aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2009-11-10rtl8187: Fix sparse warningsLarry Finger
Due to a missing header include, sparse generates the following warnings: CHECK drivers/net/wireless/rtl818x/rtl8187_rfkill.c warning: symbol 'rtl8187_rfkill_init' was not declared. Should it be static? warning: symbol 'rtl8187_rfkill_poll' was not declared. Should it be static? warning: symbol 'rtl8187_rfkill_exit' was not declared. Should it be static? Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-10ath5k: add LED definition for BenQ Joybook R55vBob Copeland
Setup the GPIOs for the BenQ Joybook netbook. Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-10ath5k: add LED support for HP Compaq CQ60Bob Copeland
Add GPIO configuration for the Compaq CQ60 laptop Reported-by: David Dreggors <ddreggors@jumptv.com> Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-10ath5k: don't reset mcast filter when configuring the modeBob Copeland
We should not zero out the multicast hash when configuring the operating mode, since a zero value means all multicast frames will get dropped. Also, ath5k_mode_setup() gets called after any reset, so the hash already set up in configure_filter() is lost. Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-10rt2x00: update MAINTAINERSIvo van Doorn
Although I have always been the active maintainer of the rt2x00 drivers, I was not mentioned explicitely in the MAINTAINERS file as such. Update the rt2x00 entry in the MAINTAINERS file to add my name and email address. Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-10b43: work around a locking issue in ->set_tim()Felix Fietkau
ops->set_tim() must be atomic, so b43 trying to acquire a mutex leads to a kernel crash. This patch trades an easy to trigger crash in AP mode for an unlikely race condition. According to Michael, the real fix would be to allow set_tim() to sleep, since b43 is not the only driver that needs to sleep in all callbacks. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-10ssb-pcmcia: Fix 32bit register access in early bus scanningMartin Fuzzey
The scan function was using 32 bit access which does not work on 16bit CF cards. This patch corrects this by doing two 16 bit reads like ssb_pcmcia_read32 already does. mb -- Removed locking. That early in init there's no need for locking. Signed-off-by: Martin Fuzzey <mfuzzey@gmail.com> Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-08net/fsl_pq_mdio: add module license GPLSebastian Siewior
or it will taint the kernel and fail to load becuase of_address_to_resource() is GPL only. Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-08can: fix WARN_ON dump in net/core/rtnetlink.c:rtmsg_ifinfo()Wolfgang Grandegger
On older kernels, e.g. 2.6.27, a WARN_ON dump in rtmsg_ifinfo() is thrown when the CAN device is registered due to insufficient skb space, as reported by various users. This patch adds the rtnl_link_ops "get_size" to fix the problem. I think this patch is required for more recent kernels as well, even if no WARN_ON dumps are triggered. Maybe we also need "get_xstats_size" for the CAN xstats. Signed-off-by: Wolfgang Grandegger <wg@grandegger.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-08can: should not use __dev_get_by_index() without locksEric Dumazet
bcm_proc_getifname() is called with RTNL and dev_base_lock not held. It calls __dev_get_by_index() without locks, and this is illegal (might crash) Close the race by holding dev_base_lock and copying dev->name in the protected section. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Oliver Hartkopp <oliver@hartkopp.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06hisax: remove bad udelay call to fix build error on ARMMartin Michlmayr
The hisax ISDN driver fails to build on ARM with CONFIG_HISAX_ELSA: | drivers/built-in.o: In function `modem_set_dial': | drivers/isdn/hisax/elsa_ser.c:535: undefined reference to `__bad_udelay' | drivers/isdn/hisax/elsa_ser.c:544: undefined reference to `__bad_udelay' | drivers/built-in.o: In function `modem_set_init': | drivers/isdn/hisax/elsa_ser.c:486: undefined reference to `__bad_udelay' | [...] According to the comment in arch/arm/include/asm/delay.h, __bad_udelay is specifically designed on ARM to produce a build failure when udelay is called with a value > 2000. Signed-off-by: Martin Michlmayr <tbm@cyrius.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06ipip: Fix handling of DF packets when pmtudisc is OFFHerbert Xu
RFC 2003 requires the outer header to have DF set if DF is set on the inner header, even when PMTU discovery is off for the tunnel. Our implementation does exactly that. For this to work properly the IPIP gateway also needs to engate in PMTU when the inner DF bit is set. As otherwise the original host would not be able to carry out its PMTU successfully since part of the path is only visible to the gateway. Unfortunately when the tunnel PMTU discovery setting is off, we do not collect the necessary soft state, resulting in blackholes when the original host tries to perform PMTU discovery. This problem is not reproducible on the IPIP gateway itself as the inner packet usually has skb->local_df set. This is not correctly cleared (an unrelated bug) when the packet passes through the tunnel, which allows fragmentation to occur. For hosts behind the IPIP gateway it is readily visible with a simple ping. This patch fixes the problem by performing PMTU discovery for all packets with the inner DF bit set, regardless of the PMTU discovery setting on the tunnel itself. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06qlge: Set PCIe reset type for EEH to fundamental.Ron Mercer
This device requires a fundamental reset when recovering from EEH. Signed-off-by: Ron Mercer <ron.mercer@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06qlge: Fix early exit from mbox cmd complete wait.Ron Mercer
This line was accidentally left out of the previous commit # da03945140a035a2962f7f93e359085596f20499 ("qlge: Fix firmware mailbox command timeout."). Signed-off-by: Ron Mercer <ron.mercer@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06ixgbe: fix traffic hangs on Tx with ioatdma loadedDon Skidmore
When ioatdma was loaded we we were unable to transmit traffic. We weren't using the correct registers in ixgbe_update_tx_dca for 82599 systems. Likewise in ixgbe_configure_tx() we weren't disabling the arbiter before modifying MTQC. Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com> Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06ixgbe: Fix checking TFCS register for TXOFF status when DCB is enabledYi Zou
When DCB is enabled, the ixgbe_check_tx_hang() should check the corresponding TC's TXOFF in TFCS based on the TC that the tx ring belongs to. Adds a function to map from the tx_ring hw reg_idx to the correspodning TC and read TFCS accordingly. Signed-off-by: Yi Zou <yi.zou@intel.com> Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06ixgbe: Fix gso_max_size for 82599 when DCB is enabledYi Zou
The 32k gso_max_size when DCB is enabled is for 82598 only, not for 82599. Signed-off-by: Yi Zou <yi.zou@intel.com> Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06macsonic: fix crash on PowerBook 520Finn Thain
No-one seems to know where the PowerBook 500 series store their ethernet MAC addresses. So, rather than crash, use a MAC address from the SONIC CAM. Failing that, generate a random one. Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06NET: cassini, fix lock imbalanceJiri Slaby
Stanse found that one error path in cas_open omits to unlock pm_mutex. Fix that. Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06ems_usb: Fix byte order issues on big endian machinesSebastian Haas
CPC-USB is using a ARM7 core with little endian byte order. The "id" field in can_msg needs byte order conversion from/to CPU byte order. Signed-off-by: Sebastian Haas <haas@ems-wuensche.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06be2net: Bug fix to send config commands to hardware after netdev_registerAjit Khaparde
Sending config commands to be2 hardware before netdev_register is completed, is sometimes causing the async link notification to arrive even before the driver is ready to handle it. The commands for vlan config and flow control settings can infact wait till be_open. This patch takes care of that. Signed-off-by: Ajit Khaparde <ajitk@serverengines.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06be2net: fix to set proper flow control on resumeAjit Khaparde
If be2 goes into suspend after a user changes the flow control settings, we are not programming them back after resume. This patch takes care of it. We now get the flow control settings before going to suspend mode and then apply them during resume. Signed-off-by: Ajit Khaparde <ajitk@serverengines.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2009-11-06netfilter: xt_connlimit: fix regression caused by zero family valueJan Engelhardt
Commit v2.6.28-rc1~717^2~109^2~2 was slightly incomplete; not all instances of par->match->family were changed to par->family. References: http://bugzilla.netfilter.org/show_bug.cgi?id=610 Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06rt2x00: Don't queue ieee80211 work after USB removalSean Cross
This prevents the rt2x00 driver from queueing ieee80211 work after the   USB card has been removed, preventing a kernel panic. Signed-off-by: Sean Cross <sean@chumby.com> Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-06Revert "ipw2200: fix oops on missing firmware"John W. Linville
This reverts commit e6c5fc53d0f44a772398402ee8a1879818e42b4e. Based on this regression report: Date: Thu, 05 Nov 2009 15:59:16 +0100 From: Holger Schurig <holgerschurig@gmail.com> To: linux-wireless@vger.kernel.org Subject: BUG: oops when "rmmod ipw2200" This happened on wireless-testing v2.6.32-rc6-41575-g5e68bfb. I modprobed ipw2200, put it into monitor mode, used tshark a while to monitor, then I stopped tshark, "ifconfig eth2 down" and finally "rmmod ipw2200", and voila: [ 917.189620] ------------[ cut here ]------------ [ 917.189717] kernel BUG at net/wireless/core.c:543! [ 917.189805] invalid opcode: 0000 [#1] PREEMPT SMP [ 917.190002] last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:02:0d.0/firmware/0000:02:0d.0/loading [ 917.190136] Modules linked in: lib80211_crypt_wep ipw2200(-) libipw lib80211 ath5k mac80211 ath cfg80211 psmouse uhci_hcd [ 917.190680] [ 917.190759] Pid: 1763, comm: rmmod Not tainted (2.6.32-rc6-wl #26) Amilo M1425 [ 917.190886] EIP: 0060:[<f8accf34>] EFLAGS: 00010202 CPU: 0 [ 917.190992] EIP is at wiphy_unregister+0xd3/0x175 [cfg80211] [ 917.191083] EAX: f601d4c4 EBX: 00000000 ECX: 00000000 EDX: f79e8600 [ 917.191176] ESI: f601d400 EDI: f95b4350 EBP: f6009eb4 ESP: f6009e8c [ 917.191269] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 [ 917.191360] Process rmmod (pid: 1763, ti=f6008000 task=f79e8130 task.ti=f6008000) [ 917.191486] Stack: [ 917.191562] f601d5a0 f601d484 f6460e98 f6009ea0 c01407ee f6009eb8 00000246 f64604c0 [ 917.191916] <0> f6460e5c f95b4350 f6009ec0 f94fd030 f6460e98 f6009edc f95a9d4f f787bc00 [ 917.192100] <0> f787bc58 f787bc00 f95b4350 f95b4350 f6009ee8 c0207fca f787bc58 f6009ef8 [ 917.192100] Call Trace: [ 917.192100] [<c01407ee>] ? trace_hardirqs_on+0xb/0xd [ 917.192100] [<f94fd030>] ? unregister_ieee80211+0xe/0x27 [libipw] [ 917.192100] [<f95a9d4f>] ? ipw_pci_remove+0x59/0x227 [ipw2200] [ 917.192100] [<c0207fca>] ? pci_device_remove+0x19/0x39 [ 917.192100] [<c02b93a4>] ? __device_release_driver+0x59/0x9d [ 917.192100] [<c02b944f>] ? driver_detach+0x67/0x85 [ 917.192100] [<c02b88d6>] ? bus_remove_driver+0x69/0x85 [ 917.192100] [<c02b9878>] ? driver_unregister+0x4d/0x54 [ 917.192100] [<c02081c3>] ? pci_unregister_driver+0x28/0x71 [ 917.192100] [<f95a9cf4>] ? ipw_exit+0x1c/0x1e [ipw2200] [ 917.192100] [<c0148e2b>] ? sys_delete_module+0x192/0x1ef [ 917.192100] [<c0162cdb>] ? remove_vma+0x52/0x58 [ 917.192100] [<c01028bb>] ? sysenter_exit+0xf/0x18 [ 917.192100] [<c0102888>] ? sysenter_do_call+0x12/0x36 [ 917.192100] Code: 74 07 e8 81 bc 8c c7 eb c8 8d 55 e0 89 f8 e8 d6 6d 66 c7 8b 45 dc 31 d2 e8 81 cc 8c c7 8d 86 c4 00 00 00 39 86 c4 00 00 00 74 04 <0f> 0b eb fe 8b 45 dc 8d 5e 0c e8 5a cc 8c c7 8b 86 94 03 00 00 [ 917.192100] EIP: [<f8accf34>] wiphy_unregister+0xd3/0x175 [cfg80211] SS:ESP 0068:f6009e8c [ 917.203718] ---[ end trace bcaaf449945a5100 ]--- Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-06decnet: netdevice refcount leakEric Dumazet
While working on device refcount stuff, I found a device refcount leak through DECNET. This nasty bug can be used to hold refcounts on any !DECNET netdevice. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06netfilter: nf_nat: fix NAT issue in 2.6.30.4+Jozsef Kadlecsik
Vitezslav Samel discovered that since 2.6.30.4+ active FTP can not work over NAT. The "cause" of the problem was a fix of unacknowledged data detection with NAT (commit a3a9f79e361e864f0e9d75ebe2a0cb43d17c4272). However, actually, that fix uncovered a long standing bug in TCP conntrack: when NAT was enabled, we simply updated the max of the right edge of the segments we have seen (td_end), by the offset NAT produced with changing IP/port in the data. However, we did not update the other parameter (td_maxend) which is affected by the NAT offset. Thus that could drift away from the correct value and thus resulted breaking active FTP. The patch below fixes the issue by *not* updating the conntrack parameters from NAT, but instead taking into account the NAT offsets in conntrack in a consistent way. (Updating from NAT would be more harder and expensive because it'd need to re-calculate parameters we already calculated in conntrack.) Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06be2net: Fix CQE_STATUS_EXTD_SHIFT defineSathya Perla
Signed-off-by: Sathya Perla <sathyap@serverengines.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-05rose: device refcount leakEric Dumazet
While hunting dev_put() for net-next-2.6, I found a device refcount leak in ROSE, ioctl(SIOCADDRT) error path. Fix is to not touch device refcount, as we hold RTNL Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-05bridge: prevent bridging wrong deviceStephen Hemminger
The bridge code assumes ethernet addressing, so be more strict in the what is allowed. This showed up when GRE had a bug and was not using correct address format. Add some more comments for increased clarity. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-05virtio_net: rename driver struct to please modpostUwe Kleine-König
Commit 3d1285b (move virtnet_remove to .devexit.text) introduced the first reference to __devexit in struct virtio_driver virtio_net which upset modpost ("Section mismatch in reference from the variable virtio_net to the function .devexit.text:virtnet_remove()"). Fix this by renaming virtio_net to virtio_net_driver. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reported-by: Michael S. Tsirkin <mst@redhat.com> Blame-taken-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-04rtl8187: Fix kernel oops when device is removed when LEDS enabledLarry Finger
As reported by Rick Farina (sidhayn@gmail.com), removing the RTL8187 USB stick, or unloading the driver rtl8187 using rmmod will cause a kernel oops. There are at least two forms of the failure, (1) BUG: Scheduling while atomic, and (2) a fatal kernel page fault. This problem is reported in Bugzilla #14539. This problem does not occur for kernel 2.6.31, but does for 2.6.32-rc2, thus it is technically a regression; however, bisection did not locate any faulty patch. The fix was found by comparing the faulty code in rtl8187 with p54usb. My interpretation is that the handling of work queues in mac80211 changed enough to the LEDs to be unregistered before tasks on the work queues are cancelled. Previously, these actions could be done in either order. (Herton Ronaldo Krzesinski <herton@mandriva.com.br> reports that the code is the same in 2.6.31, so this may be a candidate for 2.6.31.x. -- JWL) Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Reported-by: Rick Farina <sidhayn@gmail.com> Tested-by: Rick Farina <sidhayn@gmail.com> Cc: stable@kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-04MAINTAINERS: Add git net-next-2.6Joe Perches
Add a reference to the the git tree where most of the forward going network development occurs. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-04isdn: hfc_usb: Fix read buffer overflowRoel Kluin
Check whether index is within bounds before testing the element. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Cc: Karsten Keil <isdn@linux-pingi.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-04isdn: hisax: Fix test in waitforxfwRoel Kluin
The negation makes it a bool before the comparison and hence it will never be 0x40. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Cc: Karsten Keil <isdn@linux-pingi.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-04isdn: eicon: Return on errorJiri Slaby
When diva_strace_read_uint returns an error, return even from process_idi_event, because l2_state is uninitialized. Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Cc: Karsten Keil <isdn@linux-pingi.de> Acked-by: Armin Schindler <armin@melware.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-04isdn: eicon: Use offsetofJiri Slaby
Use offsetof instead of explicit implementation. * fixes bug with omitted & like: len = (byte)(((T30_INFO *) 0)->station_id + 20) * avoids compiler warnings with wrong sizes (pointer-to-char cast): len = (byte)(&(((T30_INFO *) 0)->universal_6)); * cleans up the code Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Cc: Karsten Keil <isdn@linux-pingi.de> Acked-by: Armin Schindler <armin@melware.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-04misdn: Fix reversed 'if' in st_own_ctrlDan Carpenter
The current code probably returns -EINVAL a lot. Otherwise it would oops. Compile tested only. Found by smatch (http://repo.or.cz/w/smatch.git). Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: Karsten Keil <isdn@linux-pingi.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-04isdn: hisax: Fix lock imbalance.Jiri Slaby
Add omittted unlocks to 2 functions. Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Cc: Karsten Keil <Karsten-Keil@t-online.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-04DaVinci EMAC: correct param for ISRTonyliu
emac_irq is declared as: static irqreturn_t emac_irq(int irq, void *dev_id) { struct net_device *ndev = (struct net_device *)dev_id; struct emac_priv *priv = netdev_priv(ndev); ... Clearly emac_irq() needs "struct net_device *" as "void *dev_id", so correct this. Signed-off-by: Tonyliu <Bo.Liu@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-04cdc_ether: additional Ericsson MBM PID's to the whitelistTorgny Johansson
Signed-off-by: Torgny Johansson <torgny.johansson@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-02Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2009-11-02mac80211: check interface is down before type changeJohannes Berg
For some strange reason the netif_running() check ended up after the actual type change instead of before, potentially causing all kinds of problems if the interface is up while changing the type; one of the problems manifests itself as a warning: WARNING: at net/mac80211/iface.c:651 ieee80211_teardown_sdata+0xda/0x1a0 [mac80211]() Hardware name: Aspire one Pid: 2596, comm: wpa_supplicant Tainted: G W 2.6.31-10-generic #32-Ubuntu Call Trace: [] warn_slowpath_common+0x6d/0xa0 [] warn_slowpath_null+0x15/0x20 [] ieee80211_teardown_sdata+0xda/0x1a0 [mac80211] [] ieee80211_if_change_type+0x4a/0xc0 [mac80211] [] ieee80211_change_iface+0x61/0xa0 [mac80211] [] cfg80211_wext_siwmode+0xc7/0x120 [cfg80211] [] ioctl_standard_call+0x58/0xf0 (http://www.kerneloops.org/searchweek.php?search=ieee80211_teardown_sdata) Cc: Arjan van de Ven <arjan@infradead.org> Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-02cfg80211: fix NULL ptr derefJohannes Berg
commit 211a4d12abf86fe0df4cd68fc6327cbb58f56f81 Author: Johannes Berg <johannes@sipsolutions.net> Date: Tue Oct 20 15:08:53 2009 +0900 cfg80211: sme: deauthenticate on assoc failure introduced a potential NULL pointer dereference that some people have been hitting for some reason -- the params.bssid pointer is not guaranteed to be non-NULL for what seems to be a race between various ways of reaching the same thing. While I'm trying to analyse the problem more let's first fix the crash. I think the real fix may be to avoid doing _anything_ if it ended up being NULL, but right now I'm not sure yet. I think http://bugzilla.kernel.org/show_bug.cgi?id=14342 might also be this issue. Reported-by: Parag Warudkar <parag.lkml@gmail.com> Tested-by: Parag Warudkar <parag.lkml@gmail.com> Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-10-30libertas if_usb: Fix crash on 64-bit machinesDavid Woodhouse
On a 64-bit kernel, skb->tail is an offset, not a pointer. The libertas usb driver passes it to usb_fill_bulk_urb() anyway, causing interesting crashes. Fix that by using skb->data instead. This highlights a problem with usb_fill_bulk_urb(). It doesn't notice when dma_map_single() fails and return the error to its caller as it should. In fact it _can't_ currently return the error, since it returns void. So this problem was showing up only at unmap time, after we'd already suffered memory corruption by doing DMA to a bogus address. Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Cc: stable@kernel.org Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-10-30mac80211: fix reason code output endiannessJohannes Berg
When HT debugging is enabled and we receive a DelBA frame we print out the reason code in the wrong byte order. Fix that so we don't get weird values printed. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-10-30mac80211: fix addba timerJohannes Berg
The addba timer function acquires the sta spinlock, but at the same time we try to del_timer_sync() it under the spinlock which can produce deadlocks. To fix this, always del_timer_sync() the timer in ieee80211_process_addba_resp() and add it again after checking the conditions, if necessary. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-10-30ath9k: fix misplaced semicolon on rate controlLuis R. Rodriguez
The patch e43419f9: ath9k: downgrade assert in rc.c for invalid rate downgraded an ASSERT to a WARN_ON() but also misplaced a semicolon at the end of the second check. What this did was force the rate control code to always return the rate even if we should have warned about it. Since this should not have happened anymore anyway this fix isn't critical as the proper rate would have been returned anyway. Cc: stable@kernel.org Reported-by: Jiri Slaby <jirislaby@gmail.com> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-10-30b43: Fix DMA TX bounce buffer copyingMichael Buesch
b43 allocates a bouncebuffer, if the supplied TX skb is in an invalid memory range for DMA. However, this is broken in that it fails to copy over some metadata to the new skb. This patch fixes three problems: * Failure to adjust the ieee80211_tx_info pointer to the new buffer. This results in a kmemcheck warning. * Failure to copy the skb cb, which contains ieee80211_tx_info, to the new skb. This results in breakage of various TX-status postprocessing (Rate control). * Failure to transfer the queue mapping. This results in the wrong queue being stopped on saturation and can result in queue overflow. Signed-off-by: Michael Buesch <mb@bu3sch.de> Tested-by: Christian Casteyde <casteyde.christian@free.fr> Signed-off-by: John W. Linville <linville@tuxdriver.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-28 17:58:41 +0000