linux-stable.git/drivers/net, branch v3.12.6

igb: Fix for issue where values could be too high for udelay function.

2013-12-20T15:49:00+00:00

commit df29df92adda751ac04ca5149d30014b5199db81 upstream.

This patch changes the igb_phy_has_link function to check the value of the
parameter before deciding to use udelay or mdelay in order to be sure that
the value is not too high for udelay function.

Signed-off-by: Sunil K Pandey 
Signed-off-by: Kevin B Smith 
Signed-off-by: Carolyn Wyborny 
Tested-by: Aaron Brown 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: allwinner: emac: Add missing free_irq

2013-12-20T15:49:00+00:00

commit e9c56f8d2f851fb6d6ce6794c0f5463b862a878e upstream.

The sun4i-emac driver uses devm_request_irq at .ndo_open time, but relies on
the managed device mechanism to actually free it. This causes an issue whenever
someone wants to restart the interface, the interrupt still being held, and not
yet released.

Fall back to using the regular request_irq at .ndo_open time, and introduce a
free_irq during .ndo_stop.

Signed-off-by: Maxime Ripard 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

mwifiex: fix memory leak issue for ibss join

2013-12-20T15:49:00+00:00

commit 517543fd72d577dde2ebd9505dc4abf26d589f9a upstream.

For IBSS join if the requested SSID matches current SSID,
it returns without freeing the allocated beacon IE buffer.

Signed-off-by: Ujjal Roy 
Signed-off-by: Bing Zhao 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: mvm: check sta_id/drain values in debugfs

2013-12-20T15:49:00+00:00

commit 60765a47a433d54e4744c285ad127f182dcd80aa upstream.

The station ID must be valid, if it's out of range then
the array access may crash. Validate the station ID to
the array length, and also validate the drain value even
if that doesn't matter all that much.

Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver")
Signed-off-by: Johannes Berg 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Greg Kroah-Hartman

ath9k: fix duration calculation for non-aggregated packets

2013-12-20T15:48:58+00:00

commit bbf807bc0697e577c137a5fffb30fca7c6a45da1 upstream.

When not aggregating packets, fi->framelen should be passed in as length
to calculate the duration. Before the tx path rework, ath_tx_fill_desc
was called for either one aggregate, or one single frame, with the
length of the packet or the aggregate as a parameter.
After the rework, ath_tx_sched_aggr can pass a burst of single frames to
ath_tx_fill_desc and sets len=0.
Fix broken duration calculation by overriding the length in ath_tx_fill_desc
before passing it to ath_buf_set_rate.

Reported-by: Simon Wunderlich 
Signed-off-by: Felix Fietkau 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ath9k: Fix XLNA bias strength

2013-12-20T15:48:58+00:00

commit a1783a7b0846fc6414483e6caf646db72023fffd upstream.

The EEPROM parameter to determine whether the bias
strength values for XLNA have to be applied is part
of the miscConfiguration field and not featureEnable.

Signed-off-by: Sujith Manoharan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ath9k: Fix QuickDrop usage

2013-12-20T15:48:58+00:00

commit 93c1cfbe598f72cfa7be49e4a7d2a1d482e15119 upstream.

Bit 5 in the miscConfiguration field of the base EEPROM
header denotes whether QuickDrop is enabled or not. Fix
the incorrect usage of BIT(1) and also make sure that
this is done only for the required chips.

Signed-off-by: Sujith Manoharan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: pcie: fix interrupt coalescing for 7260 / 3160

2013-12-20T15:48:54+00:00

commit 6960a059b2c618f32fe549f13287b3d2278c09e9 upstream.

We changed the timeout for the interrupt coealescing for
calibration, but that wasn't effective since we changed
that value back before loading the firmware. Since
calibrations are notification from firmware and not Rx
packets, this doesn't change anyway - the firmware will
fire an interrupt straight away regardless of the interrupt
coalescing value.
Also, a HW issue has been discovered in 7000 devices series.
The work around is to disable the new interrupt coalescing
timeout feature - do this by setting bit 31 in
CSR_INT_COALESCING.
This has been fixed in 7265 which means that we can't rely
on the device family and must have a hint in the iwl_cfg
structure.

Fixes: 99cd47142399 ("iwlwifi: add 7000 series device configuration")
Reviewed-by: Johannes Berg 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Greg Kroah-Hartman

tg3: avoid double-freeing of rx data memory

2013-12-12T06:37:55+00:00

commit 85aec73d595b8847f9c4ea571deb127913f0d508 upstream.

If build_skb fails the memory associated with the ring buffer is freed but
the ri->data member is not zeroed in this case. This causes a double-free
of this memory in tg3_free_rings->... path. The patch moves this block after
setting ri->data to NULL.
It would be nice to fix this bug also in stable >= v3.4 trees.

Cc: Nithin Nayak Sujir 
Cc: Michael Chan 
Signed-off-by: Ivan Vecera 
Acked-by: Michael Chan 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: dvm: don't override mac80211's queue setting

2013-12-12T06:37:55+00:00

commit f6b129527ca15bae29ffb9417ddaa1c9d99ffc5d upstream.

Since we set IEEE80211_HW_QUEUE_CONTROL, we can let
mac80211 do the queue assignement and don't need to
override its decisions.
While reassiging the same values is harmless of course,
it triggered  a WARNING when iwlwifi and mac80211 came
to different conclusions. This happened when mac80211 set
IEEE80211_TX_CTL_SEND_AFTER_DTIM, but didn't route the
packet to the cab_queue because no stations were asleep.

iwlwifi should not override mac80211's decicions for
offchannel packets and packets to  be sent after DTIM,
but it should override mac80211's decision for AMPDUs
since we have a special queue for them. So for AMPDU,
we still override info->hw_queue by the AMPDU queue.

This avoids:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 2531 at drivers/net/wireless/iwlwifi/dvm/tx.c:456 iwlagn_tx_skb+0x6c5/0x883()
Modules linked in:
CPU: 0 PID: 2531 Comm: hostapd Not tainted 3.12.0-rc5+ #1
Hardware name:                  /D53427RKE, BIOS RKPPT10H.86A.0017.2013.0425.1251 04/25/2013
 0000000000000000 0000000000000009 ffffffff8189aa62 0000000000000000
 ffffffff8105a4f2 ffff880058339a48 ffffffff815f8a04 0000000000000000
 ffff8800560097b0 0000000000000208 0000000000000000 ffff8800561a9e5e
Call Trace:
 [] ? dump_stack+0x41/0x51
 [] ? warn_slowpath_common+0x78/0x90
 [] ? iwlagn_tx_skb+0x6c5/0x883
 [] ? iwlagn_tx_skb+0x6c5/0x883
 [] ? put_cred+0x15/0x15
 [] ? iwlagn_mac_tx+0x19/0x2f
 [] ? __ieee80211_tx+0x226/0x29b
 [] ? ieee80211_tx+0xa6/0xb5
 [] ? ieee80211_monitor_start_xmit+0x1e9/0x204
 [] ? dev_hard_start_xmit+0x271/0x3ec
 [] ? sch_direct_xmit+0x66/0x164
 [] ? dev_queue_xmit+0x1e5/0x3c8
 [] ? packet_sendmsg+0xac5/0xb3d
 [] ? sock_sendmsg+0x37/0x52
 [] ? __do_fault+0x338/0x36b
 [] ? verify_iovec+0x44/0x94
 [] ? ___sys_sendmsg+0x1f1/0x283
 [] ? __inode_wait_for_writeback+0x67/0xae
 [] ? __cache_free.isra.46+0x178/0x187
 [] ? kmem_cache_free+0x44/0x84
 [] ? dentry_kill+0x13d/0x149
 [] ? dput+0xe5/0xef
 [] ? fget_light+0x2e/0x7c
 [] ? __sys_sendmsg+0x39/0x57
 [] ? system_call_fastpath+0x16/0x1b
---[ end trace 1b3eb79359c1d1e6 ]---

Reported-by: Sander Eikelenboom 
Reviewed-by: Johannes Berg 
Signed-off-by: Johannes Berg 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Greg Kroah-Hartman