linux-stable.git/drivers/net/wireless/rt2x00, branch linux-3.5.y

rt2800usb: Added rx packet length validity check

2012-10-02T17:39:37+00:00

commit efd5d6b03bd9c9e0df646c56fb5f4f3e25e5c1ac upstream.

On our system (ARM Cortex-M3 SOC running linux-2.6.33)
frequent crashes were observed in the rt2800usb module
because of the invalid length of the received packet (3392,
46920...). This patch adds the sanity check on the packet
legth. Also, changed WARNING to ERROR in rt2x00lib_rxdone()
so that the bad packet condition would be noticed.

The fix was tested on the latest compat-wireless-3.5.1-1-snpc.

Signed-off-by: Sergei Poselenov 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2x00: Fix rfkill polling prior to interface start.

2012-10-02T17:39:27+00:00

commit a396e10019eaf3809b0219c966865aaafec12630 upstream.

We need to program the rfkill switch GPIO pin direction to input at
device initialization time, not only when the interface is brought up.
Doing this only when the interface is brought up could lead to rfkill
detecting the switch is turned on erroneously and inability to create
the interface and bringing it up.

Reported-and-tested-by: Andreas Messer 
Signed-off-by: Gertjan van Wingerde 
Acked-by: Ivo Van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2x00: Fix word size of rt2500usb MAC_CSR19 register.

2012-10-02T17:39:26+00:00

commit 6ced58a5dbb94dbfbea1b33ca3c56d1e929cd548 upstream.

The register is 16 bits wide, not 32.

Signed-off-by: Gertjan van Wingerde 
Acked-by: Ivo Van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2x00: Identify ASUS USB-N53 device.

2012-10-02T17:39:26+00:00

commit 177ef8360fabdc49ff08d2598c06e7f7a36b53e3 upstream.

This is an RT3572 based device.

Signed-off-by: Maximilian Engelhardt 
Signed-off-by: Gertjan van Wingerde 
Acked-by: Ivo Van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2x00: Add support for BUFFALO WLI-UC-GNM2 to rt2800usb.

2012-08-26T02:31:44+00:00

commit a769f9577232afe2c754606a83aad85127e7052a upstream.

This is a RT3070 based device.

Signed-off-by: Jeongdo Son 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt61pci: fix NULL pointer dereference in config_lna_gain

2012-08-15T14:53:04+00:00

commit deee0214def5d8a32b8112f11d9c2b1696e9c0cb upstream.

We can not pass NULL libconf->conf->channel to rt61pci_config() as it
is dereferenced unconditionally in rt61pci_config_lna_gain() subroutine.

Resolves:
https://bugzilla.kernel.org/show_bug.cgi?id=44361

Reported-and-tested-by: 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2800usb: 2001:3c17 is an RT3370 device

2012-08-09T15:22:37+00:00

commit 8fd9d059af12786341dec5a688e607bcdb372238 upstream.

D-Link DWA-123 rev A1

Signed-off-by: Albert Pool
Acked-by: Gertjan van Wingerde 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2x00usb: fix indexes ordering on RX queue kick

2012-07-09T19:01:02+00:00

On rt2x00_dmastart() we increase index specified by Q_INDEX and on
rt2x00_dmadone() we increase index specified by Q_INDEX_DONE. So entries
between Q_INDEX_DONE and Q_INDEX are those we currently process in the
hardware. Entries between Q_INDEX and Q_INDEX_DONE are those we can
submit to the hardware.

According to that fix rt2x00usb_kick_queue(), as we need to submit RX
entries that are not processed by the hardware. It worked before only
for empty queue, otherwise was broken.

Note that for TX queues indexes ordering are ok. We need to kick entries
that have filled skb, but was not submitted to the hardware, i.e.
started from Q_INDEX_DONE and have ENTRY_DATA_PENDING bit set.

From practical standpoint this fixes RX queue stall, usually reproducible
in AP mode, like for example reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=828824

Reported-and-tested-by: Franco Miceli 
Reported-and-tested-by: Tom Horsley 
Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville

rt2x00: use atomic variable for seqno

2012-06-04T19:26:26+00:00

Remove spinlock as atomic_t can be used instead. Note we use only 16
lower bits, upper bits are changed but we impilcilty cast to u16.

This fix possible deadlock on IBSS mode reproted by lockdep:

=================================
[ INFO: inconsistent lock state ]
3.4.0-wl+ #4 Not tainted
---------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
kworker/u:2/30374 [HC0[0]:SC0[0]:HE1:SE1] takes:
 (&(&intf->seqlock)->rlock){+.?...}, at: [] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
{IN-SOFTIRQ-W} state was registered at:
  [] __lock_acquire+0x47b/0x1050
  [] lock_acquire+0x84/0xf0
  [] _raw_spin_lock+0x33/0x40
  [] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
  [] rt2x00queue_write_tx_frame+0x1a/0x300 [rt2x00lib]
  [] rt2x00mac_tx+0x7f/0x380 [rt2x00lib]
  [] __ieee80211_tx+0x1b3/0x300 [mac80211]
  [] ieee80211_tx+0x105/0x130 [mac80211]
  [] ieee80211_xmit+0xad/0x100 [mac80211]
  [] ieee80211_subif_start_xmit+0x2d9/0x930 [mac80211]
  [] dev_hard_start_xmit+0x307/0x660
  [] sch_direct_xmit+0xa1/0x1e0
  [] dev_queue_xmit+0x183/0x730
  [] neigh_resolve_output+0xfa/0x1e0
  [] ip_finish_output+0x24a/0x460
  [] ip_output+0xb7/0x100
  [] ip_local_out+0x20/0x60
  [] igmpv3_sendpack+0x4f/0x60
  [] igmp_ifc_timer_expire+0x29f/0x330
  [] run_timer_softirq+0x15c/0x2f0
  [] __do_softirq+0xae/0x1e0
irq event stamp: 18380437
hardirqs last  enabled at (18380437): [] __slab_alloc.clone.3+0x67/0x5f0
hardirqs last disabled at (18380436): [] __slab_alloc.clone.3+0x33/0x5f0
softirqs last  enabled at (18377616): [] __do_softirq+0x123/0x1e0
softirqs last disabled at (18377611): [] do_softirq+0x9d/0xe0

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&(&intf->seqlock)->rlock);
  
    lock(&(&intf->seqlock)->rlock);

 *** DEADLOCK ***

4 locks held by kworker/u:2/30374:
 #0:  (wiphy_name(local->hw.wiphy)){++++.+}, at: [] process_one_work+0x109/0x3f0
 #1:  ((&sdata->work)){+.+.+.}, at: [] process_one_work+0x109/0x3f0
 #2:  (&ifibss->mtx){+.+.+.}, at: [] ieee80211_ibss_work+0x1b/0x470 [mac80211]
 #3:  (&intf->beacon_skb_mutex){+.+...}, at: [] rt2x00queue_update_beacon+0x24/0x50 [rt2x00lib]

stack backtrace:
Pid: 30374, comm: kworker/u:2 Not tainted 3.4.0-wl+ #4
Call Trace:
 [] print_usage_bug+0x1f6/0x220
 [] mark_lock+0x2c2/0x300
 [] ? check_usage_forwards+0xc0/0xc0
 [] __lock_acquire+0x4bc/0x1050
 [] ? __kmalloc_track_caller+0x1c0/0x1d0
 [] ? copy_skb_header+0x26/0x90
 [] lock_acquire+0x84/0xf0
 [] ? rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
 [] _raw_spin_lock+0x33/0x40
 [] ? rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
 [] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
 [] rt2x00queue_update_beacon_locked+0x5f/0xb0 [rt2x00lib]
 [] rt2x00queue_update_beacon+0x2d/0x50 [rt2x00lib]
 [] rt2x00mac_bss_info_changed+0x1ca/0x200 [rt2x00lib]
 [] ? rt2x00mac_remove_interface+0x70/0x70 [rt2x00lib]
 [] ieee80211_bss_info_change_notify+0xe0/0x1d0 [mac80211]
 [] __ieee80211_sta_join_ibss+0x3b8/0x610 [mac80211]
 [] ? mark_held_locks+0x64/0xc0
 [] ? virt_efi_query_capsule_caps+0x12/0x50
 [] ieee80211_sta_join_ibss+0xf9/0x140 [mac80211]
 [] ieee80211_ibss_work+0x416/0x470 [mac80211]
 [] ? trace_hardirqs_on+0xb/0x10
 [] ? skb_dequeue+0x4b/0x70
 [] ieee80211_iface_work+0x13f/0x230 [mac80211]
 [] ? process_one_work+0x109/0x3f0
 [] process_one_work+0x185/0x3f0
 [] ? process_one_work+0x109/0x3f0
 [] ? ieee80211_teardown_sdata+0xa0/0xa0 [mac80211]
 [] worker_thread+0x116/0x270
 [] ? manage_workers+0x1e0/0x1e0
 [] kthread+0x84/0x90
 [] ? __init_kthread_worker+0x60/0x60
 [] kernel_thread_helper+0x6/0x10

Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka 
Acked-by: Helmut Schaa 
Acked-by: Gertjan van Wingerde 
Signed-off-by: John W. Linville

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-05-24T18:54:29+00:00

Pull more networking updates from David Miller:
 "Ok, everything from here on out will be bug fixes."

1) One final sync of wireless and bluetooth stuff from John Linville.
   These changes have all been in his tree for more than a week, and
   therefore have had the necessary -next exposure.  John was just away
   on a trip and didn't have a change to send the pull request until a
   day or two ago.

2) Put back some defines in user exposed header file areas that were
   removed during the tokenring purge.  From Stephen Hemminger and Paul
   Gortmaker.

3) A bug fix for UDP hash table allocation got lost in the pile due to
   one of those "you got it..  no I've got it.." situations.  :-)

   From Tim Bird.

4) SKB coalescing in TCP needs to have stricter checks, otherwise we'll
   try to coalesce overlapping frags and crash.  Fix from Eric Dumazet.

5) RCU routing table lookups can race with free_fib_info(), causing
   crashes when we deref the device pointers in the route.  Fix by
   releasing the net device in the RCU callback.  From Yanmin Zhang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (293 commits)
  tcp: take care of overlaps in tcp_try_coalesce()
  ipv4: fix the rcu race between free_fib_info and ip_route_output_slow
  mm: add a low limit to alloc_large_system_hash
  ipx: restore token ring define to include/linux/ipx.h
  if: restore token ring ARP type to header
  xen: do not disable netfront in dom0
  phy/micrel: Fix ID of KSZ9021
  mISDN: Add X-Tensions USB ISDN TA XC-525
  gianfar:don't add FCB length to hard_header_len
  Bluetooth: Report proper error number in disconnection
  Bluetooth: Create flags for bt_sk()
  Bluetooth: report the right security level in getsockopt
  Bluetooth: Lock the L2CAP channel when sending
  Bluetooth: Restore locking semantics when looking up L2CAP channels
  Bluetooth: Fix a redundant and problematic incoming MTU check
  Bluetooth: Add support for Foxconn/Hon Hai AR5BBU22 0489:E03C
  Bluetooth: Fix EIR data generation for mgmt_device_found
  Bluetooth: Fix Inquiry with RSSI event mask
  Bluetooth: improve readability of l2cap_seq_list code
  Bluetooth: Fix skb length calculation
  ...