agg_rx->stored_mpdu_num) {
                 j = index = seq_sub(tid_agg_rx->head_seq_num,
                                     tid_agg_rx->ssn) % tid_agg_rx->buf_size;
@@ -660,10 +646,6 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
         } else {
                 del_timer(&tid_agg_rx->reorder_timer);
         }
-        */
-
-set_release_timer:
-        return;
 }
 
 /*
@@ -673,8 +655,7 @@ set_release_timer:
  */
 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                              struct tid_ampdu_rx *tid_agg_rx,
-                                             struct sk_buff *skb,
-                                             struct sk_buff_head *frames)
+                                             struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         u16 sc = le16_to_cpu(hdr->seq_ctrl);
@@ -683,10 +664,11 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         int index;
         bool ret = true;
 
+        spin_lock(&tid_agg_rx->reorder_lock);
+
         buf_size = tid_agg_rx->buf_size;
         head_seq_num = tid_agg_rx->head_seq_num;
 
-        spin_lock(&tid_agg_rx->reorder_lock);
         /* frame with out of date sequence number */
         if (seq_less(mpdu_seq_num, head_seq_num)) {
                 dev_kfree_skb(skb);
@@ -700,8 +682,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
                 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
                 /* release stored frames up to new head to stack */
-                ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num,
-                                                 frames);
+                ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
         }
 
         /* Now the new frame is always in the range of the reordering buffer */
@@ -729,7 +710,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         tid_agg_rx->reorder_buf[index] = skb;
         tid_agg_rx->reorder_time[index] = jiffies;
         tid_agg_rx->stored_mpdu_num++;
-        ieee80211_sta_reorder_release(hw, tid_agg_rx, frames);
+        ieee80211_sta_reorder_release(hw, tid_agg_rx);
 
  out:
         spin_unlock(&tid_agg_rx->reorder_lock);
@@ -740,8 +721,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
  * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
  * true if the MPDU was buffered, false if it should be processed.
  */
-static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
-                                       struct sk_buff_head *frames)
+static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
 {
         struct sk_buff *skb = rx->skb;
         struct ieee80211_local *local = rx->local;
@@ -796,11 +776,11 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
          * sure that we cannot get to it any more before doing
          * anything with it.
          */
-        if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, frames))
+        if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb))
                 return;
 
  dont_reorder:
-        __skb_queue_tail(frames, skb);
+        skb_queue_tail(&local->rx_skb_queue, skb);
 }
 
 static ieee80211_rx_result debug_noinline
@@ -948,12 +928,31 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                  * have been expected.
                  */
                 struct ieee80211_key *key = NULL;
+                struct ieee80211_sub_if_data *sdata = rx->sdata;
+                int i;
+
                 if (ieee80211_is_mgmt(fc) &&
                     is_multicast_ether_addr(hdr->addr1) &&
                     (key = rcu_dereference(rx->sdata->default_mgmt_key)))
                         rx->key = key;
-                else if ((key = rcu_dereference(rx->sdata->default_key)))
-                        rx->key = key;
+                else {
+                        if (rx->sta) {
+                                for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+                                        key = rcu_dereference(rx->sta->gtk[i]);
+                                        if (key)
+                                                break;
+                                }
+                        }
+                        if (!key) {
+                                for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+                                        key = rcu_dereference(sdata->keys[i]);
+                                        if (key)
+                                                break;
+                                }
+                        }
+                        if (key)
+                                rx->key = key;
+                }
                 return RX_CONTINUE;
         } else {
                 u8 keyid;
@@ -1102,8 +1101,6 @@ static void ap_sta_ps_end(struct sta_info *sta)
 
         atomic_dec(&sdata->bss->num_sta_ps);
 
-        clear_sta_flags(sta, WLAN_STA_PS_STA);
-
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
                sdata->name, sta->sta.addr, sta->sta.aid);
@@ -1158,12 +1155,14 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         sta->rx_fragments++;
         sta->rx_bytes += rx->skb->len;
         sta->last_signal = status->signal;
+        ewma_add(&sta->avg_signal, -status->signal);
 
         /*
          * Change STA power saving mode only at the end of a frame
          * exchange sequence.
          */
         if (!ieee80211_has_morefrags(hdr->frame_control) &&
+            !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
                 if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
@@ -1515,12 +1514,30 @@ ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
         if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
                 if (unlikely(!ieee80211_has_protected(fc) &&
                              ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
-                             rx->key))
+                             rx->key)) {
+                        if (ieee80211_is_deauth(fc))
+                                cfg80211_send_unprot_deauth(rx->sdata->dev,
+                                                            rx->skb->data,
+                                                            rx->skb->len);
+                        else if (ieee80211_is_disassoc(fc))
+                                cfg80211_send_unprot_disassoc(rx->sdata->dev,
+                                                              rx->skb->data,
+                                                              rx->skb->len);
                         return -EACCES;
+                }
                 /* BIP does not use Protected field, so need to check MMIE */
                 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
-                             ieee80211_get_mmie_keyidx(rx->skb) < 0))
+                             ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
+                        if (ieee80211_is_deauth(fc))
+                                cfg80211_send_unprot_deauth(rx->sdata->dev,
+                                                            rx->skb->data,
+                                                            rx->skb->len);
+                        else if (ieee80211_is_disassoc(fc))
+                                cfg80211_send_unprot_disassoc(rx->sdata->dev,
+                                                              rx->skb->data,
+                                                              rx->skb->len);
                         return -EACCES;
+                }
                 /*
                  * When using MFP, Action frames are not allowed prior to
                  * having configured keys.
@@ -1788,11 +1805,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 
                         fwd_skb = skb_copy(skb, GFP_ATOMIC);
 
-                        if (!fwd_skb && net_ratelimit()) {
+                        if (!fwd_skb && net_ratelimit())
                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
                                                    sdata->name);
+                        if (!fwd_skb)
                                 goto out;
-                        }
 
                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
                         memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
@@ -1875,9 +1892,8 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += rx->skb->len;
 
-        if (ieee80211_is_data(hdr->frame_control) &&
-            !is_multicast_ether_addr(hdr->addr1) &&
-            local->hw.conf.dynamic_ps_timeout > 0 && local->ps_sdata) {
+        if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
+            !is_multicast_ether_addr(((struct ethhdr *)rx->skb->data)->h_dest)) {
                         mod_timer(&local->dynamic_ps_timer, jiffies +
                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
         }
@@ -1888,7 +1904,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 }
 
 static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
+ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
         struct ieee80211_hw *hw = &local->hw;
@@ -1926,9 +1942,11 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
                         mod_timer(&tid_agg_rx->session_timer,
                                   TU_TO_EXP_TIME(tid_agg_rx->timeout));
 
+                spin_lock(&tid_agg_rx->reorder_lock);
                 /* release stored frames up to start of BAR */
-                ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num,
-                                                 frames);
+                ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
+                spin_unlock(&tid_agg_rx->reorder_lock);
+
                 kfree_skb(skb);
                 return RX_QUEUED;
         }
@@ -2119,10 +2137,13 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 }
                 break;
         case WLAN_CATEGORY_MESH_PLINK:
-        case WLAN_CATEGORY_MESH_PATH_SEL:
                 if (!ieee80211_vif_is_mesh(&sdata->vif))
                         break;
                 goto queue;
+        case WLAN_CATEGORY_MESH_PATH_SEL:
+                if (!mesh_path_sel_is_hwmp(sdata))
+                        break;
+                goto queue;
         }
 
         return RX_CONTINUE;
@@ -2440,8 +2461,7 @@ static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
         }
 }
 
-static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
-                                  struct sk_buff_head *frames)
+static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
 {
         ieee80211_rx_result res = RX_DROP_MONITOR;
         struct sk_buff *skb;
@@ -2453,7 +2473,15 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
                         goto rxh_next;  \
         } while (0);
 
-        while ((skb = __skb_dequeue(frames))) {
+        spin_lock(&rx->local->rx_skb_queue.lock);
+        if (rx->local->running_rx_handler)
+                goto unlock;
+
+        rx->local->running_rx_handler = true;
+
+        while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
+                spin_unlock(&rx->local->rx_skb_queue.lock);
+
                 /*
                  * all the other fields are valid across frames
                  * that belong to an aMPDU since they are on the
@@ -2476,12 +2504,7 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
                         CALL_RXH(ieee80211_rx_h_mesh_fwding);
 #endif
                 CALL_RXH(ieee80211_rx_h_data)
-
-                /* special treatment -- needs the queue */
-                res = ieee80211_rx_h_ctrl(rx, frames);
-                if (res != RX_CONTINUE)
-                        goto rxh_next;
-
+                CALL_RXH(ieee80211_rx_h_ctrl);
                 CALL_RXH(ieee80211_rx_h_mgmt_check)
                 CALL_RXH(ieee80211_rx_h_action)
                 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
@@ -2490,18 +2513,20 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
 
  rxh_next:
                 ieee80211_rx_handlers_result(rx, res);
-
+                spin_lock(&rx->local->rx_skb_queue.lock);
 #undef CALL_RXH
         }
+
+        rx->local->running_rx_handler = false;
+
+ unlock:
+        spin_unlock(&rx->local->rx_skb_queue.lock);
 }
 
 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
 {
-        struct sk_buff_head reorder_release;
         ieee80211_rx_result res = RX_DROP_MONITOR;
 
-        __skb_queue_head_init(&reorder_release);
-
 #define CALL_RXH(rxh)                   \
         do {                            \
                 res = rxh(rx);          \
@@ -2512,9 +2537,9 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
         CALL_RXH(ieee80211_rx_h_passive_scan)
         CALL_RXH(ieee80211_rx_h_check)
 
-        ieee80211_rx_reorder_ampdu(rx, &reorder_release);
+        ieee80211_rx_reorder_ampdu(rx);
 
-        ieee80211_rx_handlers(rx, &reorder_release);
+        ieee80211_rx_handlers(rx);
         return;
 
  rxh_next:
@@ -2524,13 +2549,11 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
 }
 
 /*
- * This function makes calls into the RX path. Therefore the
- * caller must hold the sta_info->lock and everything has to
- * be under rcu_read_lock protection as well.
+ * This function makes calls into the RX path, therefore
+ * it has to be invoked under RCU read lock.
  */
 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
 {
-        struct sk_buff_head frames;
         struct ieee80211_rx_data rx = {
                 .sta = sta,
                 .sdata = sta->sdata,
@@ -2543,13 +2566,11 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
         if (!tid_agg_rx)
                 return;
 
-        __skb_queue_head_init(&frames);
-
         spin_lock(&tid_agg_rx->reorder_lock);
-        ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx, &frames);
+        ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx);
         spin_unlock(&tid_agg_rx->reorder_lock);
 
-        ieee80211_rx_handlers(&rx, &frames);
+        ieee80211_rx_handlers(&rx);
 }
 
 /* main receive path */
@@ -2884,6 +2905,9 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return;
         }
 
+        ieee80211_tpt_led_trig_rx(local,
+                        ((struct ieee80211_hdr *)skb->data)->frame_control,
+                        skb->len);
         __ieee80211_rx_handle_packet(hw, skb);
 
         rcu_read_unlock();