fix a rare wds related noderef issue

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@13095 3c298f89-4303-0410-b956-a3cf2f4a3e73

1 files changed, 50 insertions, 50 deletions

diff --git a/package/madwifi/patches/371-wds_sta_separation.patch b/package/madwifi/patches/371-wds_sta_separation.patch
index a37ebd493..b40eafa08 100644
--- a/package/madwifi/patches/371-wds_sta_separation.patch
+++ b/package/madwifi/patches/371-wds_sta_separation.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -202,6 +202,7 @@
+@@ -202,6 +202,7 @@ ieee80211_input(struct ieee80211vap * va
  	struct ieee80211com *ic = vap->iv_ic;
  	struct net_device *dev = vap->iv_dev;
  	struct ieee80211_node *ni_wds = NULL;
@@ -8,7 +8,7 @@
  	struct ieee80211_frame *wh;
  	struct ieee80211_key *key;
  	struct ether_header *eh;
-@@ -435,7 +436,7 @@
+@@ -435,7 +436,7 @@ ieee80211_input(struct ieee80211vap * va
  
  	switch (type) {
  	case IEEE80211_FC0_TYPE_DATA:
@@ -17,7 +17,7 @@
  		if (skb->len < hdrspace) {
  			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  				wh, "data", "too short: len %u, expecting %u",
-@@ -445,16 +446,24 @@
+@@ -445,16 +446,24 @@ ieee80211_input(struct ieee80211vap * va
  		}
  		switch (vap->iv_opmode) {
  		case IEEE80211_M_STA:
@@ -46,7 +46,7 @@
  				/* Discard multicast if IFF_MULTICAST not set */
  				if ((0 != memcmp(wh->i_addr3, dev->broadcast, ETH_ALEN)) && 
  					(0 == (dev->flags & IFF_MULTICAST))) {
-@@ -482,24 +491,10 @@
+@@ -482,24 +491,10 @@ ieee80211_input(struct ieee80211vap * va
  					vap->iv_stats.is_rx_mcastecho++;
  					goto out;
  				}
@@ -75,7 +75,7 @@
  			}
  			break;
  		case IEEE80211_M_IBSS:
-@@ -541,6 +536,11 @@
+@@ -541,6 +536,11 @@ ieee80211_input(struct ieee80211vap * va
  				vap->iv_stats.is_rx_notassoc++;
  				goto err;
  			}
@@ -87,7 +87,7 @@
  			/*
  			 * If we're a 4 address packet, make sure we have an entry in
  			 * the node table for the packet source address (addr4).
-@@ -548,9 +548,16 @@
+@@ -548,9 +548,16 @@ ieee80211_input(struct ieee80211vap * va
  			 */
  
  			/* check for wds link first */
@@ -105,7 +105,7 @@
  				TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
  					if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
  						IEEE80211_LOCK_IRQ(ni->ni_ic);
-@@ -566,7 +573,7 @@
+@@ -567,7 +574,7 @@ ieee80211_input(struct ieee80211vap * va
  			}
  
  			/* XXX: Useless node mgmt API; make better */
@@ -114,7 +114,7 @@
  				struct ieee80211_node_table *nt = &ic->ic_sta;
  				struct ieee80211_frame_addr4 *wh4;
  
-@@ -626,6 +633,11 @@
+@@ -627,6 +634,11 @@ ieee80211_input(struct ieee80211vap * va
  			goto out;
  		}
  
@@ -126,7 +126,7 @@
  		/*
  		 * Handle privacy requirements.  Note that we
  		 * must not be preempted from here until after
-@@ -698,8 +710,12 @@
+@@ -699,8 +711,12 @@ ieee80211_input(struct ieee80211vap * va
  		if (! accept_data_frame(vap, ni, key, skb, eh))
  			goto out;
  
@@ -141,7 +141,7 @@
  		IEEE80211_NODE_STAT(ni, rx_data);
  		IEEE80211_NODE_STAT_ADD(ni, rx_bytes, skb->len);
  		ic->ic_lastdata = jiffies;
-@@ -1132,6 +1148,13 @@
+@@ -1133,6 +1149,13 @@ ieee80211_deliver_data(struct ieee80211_
  		dev = vap->iv_xrvap->iv_dev;
  #endif
  
@@ -155,7 +155,7 @@
  	/* perform as a bridge within the vap */
  	/* XXX intra-vap bridging only */
  	if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
-@@ -1157,7 +1180,16 @@
+@@ -1158,7 +1181,16 @@ ieee80211_deliver_data(struct ieee80211_
  			if (ni1 != NULL) {
  				if (ni1->ni_vap == vap &&
  				    ieee80211_node_is_authorized(ni1) &&
@@ -174,7 +174,7 @@
  				}
 --- a/net80211/ieee80211_ioctl.h
 +++ b/net80211/ieee80211_ioctl.h
-@@ -649,6 +649,7 @@
+@@ -649,6 +649,7 @@ enum {
  	IEEE80211_PARAM_BGSCAN_THRESH		= 79,	/* bg scan rssi threshold */
  	IEEE80211_PARAM_RSSI_DIS_THR	= 80,	/* rssi threshold for disconnection */
  	IEEE80211_PARAM_RSSI_DIS_COUNT	= 81,	/* counter for rssi threshold */
@@ -184,7 +184,7 @@
  #define	SIOCG80211STATS			(SIOCDEVPRIVATE+2)
 --- a/net80211/ieee80211_node.h
 +++ b/net80211/ieee80211_node.h
-@@ -92,11 +92,13 @@
+@@ -92,11 +92,13 @@ struct ath_softc;
   * the ieee80211com structure.
   */
  struct ieee80211_node {
@@ -199,7 +199,7 @@
  	atomic_t ni_refcnt;
  	u_int ni_scangen;			/* gen# for timeout scan */
  	u_int8_t ni_authmode;			/* authentication algorithm */
-@@ -430,5 +432,6 @@
+@@ -430,5 +432,6 @@ void ieee80211_node_join(struct ieee8021
  void ieee80211_node_leave(struct ieee80211_node *);
  u_int8_t ieee80211_getrssi(struct ieee80211com *);
  int32_t ieee80211_get_node_count(struct ieee80211com *);
@@ -208,7 +208,7 @@
  
 --- a/net80211/ieee80211_var.h
 +++ b/net80211/ieee80211_var.h
-@@ -322,6 +322,7 @@
+@@ -322,6 +322,7 @@ struct ieee80211com {
  	u_int8_t ic_myaddr[IEEE80211_ADDR_LEN];
  	struct timer_list ic_inact;		/* mgmt/inactivity timer */
  
@@ -216,7 +216,7 @@
  	u_int32_t ic_flags;			/* state flags */
  	u_int32_t ic_flags_ext;			/* extension of state flags */
  	u_int32_t ic_caps;			/* capabilities */
-@@ -625,6 +626,7 @@
+@@ -625,6 +626,7 @@ MALLOC_DECLARE(M_80211_VAP);
  #define IEEE80211_FEXT_DROPUNENC_EAPOL	0x00000800	/* CONF: drop unencrypted eapol frames */
  #define IEEE80211_FEXT_APPIE_UPDATE	0x00001000	/* STATE: beacon APP IE updated */
  #define IEEE80211_FEXT_BGSCAN_THR	0x00002000	/* bgscan due to low rssi */
@@ -226,7 +226,7 @@
  #define IEEE80211_COM_UAPSD_DISABLE(_ic)	((_ic)->ic_flags_ext &= ~IEEE80211_FEXT_UAPSD)
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -2867,6 +2867,14 @@
+@@ -2867,6 +2867,14 @@ ieee80211_ioctl_setparam(struct net_devi
  		else
  			vap->iv_minrateindex = 0;
  		break;
@@ -241,7 +241,7 @@
  #ifdef ATH_REVERSE_ENGINEERING
  	case IEEE80211_PARAM_DUMPREGS:
  		ieee80211_dump_registers(dev, info, w, extra);
-@@ -3223,6 +3231,9 @@
+@@ -3223,6 +3231,9 @@ ieee80211_ioctl_getparam(struct net_devi
  	case IEEE80211_PARAM_MINRATE:
  		param[0] = vap->iv_minrateindex;
  		break;
@@ -251,7 +251,7 @@
  	default:
  		return -EOPNOTSUPP;
  	}
-@@ -4447,6 +4458,8 @@
+@@ -4447,6 +4458,8 @@ get_sta_space(void *arg, struct ieee8021
  	struct ieee80211vap *vap = ni->ni_vap;
  	size_t ielen;
  
@@ -260,7 +260,7 @@
  	if (vap != req->vap && vap != req->vap->iv_xrvap)	/* only entries for this vap */
  		return;
  	if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
-@@ -4466,6 +4479,8 @@
+@@ -4466,6 +4479,8 @@ get_sta_info(void *arg, struct ieee80211
  	size_t ielen, len;
  	u_int8_t *cp;
  
@@ -269,7 +269,7 @@
  	if (vap != req->vap && vap != req->vap->iv_xrvap)	/* only entries for this vap (or) xrvap */
  		return;
  	if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
-@@ -5767,6 +5782,10 @@
+@@ -5767,6 +5782,10 @@ static const struct iw_priv_args ieee802
  	 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_minrate"},
  	{ IEEE80211_IOCTL_SETSCANLIST,
  	 IW_PRIV_TYPE_CHAR | 255, 0, "setscanlist"},
@@ -280,7 +280,7 @@
  
  #ifdef ATH_REVERSE_ENGINEERING
  	/*
-@@ -5890,6 +5909,8 @@
+@@ -5890,6 +5909,8 @@ static int
  ieee80211_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
  {
  	struct ieee80211vap *vap = dev->priv;
@@ -289,7 +289,7 @@
  
  	switch (cmd) {
  	case SIOCG80211STATS:
-@@ -5898,8 +5919,20 @@
+@@ -5898,8 +5919,20 @@ ieee80211_ioctl(struct net_device *dev, 
  	case SIOC80211IFDESTROY:
  		if (!capable(CAP_NET_ADMIN))
  			return -EPERM;
@@ -321,7 +321,7 @@
  
  #include "if_media.h"
  
-@@ -236,7 +237,11 @@
+@@ -236,7 +237,11 @@ void
  ieee80211_node_vdetach(struct ieee80211vap *vap)
  {
  	struct ieee80211com *ic = vap->iv_ic;
@@ -333,7 +333,7 @@
  	ieee80211_node_table_reset(&ic->ic_sta, vap);
  	if (vap->iv_bss != NULL) {
  		ieee80211_unref_node(&vap->iv_bss);
-@@ -1134,6 +1139,57 @@
+@@ -1134,6 +1139,57 @@ ieee80211_alloc_node(struct ieee80211vap
  	return ni;
  }
  
@@ -391,7 +391,7 @@
  /* Add wds address to the node table */
  int
  #ifdef IEEE80211_DEBUG_REFCNT
-@@ -2254,6 +2310,36 @@
+@@ -2254,6 +2310,36 @@ ieee80211_node_leave_11g(struct ieee8021
  	}
  }
  
@@ -428,7 +428,7 @@
  /*
   * Handle bookkeeping for a station/neighbor leaving
   * the bss when operating in ap or adhoc modes.
-@@ -2270,6 +2356,12 @@
+@@ -2270,6 +2356,12 @@ ieee80211_node_leave(struct ieee80211_no
  			ni, "station with aid %d leaves (refcnt %u)",
  			IEEE80211_NODE_AID(ni), atomic_read(&ni->ni_refcnt));
  
@@ -443,7 +443,7 @@
  	 */
 --- a/net80211/ieee80211_linux.h
 +++ b/net80211/ieee80211_linux.h
-@@ -81,6 +81,12 @@
+@@ -81,6 +81,12 @@ set_quality(struct iw_quality *iq, u_int
  #endif
  }
  
@@ -456,7 +456,7 @@
  /*
   * Task deferral
   *
-@@ -113,6 +119,29 @@
+@@ -113,6 +119,29 @@ typedef void *IEEE80211_TQUEUE_ARG;
  
  #define	IEEE80211_RESCHEDULE	schedule
  
@@ -488,7 +488,7 @@
   * because spinlocks do not exist in this configuration. Instead IRQs 
 --- a/net80211/ieee80211_proto.c
 +++ b/net80211/ieee80211_proto.c
-@@ -1081,6 +1081,8 @@
+@@ -1081,6 +1081,8 @@ ieee80211_init(struct net_device *dev, i
  int
  ieee80211_open(struct net_device *dev)
  {
@@ -497,7 +497,7 @@
  	return ieee80211_init(dev, 0);
  }
  
-@@ -1116,11 +1118,33 @@
+@@ -1116,11 +1118,33 @@ ieee80211_stop(struct net_device *dev)
  	struct ieee80211vap *vap = dev->priv;
  	struct ieee80211com *ic = vap->iv_ic;
  	struct net_device *parent = ic->ic_dev;
@@ -531,7 +531,7 @@
  	ieee80211_new_state(vap, IEEE80211_S_INIT, -1);
  	if (dev->flags & IFF_RUNNING) {
  		dev->flags &= ~IFF_RUNNING;		/* mark us stopped */
-@@ -1630,6 +1654,7 @@
+@@ -1630,6 +1654,7 @@ __ieee80211_newstate(struct ieee80211vap
  		 */
  		if (ni->ni_authmode != IEEE80211_AUTH_8021X)
  			ieee80211_node_authorize(ni);
@@ -539,7 +539,7 @@
  #ifdef ATH_SUPERG_XR
  		/*
  		 * fire a timer to bring up XR vap if configured.
-@@ -1885,8 +1910,15 @@
+@@ -1885,8 +1910,15 @@ ieee80211_newstate(struct ieee80211vap *
  		if (ostate == IEEE80211_S_SCAN || 
  		    ostate == IEEE80211_S_AUTH ||
  		    ostate == IEEE80211_S_ASSOC) {
@@ -557,7 +557,7 @@
  			if (dstate == IEEE80211_S_RUN) {
 --- a/net80211/ieee80211.c
 +++ b/net80211/ieee80211.c
-@@ -373,10 +373,25 @@
+@@ -373,10 +373,25 @@ void
  ieee80211_ifdetach(struct ieee80211com *ic)
  {
  	struct ieee80211vap *vap;
@@ -584,7 +584,7 @@
  	rtnl_unlock();
  
  	del_timer(&ic->ic_dfs_excl_timer);
-@@ -599,8 +614,10 @@
+@@ -599,8 +614,10 @@ ieee80211_vap_detach(struct ieee80211vap
  
  	IEEE80211_CANCEL_TQUEUE(&vap->iv_stajoin1tq);
  	IEEE80211_LOCK_IRQ(ic);
@@ -598,7 +598,7 @@
  		TAILQ_REMOVE(&vap->iv_master->iv_wdslinks, vap, iv_wdsnext);
 --- a/ath/if_athvar.h
 +++ b/ath/if_athvar.h
-@@ -79,28 +79,6 @@
+@@ -79,28 +79,6 @@ typedef void *TQUEUE_ARG;
  #define	tasklet_enable(t)	do { (void) t; local_bh_enable(); } while (0)
  #endif /* !DECLARE_TASKLET */
  
@@ -629,7 +629,7 @@
   */
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -261,6 +261,10 @@
+@@ -261,6 +261,10 @@ ieee80211_hardstart(struct sk_buff *skb,
  		goto bad;
  	}
  
@@ -640,7 +640,7 @@
  	/* calculate priority so drivers can find the TX queue */
  	if (ieee80211_classify(ni, skb)) {
  		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
-@@ -340,20 +344,33 @@
+@@ -340,20 +344,33 @@ void ieee80211_parent_queue_xmit(struct 
   * constructing a frame as it sets i_fc[1]; other bits can
   * then be or'd in.
   */
@@ -677,7 +677,7 @@
  		case IEEE80211_M_STA:
  			wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
  			IEEE80211_ADDR_COPY(wh->i_addr1, bssid);
-@@ -395,6 +412,8 @@
+@@ -395,6 +412,8 @@ ieee80211_send_setup(struct ieee80211vap
  	*(__le16 *)&wh->i_seq[0] =
  	    htole16(ni->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
  	ni->ni_txseqs[0]++;
@@ -686,7 +686,7 @@
  #undef WH4
  }
  
-@@ -416,9 +435,7 @@
+@@ -416,9 +435,7 @@ ieee80211_mgmt_output(struct ieee80211_n
  
  	SKB_CB(skb)->ni = ni;
  
@@ -697,7 +697,7 @@
  		IEEE80211_FC0_TYPE_MGT | type,
  		vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
  	/* XXX power management */
-@@ -464,6 +481,9 @@
+@@ -464,6 +481,9 @@ ieee80211_send_nulldata(struct ieee80211
  	struct ieee80211_frame *wh;
  	u_int8_t *frm;
  
@@ -707,7 +707,7 @@
  	skb = ieee80211_getmgtframe(&frm, 0);
  	if (skb == NULL) {
  		/* XXX debug msg */
-@@ -472,9 +492,7 @@
+@@ -472,9 +492,7 @@ ieee80211_send_nulldata(struct ieee80211
  		return -ENOMEM;
  	}
  
@@ -718,7 +718,7 @@
  		IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA,
  		vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
  	/* NB: power management bit is never sent by an AP */
-@@ -512,6 +530,7 @@
+@@ -512,6 +530,7 @@ ieee80211_send_qosnulldata(struct ieee80
  	struct sk_buff *skb;
  	struct ieee80211_qosframe *qwh;
  	u_int8_t *frm;
@@ -726,7 +726,7 @@
  	int tid;
  
  	skb = ieee80211_getmgtframe(&frm, 2);
-@@ -523,11 +542,12 @@
+@@ -523,11 +542,12 @@ ieee80211_send_qosnulldata(struct ieee80
  	SKB_CB(skb)->ni = ieee80211_ref_node(ni);
  
  	skb->priority = ac;
@@ -742,7 +742,7 @@
  		IEEE80211_FC0_TYPE_DATA,
  		vap->iv_myaddr, /* SA */
  		ni->ni_macaddr, /* DA */
-@@ -541,10 +561,10 @@
+@@ -541,10 +561,10 @@ ieee80211_send_qosnulldata(struct ieee80
  
  	/* map from access class/queue to 11e header priority value */
  	tid = WME_AC_TO_TID(ac);
@@ -755,7 +755,7 @@
  
  	IEEE80211_NODE_STAT(ni, tx_data);
  
-@@ -786,6 +806,8 @@
+@@ -786,6 +806,8 @@ ieee80211_encap(struct ieee80211_node *n
  		hdrsize = sizeof(struct ieee80211_frame);
  
  	SKB_CB(skb)->auth_pkt = (eh.ether_type == __constant_htons(ETHERTYPE_PAE));
@@ -764,7 +764,7 @@
  
  	switch (vap->iv_opmode) {
  	case IEEE80211_M_IBSS:
-@@ -805,20 +827,9 @@
+@@ -805,20 +827,9 @@ ieee80211_encap(struct ieee80211_node *n
  			ismulticast = IEEE80211_IS_MULTICAST(eh.ether_dhost);
  		break;
  	case IEEE80211_M_STA:
@@ -787,7 +787,7 @@
  		} else
  			ismulticast = IEEE80211_IS_MULTICAST(vap->iv_bssid);
  		break;
-@@ -1689,9 +1700,7 @@
+@@ -1689,9 +1700,7 @@ ieee80211_send_probereq(struct ieee80211
  
  	SKB_CB(skb)->ni = ieee80211_ref_node(ni);
  
@@ -800,7 +800,7 @@
  	/* XXX power management? */
 --- a/net80211/ieee80211_linux.c
 +++ b/net80211/ieee80211_linux.c
-@@ -145,7 +145,7 @@
+@@ -145,7 +145,7 @@ ieee80211_getmgtframe(u_int8_t **frm, u_
  	struct sk_buff *skb;
  	u_int len;
  
@@ -809,7 +809,7 @@
  #ifdef IEEE80211_DEBUG_REFCNT
  	skb = ieee80211_dev_alloc_skb_debug(len + align - 1, func, line);
  #else
-@@ -161,7 +161,7 @@
+@@ -161,7 +161,7 @@ ieee80211_getmgtframe(u_int8_t **frm, u_
  		SKB_CB(skb)->flags = 0;
  		SKB_CB(skb)->next = NULL;