linux-stable.git/drivers/net/wireless, branch v3.10.26

rtlwifi: pci: Fix oops on driver unload

2014-01-09T20:24:23+00:00

commit 9278db6279e28d4d433bc8a848e10b4ece8793ed upstream.

On Fedora systems, unloading rtl8192ce causes an oops. This patch fixes the
problem reported at https://bugzilla.redhat.com/show_bug.cgi?id=852761.

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ath9k_htc: properly set MAC address and BSSID mask

2014-01-09T20:24:22+00:00

commit 657eb17d87852c42b55c4b06d5425baa08b2ddb3 upstream.

Pick the MAC address of the first virtual interface as the new hardware MAC
address. Set BSSID mask according to this MAC address. This fixes CVE-2013-4579.

Signed-off-by: Mathy Vanhoef 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ath9k: Fix interrupt handling for the AR9002 family

2014-01-09T20:24:22+00:00

commit 73f0b56a1ff64e7fb6c3a62088804bab93bcedc2 upstream.

This patch adds a driver workaround for a HW issue.

A race condition in the HW results in missing interrupts,
which can be avoided by a read/write with the ISR register.
All chips in the AR9002 series are affected by this bug - AR9003
and above do not have this problem.

Cc: Felix Fietkau 
Signed-off-by: Sujith Manoharan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mwifiex: fix memory leak issue for ibss join

2013-12-20T15:45:09+00:00

commit 517543fd72d577dde2ebd9505dc4abf26d589f9a upstream.

For IBSS join if the requested SSID matches current SSID,
it returns without freeing the allocated beacon IE buffer.

Signed-off-by: Ujjal Roy 
Signed-off-by: Bing Zhao 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: mvm: check sta_id/drain values in debugfs

2013-12-20T15:45:09+00:00

commit 60765a47a433d54e4744c285ad127f182dcd80aa upstream.

The station ID must be valid, if it's out of range then
the array access may crash. Validate the station ID to
the array length, and also validate the drain value even
if that doesn't matter all that much.

Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver")
Signed-off-by: Johannes Berg 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Greg Kroah-Hartman

ath9k: Fix XLNA bias strength

2013-12-20T15:45:09+00:00

commit a1783a7b0846fc6414483e6caf646db72023fffd upstream.

The EEPROM parameter to determine whether the bias
strength values for XLNA have to be applied is part
of the miscConfiguration field and not featureEnable.

Signed-off-by: Sujith Manoharan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ath9k: Fix QuickDrop usage

2013-12-20T15:45:09+00:00

commit 93c1cfbe598f72cfa7be49e4a7d2a1d482e15119 upstream.

Bit 5 in the miscConfiguration field of the base EEPROM
header denotes whether QuickDrop is enabled or not. Fix
the incorrect usage of BIT(1) and also make sure that
this is done only for the required chips.

Signed-off-by: Sujith Manoharan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: dvm: don't override mac80211's queue setting

2013-12-12T06:36:28+00:00

commit f6b129527ca15bae29ffb9417ddaa1c9d99ffc5d upstream.

Since we set IEEE80211_HW_QUEUE_CONTROL, we can let
mac80211 do the queue assignement and don't need to
override its decisions.
While reassiging the same values is harmless of course,
it triggered  a WARNING when iwlwifi and mac80211 came
to different conclusions. This happened when mac80211 set
IEEE80211_TX_CTL_SEND_AFTER_DTIM, but didn't route the
packet to the cab_queue because no stations were asleep.

iwlwifi should not override mac80211's decicions for
offchannel packets and packets to  be sent after DTIM,
but it should override mac80211's decision for AMPDUs
since we have a special queue for them. So for AMPDU,
we still override info->hw_queue by the AMPDU queue.

This avoids:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 2531 at drivers/net/wireless/iwlwifi/dvm/tx.c:456 iwlagn_tx_skb+0x6c5/0x883()
Modules linked in:
CPU: 0 PID: 2531 Comm: hostapd Not tainted 3.12.0-rc5+ #1
Hardware name:                  /D53427RKE, BIOS RKPPT10H.86A.0017.2013.0425.1251 04/25/2013
 0000000000000000 0000000000000009 ffffffff8189aa62 0000000000000000
 ffffffff8105a4f2 ffff880058339a48 ffffffff815f8a04 0000000000000000
 ffff8800560097b0 0000000000000208 0000000000000000 ffff8800561a9e5e
Call Trace:
 [] ? dump_stack+0x41/0x51
 [] ? warn_slowpath_common+0x78/0x90
 [] ? iwlagn_tx_skb+0x6c5/0x883
 [] ? iwlagn_tx_skb+0x6c5/0x883
 [] ? put_cred+0x15/0x15
 [] ? iwlagn_mac_tx+0x19/0x2f
 [] ? __ieee80211_tx+0x226/0x29b
 [] ? ieee80211_tx+0xa6/0xb5
 [] ? ieee80211_monitor_start_xmit+0x1e9/0x204
 [] ? dev_hard_start_xmit+0x271/0x3ec
 [] ? sch_direct_xmit+0x66/0x164
 [] ? dev_queue_xmit+0x1e5/0x3c8
 [] ? packet_sendmsg+0xac5/0xb3d
 [] ? sock_sendmsg+0x37/0x52
 [] ? __do_fault+0x338/0x36b
 [] ? verify_iovec+0x44/0x94
 [] ? ___sys_sendmsg+0x1f1/0x283
 [] ? __inode_wait_for_writeback+0x67/0xae
 [] ? __cache_free.isra.46+0x178/0x187
 [] ? kmem_cache_free+0x44/0x84
 [] ? dentry_kill+0x13d/0x149
 [] ? dput+0xe5/0xef
 [] ? fget_light+0x2e/0x7c
 [] ? __sys_sendmsg+0x39/0x57
 [] ? system_call_fastpath+0x16/0x1b
---[ end trace 1b3eb79359c1d1e6 ]---

Reported-by: Sander Eikelenboom 
Reviewed-by: Johannes Berg 
Signed-off-by: Johannes Berg 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Greg Kroah-Hartman

iwl4965: better skb management in rx path

2013-12-04T18:57:36+00:00

commit c1de4a9557d9e25e41fc4ba034b9659152205539 upstream.

4965 version of Eric patch "iwl3945: better skb management in rx path".
It fixes several problems :

1) skb->truesize is underestimated.
   We really consume PAGE_SIZE bytes for a fragment,
   not the frame length.
2) 128 bytes of initial headroom is a bit low and forces reallocations.
3) We can avoid consuming a full page for small enough frames.

Signed-off-by: Stanislaw Gruszka 
Acked-by: Eric Dumazet 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwl3945: better skb management in rx path

2013-12-04T18:57:36+00:00

commit 45fe142cefa864b685615bcb930159f6749c3667 upstream.

Steinar reported reallocations of skb->head with IPv6, leading to
a warning in skb_try_coalesce()

It turns out iwl3945 has several problems :

1) skb->truesize is underestimated.
   We really consume PAGE_SIZE bytes for a fragment,
   not the frame length.
2) 128 bytes of initial headroom is a bit low and forces reallocations.
3) We can avoid consuming a full page for small enough frames.

Reported-by: Steinar H. Gunderson 
Signed-off-by: Eric Dumazet 
Cc: Paul Stewart 
Acked-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman