linux-stable.git/drivers/net/wireless, branch v3.10.45

ath9k: protect tid->sched check

2014-06-07T20:25:40+00:00

[ Upstream commit 21f8aaee0c62708654988ce092838aa7df4d25d8 ]

We check tid->sched without a lock taken on ath_tx_aggr_sleep(). That
is race condition which can result of doing list_del(&tid->list) twice
(second time with poisoned list node) and cause crash like shown below:

[424271.637220] BUG: unable to handle kernel paging request at 00100104
[424271.637328] IP: [] ath_tx_aggr_sleep+0x62/0xe0 [ath9k]
...
[424271.639953] Call Trace:
[424271.639998]  [] ? ath9k_get_survey+0x110/0x110 [ath9k]
[424271.640083]  [] ath9k_sta_notify+0x42/0x50 [ath9k]
[424271.640177]  [] sta_ps_start+0x8f/0x1c0 [mac80211]
[424271.640258]  [] ? free_compound_page+0x2e/0x40
[424271.640346]  [] ieee80211_rx_handlers+0x9d5/0x2340 [mac80211]
[424271.640437]  [] ? kmem_cache_free+0x1d8/0x1f0
[424271.640510]  [] ? kfree_skbmem+0x34/0x90
[424271.640578]  [] ? put_page+0x2c/0x40
[424271.640640]  [] ? kfree_skbmem+0x34/0x90
[424271.640706]  [] ? kfree_skbmem+0x34/0x90
[424271.640787]  [] ? ieee80211_rx_handlers_result+0x73/0x1d0 [mac80211]
[424271.640897]  [] ieee80211_prepare_and_rx_handle+0x520/0xad0 [mac80211]
[424271.641009]  [] ? ieee80211_rx_handlers+0x2ed/0x2340 [mac80211]
[424271.641104]  [] ? ip_output+0x7e/0xd0
[424271.641182]  [] ieee80211_rx+0x307/0x7c0 [mac80211]
[424271.641266]  [] ath_rx_tasklet+0x88e/0xf70 [ath9k]
[424271.641358]  [] ? ieee80211_rx+0x1dc/0x7c0 [mac80211]
[424271.641445]  [] ath9k_tasklet+0xcb/0x130 [ath9k]

Bug report:
https://bugzilla.kernel.org/show_bug.cgi?id=70551

Reported-and-tested-by: Max Sydorenko 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
[ xl: backported to 3.10: adjusted context ]
Signed-off-by: Xiangyu Lu 
Signed-off-by: Greg Kroah-Hartman

brcmsmac: fix deadlock on missing firmware

2014-06-07T20:25:34+00:00

commit 8fc1e8c240aab968db658b2d8d079b4391207a36 upstream.

When brcm80211 firmware is not installed networking hangs.
A deadlock happens because we call ieee80211_unregister_hw()
from the .start callback of struct ieee80211_ops. When .start
is called we are under rtnl lock and ieee80211_unregister_hw()
tries to take it again.

Function call stack:

dev_change_flags()
	__dev_change_flags()
		__dev_open()
			ASSERT_RTNL() <-- Assert rtnl lock
			ops->ndo_open()

.ndo_open = ieee80211_open,

ieee80211_open()
	ieee80211_do_open()
		drv_start()
			local->ops->start()

.start = brcms_ops_start,

brcms_ops_start()
	brcms_remove()
		ieee80211_unregister_hw()
			rtnl_lock() <-- Here we deadlock

Introduced by:
commit 25b5632fb35ca61b8ae3eee235edcdc2883f7a5e
("brcmsmac: request firmware in .start() callback")

This patch fixes the bug by removing the call to brcms_remove()
and moves the brcms_request_fw() call to the top of the .start
callback to not initiate anything unless firmware is installed.

Signed-off-by: Emil Goode 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtl8192cu: Fix unbalanced irq enable in error path of rtl92cu_hw_init()

2014-06-07T20:25:34+00:00

commit 3234f5b06fc3094176a86772cc64baf3decc98fc upstream.

Fixes: a53268be0cb9 ('rtlwifi: rtl8192cu: Fix too long disable of IRQs')
Signed-off-by: Ben Hutchings 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2x00: fix beaconing on USB

2014-06-07T20:25:33+00:00

commit 8834d3608cc516f13e2e510f4057c263f3d2ce42 upstream.

When disable beaconing we clear register with beacon and newer set it
back, what make we stop send beacons infinitely.

Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtlwifi: rtl8188ee: initialize packet_beacon

2014-05-13T11:59:45+00:00

commit 328e203fc35f0b4f6df1c4943f74cf553bcc04f8 upstream.

static code analysis from cppcheck reports:

[drivers/net/wireless/rtlwifi/rtl8188ee/trx.c:322]:
  (error) Uninitialized variable: packet_beacon

packet_beacon is not initialized and hence packet_beacon
contains garbage from the stack, so set it to false.

Signed-off-by: Colin Ian King 
Acked-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtlwifi: rtl8192se: Fix regression due to commit 1bf4bbb

2014-05-13T11:59:44+00:00

commit 5f9186990ec4579ee5b7a99b3254c29eda479f36 upstream.

Beginning with kernel 3.13, this driver fails on some systems. The problem
was bisected to:

Commit 1bf4bbb4024dcdab5e57634dd8ae1072d42a53ac
Author: Felix Fietkau 
Title: mac80211: send control port protocol frames to the VO queue

There is noting wrong with the above commit. The regression occurs because
V0 queue on RTL8192SE cards uses priority 6, not the usual 7. The fix is to
modify the rtl8192se routine that sets the correct transmit queue.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=74541

Reported-by: Alex Miller 
Tested-by: Alex Miller 
Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtlwifi: rtl8192se: Fix too long disable of IRQs

2014-05-13T11:59:44+00:00

commit 2610decdd0b3808ba20471a999835cfee5275f98 upstream.

In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
 fixed a problem caused by an extra long disabling
of interrupts. This patch makes the same fix for rtl8192se.

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtlwifi: rtl8192cu: Fix too long disable of IRQs

2014-05-13T11:59:44+00:00

commit a53268be0cb9763f11da4f6fe3fb924cbe3a7d4a upstream.

In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
 fixed a problem caused by an extra long disabling
of interrupts. This patch makes the same fix for rtl8192cu.

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtlwifi: rtl8188ee: Fix too long disable of IRQs

2014-05-13T11:59:44+00:00

commit 6b6392715856d563719991e9ce95e773491a8983 upstream.

In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
 fixed a problem caused by an extra long disabling
of interrupts. This patch makes the same fix for rtl8188ee.

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtlwifi: rtl8723ae: Fix too long disable of IRQs

2014-05-13T11:59:44+00:00

commit bfc1010c418a22cbebd8b1bd1e75dad6a527a609 upstream.

In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
 fixed a problem caused by an extra long disabling
of interrupts. This patch makes the same fix for rtl8723ae.

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman