It fixes a potential crash when receiving an LLCP HDLC frame acking a frame that is not the last sent one. In that case we may dereference an already freed pointer. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAABAgAGBQJQt0kOAAoJEIqAPN1PVmxKpxoQAJwbaylVz/miDjJLPekDhQ+z YkDmtBWJD9oy5GS/EUZPRIIEj+Ftaao0lAJDP4couYiZPQbrRBY1llBOxcIzkCqR fsAaD8jnPRGHwWtdqws8txFePh4Hn5WXHmJbcsOyVGt4gmy/xT06gme4p3VdIQIP XIkbss5mz29OdQwOLHzH4zva7JtZm9XOEWYWAbbFsrgNxXLBt7GhfF92TT29K4Wt UxFalwMYrpowY+BCBWzS1H31wVvNaDcsBRSO0hqvUZb7DgWM2b25B4Xnx3LiyLHR 9A17LWYso6mRhQPSqqhT5wWlKNT1G5VKZ8/X0i69ZLXi040NzpvMbvq41RhM9SwN bmWZNUWGrGkQJY6VPAdXeraoSmSNwOD4KnLXNV8rWmmg+NSzf8ZPWNCcxNEdIMnK oBe7vvk3j5z6QGNPeMB5C3hfpyRwyvRTqC9O5/dO7DOYD0lb0O6tuj1/MzhsOR2L pzBUjkvfJBA0FXdeDD7gFwR062uJZL4hinRpFPj4qTtFWPYypirWdnRpCSZbvbeW ZB3k7+8oNOGhn1TYPUmWsN1GNk2EJ4ZSpAf7BUI5Vb1KmcSpUQA6BN6yPlS/WQ4U eowwW+sUYPu5LixMCO/LtuUllJ/RCTzdQJH6j/hZlEqmfYs00emKNa08tk15XjGF zn2jXJjTykbYiVRirBR5 =tpAI -----END PGP SIGNATURE----- Merge tag 'nfc-fixes-3.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-3.0 This is an NFC LLCP fix for 3.7 and contains only one patch. It fixes a potential crash when receiving an LLCP HDLC frame acking a frame that is not the last sent one. In that case we may dereference an already freed pointer.
		
			
				
	
	
		
			480 lines
		
	
	
	
		
			13 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			480 lines
		
	
	
	
		
			13 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
/*
 | 
						|
 * Off-channel operation helpers
 | 
						|
 *
 | 
						|
 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
 | 
						|
 * Copyright 2004, Instant802 Networks, Inc.
 | 
						|
 * Copyright 2005, Devicescape Software, Inc.
 | 
						|
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 | 
						|
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 | 
						|
 * Copyright 2009	Johannes Berg <johannes@sipsolutions.net>
 | 
						|
 *
 | 
						|
 * This program is free software; you can redistribute it and/or modify
 | 
						|
 * it under the terms of the GNU General Public License version 2 as
 | 
						|
 * published by the Free Software Foundation.
 | 
						|
 */
 | 
						|
#include <linux/export.h>
 | 
						|
#include <net/mac80211.h>
 | 
						|
#include "ieee80211_i.h"
 | 
						|
#include "driver-ops.h"
 | 
						|
 | 
						|
/*
 | 
						|
 * Tell our hardware to disable PS.
 | 
						|
 * Optionally inform AP that we will go to sleep so that it will buffer
 | 
						|
 * the frames while we are doing off-channel work.  This is optional
 | 
						|
 * because we *may* be doing work on-operating channel, and want our
 | 
						|
 * hardware unconditionally awake, but still let the AP send us normal frames.
 | 
						|
 */
 | 
						|
static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
 | 
						|
{
 | 
						|
	struct ieee80211_local *local = sdata->local;
 | 
						|
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 | 
						|
 | 
						|
	local->offchannel_ps_enabled = false;
 | 
						|
 | 
						|
	/* FIXME: what to do when local->pspolling is true? */
 | 
						|
 | 
						|
	del_timer_sync(&local->dynamic_ps_timer);
 | 
						|
	del_timer_sync(&ifmgd->bcn_mon_timer);
 | 
						|
	del_timer_sync(&ifmgd->conn_mon_timer);
 | 
						|
 | 
						|
	cancel_work_sync(&local->dynamic_ps_enable_work);
 | 
						|
 | 
						|
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
 | 
						|
		local->offchannel_ps_enabled = true;
 | 
						|
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
 | 
						|
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 | 
						|
	}
 | 
						|
 | 
						|
	if (!local->offchannel_ps_enabled ||
 | 
						|
	    !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
 | 
						|
		/*
 | 
						|
		 * If power save was enabled, no need to send a nullfunc
 | 
						|
		 * frame because AP knows that we are sleeping. But if the
 | 
						|
		 * hardware is creating the nullfunc frame for power save
 | 
						|
		 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
 | 
						|
		 * enabled) and power save was enabled, the firmware just
 | 
						|
		 * sent a null frame with power save disabled. So we need
 | 
						|
		 * to send a new nullfunc frame to inform the AP that we
 | 
						|
		 * are again sleeping.
 | 
						|
		 */
 | 
						|
		ieee80211_send_nullfunc(local, sdata, 1);
 | 
						|
}
 | 
						|
 | 
						|
/* inform AP that we are awake again, unless power save is enabled */
 | 
						|
static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
 | 
						|
{
 | 
						|
	struct ieee80211_local *local = sdata->local;
 | 
						|
 | 
						|
	if (!local->ps_sdata)
 | 
						|
		ieee80211_send_nullfunc(local, sdata, 0);
 | 
						|
	else if (local->offchannel_ps_enabled) {
 | 
						|
		/*
 | 
						|
		 * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
 | 
						|
		 * will send a nullfunc frame with the powersave bit set
 | 
						|
		 * even though the AP already knows that we are sleeping.
 | 
						|
		 * This could be avoided by sending a null frame with power
 | 
						|
		 * save bit disabled before enabling the power save, but
 | 
						|
		 * this doesn't gain anything.
 | 
						|
		 *
 | 
						|
		 * When IEEE80211_HW_PS_NULLFUNC_STACK is enabled, no need
 | 
						|
		 * to send a nullfunc frame because AP already knows that
 | 
						|
		 * we are sleeping, let's just enable power save mode in
 | 
						|
		 * hardware.
 | 
						|
		 */
 | 
						|
		/* TODO:  Only set hardware if CONF_PS changed?
 | 
						|
		 * TODO:  Should we set offchannel_ps_enabled to false?
 | 
						|
		 */
 | 
						|
		local->hw.conf.flags |= IEEE80211_CONF_PS;
 | 
						|
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 | 
						|
	} else if (local->hw.conf.dynamic_ps_timeout > 0) {
 | 
						|
		/*
 | 
						|
		 * If IEEE80211_CONF_PS was not set and the dynamic_ps_timer
 | 
						|
		 * had been running before leaving the operating channel,
 | 
						|
		 * restart the timer now and send a nullfunc frame to inform
 | 
						|
		 * the AP that we are awake.
 | 
						|
		 */
 | 
						|
		ieee80211_send_nullfunc(local, sdata, 0);
 | 
						|
		mod_timer(&local->dynamic_ps_timer, jiffies +
 | 
						|
			  msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
 | 
						|
	}
 | 
						|
 | 
						|
	ieee80211_sta_reset_beacon_monitor(sdata);
 | 
						|
	ieee80211_sta_reset_conn_monitor(sdata);
 | 
						|
}
 | 
						|
 | 
						|
void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
 | 
						|
				    bool offchannel_ps_enable)
 | 
						|
{
 | 
						|
	struct ieee80211_sub_if_data *sdata;
 | 
						|
 | 
						|
	if (WARN_ON(local->use_chanctx))
 | 
						|
		return;
 | 
						|
 | 
						|
	/*
 | 
						|
	 * notify the AP about us leaving the channel and stop all
 | 
						|
	 * STA interfaces.
 | 
						|
	 */
 | 
						|
	mutex_lock(&local->iflist_mtx);
 | 
						|
	list_for_each_entry(sdata, &local->interfaces, list) {
 | 
						|
		if (!ieee80211_sdata_running(sdata))
 | 
						|
			continue;
 | 
						|
 | 
						|
		if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
 | 
						|
			continue;
 | 
						|
 | 
						|
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 | 
						|
			set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 | 
						|
 | 
						|
		/* Check to see if we should disable beaconing. */
 | 
						|
		if (sdata->vif.type == NL80211_IFTYPE_AP ||
 | 
						|
		    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
 | 
						|
		    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
 | 
						|
			ieee80211_bss_info_change_notify(
 | 
						|
				sdata, BSS_CHANGED_BEACON_ENABLED);
 | 
						|
 | 
						|
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
 | 
						|
			netif_tx_stop_all_queues(sdata->dev);
 | 
						|
			if (offchannel_ps_enable &&
 | 
						|
			    (sdata->vif.type == NL80211_IFTYPE_STATION) &&
 | 
						|
			    sdata->u.mgd.associated)
 | 
						|
				ieee80211_offchannel_ps_enable(sdata);
 | 
						|
		}
 | 
						|
	}
 | 
						|
	mutex_unlock(&local->iflist_mtx);
 | 
						|
}
 | 
						|
 | 
						|
void ieee80211_offchannel_return(struct ieee80211_local *local,
 | 
						|
				 bool offchannel_ps_disable)
 | 
						|
{
 | 
						|
	struct ieee80211_sub_if_data *sdata;
 | 
						|
 | 
						|
	if (WARN_ON(local->use_chanctx))
 | 
						|
		return;
 | 
						|
 | 
						|
	mutex_lock(&local->iflist_mtx);
 | 
						|
	list_for_each_entry(sdata, &local->interfaces, list) {
 | 
						|
		if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
 | 
						|
			continue;
 | 
						|
 | 
						|
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 | 
						|
			clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 | 
						|
 | 
						|
		if (!ieee80211_sdata_running(sdata))
 | 
						|
			continue;
 | 
						|
 | 
						|
		/* Tell AP we're back */
 | 
						|
		if (offchannel_ps_disable &&
 | 
						|
		    sdata->vif.type == NL80211_IFTYPE_STATION) {
 | 
						|
			if (sdata->u.mgd.associated)
 | 
						|
				ieee80211_offchannel_ps_disable(sdata);
 | 
						|
		}
 | 
						|
 | 
						|
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
 | 
						|
			/*
 | 
						|
			 * This may wake up queues even though the driver
 | 
						|
			 * currently has them stopped. This is not very
 | 
						|
			 * likely, since the driver won't have gotten any
 | 
						|
			 * (or hardly any) new packets while we weren't
 | 
						|
			 * on the right channel, and even if it happens
 | 
						|
			 * it will at most lead to queueing up one more
 | 
						|
			 * packet per queue in mac80211 rather than on
 | 
						|
			 * the interface qdisc.
 | 
						|
			 */
 | 
						|
			netif_tx_wake_all_queues(sdata->dev);
 | 
						|
		}
 | 
						|
 | 
						|
		if (sdata->vif.type == NL80211_IFTYPE_AP ||
 | 
						|
		    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
 | 
						|
		    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
 | 
						|
			ieee80211_bss_info_change_notify(
 | 
						|
				sdata, BSS_CHANGED_BEACON_ENABLED);
 | 
						|
	}
 | 
						|
	mutex_unlock(&local->iflist_mtx);
 | 
						|
}
 | 
						|
 | 
						|
void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc)
 | 
						|
{
 | 
						|
	if (roc->notified)
 | 
						|
		return;
 | 
						|
 | 
						|
	if (roc->mgmt_tx_cookie) {
 | 
						|
		if (!WARN_ON(!roc->frame)) {
 | 
						|
			ieee80211_tx_skb_tid_band(roc->sdata, roc->frame, 7,
 | 
						|
						  roc->chan->band);
 | 
						|
			roc->frame = NULL;
 | 
						|
		}
 | 
						|
	} else {
 | 
						|
		cfg80211_ready_on_channel(&roc->sdata->wdev, roc->cookie,
 | 
						|
					  roc->chan, roc->req_duration,
 | 
						|
					  GFP_KERNEL);
 | 
						|
	}
 | 
						|
 | 
						|
	roc->notified = true;
 | 
						|
}
 | 
						|
 | 
						|
static void ieee80211_hw_roc_start(struct work_struct *work)
 | 
						|
{
 | 
						|
	struct ieee80211_local *local =
 | 
						|
		container_of(work, struct ieee80211_local, hw_roc_start);
 | 
						|
	struct ieee80211_roc_work *roc, *dep, *tmp;
 | 
						|
 | 
						|
	mutex_lock(&local->mtx);
 | 
						|
 | 
						|
	if (list_empty(&local->roc_list))
 | 
						|
		goto out_unlock;
 | 
						|
 | 
						|
	roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
 | 
						|
			       list);
 | 
						|
 | 
						|
	if (!roc->started)
 | 
						|
		goto out_unlock;
 | 
						|
 | 
						|
	roc->hw_begun = true;
 | 
						|
	roc->hw_start_time = local->hw_roc_start_time;
 | 
						|
 | 
						|
	ieee80211_handle_roc_started(roc);
 | 
						|
	list_for_each_entry_safe(dep, tmp, &roc->dependents, list) {
 | 
						|
		ieee80211_handle_roc_started(dep);
 | 
						|
 | 
						|
		if (dep->duration > roc->duration) {
 | 
						|
			u32 dur = dep->duration;
 | 
						|
			dep->duration = dur - roc->duration;
 | 
						|
			roc->duration = dur;
 | 
						|
			list_move(&dep->list, &roc->list);
 | 
						|
		}
 | 
						|
	}
 | 
						|
 out_unlock:
 | 
						|
	mutex_unlock(&local->mtx);
 | 
						|
}
 | 
						|
 | 
						|
void ieee80211_ready_on_channel(struct ieee80211_hw *hw)
 | 
						|
{
 | 
						|
	struct ieee80211_local *local = hw_to_local(hw);
 | 
						|
 | 
						|
	local->hw_roc_start_time = jiffies;
 | 
						|
 | 
						|
	trace_api_ready_on_channel(local);
 | 
						|
 | 
						|
	ieee80211_queue_work(hw, &local->hw_roc_start);
 | 
						|
}
 | 
						|
EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel);
 | 
						|
 | 
						|
void ieee80211_start_next_roc(struct ieee80211_local *local)
 | 
						|
{
 | 
						|
	struct ieee80211_roc_work *roc;
 | 
						|
 | 
						|
	lockdep_assert_held(&local->mtx);
 | 
						|
 | 
						|
	if (list_empty(&local->roc_list)) {
 | 
						|
		ieee80211_run_deferred_scan(local);
 | 
						|
		return;
 | 
						|
	}
 | 
						|
 | 
						|
	roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
 | 
						|
			       list);
 | 
						|
 | 
						|
	if (WARN_ON_ONCE(roc->started))
 | 
						|
		return;
 | 
						|
 | 
						|
	if (local->ops->remain_on_channel) {
 | 
						|
		int ret, duration = roc->duration;
 | 
						|
 | 
						|
		/* XXX: duplicated, see ieee80211_start_roc_work() */
 | 
						|
		if (!duration)
 | 
						|
			duration = 10;
 | 
						|
 | 
						|
		ret = drv_remain_on_channel(local, roc->sdata, roc->chan,
 | 
						|
					    duration);
 | 
						|
 | 
						|
		roc->started = true;
 | 
						|
 | 
						|
		if (ret) {
 | 
						|
			wiphy_warn(local->hw.wiphy,
 | 
						|
				   "failed to start next HW ROC (%d)\n", ret);
 | 
						|
			/*
 | 
						|
			 * queue the work struct again to avoid recursion
 | 
						|
			 * when multiple failures occur
 | 
						|
			 */
 | 
						|
			ieee80211_remain_on_channel_expired(&local->hw);
 | 
						|
		}
 | 
						|
	} else {
 | 
						|
		/* delay it a bit */
 | 
						|
		ieee80211_queue_delayed_work(&local->hw, &roc->work,
 | 
						|
					     round_jiffies_relative(HZ/2));
 | 
						|
	}
 | 
						|
}
 | 
						|
 | 
						|
void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
 | 
						|
{
 | 
						|
	struct ieee80211_roc_work *dep, *tmp;
 | 
						|
 | 
						|
	/* was never transmitted */
 | 
						|
	if (roc->frame) {
 | 
						|
		cfg80211_mgmt_tx_status(&roc->sdata->wdev,
 | 
						|
					(unsigned long)roc->frame,
 | 
						|
					roc->frame->data, roc->frame->len,
 | 
						|
					false, GFP_KERNEL);
 | 
						|
		kfree_skb(roc->frame);
 | 
						|
	}
 | 
						|
 | 
						|
	if (!roc->mgmt_tx_cookie)
 | 
						|
		cfg80211_remain_on_channel_expired(&roc->sdata->wdev,
 | 
						|
						   roc->cookie, roc->chan,
 | 
						|
						   GFP_KERNEL);
 | 
						|
 | 
						|
	list_for_each_entry_safe(dep, tmp, &roc->dependents, list)
 | 
						|
		ieee80211_roc_notify_destroy(dep);
 | 
						|
 | 
						|
	kfree(roc);
 | 
						|
}
 | 
						|
 | 
						|
void ieee80211_sw_roc_work(struct work_struct *work)
 | 
						|
{
 | 
						|
	struct ieee80211_roc_work *roc =
 | 
						|
		container_of(work, struct ieee80211_roc_work, work.work);
 | 
						|
	struct ieee80211_sub_if_data *sdata = roc->sdata;
 | 
						|
	struct ieee80211_local *local = sdata->local;
 | 
						|
	bool started;
 | 
						|
 | 
						|
	mutex_lock(&local->mtx);
 | 
						|
 | 
						|
	if (roc->abort)
 | 
						|
		goto finish;
 | 
						|
 | 
						|
	if (WARN_ON(list_empty(&local->roc_list)))
 | 
						|
		goto out_unlock;
 | 
						|
 | 
						|
	if (WARN_ON(roc != list_first_entry(&local->roc_list,
 | 
						|
					    struct ieee80211_roc_work,
 | 
						|
					    list)))
 | 
						|
		goto out_unlock;
 | 
						|
 | 
						|
	if (!roc->started) {
 | 
						|
		struct ieee80211_roc_work *dep;
 | 
						|
 | 
						|
		/* start this ROC */
 | 
						|
 | 
						|
		/* switch channel etc */
 | 
						|
		ieee80211_recalc_idle(local);
 | 
						|
 | 
						|
		local->tmp_channel = roc->chan;
 | 
						|
		ieee80211_hw_config(local, 0);
 | 
						|
 | 
						|
		/* tell userspace or send frame */
 | 
						|
		ieee80211_handle_roc_started(roc);
 | 
						|
		list_for_each_entry(dep, &roc->dependents, list)
 | 
						|
			ieee80211_handle_roc_started(dep);
 | 
						|
 | 
						|
		/* if it was pure TX, just finish right away */
 | 
						|
		if (!roc->duration)
 | 
						|
			goto finish;
 | 
						|
 | 
						|
		roc->started = true;
 | 
						|
		ieee80211_queue_delayed_work(&local->hw, &roc->work,
 | 
						|
					     msecs_to_jiffies(roc->duration));
 | 
						|
	} else {
 | 
						|
		/* finish this ROC */
 | 
						|
 finish:
 | 
						|
		list_del(&roc->list);
 | 
						|
		started = roc->started;
 | 
						|
		ieee80211_roc_notify_destroy(roc);
 | 
						|
 | 
						|
		if (started) {
 | 
						|
			drv_flush(local, false);
 | 
						|
 | 
						|
			local->tmp_channel = NULL;
 | 
						|
			ieee80211_hw_config(local, 0);
 | 
						|
 | 
						|
			ieee80211_offchannel_return(local, true);
 | 
						|
		}
 | 
						|
 | 
						|
		ieee80211_recalc_idle(local);
 | 
						|
 | 
						|
		if (started)
 | 
						|
			ieee80211_start_next_roc(local);
 | 
						|
	}
 | 
						|
 | 
						|
 out_unlock:
 | 
						|
	mutex_unlock(&local->mtx);
 | 
						|
}
 | 
						|
 | 
						|
static void ieee80211_hw_roc_done(struct work_struct *work)
 | 
						|
{
 | 
						|
	struct ieee80211_local *local =
 | 
						|
		container_of(work, struct ieee80211_local, hw_roc_done);
 | 
						|
	struct ieee80211_roc_work *roc;
 | 
						|
 | 
						|
	mutex_lock(&local->mtx);
 | 
						|
 | 
						|
	if (list_empty(&local->roc_list))
 | 
						|
		goto out_unlock;
 | 
						|
 | 
						|
	roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
 | 
						|
			       list);
 | 
						|
 | 
						|
	if (!roc->started)
 | 
						|
		goto out_unlock;
 | 
						|
 | 
						|
	list_del(&roc->list);
 | 
						|
 | 
						|
	ieee80211_roc_notify_destroy(roc);
 | 
						|
 | 
						|
	/* if there's another roc, start it now */
 | 
						|
	ieee80211_start_next_roc(local);
 | 
						|
 | 
						|
 out_unlock:
 | 
						|
	mutex_unlock(&local->mtx);
 | 
						|
}
 | 
						|
 | 
						|
void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw)
 | 
						|
{
 | 
						|
	struct ieee80211_local *local = hw_to_local(hw);
 | 
						|
 | 
						|
	trace_api_remain_on_channel_expired(local);
 | 
						|
 | 
						|
	ieee80211_queue_work(hw, &local->hw_roc_done);
 | 
						|
}
 | 
						|
EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired);
 | 
						|
 | 
						|
void ieee80211_roc_setup(struct ieee80211_local *local)
 | 
						|
{
 | 
						|
	INIT_WORK(&local->hw_roc_start, ieee80211_hw_roc_start);
 | 
						|
	INIT_WORK(&local->hw_roc_done, ieee80211_hw_roc_done);
 | 
						|
	INIT_LIST_HEAD(&local->roc_list);
 | 
						|
}
 | 
						|
 | 
						|
void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata)
 | 
						|
{
 | 
						|
	struct ieee80211_local *local = sdata->local;
 | 
						|
	struct ieee80211_roc_work *roc, *tmp;
 | 
						|
	LIST_HEAD(tmp_list);
 | 
						|
 | 
						|
	mutex_lock(&local->mtx);
 | 
						|
	list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 | 
						|
		if (roc->sdata != sdata)
 | 
						|
			continue;
 | 
						|
 | 
						|
		if (roc->started && local->ops->remain_on_channel) {
 | 
						|
			/* can race, so ignore return value */
 | 
						|
			drv_cancel_remain_on_channel(local);
 | 
						|
		}
 | 
						|
 | 
						|
		list_move_tail(&roc->list, &tmp_list);
 | 
						|
		roc->abort = true;
 | 
						|
	}
 | 
						|
	mutex_unlock(&local->mtx);
 | 
						|
 | 
						|
	list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
 | 
						|
		if (local->ops->remain_on_channel) {
 | 
						|
			list_del(&roc->list);
 | 
						|
			ieee80211_roc_notify_destroy(roc);
 | 
						|
		} else {
 | 
						|
			ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
 | 
						|
 | 
						|
			/* work will clean up etc */
 | 
						|
			flush_delayed_work(&roc->work);
 | 
						|
		}
 | 
						|
	}
 | 
						|
 | 
						|
	WARN_ON_ONCE(!list_empty(&tmp_list));
 | 
						|
}
 |