linux-stable.git/drivers/net, branch linux-3.1.y

rtl8192se: Fix BUG caused by failure to check skb allocation

2012-01-18T15:31:58+00:00

commit d90db4b12bc1b9b8a787ef28550fdb767ee25a49 upstream.

When downloading firmware into the device, the driver fails to check the
return when allocating an skb. When the allocation fails, a BUG can be
generated, as seen in https://bugzilla.redhat.com/show_bug.cgi?id=771656.

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

bonding: fix error handling if slave is busy (v2)

2012-01-12T19:33:42+00:00

commit f7d9821a6a9c83450ac35e76d3709e32fd38b76f upstream.

If slave device already has a receive handler registered, then the
error unwind of bonding device enslave function is broken.

The following will leave a pointer to freed memory in the slave
device list, causing a later kernel panic.
# modprobe dummy
# ip li add dummy0-1 link dummy0 type macvlan
# modprobe bonding
# echo +dummy0 >/sys/class/net/bond0/bonding/slaves

The fix is to detach the slave (which removes it from the list)
in the unwind path.

Signed-off-by: Stephen Hemminger 
Reviewed-by: Nicolas de Pesloüan 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

asix: fix infinite loop in rx_fixup()

2012-01-12T19:33:42+00:00

commit 6c15d74defd38e7e7f8805392578b7a1d508097e upstream.

At this point if skb->len happens to be 2, the subsequant skb_pull(skb, 4)
call won't work and the skb->len won't be decreased and won't ever reach 0,
resulting in an infinite loop.

With an ASIX 88772 under heavy load, without this patch, rx_fixup() reaches
an infinite loop in less than a minute. With this patch applied,
no infinite loop even after hours of heavy load.

Signed-off-by: Aurelien Jacobs 
Cc: Jussi Kivilinna 
Signed-off-by: David S. Miller

asix: new device id

2012-01-12T19:33:15+00:00

commit e8303a3b2196272c3eb994d0fd1a189a958a2bdd upstream.

Adds the device id needed for the USB Ethernet Adapter delivered by
ASUS with their Zenbook.

Signed-off-by: Aurelien Jacobs 
Acked-by: Grant Grundler 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

wl12xx: Restore testmode ABI

2012-01-12T19:33:11+00:00

commit 3f1764945eaac532c20ab1f23afa352a40f797b2 upstream.

Commit 80900d0140a7648587982c8f299830e900e49165 accidently broke
the ABI for testmode commands. Restore the ABI again.

Signed-off-by: Pontus Fuchs 
Signed-off-by: Luciano Coelho 
Signed-off-by: Greg Kroah-Hartman

wl12xx: Check buffer bound when processing nvs data

2012-01-12T19:33:10+00:00

commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream.

An nvs with malformed contents could cause the processing of the
calibration data to read beyond the end of the buffer. Prevent this
from happening by adding bound checking.

Signed-off-by: Pontus Fuchs 
Reviewed-by: Luciano Coelho 
Signed-off-by: Luciano Coelho 
Signed-off-by: Greg Kroah-Hartman

wl12xx: Validate FEM index from ini file and FW

2012-01-12T19:33:10+00:00

commit 2131d3c2f99b081806fdae7662c92fe6acda52af upstream.

Check for out of bound FEM index to prevent reading beyond ini
memory end.

Signed-off-by: Pontus Fuchs 
Reviewed-by: Luciano Coelho 
Signed-off-by: Luciano Coelho 
Signed-off-by: Greg Kroah-Hartman

rt2800usb: Move ID out of unknown

2012-01-12T19:33:08+00:00

commit 3f81f8f1524ccca24df1029b0cf825ecef5e5cdc upstream.

Testing on the openSUSE wireless forum has shown that a Linksys
WUSB54GC v3 with USB ID 1737:0077 works with rt2800usb when the ID is
written to /sys/.../new_id. This ID can therefore be moved out of UNKNOWN.

Signed-off-by: Larry Finger 
Acked-by: Gertjan van Wingerde 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ath9k: Fix kernel panic in AR2427 in AP mode

2012-01-06T22:17:35+00:00

commit b25bfda38236f349cde0d1b28952f4eea2148d3f upstream.

don't do aggregation related stuff for 'AP mode client power save
handling' if aggregation is not enabled in the driver, otherwise it
will lead to panic because those data structures won't be never
intialized in 'ath_tx_node_init' if aggregation is disabled

	EIP is at ath_tx_aggr_wakeup+0x37/0x80 [ath9k]
	EAX: e8c09a20 EBX: f2a304e8 ECX: 00000001 EDX: 00000000
	ESI: e8c085e0 EDI: f2a304ac EBP: f40e1ca4 ESP: f40e1c8c
	DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
	Process swapper/1 (pid: 0, ti=f40e0000 task=f408e860
	task.ti=f40dc000)
	Stack:
	0001e966 e8c09a20 00000000 f2a304ac e8c085e0 f2a304ac
	f40e1cb0 f8186741
	f8186700 f40e1d2c f922988d f2a304ac 00000202 00000001
	c0b4ba43 00000000
	0000000f e8eb75c0 e8c085e0 205b0001 34383220 f2a304ac
	f2a30000 00010020
	Call Trace:
	[] ath9k_sta_notify+0x41/0x50 [ath9k]
	[] ? ath9k_get_survey+0x110/0x110 [ath9k]
	[] ieee80211_sta_ps_deliver_wakeup+0x9d/0x350
	[mac80211]
	[] ? __module_address+0x95/0xb0
	[] ap_sta_ps_end+0x63/0xa0 [mac80211]
	[] ieee80211_rx_h_sta_process+0x156/0x2b0
	[mac80211]
	[] ieee80211_rx_handlers+0xce/0x510 [mac80211]
	[] ? trace_hardirqs_on+0xb/0x10
	[] ? skb_queue_tail+0x3e/0x50
	[] ieee80211_prepare_and_rx_handle+0x111/0x750
	[mac80211]
	[] ieee80211_rx+0x349/0xb20 [mac80211]
	[] ? ieee80211_rx+0x99/0xb20 [mac80211]
	[] ath_rx_tasklet+0x818/0x1d00 [ath9k]
	[] ? ath9k_tasklet+0x35/0x1c0 [ath9k]
	[] ? ath9k_tasklet+0x35/0x1c0 [ath9k]
	[] ath9k_tasklet+0xf3/0x1c0 [ath9k]
	[] tasklet_action+0xbe/0x180

Cc: Senthil Balasubramanian 
Cc: Rajkumar Manoharan 
Reported-by: Ashwin Mendonca 
Tested-by: Ashwin Mendonca 
Signed-off-by: Mohammed Shafi Shajakhan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: update SCD BC table for all SCD queues

2012-01-06T22:17:31+00:00

commit 96f1f05af76b601ab21a7dc603ae0a1cea4efc3d upstream.

Since we configure all the queues as CHAINABLE, we need to update the
byte count for all the queues, not only the AGGREGATABLE ones.

Not doing so can confuse the SCD and make the fw assert.

Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Wey-Yi Guy 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman