linux-stable.git/drivers/net/wireless, branch v3.2.30

rt2800usb: Added rx packet length validity check

2012-09-19T14:05:11+00:00

commit efd5d6b03bd9c9e0df646c56fb5f4f3e25e5c1ac upstream.

On our system (ARM Cortex-M3 SOC running linux-2.6.33)
frequent crashes were observed in the rt2800usb module
because of the invalid length of the received packet (3392,
46920...). This patch adds the sanity check on the packet
legth. Also, changed WARNING to ERROR in rt2x00lib_rxdone()
so that the bad packet condition would be noticed.

The fix was tested on the latest compat-wireless-3.5.1-1-snpc.

Signed-off-by: Sergei Poselenov 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Ben Hutchings

rt2x00: Fix rfkill polling prior to interface start.

2012-09-19T14:05:10+00:00

commit a396e10019eaf3809b0219c966865aaafec12630 upstream.

We need to program the rfkill switch GPIO pin direction to input at
device initialization time, not only when the interface is brought up.
Doing this only when the interface is brought up could lead to rfkill
detecting the switch is turned on erroneously and inability to create
the interface and bringing it up.

Reported-and-tested-by: Andreas Messer 
Signed-off-by: Gertjan van Wingerde 
Acked-by: Ivo Van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Ben Hutchings

rt2x00: Fix word size of rt2500usb MAC_CSR19 register.

2012-09-19T14:05:10+00:00

commit 6ced58a5dbb94dbfbea1b33ca3c56d1e929cd548 upstream.

The register is 16 bits wide, not 32.

Signed-off-by: Gertjan van Wingerde 
Acked-by: Ivo Van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Ben Hutchings

rt2x00: Identify ASUS USB-N53 device.

2012-09-19T14:05:09+00:00

commit 177ef8360fabdc49ff08d2598c06e7f7a36b53e3 upstream.

This is an RT3572 based device.

Signed-off-by: Maximilian Engelhardt 
Signed-off-by: Gertjan van Wingerde 
Acked-by: Ivo Van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Ben Hutchings

iwlwifi: protect SRAM debugfs

2012-09-19T14:04:27+00:00

commit 4fc79db178f0a0ede479b4713e00df2d106028b3 upstream.

If the device is not started, we can't read its
SRAM and attempting to do so will cause issues.
Protect the debugfs read.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
[bwh: Backported to 3.2:
 - Adjust context
 - Pass iwl_shared not iwl_priv pointer to iwl_is_ready_rf()]
Signed-off-by: Ben Hutchings

iwlwifi: fix flow handler debug code

2012-09-19T14:04:26+00:00

commit 94543a8d4fb302817014981489f15cb3b92ec3c2 upstream.

iwl_dbgfs_fh_reg_read() can cause crashes and/or
BUG_ON in slub because the ifdefs are wrong, the
code in iwl_dump_fh() should use DEBUGFS, not
DEBUG to protect the buffer writing code.

Also, while at it, clean up the arguments to the
function, some code and make it generally safer.

Reported-by: Benjamin Herrenschmidt 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
[bwh: Backported to 3.2: adjust filenames and context]
Signed-off-by: Ben Hutchings

USB: rtl8187: remove __devinit* from the struct usb_device_id table

2012-09-12T02:37:11+00:00

commit a3433179d0822ccfa8e80aa4d1d52843bd2dcc63 upstream.

This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.

Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.

Reported-by: Fengguang Wu 
Reported-by: Bjørn Mork 
CC: Herton Ronaldo Krzesinski 
CC: Hin-Tak Leung 
CC: Larry Finger 
CC: "John W. Linville" 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

USB: p54usb: remove __devinit* from the struct usb_device_id table

2012-09-12T02:37:10+00:00

commit b9c4167cbbafddac3462134013bc15e63e4c53ef upstream.

This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.

Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.

Reported-by: Fengguang Wu 
Reported-by: Bjørn Mork 
CC: Christian Lamparter 
CC: "John W. Linville" 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

ath9k: fix decrypt_error initialization in ath_rx_tasklet()

2012-09-12T02:37:00+00:00

commit e1352fde5682ab1bdd2a9e5d75c22d1fe210ef77 upstream.

ath_rx_tasklet() calls ath9k_rx_skb_preprocess() and ath9k_rx_skb_postprocess()
in a loop over the received frames. The decrypt_error flag is
initialized to false
just outside ath_rx_tasklet() loop. ath9k_rx_accept(), called by
ath9k_rx_skb_preprocess(),
only sets decrypt_error to true and never to false.
Then ath_rx_tasklet() calls ath9k_rx_skb_postprocess() and passes
decrypt_error to it.
So, after a decryption error, in ath9k_rx_skb_postprocess(), we can
have a leftover value
from another processed frame. In that case, the frame will not be marked with
RX_FLAG_DECRYPTED even if it is decrypted correctly.
When using CCMP encryption this issue can lead to connection stuck
because of CCMP
PN corruption and a waste of CPU time since mac80211 tries to decrypt an already
deciphered frame with ieee80211_aes_ccm_decrypt.
Fix the issue initializing decrypt_error flag at the begging of the
ath_rx_tasklet() loop.

Signed-off-by: Lorenzo Bianconi 
Signed-off-by: John W. Linville 
Signed-off-by: Ben Hutchings

iwlwifi: disable greenfield transmissions as a workaround

2012-08-19T17:15:31+00:00

commit 50e2a30cf6fcaeb2d27360ba614dd169a10041c5 upstream.

There's a bug that causes the rate scaling to get stuck
when it has to use single-stream rates with a peer that
can do GF and SGI; the two are incompatible so we can't
use them together, but that causes the algorithm to not
work at all, it always rejects updates.

Disable greenfield for now to prevent that problem.

Reviewed-by: Emmanuel Grumbach 
Tested-by: Cesar Eduardo Barros 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings