linux-toradex.git/drivers/net, branch v3.0.41

rt61pci: fix NULL pointer dereference in config_lna_gain

2012-08-15T19:04:30+00:00

commit deee0214def5d8a32b8112f11d9c2b1696e9c0cb upstream.

We can not pass NULL libconf->conf->channel to rt61pci_config() as it
is dereferenced unconditionally in rt61pci_config_lna_gain() subroutine.

Resolves:
https://bugzilla.kernel.org/show_bug.cgi?id=44361

Reported-and-tested-by: 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

e1000e: NIC goes up and immediately goes down

2012-08-15T19:04:30+00:00

commit b7ec70be01a87f2c85df3ae11046e74f9b67e323 upstream.

Found that commit d478eb44 was a bad commit.
If the link partner is transmitting codeword (even if NULL codeword),
then the RXCW.C bit will be set so check for RXCW.CW is unnecessary.
Ref: RH BZ 840642

Reported-by: Fabio Futigami 
Signed-off-by: Tushar Dave 
CC: Marcelo Ricardo Leitner 
Tested-by: Aaron Brown 
Signed-off-by: Peter P Waskiewicz Jr 
Signed-off-by: Greg Kroah-Hartman

net/tun: fix ioctl() based info leaks

2012-08-09T15:27:53+00:00

[ Upstream commits a117dacde0288f3ec60b6e5bcedae8fa37ee0dfc
  and 8bbb181308bc348e02bfdbebdedd4e4ec9d452ce ]

The tun module leaks up to 36 bytes of memory by not fully initializing
a structure located on the stack that gets copied to user memory by the
TUNGETIFF and SIOCGIFHWADDR ioctl()s.

Signed-off-by: Mathias Krause 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

USB: kaweth.c: use GFP_ATOMIC under spin_lock

2012-08-09T15:27:52+00:00

[ Upstream commit e4c7f259c5be99dcfc3d98f913590663b0305bf8 ]

The problem is that we call this with a spin lock held.  The call tree
is:
	kaweth_start_xmit() holds kaweth->device_lock.
	-> kaweth_async_set_rx_mode()
	   -> kaweth_control()
	      -> kaweth_internal_control_msg()

The kaweth_internal_control_msg() function is only called from
kaweth_control() which used GFP_ATOMIC for its allocations.

Signed-off-by: Dan Carpenter 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

caif: fix NULL pointer check

2012-08-09T15:27:52+00:00

[ Upstream commit c66b9b7d365444b433307ebb18734757cb668a02 ]

Reported-by: 
Resolves-bug: http://bugzilla.kernel.org/show_bug?44441
Signed-off-by: Alan Cox 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bnx2: Fix bug in bnx2_free_tx_skbs().

2012-08-09T15:27:51+00:00

[ Upstream commit c1f5163de417dab01fa9daaf09a74bbb19303f3c ]

In rare cases, bnx2x_free_tx_skbs() can unmap the wrong DMA address
when it gets to the last entry of the tx ring.  We were not using
the proper macro to skip the last entry when advancing the tx index.

Reported-by: Zongyun Lai 
Reviewed-by: Jeffrey Huang 
Signed-off-by: Michael Chan 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

e1000e: Correct link check logic for 82571 serdes

2012-07-19T15:58:21+00:00

commit d0efa8f23a644f7cb7d1f8e78dd9a223efa412a3 upstream.

SYNCH bit and IV bit of RXCW register are sticky. Before examining these bits,
RXCW should be read twice to filter out one-time false events and have correct
values for these bits. Incorrect values of these bits in link check logic can
cause weird link stability issues if auto-negotiation fails.

Reported-by: Dean Nelson 
Signed-off-by: Tushar Dave 
Reviewed-by: Bruce Allan 
Tested-by: Jeff Pieper 
Signed-off-by: Jeff Kirsher 
Signed-off-by: Greg Kroah-Hartman

rt2x00usb: fix indexes ordering on RX queue kick

2012-07-19T15:58:21+00:00

commit efd821182cec8c92babef6e00a95066d3252fda4 upstream.

On rt2x00_dmastart() we increase index specified by Q_INDEX and on
rt2x00_dmadone() we increase index specified by Q_INDEX_DONE. So entries
between Q_INDEX_DONE and Q_INDEX are those we currently process in the
hardware. Entries between Q_INDEX and Q_INDEX_DONE are those we can
submit to the hardware.

According to that fix rt2x00usb_kick_queue(), as we need to submit RX
entries that are not processed by the hardware. It worked before only
for empty queue, otherwise was broken.

Note that for TX queues indexes ordering are ok. We need to kick entries
that have filled skb, but was not submitted to the hardware, i.e.
started from Q_INDEX_DONE and have ENTRY_DATA_PENDING bit set.

From practical standpoint this fixes RX queue stall, usually reproducible
in AP mode, like for example reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=828824

Reported-and-tested-by: Franco Miceli 
Reported-and-tested-by: Tom Horsley 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtl8187: ->brightness_set can not sleep

2012-07-16T15:47:51+00:00

commit 0fde0a8cfd0ede7f310d6a681c8e5a7cb3e32406 upstream.

Fix:

BUG: sleeping function called from invalid context at kernel/workqueue.c:2547
in_atomic(): 1, irqs_disabled(): 0, pid: 629, name: wpa_supplicant
2 locks held by wpa_supplicant/629:
 #0:  (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x14/0x20
 #1:  (&trigger->leddev_list_lock){.+.?..}, at: [] led_trigger_event+0x21/0x80
Pid: 629, comm: wpa_supplicant Not tainted 3.3.0-0.rc3.git5.1.fc17.i686
Call Trace:
 [] __might_sleep+0x126/0x1d0
 [] wait_on_work+0x2c/0x1d0
 [] __cancel_work_timer+0x6a/0x120
 [] cancel_delayed_work_sync+0x10/0x20
 [] rtl8187_led_brightness_set+0x82/0xf0 [rtl8187]
 [] led_trigger_event+0x5c/0x80
 [] ieee80211_led_radio+0x1d/0x40 [mac80211]
 [] ieee80211_stop_device+0x13/0x230 [mac80211]

Removing _sync is ok, because if led_on work is currently running
it will be finished before led_off work start to perform, since
they are always queued on the same mac80211 local->workqueue.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=795176

Signed-off-by: Stanislaw Gruszka 
Acked-by: Larry Finger 
Acked-by: Hin-Tak Leung 
Signed-off-by: John W. Linville 
Cc: Josh Boyer 
Signed-off-by: Greg Kroah-Hartman

ipheth: add support for iPad

2012-07-16T15:47:50+00:00

commit 6de0298ec9c1edaf330b71b57346241ece8f3346 upstream.

This adds support for the iPad to the ipheth driver.
(product id = 0x129a)

Signed-off-by: Davide Gerhard 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman