diff mbox

cfg80211: free sme on connection failures

Message ID 1398862693-19264-1-git-send-email-eliad@wizery.com (mailing list archive)
State Not Applicable, archived
Headers show

Commit Message

Eliad Peller April 30, 2014, 12:58 p.m. UTC
cfg80211 is notified about connection failures by
__cfg80211_connect_result() call. However, this
function currently does not free cfg80211 sme.

This results in hanging connection attempts in some cases

e.g. when mac80211 authentication attempt is denied,
we have this function call:
ieee80211_rx_mgmt_auth() -> cfg80211_rx_mlme_mgmt() ->
cfg80211_process_auth() -> cfg80211_sme_rx_auth() ->
__cfg80211_connect_result()

but cfg80211_sme_free() is never get called.

Fixes: ceca7b712 ("cfg80211: separate internal SME implementation")
Cc: stable@vger.kernel.org (3.10+)
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
---
 net/wireless/sme.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Johannes Berg May 5, 2014, 12:59 p.m. UTC | #1
On Wed, 2014-04-30 at 15:58 +0300, Eliad Peller wrote:
> cfg80211 is notified about connection failures by
> __cfg80211_connect_result() call. However, this
> function currently does not free cfg80211 sme.
> 
> This results in hanging connection attempts in some cases
> 
> e.g. when mac80211 authentication attempt is denied,
> we have this function call:
> ieee80211_rx_mgmt_auth() -> cfg80211_rx_mlme_mgmt() ->
> cfg80211_process_auth() -> cfg80211_sme_rx_auth() ->
> __cfg80211_connect_result()
> 
> but cfg80211_sme_free() is never get called.

Applied.

johannes

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 4bc21a2..1f05cfc 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -236,7 +236,6 @@  void cfg80211_conn_work(struct work_struct *work)
 					NULL, 0, NULL, 0,
 					WLAN_STATUS_UNSPECIFIED_FAILURE,
 					false, NULL);
-			cfg80211_sme_free(wdev);
 		}
 		wdev_unlock(wdev);
 	}
@@ -649,6 +648,7 @@  void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 			cfg80211_unhold_bss(bss_from_pub(bss));
 			cfg80211_put_bss(wdev->wiphy, bss);
 		}
+		cfg80211_sme_free(wdev);
 		return;
 	}