linux-toradex.git/drivers/net, branch v2.6.27.5

bonding: fix panic when taking bond interface down before removing module

2008-11-07T03:05:55+00:00

commit ce39a800ea87c655de49af021c8b20ee323cb40d upstream.

A panic was discovered with bonding when using mode 5 or 6 and trying to
remove the slaves from the bond after the interface was taken down.
When calling 'ifconfig bond0 down' the following happens:

    bond_close()
        bond_alb_deinitialize()
            tlb_deinitialize()
		kfree(bond_info->tx_hashtbl)
                bond_info->tx_hashtbl = NULL

Unfortunately if there are still slaves in the bond, when removing the
module the following happens:

    bonding_exit()
        bond_free_all()
            bond_release_all()
                bond_alb_deinit_slave()
                    tlb_clear_slave()
                        tx_hash_table = BOND_ALB_INFO(bond).tx_hashtbl
			u32 next_index = tx_hash_table[index].next

As you might guess we panic when trying to access a few entries into the
table that no longer exists.

I experimented with several options (like moving the calls to
tlb_deinitialize somewhere else), but it really makes the most sense to
be part of the bond_close routine.  It also didn't seem logical move
tlb_clear_slave around too much, so the simplest option seems to add a
check in tlb_clear_slave to make sure we haven't already wiped the
tx_hashtbl away before searching for all the non-existent hash-table
entries that used to point to the slave as the output interface.

Signed-off-by: Andy Gospodarek 
Signed-off-by: Jay Vosburgh 
Signed-off-by: Jeff Garzik 
Signed-off-by: Greg Kroah-Hartman

libertas: fix buffer overrun

2008-11-07T03:05:40+00:00

commit 48735d8d8bd701b1e0cd3d49c21e5e385ddcb077 upstream

If somebody sends an invalid beacon/probe response, that can trash the
whole BSS descriptor. The descriptor is, luckily, large enough so that
it cannot scribble past the end of it; it's well above 400 bytes long.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

atl1: fix vlan tag regression

2008-11-07T03:05:39+00:00

commit dc5596d920b504d263c7ca38bd76326179b13dee upstream

Commit 401c0aabec4b97320f962a0161a846d230a6f7aa introduced a regression
in the atl1 driver by storing the VLAN tag in the wrong TX descriptor
field.

This patch causes the VLAN tag to be stored in its proper location.

Tested-by: Ramon Casellas 
Signed-off-by: Jay Cliburn 
Signed-off-by: Jeff Garzik 
Signed-off-by: Greg Kroah-Hartman

ath9k: fix oops on trying to hold the wrong spinlock

2008-10-22T21:21:12+00:00

commit a477e4e6d48d3ac7c7a75bad40585cb391e5c237 upstream

We were trying to hold the wrong spinlock due to a typo
on IEEE80211_BAR_CTL_TID_S's definition. We use this to
compute the tid number and then hold this this tid number's
spinlock.

Tested-by: Steven Noonan 
Signed-off-by: Vasanthakumar Thiagarajan 
Signed-off-by: Sujith 
Signed-off-by: Luis R. Rodriguez 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ath9k/mac80211: disallow fragmentation in ath9k, report to userspace

2008-10-22T21:21:05+00:00

commit 4233df6b748193d45f79fb7448991a473061a65d upstream

As I've reported, ath9k currently fails utterly when fragmentation
is enabled. This makes ath9k "support" hardware fragmentation by
not supporting fragmentation at all to avoid the double-free issue.
The patch also changes mac80211 to report errors from the driver
operation to userspace.

That hack in ath9k should be removed once the rate control algorithm
it has is fixed, and we can at that time consider removing the hw
fragmentation support entirely since it's not used by any driver.

Signed-off-by: Johannes Berg 
Acked-by: Luis R. Rodriguez 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

netdrvr: atl1e: Don't take the mdio_lock in atl1e_probe

2008-10-18T17:49:13+00:00

commit f382a0a8e9403c6d7f8b2cfa21e41fefb5d0c9bd upstream

Lockdep warns about the mdio_lock taken with interrupts enabled then later
taken from interrupt context.  Initially, I considered changing these
to spin_lock_irq/spin_unlock_irq, but then I looked at atl1e_phy_init()
and saw that it calls msleep().  Sleeping while holding a spinlock is
not allowed either.

In the probe path, we haven't registered the interrupt handler, so
it can't poke at this card yet.  It's before we call register_netdev(),
so I don't think any other threads can reach this card either.  If I'm
right, we don't need a spinlock at all.

Signed-off-by: Matthew Wilcox 
Cc: Jay Cliburn 
Signed-off-by: Jeff Garzik 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

sky2: Fix WOL regression

2008-10-18T17:49:13+00:00

commit 9d731d77c9794bb0a264f58d35949a1ab6dcc41c upstream

Since dev->power.should_wakeup bit is used by the PCI core to
decide whether the device should wake up the system from sleep
states, set/unset this bit whenever WOL is enabled/disabled using
sky2_set_wol().

Remove an open-coded reference to the standard PCI PM registers that
is not used any more.

Signed-off-by: Rafael J. Wysocki 
Cc: Tino Keitel 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

b43legacy: Fix failure in rate-adjustment mechanism

2008-10-18T17:49:12+00:00

commit c6a2afdacccd56cc0be8e9a7977f0ed1509069f6 upstream
Date: Sat, 6 Sep 2008 16:51:22 -0500
Subject: b43legacy: Fix failure in rate-adjustment mechanism

A coding error present since b43legacy was incorporated into the
kernel has prevented the driver from using the rate-setting mechanism
of mac80211. The driver has been forced to remain at a 1 Mb/s rate.

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

libertas: clear current command on card removal

2008-10-18T17:49:12+00:00

commit 71b35f3abeb8f7f7e0afd7573424540cc5aae2d5 upstream

If certain commands were in-flight when the card was pulled or the
driver rmmod-ed, cleanup would block on the work queue stopping, but the
work queue was in turn blocked on the current command being canceled,
which didn't happen.  Fix that.

Signed-off-by: Dan Williams 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

e1000e: Fix incorrect debug warning

2008-10-03T16:18:17+00:00

Doing 'WARN_ON(preempt_count())' was horribly horribly wrong, and would
cause tons of warnings at bootup if PREEMPT was enabled because the
initcalls currently run with the kernel lock, which increments the
preempt count.

At the same time, the warning was also insufficient, since it didn't
check that interrupts were enabled.

The proper debug function to use for something that can sleep and wants
a warning if it's called in the wrong context is 'might_sleep()'.

Reported-by: Christian Borntraeger 
Signed-off-by: Linus Torvalds