madwifi: fix a rare ad-hoc mode crash

[openwrt/svn-archive/archive.git] / package / madwifi / patches / 393-mbss_vap_auth.patch

diff --git a/package/madwifi/patches/393-mbss_vap_auth.patch b/package/madwifi/patches/393-mbss_vap_auth.patch
index 3b8a5224988e60d2bfb2c32f5afd7a7ce3b92ea5..e1c9cae0d0be2fa5bdde54b9bed19191a7e19531 100644 (file)
--- a/package/madwifi/patches/393-mbss_vap_auth.patch
+++ b/package/madwifi/patches/393-mbss_vap_auth.patch
@@ -19,7 +19,7 @@
        if (ni == NULL) {
                ni = ieee80211_alloc_node_table(vap, se->se_macaddr);
                IEEE80211_DPRINTF(vap, IEEE80211_MSG_ASSOC,
-@@ -1391,6 +1394,53 @@ ieee80211_add_neighbor(struct ieee80211v
+@@ -1394,6 +1397,53 @@ ieee80211_add_neighbor(struct ieee80211v
        return ni;
  }
  
@@ -73,7 +73,7 @@
  /*
   * Return the node for the sender of a frame; if the sender is unknown return 
   * NULL. The caller is expected to deal with this. (The frame is sent to all 
-@@ -1400,10 +1450,10 @@ ieee80211_add_neighbor(struct ieee80211v
+@@ -1403,10 +1453,10 @@ ieee80211_add_neighbor(struct ieee80211v
   */
  struct ieee80211_node *
  #ifdef IEEE80211_DEBUG_REFCNT
@@ -86,7 +86,7 @@
        const struct ieee80211_frame_min *wh)
  #endif
  {
-@@ -1411,9 +1461,8 @@ ieee80211_find_rxnode(struct ieee80211co
+@@ -1414,9 +1464,8 @@ ieee80211_find_rxnode(struct ieee80211co
        ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
  #define       IS_PSPOLL(wh) \
        ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
@@ -98,7 +98,7 @@
        const u_int8_t *addr;
  
        if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
-@@ -1426,32 +1475,24 @@ ieee80211_find_rxnode(struct ieee80211co
+@@ -1429,32 +1478,25 @@ ieee80211_find_rxnode(struct ieee80211co
  
        /* XXX check ic_bss first in station mode */
        /* XXX 4-address frames? */
@@ -118,6 +118,7 @@
 -                              else
 -                                      return NULL;
 +                                      ni = ieee80211_ref_node(avp->iv_wdsnode);
++                              return ni;
                        }
 +                      if (!(vap->iv_flags_ext & IEEE80211_FEXT_WDS))
 +                              return NULL;
@@ -140,7 +141,7 @@
  }
  #ifdef IEEE80211_DEBUG_REFCNT
  EXPORT_SYMBOL(ieee80211_find_rxnode_debug);
-@@ -1476,15 +1517,14 @@ ieee80211_find_txnode(struct ieee80211va
+@@ -1479,15 +1521,14 @@ ieee80211_find_txnode(struct ieee80211va
        struct ieee80211com *ic = vap->iv_ic;
        struct ieee80211_node_table *nt;
        struct ieee80211_node *ni = NULL;
@@ -157,7 +158,7 @@
  
        /*
         * The destination address should be in the node table
-@@ -1502,11 +1542,22 @@ ieee80211_find_txnode(struct ieee80211va
+@@ -1505,11 +1546,22 @@ ieee80211_find_txnode(struct ieee80211va
        /* XXX: Can't hold lock across dup_bss due to recursive locking. */
        nt = &vap->iv_ic->ic_sta;
        IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
@@ -182,7 +183,7 @@
        IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
  
        if (ni == NULL) {
-@@ -1961,13 +2012,29 @@ remove_worse_nodes(void *arg, struct iee
+@@ -1964,13 +2016,32 @@ remove_worse_nodes(void *arg, struct iee
                }
  }
  
@@ -197,6 +198,9 @@
 +      if (ni->ni_vap == rni->ni_vap)
 +              return;
 +
++      if (!IEEE80211_ADDR_EQ(rni->ni_macaddr, ni->ni_macaddr))
++              return;
++
 +      ieee80211_node_leave(ni);
 +}
 +
@@ -249,7 +253,7 @@
  
        KASSERT(skb->len >= sizeof(struct ieee80211_frame_min),
                ("frame length too short: %u", skb->len));
-@@ -848,10 +847,11 @@ ieee80211_input(struct ieee80211vap * va
+@@ -844,10 +843,11 @@ ieee80211_input(struct ieee80211vap * va
  err:
        vap->iv_devstats.rx_errors++;
  out:
@@ -263,7 +267,7 @@
        return type;
  #undef HAS_SEQ
  }
-@@ -933,16 +933,23 @@ int
+@@ -929,16 +929,23 @@ int
  ieee80211_input_all(struct ieee80211com *ic,
        struct sk_buff *skb, int rssi, u_int64_t rtsf)
  {
@@ -287,7 +291,7 @@
                if (TAILQ_NEXT(vap, iv_next) != NULL) {
                        skb1 = skb_copy(skb, GFP_ATOMIC);
                        if (skb1 == NULL) {
-@@ -954,8 +961,10 @@ ieee80211_input_all(struct ieee80211com 
+@@ -950,8 +957,10 @@ ieee80211_input_all(struct ieee80211com 
                        skb1 = skb;
                        skb = NULL;
                }
@@ -315,7 +319,7 @@
  
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -6577,9 +6577,8 @@ ath_recv_mgmt(struct ieee80211vap * vap,
+@@ -6588,9 +6588,8 @@ ath_recv_mgmt(struct ieee80211vap * vap,
  
        sc->sc_recv_mgmt(vap, ni_or_null, skb, subtype, rssi, rtsf);
  
@@ -326,7 +330,7 @@
                 (const struct ieee80211_frame_min *)skb->data);
        if (ni == NULL) {
                DPRINTF(sc, ATH_DEBUG_BEACON, "Dropping; node unknown.\n");
-@@ -6734,7 +6733,9 @@ ath_rx_poll(struct net_device *dev, int 
+@@ -6745,7 +6744,9 @@ ath_rx_poll(struct net_device *dev, int 
        struct ath_desc *ds;
        struct ath_rx_status *rs;
        struct sk_buff *skb = NULL;
@@ -336,7 +340,7 @@
        unsigned int len;
        int type;
        u_int phyerr;
-@@ -6889,12 +6890,15 @@ rx_accept:
+@@ -6900,12 +6901,15 @@ rx_accept:
                skb_trim(skb, skb->len - IEEE80211_CRC_LEN);
  
                if (mic_fail) {
@@ -354,7 +358,7 @@
  
                        if (ni && ni->ni_table) {
                                ieee80211_check_mic(ni, skb);
-@@ -6956,11 +6960,24 @@ drop_micfail:
+@@ -6967,11 +6971,24 @@ drop_micfail:
                 * for its use.  If the sender is unknown spam the
                 * frame; it'll be dropped where it's not wanted.
                 */
@@ -381,7 +385,7 @@
                        ATH_RSSI_LPF(ATH_NODE(ni)->an_avgrssi, rs->rs_rssi);
                        type = ieee80211_input(ni->ni_vap, ni, skb, rs->rs_rssi, bf->bf_tsf);
                        ieee80211_unref_node(&ni);
-@@ -6969,24 +6986,35 @@ drop_micfail:
+@@ -6980,24 +6997,35 @@ drop_micfail:
                         * No key index or no entry, do a lookup and
                         * add the node to the mapping table if possible.
                         */