mac80211: fix scan abort sanity checks

commit 6d3560d4fc9c5b9fe1a07a63926ea70512c69c32 upstream.

Since sometimes mac80211 queues up a scan request
to only act on it later, it must be allowed to
(internally) cancel a not-yet-running scan, e.g.
when the interface is taken down. This condition
was missing since we always checked only the
local->scanning variable which isn't yet set in
that situation.

Reported-by: Luis R. Rodriguez <mcgrof@gmail.com>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 71e10cabf811f6a8825faea8b0ea72472625bafb..736537fc03dd22fab81e5c1de9fe4c7e1dc89956 100644 (file)
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -264,10 +264,14 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 
        mutex_lock(&local->scan_mtx);
 
-       if (WARN_ON(!local->scanning)) {
-               mutex_unlock(&local->scan_mtx);
-               return;
-       }
+       /*
+        * It's ok to abort a not-yet-running scan (that
+        * we have one at all will be verified by checking
+        * local->scan_req next), but not to complete it
+        * successfully.
+        */
+       if (WARN_ON(!local->scanning && !aborted))
+               aborted = true;
 
        if (WARN_ON(!local->scan_req)) {
                mutex_unlock(&local->scan_mtx);