linux-toradex.git/drivers/net/wireless, branch v2.6.27.54

ath9k_hw: fix parsing of HT40 5 GHz CTLs

2010-09-20T20:03:20+00:00

commit 904879748d7439a6dabdc6be9aad983e216b027d upstream.

The 5 GHz CTL indexes were not being read for all hardware
devices due to the masking out through the CTL_MODE_M mask
being one bit too short. Without this the calibrated regulatory
maximum values were not being picked up when devices operate
on 5 GHz in HT40 mode. The final output power used for Atheros
devices is the minimum between the calibrated CTL values and
what CRDA provides.

Signed-off-by: Luis R. Rodriguez 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

hostap: Protect against initialization interrupt

2010-08-02T17:18:50+00:00

commit d6a574ff6bfb842bdb98065da053881ff527be46 upstream.

Use an irq spinlock to hold off the IRQ handler until
enough early card init is complete such that the handler
can run without faulting.

Signed-off-by: Tim Gardner 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

Libertas: fix buffer overflow in lbs_get_essid()

2010-01-06T23:17:07+00:00

commit 45b241689179a6065384260242637cf21dabfb2d upstream.

The libertas driver copies the SSID buffer back to the wireless core and
appends a trailing NULL character for termination. This is

a) unnecessary because the buffer is allocated with kzalloc and is hence
   already NULLed when this function is called, and

b) for priv->curbssparams.ssid_len == 32, it writes back one byte too
   much which causes memory corruptions.

Fix this by removing the extra write.

Signed-off-by: Daniel Mack 
Cc: Stephen Hemminger 
Cc: Maithili Hinge 
Cc: Kiran Divekar 
Cc: Michael Hirsch 
Cc: netdev@vger.kernel.org
Cc: libertas-dev@lists.infradead.org
Cc: linux-wireless@lists.infradead.org
Acked-by: Holger Schurig 
Acked-by: Dan Williams 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ray_cs: Fix copy_from_user handling

2009-11-10T00:52:15+00:00

commit 575c9ed7798218dc923f319c0d78f0c25ca506b9 upstream.

I've not touched the other stuff here but the word "locking" comes to mind.

Signed-off-by: Alan Cox 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

libertas if_usb: Fix crash on 64-bit machines

2009-11-10T00:52:10+00:00

commit e9024a059f2c17fb2bfab212ee9d31511d7b8e57 upstream.

On a 64-bit kernel, skb->tail is an offset, not a pointer. The libertas
usb driver passes it to usb_fill_bulk_urb() anyway, causing interesting
crashes. Fix that by using skb->data instead.

This highlights a problem with usb_fill_bulk_urb(). It doesn't notice
when dma_map_single() fails and return the error to its caller as it
should. In fact it _can't_ currently return the error, since it returns
void.

So this problem was showing up only at unmap time, after we'd already
suffered memory corruption by doing DMA to a bogus address.

Signed-off-by: David Woodhouse 
Acked-by: David S. Miller 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

b43: Fix Bugzilla #14181 and the bug from the previous 'fix'

2009-11-10T00:51:53+00:00

commit d50bae33d1358b909ade05ae121d83d3a60ab63f upstream.

"b43: Fix PPC crash in rfkill polling on unload" fixed the bug reported
in Bugzilla No. 14181; however, it introduced a new bug. Whenever the
radio switch was turned off, it was necessary to unload and reload
the driver for it to recognize the switch again.

This patch fixes both the original bug in #14181 and the bug introduced by
the previous patch. It must be stated, however, that if there is a BCM4306/3
with an rfkill switch (not yet proven), then the driver will need an
unload/reload cycle to turn the device back on.

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

p54usb: add Zcomax XG-705A usbid

2009-10-05T15:11:41+00:00

commit f7f71173ea69d4dabf166533beffa9294090b7ef upstream.

This patch adds a new usbid for Zcomax XG-705A to the device table.

Reported-by: Jari Jaakola 
Signed-off-by: Christian Lamparter 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

NET: Fix locking issues in PPP, 6pack, mkiss and strip line disciplines.

2009-07-30T23:06:15+00:00

[ Upstream commit adeab1afb7de89555c69aab5ca21300c14af6369 ]

Guido Trentalancia reports:

I am trying to use the kiss driver in the Linux kernel that is being
shipped with Fedora 10 but unfortunately I get the following oops:

mkiss: AX.25 Multikiss, Hans Albas PE1AYX
mkiss: ax0: crc mode is auto.
ADDRCONF(NETDEV_CHANGE): ax0: link becomes ready
------------[ cut here ]------------
WARNING: at kernel/softirq.c:77 __local_bh_disable+0x2f/0x83() (Not
tainted)
[...]
unloaded: microcode]
Pid: 0, comm: swapper Not tainted 2.6.27.25-170.2.72.fc10.i686 #1
 [] warn_on_slowpath+0x65/0x8b
 [] ? _spin_unlock_irqrestore+0x22/0x38
 [] ? __enqueue_entity+0xe3/0xeb
 [] ? enqueue_entity+0x203/0x20b
 [] ? enqueue_task_fair+0x3b/0x3f
 [] ? resched_task+0x3a/0x6e
 [] ? _spin_unlock_irqrestore+0x22/0x38
 [] ? _spin_lock_bh+0xb/0x16
 [] __local_bh_disable+0x2f/0x83
 [] local_bh_disable+0xb/0xd
 [] _spin_lock_bh+0xb/0x16
 [] mkiss_receive_buf+0x2fb/0x3a6 [mkiss]
 [] flush_to_ldisc+0xf7/0x198
 [] tty_flip_buffer_push+0x41/0x51
 [] ftdi_process_read+0x375/0x4ad [ftdi_sio]
 [] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio]
 [] usb_hcd_giveback_urb+0x63/0x93
 [] uhci_giveback_urb+0xe5/0x15f
 [] uhci_scan_schedule+0x52e/0x767
 [] ? psmouse_handle_byte+0xc/0xe5
 [] ? acpi_ev_gpe_detect+0xd6/0xe1
 [] uhci_irq+0x110/0x125
 [] usb_hcd_irq+0x40/0xa3
 [] handle_IRQ_event+0x2f/0x64
 [] handle_level_irq+0x74/0xbe
 [] ? handle_level_irq+0x0/0xbe
 [] do_IRQ+0xc7/0xfe
 [] common_interrupt+0x28/0x30
 [] ? acpi_idle_enter_simple+0x162/0x19d
 [] cpuidle_idle_call+0x60/0x92
 [] cpu_idle+0x101/0x134
 [] rest_init+0x4e/0x50
 =======================
---[ end trace b7cc8076093467ad ]---
------------[ cut here ]------------
WARNING: at kernel/softirq.c:136 _local_bh_enable_ip+0x3d/0xc4()
[...]
Pid: 0, comm: swapper Tainted: G        W 2.6.27.25-170.2.72.fc10.i686
 [] warn_on_slowpath+0x65/0x8b
 [] ? _spin_unlock_irqrestore+0x22/0x38
 [] ? __enqueue_entity+0xe3/0xeb
 [] ? enqueue_entity+0x203/0x20b
 [] ? enqueue_task_fair+0x3b/0x3f
 [] ? resched_task+0x3a/0x6e
 [] ? _spin_unlock_irqrestore+0x22/0x38
 [] ? _spin_lock_bh+0xb/0x16
 [] ? mkiss_receive_buf+0x33d/0x3a6 [mkiss]
 [] _local_bh_enable_ip+0x3d/0xc4
 [] local_bh_enable_ip+0x8/0xa
 [] _spin_unlock_bh+0x11/0x13
 [] mkiss_receive_buf+0x33d/0x3a6 [mkiss]
 [] flush_to_ldisc+0xf7/0x198
 [] tty_flip_buffer_push+0x41/0x51
 [] ftdi_process_read+0x375/0x4ad [ftdi_sio]
 [] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio]
 [] usb_hcd_giveback_urb+0x63/0x93
 [] uhci_giveback_urb+0xe5/0x15f
 [] uhci_scan_schedule+0x52e/0x767
 [] ? psmouse_handle_byte+0xc/0xe5
 [] ? acpi_ev_gpe_detect+0xd6/0xe1
 [] uhci_irq+0x110/0x125
 [] usb_hcd_irq+0x40/0xa3
 [] handle_IRQ_event+0x2f/0x64
 [] handle_level_irq+0x74/0xbe
 [] ? handle_level_irq+0x0/0xbe
 [] do_IRQ+0xc7/0xfe
 [] common_interrupt+0x28/0x30
 [] ? acpi_idle_enter_simple+0x162/0x19d
 [] cpuidle_idle_call+0x60/0x92
 [] cpu_idle+0x101/0x134
 [] rest_init+0x4e/0x50
 =======================
---[ end trace b7cc8076093467ad ]---
mkiss: ax0: Trying crc-smack
mkiss: ax0: Trying crc-flexnet

The issue was, that the locking code in mkiss was assuming it was only
ever being called in process or bh context.  Fixed by converting the
involved locking code to use irq-safe locks.

Review of other networking line disciplines shows that 6pack, both sync
and async PPP and STRIP have similar issues.  The ppp_async one is the
most interesting one as it sorts out half of the issue as far back as
2004 in commit http://git.kernel.org/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=2996d8deaeddd01820691a872550dc0cfba0c37d

Signed-off-by: Ralf Baechle 
Reported-by: Guido Trentalancia 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

rndis_wlan: fix initialization order for workqueue&workers

2009-05-08T21:54:36+00:00

commit e805e4d0b53506dff4255a2792483f094e7fcd2c upstream.

rndis_wext_link_change() might be called from rndis_command() at
initialization stage and priv->workqueue/priv->work have not been
initialized yet. This causes invalid opcode at rndis_wext_bind on
some brands of bcm4320.

Fix by initializing workqueue/workers in rndis_wext_bind() before
rndis_command is used.

This bug has existed since 2.6.25, reported at:
	http://bugzilla.kernel.org/show_bug.cgi?id=12794

Signed-off-by: Jussi Kivilinna 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

b43: Refresh RX poison on buffer recycling

2009-05-08T21:54:34+00:00

upstream commit: cf68636a9773aa97915497fe54fa4a51e3f08f3a

The RX buffer poison needs to be refreshed, if we recycle an RX buffer,
because it might be (partially) overwritten by some DMA operations.

Cc: stable@kernel.org
Cc: Francesco Gringoli 
Signed-off-by: Michael Buesch 
Signed-off-by: John W. Linville 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman