linux-stable.git/drivers/net/wireless/rt2x00/rt2x00dev.c, branch v3.3

rt2x00: fix random stalls

2012-03-12T18:00:17+00:00

Is possible that we stop queue and then do not wake up it again,
especially when packets are transmitted fast. That can be easily
reproduced with modified tx queue entry_num to some small value e.g. 16.

If mac80211 already hold local->queue_stop_reason_lock, then we can wait
on that lock in both rt2x00queue_pause_queue() and
rt2x00queue_unpause_queue(). After drooping ->queue_stop_reason_lock
is possible that __ieee80211_wake_queue() will be performed before
__ieee80211_stop_queue(), hence we stop queue and newer wake up it
again.

Another race condition is possible when between rt2x00queue_threshold()
check and rt2x00queue_pause_queue() we will process all pending tx
buffers on different cpu. This might happen if for example interrupt
will be triggered on cpu performing rt2x00mac_tx().

To prevent race conditions serialize pause/unpause by queue->tx_lock.

Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka 
Acked-by: Gertjan van Wingerde 
Signed-off-by: John W. Linville

rt2x00: fix a possible NULL pointer dereference

2012-02-21T19:45:25+00:00

The 'rt2x00lib_probe_dev' function tries to
allocate the workqueue. If the allocation
fails, 'rt2x00_lib_remove_dev' is called on
the error path. Because 'rt2x00dev->workqueue'
is NULL in this case, the 'destroy_workqueue'
call will cause a NULL pointer dereference.

Signed-off-by: Gabor Juhos 
Acked-by: Gertjan van Wingerde 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: Use kcalloc instead of kzalloc to allocate array

2011-12-06T21:02:51+00:00

The advantage of kcalloc is, that will prevent integer overflows which could
result from the multiplication of number of elements and size and it is also
a bit nicer to read.

The semantic patch that makes this change is available
in https://lkml.org/lkml/2011/11/25/107

Signed-off-by: Thomas Meyer 
Acked-by: Gertjan van Wingerde 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: Fix sleep-while-atomic bug in powersaving code.

2011-11-15T15:02:56+00:00

The generic powersaving code that determines after reception of a frame
whether the device should go back to sleep or whether is could stay
awake was calling rt2x00lib_config directly from RX tasklet context.
On a number of the devices this call can actually sleep, due to having
to confirm that the sleeping commands have been executed successfully.

Fix this by moving the call to rt2x00lib_config to a workqueue call.

This fixes bug https://bugzilla.redhat.com/show_bug.cgi?id=731672

Tested-by: Tomas Trnka 
Signed-off-by: Gertjan van Wingerde 
Cc: 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: Introduce sta_add/remove callbacks

2011-09-14T17:56:54+00:00

This implements a basic sta_add and sta_remove callback. Introduce a new
structure rt2x00_sta and ask mac80211 to allocate it as private part of
its ieee80211_sta. rt2x00_sta only contains the WCID for now.

The sta_add callback allows the driver to assign a WCID to a station
that is currently being added. The same wcid is also passed to the
sta_remove callback one mac80211 removes this STA.

Signed-off-by: Helmut Schaa 
Signed-off-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: Move bssidx calculation into its own function

2011-09-14T17:56:53+00:00

This will be used by a later patch. No functional changes.

Signed-off-by: Helmut Schaa 
Signed-off-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: Fix PCI interrupt processing race on SMP systems

2011-08-09T19:52:08+00:00

When toggle_irq is called for PCI devices to disable device interrupts
it used tasklet_disable to wait for a possibly running tasklet to finish.
However, on SMP systems the tasklet might still be scheduled on another CPU.
Instead, use tasklet_kill to ensure that all scheduled tasklets are finished
before returning from toggle_irq.

Furthermore, it was possible that a tasklet reenabled its interrupt even
though interrupts have been disabled already. Fix this by checking the
DEVICE_STATE_ENABLED_RADIO flag before reenabling single interrupts
during tasklet processing.

While at it also enable/kill the TBTT and PRETBTT tasklets in the
toggle_irq callback and only use tasklet_kill in stop_queue to wait
for a currently scheduled beacon update before returning.

Signed-off-by: Helmut Schaa 
Signed-off-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: fix possible memory corruption in case of invalid rxdesc.size

2011-06-22T20:09:44+00:00

Sometimes rxdesc descriptor provided by hardware contains invalid
(random) data. For example rxdesc.size can be bigger than actual
size of the buffer. When this happen rt2x00crypto_rx_insert_iv()
corrupt memory doing memmove outside of buffer boundaries.

Signed-off-by: Stanislaw Gruszka 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: fix rmmod crash

2011-06-06T19:24:18+00:00

Avoid queue and run autowakeup_work when device is not present anymore.
That prevent rmmod and device remove crash introduced by:

commit 1c0bcf89d85cc97a0d9ce4cd909351a81fa4fdde
Author: Ivo van Doorn 
Date:   Sat Apr 30 17:18:18 2011 +0200

    rt2x00: Add autowake support for USB hardware

Signed-off-by: Stanislaw Gruszka 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: Fix rmmod hang of rt2800pci

2011-05-10T19:54:48+00:00

txstatus_timer should only be deleted for USB devices, as it is only
initialized for USB devices.

Reported-by: Andreas Hartmann 
Signed-off-by: Gertjan van Wingerde 
Signed-off-by: Ivo van Doorn 
Signed-off-by: John W. Linville