linux-stable.git/drivers/net/wireless, branch v3.4.7

iwlegacy: don't mess up the SCD when removing a key

2012-07-19T15:58:57+00:00

commit b48d96652626b315229b1b82c6270eead6a77a6d upstream.

When we remove a key, we put a key index which was supposed
to tell the fw that we are actually removing the key. But
instead the fw took that index as a valid index and messed
up the SRAM of the device.

This memory corruption on the device mangled the data of
the SCD. The impact on the user is that SCD queue 2 got
stuck after having removed keys.

Reported-by: Paul Bolle 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlegacy: always monitor for stuck queues

2012-07-19T15:58:57+00:00

commit c2ca7d92ed4bbd779516beb6eb226e19f7f7ab0f upstream.

This is iwlegacy version of:

commit 342bbf3fee2fa9a18147e74b2e3c4229a4564912
Author: Johannes Berg 
Date:   Sun Mar 4 08:50:46 2012 -0800

    iwlwifi: always monitor for stuck queues

    If we only monitor while associated, the following
    can happen:
     - we're associated, and the queue stuck check
       runs, setting the queue "touch" time to X
     - we disassociate, stopping the monitoring,
       which leaves the time set to X
     - almost 2s later, we associate, and enqueue
       a frame
     - before the frame is transmitted, we monitor
       for stuck queues, and find the time set to
       X, although it is now later than X + 2000ms,
       so we decide that the queue is stuck and
       erroneously restart the device

Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2x00usb: fix indexes ordering on RX queue kick

2012-07-19T15:58:56+00:00

commit efd821182cec8c92babef6e00a95066d3252fda4 upstream.

On rt2x00_dmastart() we increase index specified by Q_INDEX and on
rt2x00_dmadone() we increase index specified by Q_INDEX_DONE. So entries
between Q_INDEX_DONE and Q_INDEX are those we currently process in the
hardware. Entries between Q_INDEX and Q_INDEX_DONE are those we can
submit to the hardware.

According to that fix rt2x00usb_kick_queue(), as we need to submit RX
entries that are not processed by the hardware. It worked before only
for empty queue, otherwise was broken.

Note that for TX queues indexes ordering are ok. We need to kick entries
that have filled skb, but was not submitted to the hardware, i.e.
started from Q_INDEX_DONE and have ENTRY_DATA_PENDING bit set.

From practical standpoint this fixes RX queue stall, usually reproducible
in AP mode, like for example reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=828824

Reported-and-tested-by: Franco Miceli 
Reported-and-tested-by: Tom Horsley 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

net/wireless: ipw2x00: add supported cipher suites to wiphy initialization

2012-07-16T16:04:42+00:00

commit a141e6a0097118bb35024485f1faffc0d9042f5c upstream.

Driver doesn't report its supported cipher suites through cfg80211
interface. It still uses wext interface and probably will not work
through nl80211, but will at least correctly advertise supported
features.

Bug was reported by Omar Siam.
https://bugzilla.kernel.org/show_bug.cgi?id=43049

Signed-off-by: Stanislav Yakovlev 
Signed-off-by: John W. Linville 
Cc: Josh Boyer 
Signed-off-by: Greg Kroah-Hartman

rtl8187: ->brightness_set can not sleep

2012-07-16T16:04:42+00:00

commit 0fde0a8cfd0ede7f310d6a681c8e5a7cb3e32406 upstream.

Fix:

BUG: sleeping function called from invalid context at kernel/workqueue.c:2547
in_atomic(): 1, irqs_disabled(): 0, pid: 629, name: wpa_supplicant
2 locks held by wpa_supplicant/629:
 #0:  (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x14/0x20
 #1:  (&trigger->leddev_list_lock){.+.?..}, at: [] led_trigger_event+0x21/0x80
Pid: 629, comm: wpa_supplicant Not tainted 3.3.0-0.rc3.git5.1.fc17.i686
Call Trace:
 [] __might_sleep+0x126/0x1d0
 [] wait_on_work+0x2c/0x1d0
 [] __cancel_work_timer+0x6a/0x120
 [] cancel_delayed_work_sync+0x10/0x20
 [] rtl8187_led_brightness_set+0x82/0xf0 [rtl8187]
 [] led_trigger_event+0x5c/0x80
 [] ieee80211_led_radio+0x1d/0x40 [mac80211]
 [] ieee80211_stop_device+0x13/0x230 [mac80211]

Removing _sync is ok, because if led_on work is currently running
it will be finished before led_off work start to perform, since
they are always queued on the same mac80211 local->workqueue.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=795176

Signed-off-by: Stanislaw Gruszka 
Acked-by: Larry Finger 
Acked-by: Hin-Tak Leung 
Signed-off-by: John W. Linville 
Cc: Josh Boyer 
Signed-off-by: Greg Kroah-Hartman

ath9k: fix panic caused by returning a descriptor we have queued for reuse

2012-07-16T16:04:41+00:00

commit 6bb51c70cabaadddc54a6454844eceba91a56083 upstream.

Commit 3a2923e83c introduced a bug when a corrupt descriptor
is encountered - although the following descriptor is discarded
and returned to the queue for reuse the associated frame is
also returned for processing. This leads to a panic:

BUG: unable to handle kernel NULL pointer dereference at 000000000000003a
IP: [] ath_rx_tasklet+0x165/0x1b00 [ath9k]
Call Trace:

[] ? map_single+0x60/0x60
[] ? ath9k_ioread32+0x34/0x90 [ath9k]
[] athk9k_tasklet+0xdc/0x160 [ath9k]
[] tasklet_action+0x63/0xd0
[] __do_softirq+0xc0/0x1e0
[] ? native_sched_clock+0x13/0x80
[] call_softirq+0x1c/0x30
[] do_softirq+0x75/0xb0
[] irq_exit+0xb5/0xc0
[] do_IRQ+0x63/0xe0
[] common_interrupt+0x6a/0x6a

[] ? intel_idle+0xea/0x150
[] ? intel_idle+0xcb/0x150
[] cpuidle_enter+0x19/0x20
[] cpuidle_idle_call+0xa9/0x240
[] cpu_idle+0xaf/0x120
[] rest_init+0x72/0x74
[] start_kernel+0x3b7/0x3c4
[] ? repair_env_string+0x5e/0x5e
[] x86_64_start_reservations+0x131/0x135
[] x86_64_start_kernel+0x100/0x10f

Making sure bf is cleared to NULL in this case restores the
old behaviour.

Signed-off-by: Tom Hughes 
Signed-off-by: John W. Linville 
Cc: Josh Boyer 
Signed-off-by: Greg Kroah-Hartman

mwifiex: fix wrong return values in add_virtual_intf() error cases

2012-07-16T16:04:40+00:00

commit 858faa57dd9e2b91f3f870fbb1185982e42f5a2b upstream

add_virtual_intf() needs to return an ERR_PTR(), instead of NULL,
on errors, otherwise cfg80211 will crash.

Reported-by: Johannes Berg 
Signed-off-by: Bing Zhao 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: remove log_event debugfs file debugging is disabled

2012-07-16T16:04:40+00:00

commit 882b7b7d11d65e8eccce738f1ce97cdfdb998f9f upstream.

When debugging is disabled, the event log functions aren't
functional in the way that the debugfs file expects. This
leads to the debugfs access crashing. Since the event log
functions aren't functional then, remove the debugfs file
when CONFIG_IWLWIFI_DEBUG is not set.

Reported-by: Lekensteyn 
Reviewed-by: Emmanuel Grumbach 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: fix activating inactive stations

2012-07-16T16:04:24+00:00

commit eac9ac6d1f5d0e9d33e4ded682187b630e7606cd upstream.

When authentication/association timed out, the driver would
complain bitterly, printing the message
ACTIVATE a non DRIVER active station id ... addr ...

The cause turns out to be that when the AP station is added
but we don't associate, the IWL_STA_UCODE_INPROGRESS is set
but never cleared. This then causes iwl_restore_stations()
to attempt to resend it because it uses the flag internally
and uploads even if it didn't set it itself.

To fix this issue and not upload the station again when it
has already been removed by mac80211, clear the flag after
adding it in case we add it only for association.

Reviewed-by: Meenakshi Venkataraman 
Reviewed-by: Emmanuel Grumbach 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mwifiex: fix WPS eapol handshake failure

2012-07-16T16:04:23+00:00

commit f03ba7e9a24e5e9efaad56bd1713b994ea556b16 upstream.

After association, STA will go through eapol handshake with WPS
enabled AP. It's observed that WPS handshake fails with some 11n
AP. The reason for the failure is that the eapol packet is sent
via 11n frame aggregation.

The eapol packet should be sent directly without 11n aggregation.

This patch fixes the problem by adding WPS session control while
dequeuing Tx packets for transmission.

Signed-off-by: Stone Piao 
Signed-off-by: Avinash Patil 
Signed-off-by: Bing Zhao 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman