linux-toradex.git/drivers/net/wireless, branch v2.6.32.41

libertas: fix cmdpendingq locking

2011-05-23T18:20:17+00:00

commit 2ae1b8b35faba31a59b153cbad07f9c15de99740 upstream.

We occasionally see list corruption using libertas.

While we haven't been able to diagnose this precisely, we have spotted
a possible cause: cmdpendingq is generally modified with driver_lock
held. However, there are a couple of points where this is not the case.

Fix up those operations to execute under the lock, it seems like
the correct thing to do and will hopefully improve the situation.

Signed-off-by: Paul Fox 
Signed-off-by: Daniel Drake 
Acked-by: Dan Williams 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: fix skb usage after free

2011-05-09T22:55:41+00:00

commit b25026981aecde3685dd0e45ad980fff9f528daa upstream.

Since

commit a120e912eb51e347f36c71b60a1d13af74d30e83
Author: Stanislaw Gruszka 
Date:   Fri Feb 19 15:47:33 2010 -0800

    iwlwifi: sanity check before counting number of tfds can be free

we use skb->data after calling ieee80211_tx_status_irqsafe(), which
could free skb instantly.

On current kernels I do not observe practical problems related with
bug, but on 2.6.35.y it cause random system hangs when stressing
wireless link.

Signed-off-by: Stanislaw Gruszka 
Acked-by: Wey-Yi Guy 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

wireless: b43: fix error path in SDIO

2011-05-09T22:55:40+00:00

commit e476a5a41ad67d0e2b4a652820c49a3923eb936b upstream.

Fix unbalanced call to sdio_release_host() on the error path.

Signed-off-by: Guennadi Liakhovetski 
Acked-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Andi Kleen 
Signed-off-by: Greg Kroah-Hartman

rt2500usb: fallback to SW encryption for TKIP+AES

2011-05-09T22:55:40+00:00

commit 75f64dd54a185150ebfc45e99351c890d4a2252f upstream.

HW crypto in rt2500usb does not seem to support keys with different ciphers,
which breaks TKIP+AES mode. Fall back to software encryption to fix it.

This should fix long-standing problems with rt2500usb and WPA, such as:
http://rt2x00.serialmonkey.com/phpBB/viewtopic.php?f=4&t=4834
https://bugzilla.redhat.com/show_bug.cgi?id=484888

Also tested that it does not break WEP, TKIP-only and AES-only modes.

Signed-off-by: Ondrej Zary 
Acked-by: Gertjan van Wingerde 
Signed-off-by: John W. Linville 
[bwh: Adjust context for 2.6.32]
Signed-off-by: Greg Kroah-Hartman

b43: Fix warning at drivers/mmc/core/core.c:237 in mmc_wait_for_cmd

2011-05-09T22:55:32+00:00

commit 9f2a0fac625bcef9c579bcf0b0c904ab1a56e7c4 upstream.

On module removal, the sdio version of b43 generates the following warning:

[  851.560519] ------------[ cut here ]------------
[  851.560531] WARNING: at drivers/mmc/core/core.c:237 mmc_wait_for_cmd+0x88/0x90()
[  851.560534] Hardware name: 20552PG
[  851.560536] Modules linked in: b43(-) ssb mmc_block binfmt_misc rfcomm sco bnep ppdev l2cap ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp kvm_intel kvm arc4 iwlagn snd_hda_codec_conexant snd_hda_intel snd_hda_codec iwlcore snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq r852 joydev snd_timer sm_common pcmcia nand snd_seq_device cfg80211 sdhci_pci btusb psmouse tpm_tis yenta_socket nand_ids lp snd pcmcia_rsrc nand_ecc bluetooth sdhci tpm pcmcia_core parport mtd snd_page_alloc serio_raw tpm_bios soundcore nvram led_class sha256_generic aes_i586 aes_generic dm_crypt i915 drm_kms_helper drm ahci intel_agp i2c_algo_bit intel_gtt e1000e libahci video agpgart output
[  851.560620] Pid: 2504, comm: rmmod Not tainted 2.6.36-titan0+ #1
[  851.560622] Call Trace:
[  851.560631]  [] warn_slowpath_common+0x72/0xa0
[  851.560636]  [] ? mmc_wait_for_cmd+0x88/0x90
[  851.560641]  [] ? mmc_wait_for_cmd+0x88/0x90
[  851.560645]  [] warn_slowpath_null+0x22/0x30
[  851.560649]  [] mmc_wait_for_cmd+0x88/0x90
[  851.560655]  [] ? device_release+0x25/0x80
[  851.560660]  [] mmc_io_rw_direct_host+0xa0/0x150
[  851.560665]  [] mmc_io_rw_direct+0x30/0x40
[  851.560669]  [] sdio_disable_func+0x37/0xa0
[  851.560683]  [] b43_sdio_remove+0x30/0x50 [b43]
[  851.560687]  [] sdio_bus_remove+0x1c/0x60
[  851.560692]  [] ? blocking_notifier_call_chain+0x1f/0x30
[  851.560697]  [] __device_release_driver+0x51/0xb0
[  851.560701]  [] driver_detach+0x8f/0xa0
[  851.560705]  [] bus_remove_driver+0x63/0xa0
[  851.560709]  [] driver_unregister+0x49/0x80
[  851.560713]  [] ? driver_unregister+0x49/0x80
[  851.560718]  [] sdio_unregister_driver+0x17/0x20
[  851.560727]  [] b43_sdio_exit+0x12/0x20 [b43]
[  851.560734]  [] b43_exit+0x17/0x3c [b43]
[  851.560740]  [] sys_delete_module+0x13d/0x200
[  851.560747]  [] ? do_munmap+0x212/0x300
[  851.560752]  [] sysenter_do_call+0x12/0x28
[  851.560757] ---[ end trace 31e14488072d2f7d ]---
[  851.560759] ------------[ cut here ]------------

The warning is caused by b43 not claiming the device before calling
sdio_disable_func().

Signed-off-by: Larry Finger 
Reported-by: Arnd Hannemann 
Tested-by: Arnd Hannemann 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Andi Kleen

rt2x00: use correct headroom for transmission

2011-05-09T22:55:24+00:00

commit b59a52f12e483b79e7d32da7ec30dcf3b2e0210b upstream.

Use rt2x00dev->ops->extra_tx_headroom, not rt2x00dev->hw->extra_tx_headroom
in the tx code, as the later may include other headroom not to be used in
the chipset driver.

Signed-off-by: Pavel Roskin 
Signed-off-by: Gertjan van Wingerde 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2x00: Properly request tx headroom for alignment operations.

2011-05-09T22:55:23+00:00

commit 7a4a77b7771164d61ce702a588067d1e1d66db7c upstream.

Current rt2x00 drivers may result in a "ieee80211_tx_status: headroom too
small" error message when a frame needs to be properly aligned before
transmitting it.
This is because the space needed to ensure proper alignment isn't
requested from mac80211.
Fix this by adding sufficient amount of alignment space to the amount
of headroom requested for TX frames.

Reported-by: David Ellingsworth 
Signed-off-by: Gertjan van Wingerde 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2x00: Centralize setting of extra TX headroom requested by rt2x00.

2011-05-09T22:55:23+00:00

commit e6218cc47bd54710dc523e8c983ceddba625e3ae upstream.

Set the value of extra_tx_headroom in a central place, rather than in each
of the drivers. This is preparatory for taking alignment space into account
in the TX headroom requested by rt2x00.

Signed-off-by: Gertjan van Wingerde 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville 
[bwh: Adjust for 2.6.32]
Signed-off-by: Greg Kroah-Hartman

iwlagn: Support new 5000 microcode.

2011-05-09T22:54:51+00:00

commit 41504cce240f791f1e16561db95728c5537fbad9 upstream.

New iwlwifi-5000 microcode requires driver support for API version 5.

Signed-off-by: Don Fry 
Signed-off-by: Wey-Yi Guy 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: Greg Kroah-Hartman

p54: Initialize extra_len in p54_tx_80211

2011-05-09T22:54:46+00:00

commit a6756da9eace8b4af73e9dea43f1fc2889224c94 upstream.

This patch fixes a very serious off-by-one bug in
the driver, which could leave the device in an
unresponsive state.

The problem was that the extra_len variable [used to
reserve extra scratch buffer space for the firmware]
was left uninitialized. Because p54_assign_address
later needs the value to reserve additional space,
the resulting frame could be to big for the small
device's memory window and everything would
immediately come to a grinding halt.

Reference: https://bugs.launchpad.net/bugs/722185

Acked-by: Christian Lamparter 
Signed-off-by: Jason Conti 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman