linux-stable.git/drivers/net/wireless, branch linux-3.1.y

rtl8192se: Fix BUG caused by failure to check skb allocation

2012-01-18T15:31:58+00:00

commit d90db4b12bc1b9b8a787ef28550fdb767ee25a49 upstream.

When downloading firmware into the device, the driver fails to check the
return when allocating an skb. When the allocation fails, a BUG can be
generated, as seen in https://bugzilla.redhat.com/show_bug.cgi?id=771656.

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

wl12xx: Restore testmode ABI

2012-01-12T19:33:11+00:00

commit 3f1764945eaac532c20ab1f23afa352a40f797b2 upstream.

Commit 80900d0140a7648587982c8f299830e900e49165 accidently broke
the ABI for testmode commands. Restore the ABI again.

Signed-off-by: Pontus Fuchs 
Signed-off-by: Luciano Coelho 
Signed-off-by: Greg Kroah-Hartman

wl12xx: Check buffer bound when processing nvs data

2012-01-12T19:33:10+00:00

commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream.

An nvs with malformed contents could cause the processing of the
calibration data to read beyond the end of the buffer. Prevent this
from happening by adding bound checking.

Signed-off-by: Pontus Fuchs 
Reviewed-by: Luciano Coelho 
Signed-off-by: Luciano Coelho 
Signed-off-by: Greg Kroah-Hartman

wl12xx: Validate FEM index from ini file and FW

2012-01-12T19:33:10+00:00

commit 2131d3c2f99b081806fdae7662c92fe6acda52af upstream.

Check for out of bound FEM index to prevent reading beyond ini
memory end.

Signed-off-by: Pontus Fuchs 
Reviewed-by: Luciano Coelho 
Signed-off-by: Luciano Coelho 
Signed-off-by: Greg Kroah-Hartman

rt2800usb: Move ID out of unknown

2012-01-12T19:33:08+00:00

commit 3f81f8f1524ccca24df1029b0cf825ecef5e5cdc upstream.

Testing on the openSUSE wireless forum has shown that a Linksys
WUSB54GC v3 with USB ID 1737:0077 works with rt2800usb when the ID is
written to /sys/.../new_id. This ID can therefore be moved out of UNKNOWN.

Signed-off-by: Larry Finger 
Acked-by: Gertjan van Wingerde 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ath9k: Fix kernel panic in AR2427 in AP mode

2012-01-06T22:17:35+00:00

commit b25bfda38236f349cde0d1b28952f4eea2148d3f upstream.

don't do aggregation related stuff for 'AP mode client power save
handling' if aggregation is not enabled in the driver, otherwise it
will lead to panic because those data structures won't be never
intialized in 'ath_tx_node_init' if aggregation is disabled

	EIP is at ath_tx_aggr_wakeup+0x37/0x80 [ath9k]
	EAX: e8c09a20 EBX: f2a304e8 ECX: 00000001 EDX: 00000000
	ESI: e8c085e0 EDI: f2a304ac EBP: f40e1ca4 ESP: f40e1c8c
	DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
	Process swapper/1 (pid: 0, ti=f40e0000 task=f408e860
	task.ti=f40dc000)
	Stack:
	0001e966 e8c09a20 00000000 f2a304ac e8c085e0 f2a304ac
	f40e1cb0 f8186741
	f8186700 f40e1d2c f922988d f2a304ac 00000202 00000001
	c0b4ba43 00000000
	0000000f e8eb75c0 e8c085e0 205b0001 34383220 f2a304ac
	f2a30000 00010020
	Call Trace:
	[] ath9k_sta_notify+0x41/0x50 [ath9k]
	[] ? ath9k_get_survey+0x110/0x110 [ath9k]
	[] ieee80211_sta_ps_deliver_wakeup+0x9d/0x350
	[mac80211]
	[] ? __module_address+0x95/0xb0
	[] ap_sta_ps_end+0x63/0xa0 [mac80211]
	[] ieee80211_rx_h_sta_process+0x156/0x2b0
	[mac80211]
	[] ieee80211_rx_handlers+0xce/0x510 [mac80211]
	[] ? trace_hardirqs_on+0xb/0x10
	[] ? skb_queue_tail+0x3e/0x50
	[] ieee80211_prepare_and_rx_handle+0x111/0x750
	[mac80211]
	[] ieee80211_rx+0x349/0xb20 [mac80211]
	[] ? ieee80211_rx+0x99/0xb20 [mac80211]
	[] ath_rx_tasklet+0x818/0x1d00 [ath9k]
	[] ? ath9k_tasklet+0x35/0x1c0 [ath9k]
	[] ? ath9k_tasklet+0x35/0x1c0 [ath9k]
	[] ath9k_tasklet+0xf3/0x1c0 [ath9k]
	[] tasklet_action+0xbe/0x180

Cc: Senthil Balasubramanian 
Cc: Rajkumar Manoharan 
Reported-by: Ashwin Mendonca 
Tested-by: Ashwin Mendonca 
Signed-off-by: Mohammed Shafi Shajakhan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: update SCD BC table for all SCD queues

2012-01-06T22:17:31+00:00

commit 96f1f05af76b601ab21a7dc603ae0a1cea4efc3d upstream.

Since we configure all the queues as CHAINABLE, we need to update the
byte count for all the queues, not only the AGGREGATABLE ones.

Not doing so can confuse the SCD and make the fw assert.

Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Wey-Yi Guy 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: allow to switch to HT40 if not associated

2012-01-06T22:17:16+00:00

commit 78feb35b8161acd95c33a703ed6ab6f554d29387 upstream.

My previous patch
34a5b4b6af104cf18eb50748509528b9bdbc4036 iwlwifi: do not re-configure
HT40 after associated

Fix the case of HT40 after association on specified AP, but it break the
association for some APs and cause not able to establish connection.
We need to address HT40 before and after addociation.

Reported-by: Andrej Gelenberg 
Signed-off-by: Wey-Yi Guy 
Tested-by: Andrej Gelenberg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: do not set the sequence control bit is not needed

2012-01-06T22:17:15+00:00

commit 123877b80ed62c3b897c53357b622574c023b642 upstream.

Check the IEEE80211_TX_CTL_ASSIGN_SEQ flag from mac80211, then decide how to
set the TX_CMD_FLG_SEQ_CTL_MSK bit. Setting the wrong bit in BAR frame whill
make the firmware to increment the sequence number which is incorrect and
cause unknown behavior.

Signed-off-by: Wey-Yi Guy 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ath9k: fix max phy rate at rate control init

2012-01-06T22:17:14+00:00

commit 10636bc2d60942254bda149827b922c41f4cb4af upstream.

The stations always chooses 1Mbps for all trasmitting frames,
whenever the AP is configured to lock the supported rates.
As the max phy rate is always set with the 4th from highest phy rate,
this assumption might be wrong if we have less than that. Fix that.

Cc: Paul Stewart 
Reported-by: Ajay Gummalla 
Signed-off-by: Rajkumar Manoharan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman