linux.git/drivers/net/wireless, branch v3.6-rc4 Linux kernel source tree Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2012-08-21T23:46:08+00:00 Linus Torvalds torvalds@linux-foundation.org 2012-08-21T23:46:08+00:00 8f8ba75ee2065738644382667f833a4eb6f6db1d Pull networking update from David Miller: "A couple weeks of bug fixing in there. The largest chunk is all the broken crap Amerigo Wang found in the netpoll layer." 1) netpoll and it's users has several serious bugs: a) uses GFP_KERNEL with locks held b) interfaces requiring interrupts disabled are called with them enabled c) and vice versa d) VLAN tag demuxing, as per all other RX packet input paths, is not applied All from Amerigo Wang. 2) Hopefully cure the ipv4 mapped ipv6 address TCP early demux bugs for good, from Neal Cardwell. 3) Unlike AF_UNIX, AF_PACKET sockets don't set a default credentials when the user doesn't specify one explicitly during sendmsg(). Instead we attach an empty (zero) SCM credential block which is definitely not what we want. Fix from Eric Dumazet. 4) IPv6 illegally invokes netdevice notifiers with RCU lock held, fix from Ben Hutchings. 5) inet_csk_route_child_sock() checks wrong inet options pointer, fix from Christoph Paasch. 6) When AF_PACKET is used for transmit, packet loopback doesn't behave properly when a socket fanout is enabled, from Eric Leblond. 7) On bluetooth l2cap channel create failure, we leak the socket, from Jaganath Kanakkassery. 8) Fix all the netprio file handling bugs found by Al Viro, from John Fastabend. 9) Several error return and NULL deref bug fixes in networking drivers from Julia Lawall. 10) A large smattering of struct padding et al. kernel memory leaks to userspace found of Mathias Krause. 11) Conntrack expections in netfilter can access an uninitialized timer, fix from Pablo Neira Ayuso. 12) Several netfilter SIP tracker bug fixes from Patrick McHardy. 13) IPSEC ipv6 routes are not initialized correctly all the time, resulting in an OOPS in inet_putpeer(). Also from Patrick McHardy. 14) Bridging does rcu_dereference() outside of RCU protected area, from Stephen Hemminger. 15) Fix routing cache removal performance regression when looking up output routes that have a local destination. From Zheng Yan. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (87 commits) af_netlink: force credentials passing [CVE-2012-3520] ipv4: fix ip header ident selection in __ip_make_skb() ipv4: Use newinet->inet_opt in inet_csk_route_child_sock() tcp: fix possible socket refcount problem net: tcp: move sk_rx_dst_set call after tcp_create_openreq_child() net/core/dev.c: fix kernel-doc warning netconsole: remove a redundant netconsole_target_put() net: ipv6: fix oops in inet_putpeer() net/stmmac: fix issue of clk_get for Loongson1B. caif: Do not dereference NULL in chnl_recv_cb() af_packet: don't emit packet on orig fanout group drivers/net/irda: fix error return code drivers/net/wan/dscc4.c: fix error return code drivers/net/wimax/i2400m/fw.c: fix error return code smsc75xx: add missing entry to MAINTAINERS net: qmi_wwan: new devices: UML290 and K5006-Z net: sh_eth: Add eth support for R8A7779 device netdev/phy: skip disabled mdio-mux nodes dt: introduce for_each_available_child_of_node, of_get_next_available_child net: netprio: fix cgrp create and write priomap race ... 
Pull networking update from David Miller:
 "A couple weeks of bug fixing in there.  The largest chunk is all the
  broken crap Amerigo Wang found in the netpoll layer."

 1) netpoll and it's users has several serious bugs:
    a) uses GFP_KERNEL with locks held
    b) interfaces requiring interrupts disabled are called with them
       enabled
    c) and vice versa
    d) VLAN tag demuxing, as per all other RX packet input paths, is not
       applied

    All from Amerigo Wang.

 2) Hopefully cure the ipv4 mapped ipv6 address TCP early demux bugs for
    good, from Neal Cardwell.

 3) Unlike AF_UNIX, AF_PACKET sockets don't set a default credentials
    when the user doesn't specify one explicitly during sendmsg().
    Instead we attach an empty (zero) SCM credential block which is
    definitely not what we want.  Fix from Eric Dumazet.

 4) IPv6 illegally invokes netdevice notifiers with RCU lock held, fix
    from Ben Hutchings.

 5) inet_csk_route_child_sock() checks wrong inet options pointer, fix
    from Christoph Paasch.

 6) When AF_PACKET is used for transmit, packet loopback doesn't behave
    properly when a socket fanout is enabled, from Eric Leblond.

 7) On bluetooth l2cap channel create failure, we leak the socket, from
    Jaganath Kanakkassery.

 8) Fix all the netprio file handling bugs found by Al Viro, from John
    Fastabend.

 9) Several error return and NULL deref bug fixes in networking drivers
    from Julia Lawall.

10) A large smattering of struct padding et al.  kernel memory leaks to
    userspace found of Mathias Krause.

11) Conntrack expections in netfilter can access an uninitialized timer,
    fix from Pablo Neira Ayuso.

12) Several netfilter SIP tracker bug fixes from Patrick McHardy.

13) IPSEC ipv6 routes are not initialized correctly all the time,
    resulting in an OOPS in inet_putpeer().  Also from Patrick McHardy.

14) Bridging does rcu_dereference() outside of RCU protected area, from
    Stephen Hemminger.

15) Fix routing cache removal performance regression when looking up
    output routes that have a local destination.  From Zheng Yan.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (87 commits)
  af_netlink: force credentials passing [CVE-2012-3520]
  ipv4: fix ip header ident selection in __ip_make_skb()
  ipv4: Use newinet->inet_opt in inet_csk_route_child_sock()
  tcp: fix possible socket refcount problem
  net: tcp: move sk_rx_dst_set call after tcp_create_openreq_child()
  net/core/dev.c: fix kernel-doc warning
  netconsole: remove a redundant netconsole_target_put()
  net: ipv6: fix oops in inet_putpeer()
  net/stmmac: fix issue of clk_get for Loongson1B.
  caif: Do not dereference NULL in chnl_recv_cb()
  af_packet: don't emit packet on orig fanout group
  drivers/net/irda: fix error return code
  drivers/net/wan/dscc4.c: fix error return code
  drivers/net/wimax/i2400m/fw.c: fix error return code
  smsc75xx: add missing entry to MAINTAINERS
  net: qmi_wwan: new devices: UML290 and K5006-Z
  net: sh_eth: Add eth support for R8A7779 device
  netdev/phy: skip disabled mdio-mux nodes
  dt: introduce for_each_available_child_of_node, of_get_next_available_child
  net: netprio: fix cgrp create and write priomap race
  ...
Merge tag 'usb-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 2012-08-20T20:14:22+00:00 Linus Torvalds torvalds@linux-foundation.org 2012-08-20T20:14:22+00:00 10c63c9aec648402f593b6c883ca247ece7b2af9 Pull more USB patches from Greg Kroah-Hartman: "Here are 10 more USB patches for 3.6-rc3. They all fix reported problems (build problems for one of them, and easily repeatable oopses for the others.) Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>" * tag 'usb-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: gpu/mfd/usb: Fix USB randconfig problems USB: CDC ACM: Fix NULL pointer dereference USB: emi62: remove __devinit* from the struct usb_device_id table USB: winbond: remove __devinit* from the struct usb_device_id table USB: vt6656: remove __devinit* from the struct usb_device_id table USB: rtl8187: remove __devinit* from the struct usb_device_id table USB: p54usb: remove __devinit* from the struct usb_device_id table USB: spca506: remove __devinit* from the struct usb_device_id table USB: jl2005bcd: remove __devinit* from the struct usb_device_id table USB: smsusb: remove __devinit* from the struct usb_device_id table 
Pull more USB patches from Greg Kroah-Hartman:
 "Here are 10 more USB patches for 3.6-rc3.  They all fix reported
  problems (build problems for one of them, and easily repeatable oopses
  for the others.)

  Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"

* tag 'usb-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  gpu/mfd/usb: Fix USB randconfig problems
  USB: CDC ACM: Fix NULL pointer dereference
  USB: emi62: remove __devinit* from the struct usb_device_id table
  USB: winbond: remove __devinit* from the struct usb_device_id table
  USB: vt6656: remove __devinit* from the struct usb_device_id table
  USB: rtl8187: remove __devinit* from the struct usb_device_id table
  USB: p54usb: remove __devinit* from the struct usb_device_id table
  USB: spca506: remove __devinit* from the struct usb_device_id table
  USB: jl2005bcd: remove __devinit* from the struct usb_device_id table
  USB: smsusb: remove __devinit* from the struct usb_device_id table
USB: rtl8187: remove __devinit* from the struct usb_device_id table 2012-08-18T00:50:45+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2012-08-18T00:48:29+00:00 a3433179d0822ccfa8e80aa4d1d52843bd2dcc63 This structure needs to always stick around, even if CONFIG_HOTPLUG is disabled, otherwise we can oops when trying to probe a device that was added after the structure is thrown away. Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Reported-by: Bjørn Mork <bjorn@mork.no> Cc: stable <stable@vger.kernel.org> CC: Herton Ronaldo Krzesinski <herton@canonical.com> CC: Hin-Tak Leung <htl10@users.sourceforge.net> CC: Larry Finger <Larry.Finger@lwfinger.net> CC: "John W. Linville" <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.

Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
CC: Herton Ronaldo Krzesinski <herton@canonical.com>
CC: Hin-Tak Leung <htl10@users.sourceforge.net>
CC: Larry Finger <Larry.Finger@lwfinger.net>
CC: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: p54usb: remove __devinit* from the struct usb_device_id table 2012-08-18T00:50:44+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2012-08-18T00:48:28+00:00 b9c4167cbbafddac3462134013bc15e63e4c53ef This structure needs to always stick around, even if CONFIG_HOTPLUG is disabled, otherwise we can oops when trying to probe a device that was added after the structure is thrown away. Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Reported-by: Bjørn Mork <bjorn@mork.no> Cc: stable <stable@vger.kernel.org> CC: Christian Lamparter <chunkeey@googlemail.com> CC: "John W. Linville" <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.

Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Bjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
CC: Christian Lamparter <chunkeey@googlemail.com>
CC: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem 2012-08-14T18:42:54+00:00 John W. Linville linville@tuxdriver.com 2012-08-14T18:42:54+00:00 1e55217e174f4e6920fd441dcd3aaf8e37645460 






ath5k: fix spin_lock_irqsave/spin_lock_bh nesting in mesh
2012-08-13T19:17:25+00:00

Bob Copeland
me@bobcopeland.com

2012-08-13T01:18:33+00:00

7dd6753f6d2e7e0ccbf2263cef3a9fff6bc89988

Lockdep found an inconsistent lock state when joining a mesh with
ath5k.  The problem is that ath5k takes the lock for its beacon state,
ah->block, with spin_lock_irqsave(), while mesh internally takes the
sync_offset_lock with spin_lock_bh() in mesh_sync_offset_adjust_tbtt(),
which in turn is called under ah->block.

This could deadlock if the beacon tasklet was run on the processor
that held the beacon lock during the do_softirq() in spin_unlock_bh().

We probably shouldn't hold the lock around the callbacks, but the
easiest fix is to switch to spin_lock_bh for ah->block: it doesn't
need interrupts disabled anyway as the data in question is only accessed
in softirq or process context.

Fixes the following lockdep warning:

[  446.892304] WARNING: at kernel/softirq.c:159 _local_bh_enable_ip+0x38/0xa6()
[  446.892306] Hardware name: MacBook1,1
[  446.892309] Modules linked in: tcp_lp fuse sunrpc cpufreq_ondemand acpi_cpufreq mperf ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 ip6table_filter nf_defrag_ipv4 xt_state nf_conntrack ip6_tables ext2 arc4 btusb bluetooth snd_hda_codec_idt snd_hda_intel carl9170 snd_hda_codec coretemp joydev ath5k snd_hwdep snd_seq isight_firmware ath snd_seq_device snd_pcm applesmc appletouch mac80211 input_polldev snd_timer microcode cfg80211 snd lpc_ich pcspkr i2c_i801 mfd_core soundcore rfkill snd_page_alloc sky2 tpm_infineon virtio_net kvm_intel kvm i915 drm_kms_helper drm i2c_algo_bit i2c_core video
[  446.892385] Pid: 1892, comm: iw Not tainted 3.6.0-rc1-wl+ #296
[  446.892387] Call Trace:
[  446.892394]  [<c0432958>] warn_slowpath_common+0x7c/0x91
[  446.892398]  [<c04399d7>] ? _local_bh_enable_ip+0x38/0xa6
[  446.892403]  [<c04399d7>] ? _local_bh_enable_ip+0x38/0xa6
[  446.892459]  [<f7f9ae3b>] ? mesh_sync_offset_adjust_tbtt+0x95/0x99 [mac80211]
[  446.892464]  [<c043298f>] warn_slowpath_null+0x22/0x24
[  446.892468]  [<c04399d7>] _local_bh_enable_ip+0x38/0xa6
[  446.892473]  [<c0439a52>] local_bh_enable_ip+0xd/0xf
[  446.892479]  [<c088004f>] _raw_spin_unlock_bh+0x34/0x37
[  446.892527]  [<f7f9ae3b>] mesh_sync_offset_adjust_tbtt+0x95/0x99 [mac80211]
[  446.892569]  [<f7f7650f>] ieee80211_beacon_get_tim+0x28f/0x4e0 [mac80211]
[  446.892575]  [<c047ceeb>] ? trace_hardirqs_on_caller+0x10e/0x13f
[  446.892591]  [<f7fdc541>] ath5k_beacon_update+0x40/0x26b [ath5k]
[  446.892597]  [<c047ad67>] ? lock_acquired+0x1f5/0x21e
[  446.892612]  [<f7fdf9fb>] ? ath5k_bss_info_changed+0x167/0x1b2 [ath5k]
[  446.892617]  [<c087f9ea>] ? _raw_spin_lock_irqsave+0x78/0x82
[  446.892632]  [<f7fdf9fb>] ? ath5k_bss_info_changed+0x167/0x1b2 [ath5k]
[  446.892647]  [<f7fdfa09>] ath5k_bss_info_changed+0x175/0x1b2 [ath5k]
[  446.892651]  [<c0479dd4>] ? lock_is_held+0x73/0x7b
[  446.892662]  [<c0458fd5>] ? __might_sleep+0xa7/0x17a
[  446.892698]  [<f7f5d8f7>] ieee80211_bss_info_change_notify+0x1ed/0x21a [mac80211]
[  446.892703]  [<c0449875>] ? queue_work+0x24/0x32
[  446.892718]  [<f7fdf894>] ? ath5k_configure_filter+0x163/0x163 [ath5k]
[  446.892766]  [<f7f95fa4>] ieee80211_start_mesh+0xb9/0xbd [mac80211]
[  446.892806]  [<f7f6e610>] ieee80211_join_mesh+0x10c/0x116 [mac80211]
[  446.892834]  [<f7a96b90>] __cfg80211_join_mesh+0x176/0x1b3 [cfg80211]
[  446.892855]  [<f7a96c1c>] cfg80211_join_mesh+0x4f/0x6a [cfg80211]
[  446.892875]  [<f7a89891>] nl80211_join_mesh+0x1de/0x1ed [cfg80211]
[  446.892908]  [<f7a8db99>] ? nl80211_set_wiphy+0x4cf/0x4cf [cfg80211]
[  446.892919]  [<c07cfa36>] genl_rcv_msg+0x1d5/0x1f3
[  446.892940]  [<c07cf861>] ? genl_rcv+0x25/0x25
[  446.892946]  [<c07cf009>] netlink_rcv_skb+0x37/0x78
[  446.892950]  [<c07cf85a>] genl_rcv+0x1e/0x25
[  446.892955]  [<c07cebf3>] netlink_unicast+0xc3/0x12d
[  446.892959]  [<c07cee46>] netlink_sendmsg+0x1e9/0x213
[  446.892966]  [<c079f282>] sock_sendmsg+0x79/0x96
[  446.892972]  [<c04eb90d>] ? might_fault+0x9d/0xa3
[  446.892978]  [<c07a81d8>] ? copy_from_user+0x8/0xa
[  446.892983]  [<c07a852c>] ? verify_iovec+0x43/0x77
[  446.892987]  [<c079f4d8>] __sys_sendmsg+0x180/0x215
[  446.892993]  [<c045f107>] ? sched_clock_cpu+0x134/0x144
[  446.892997]  [<c047992f>] ? trace_hardirqs_off+0xb/0xd
[  446.893002]  [<c047bf88>] ? __lock_acquire+0x46b/0xb6e
[  446.893006]  [<c047992f>] ? trace_hardirqs_off+0xb/0xd
[  446.893010]  [<c045f149>] ? local_clock+0x32/0x49
[  446.893015]  [<c0479ec1>] ? lock_release_holdtime.part.9+0x4b/0x51
[  446.893020]  [<c0479dd4>] ? lock_is_held+0x73/0x7b
[  446.893025]  [<c050d127>] ? fcheck_files+0x97/0xcd
[  446.893029]  [<c050d4df>] ? fget_light+0x2d/0x81
[  446.893034]  [<c07a01f3>] sys_sendmsg+0x3b/0x52
[  446.893038]  [<c07a07b4>] sys_socketcall+0x238/0x2a2
[  446.893044]  [<c0885edf>] sysenter_do_call+0x12/0x38
[  446.893047] ---[ end trace a9af5998f929270f ]---
[  447.627222]
[  447.627232] =================================
[  447.627237] [ INFO: inconsistent lock state ]
[  447.627244] 3.6.0-rc1-wl+ #296 Tainted: G        W
[  447.627248] ---------------------------------
[  447.627253] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[  447.627260] swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
[  447.627264]  (&(&ah->block)->rlock){+.?...}, at: [<f7fdd2d1>] ath5k_tasklet_beacon+0x91/0xa7 [ath5k]
[  447.627299] {SOFTIRQ-ON-W} state was registered at:
[  447.627304]   [<c047cdbf>] mark_held_locks+0x59/0x77
[  447.627316]   [<c047ceeb>] trace_hardirqs_on_caller+0x10e/0x13f
[  447.627324]   [<c047cf27>] trace_hardirqs_on+0xb/0xd
[  447.627332]   [<c0439a3d>] _local_bh_enable_ip+0x9e/0xa6
[  447.627342]   [<c0439a52>] local_bh_enable_ip+0xd/0xf
[  447.627349]   [<c088004f>] _raw_spin_unlock_bh+0x34/0x37
[  447.627359]   [<f7f9ae3b>] mesh_sync_offset_adjust_tbtt+0x95/0x99 [mac80211]
[  447.627451]   [<f7f7650f>] ieee80211_beacon_get_tim+0x28f/0x4e0 [mac80211]
[  447.627526]   [<f7fdc541>] ath5k_beacon_update+0x40/0x26b [ath5k]
[  447.627547]   [<f7fdfa09>] ath5k_bss_info_changed+0x175/0x1b2 [ath5k]
[  447.627569]   [<f7f5d8f7>] ieee80211_bss_info_change_notify+0x1ed/0x21a [mac80211]
[  447.627628]   [<f7f95fa4>] ieee80211_start_mesh+0xb9/0xbd [mac80211]
[  447.627712]   [<f7f6e610>] ieee80211_join_mesh+0x10c/0x116 [mac80211]
[  447.627782]   [<f7a96b90>] __cfg80211_join_mesh+0x176/0x1b3 [cfg80211]
[  447.627816]   [<f7a96c1c>] cfg80211_join_mesh+0x4f/0x6a [cfg80211]
[  447.627845]   [<f7a89891>] nl80211_join_mesh+0x1de/0x1ed [cfg80211]
[  447.627872]   [<c07cfa36>] genl_rcv_msg+0x1d5/0x1f3
[  447.627881]   [<c07cf009>] netlink_rcv_skb+0x37/0x78
[  447.627891]   [<c07cf85a>] genl_rcv+0x1e/0x25
[  447.627898]   [<c07cebf3>] netlink_unicast+0xc3/0x12d
[  447.627907]   [<c07cee46>] netlink_sendmsg+0x1e9/0x213
[  447.627915]   [<c079f282>] sock_sendmsg+0x79/0x96
[  447.627926]   [<c079f4d8>] __sys_sendmsg+0x180/0x215
[  447.627934]   [<c07a01f3>] sys_sendmsg+0x3b/0x52
[  447.627941]   [<c07a07b4>] sys_socketcall+0x238/0x2a2
[  447.627949]   [<c0885edf>] sysenter_do_call+0x12/0x38
[  447.627959] irq event stamp: 1929200
[  447.627963] hardirqs last  enabled at (1929200): [<c043a0e9>] tasklet_hi_action+0x3e/0xbf
[  447.627972] hardirqs last disabled at (1929199): [<c043a0c0>] tasklet_hi_action+0x15/0xbf
[  447.627981] softirqs last  enabled at (1929196): [<c043999d>] _local_bh_enable+0x12/0x14
[  447.627989] softirqs last disabled at (1929197): [<c040443b>] do_softirq+0x63/0xb8
[  447.627999]
[  447.627999] other info that might help us debug this:
[  447.628004]  Possible unsafe locking scenario:
[  447.628004]
[  447.628009]        CPU0
[  447.628012]        ----
[  447.628016]   lock(&(&ah->block)->rlock);
[  447.628023]   <Interrupt>
[  447.628027]     lock(&(&ah->block)->rlock);
[  447.628034]
[  447.628034]  *** DEADLOCK ***

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>





Lockdep found an inconsistent lock state when joining a mesh with
ath5k.  The problem is that ath5k takes the lock for its beacon state,
ah->block, with spin_lock_irqsave(), while mesh internally takes the
sync_offset_lock with spin_lock_bh() in mesh_sync_offset_adjust_tbtt(),
which in turn is called under ah->block.

This could deadlock if the beacon tasklet was run on the processor
that held the beacon lock during the do_softirq() in spin_unlock_bh().

We probably shouldn't hold the lock around the callbacks, but the
easiest fix is to switch to spin_lock_bh for ah->block: it doesn't
need interrupts disabled anyway as the data in question is only accessed
in softirq or process context.

Fixes the following lockdep warning:

[  446.892304] WARNING: at kernel/softirq.c:159 _local_bh_enable_ip+0x38/0xa6()
[  446.892306] Hardware name: MacBook1,1
[  446.892309] Modules linked in: tcp_lp fuse sunrpc cpufreq_ondemand acpi_cpufreq mperf ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 ip6table_filter nf_defrag_ipv4 xt_state nf_conntrack ip6_tables ext2 arc4 btusb bluetooth snd_hda_codec_idt snd_hda_intel carl9170 snd_hda_codec coretemp joydev ath5k snd_hwdep snd_seq isight_firmware ath snd_seq_device snd_pcm applesmc appletouch mac80211 input_polldev snd_timer microcode cfg80211 snd lpc_ich pcspkr i2c_i801 mfd_core soundcore rfkill snd_page_alloc sky2 tpm_infineon virtio_net kvm_intel kvm i915 drm_kms_helper drm i2c_algo_bit i2c_core video
[  446.892385] Pid: 1892, comm: iw Not tainted 3.6.0-rc1-wl+ #296
[  446.892387] Call Trace:
[  446.892394]  [<c0432958>] warn_slowpath_common+0x7c/0x91
[  446.892398]  [<c04399d7>] ? _local_bh_enable_ip+0x38/0xa6
[  446.892403]  [<c04399d7>] ? _local_bh_enable_ip+0x38/0xa6
[  446.892459]  [<f7f9ae3b>] ? mesh_sync_offset_adjust_tbtt+0x95/0x99 [mac80211]
[  446.892464]  [<c043298f>] warn_slowpath_null+0x22/0x24
[  446.892468]  [<c04399d7>] _local_bh_enable_ip+0x38/0xa6
[  446.892473]  [<c0439a52>] local_bh_enable_ip+0xd/0xf
[  446.892479]  [<c088004f>] _raw_spin_unlock_bh+0x34/0x37
[  446.892527]  [<f7f9ae3b>] mesh_sync_offset_adjust_tbtt+0x95/0x99 [mac80211]
[  446.892569]  [<f7f7650f>] ieee80211_beacon_get_tim+0x28f/0x4e0 [mac80211]
[  446.892575]  [<c047ceeb>] ? trace_hardirqs_on_caller+0x10e/0x13f
[  446.892591]  [<f7fdc541>] ath5k_beacon_update+0x40/0x26b [ath5k]
[  446.892597]  [<c047ad67>] ? lock_acquired+0x1f5/0x21e
[  446.892612]  [<f7fdf9fb>] ? ath5k_bss_info_changed+0x167/0x1b2 [ath5k]
[  446.892617]  [<c087f9ea>] ? _raw_spin_lock_irqsave+0x78/0x82
[  446.892632]  [<f7fdf9fb>] ? ath5k_bss_info_changed+0x167/0x1b2 [ath5k]
[  446.892647]  [<f7fdfa09>] ath5k_bss_info_changed+0x175/0x1b2 [ath5k]
[  446.892651]  [<c0479dd4>] ? lock_is_held+0x73/0x7b
[  446.892662]  [<c0458fd5>] ? __might_sleep+0xa7/0x17a
[  446.892698]  [<f7f5d8f7>] ieee80211_bss_info_change_notify+0x1ed/0x21a [mac80211]
[  446.892703]  [<c0449875>] ? queue_work+0x24/0x32
[  446.892718]  [<f7fdf894>] ? ath5k_configure_filter+0x163/0x163 [ath5k]
[  446.892766]  [<f7f95fa4>] ieee80211_start_mesh+0xb9/0xbd [mac80211]
[  446.892806]  [<f7f6e610>] ieee80211_join_mesh+0x10c/0x116 [mac80211]
[  446.892834]  [<f7a96b90>] __cfg80211_join_mesh+0x176/0x1b3 [cfg80211]
[  446.892855]  [<f7a96c1c>] cfg80211_join_mesh+0x4f/0x6a [cfg80211]
[  446.892875]  [<f7a89891>] nl80211_join_mesh+0x1de/0x1ed [cfg80211]
[  446.892908]  [<f7a8db99>] ? nl80211_set_wiphy+0x4cf/0x4cf [cfg80211]
[  446.892919]  [<c07cfa36>] genl_rcv_msg+0x1d5/0x1f3
[  446.892940]  [<c07cf861>] ? genl_rcv+0x25/0x25
[  446.892946]  [<c07cf009>] netlink_rcv_skb+0x37/0x78
[  446.892950]  [<c07cf85a>] genl_rcv+0x1e/0x25
[  446.892955]  [<c07cebf3>] netlink_unicast+0xc3/0x12d
[  446.892959]  [<c07cee46>] netlink_sendmsg+0x1e9/0x213
[  446.892966]  [<c079f282>] sock_sendmsg+0x79/0x96
[  446.892972]  [<c04eb90d>] ? might_fault+0x9d/0xa3
[  446.892978]  [<c07a81d8>] ? copy_from_user+0x8/0xa
[  446.892983]  [<c07a852c>] ? verify_iovec+0x43/0x77
[  446.892987]  [<c079f4d8>] __sys_sendmsg+0x180/0x215
[  446.892993]  [<c045f107>] ? sched_clock_cpu+0x134/0x144
[  446.892997]  [<c047992f>] ? trace_hardirqs_off+0xb/0xd
[  446.893002]  [<c047bf88>] ? __lock_acquire+0x46b/0xb6e
[  446.893006]  [<c047992f>] ? trace_hardirqs_off+0xb/0xd
[  446.893010]  [<c045f149>] ? local_clock+0x32/0x49
[  446.893015]  [<c0479ec1>] ? lock_release_holdtime.part.9+0x4b/0x51
[  446.893020]  [<c0479dd4>] ? lock_is_held+0x73/0x7b
[  446.893025]  [<c050d127>] ? fcheck_files+0x97/0xcd
[  446.893029]  [<c050d4df>] ? fget_light+0x2d/0x81
[  446.893034]  [<c07a01f3>] sys_sendmsg+0x3b/0x52
[  446.893038]  [<c07a07b4>] sys_socketcall+0x238/0x2a2
[  446.893044]  [<c0885edf>] sysenter_do_call+0x12/0x38
[  446.893047] ---[ end trace a9af5998f929270f ]---
[  447.627222]
[  447.627232] =================================
[  447.627237] [ INFO: inconsistent lock state ]
[  447.627244] 3.6.0-rc1-wl+ #296 Tainted: G        W
[  447.627248] ---------------------------------
[  447.627253] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[  447.627260] swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
[  447.627264]  (&(&ah->block)->rlock){+.?...}, at: [<f7fdd2d1>] ath5k_tasklet_beacon+0x91/0xa7 [ath5k]
[  447.627299] {SOFTIRQ-ON-W} state was registered at:
[  447.627304]   [<c047cdbf>] mark_held_locks+0x59/0x77
[  447.627316]   [<c047ceeb>] trace_hardirqs_on_caller+0x10e/0x13f
[  447.627324]   [<c047cf27>] trace_hardirqs_on+0xb/0xd
[  447.627332]   [<c0439a3d>] _local_bh_enable_ip+0x9e/0xa6
[  447.627342]   [<c0439a52>] local_bh_enable_ip+0xd/0xf
[  447.627349]   [<c088004f>] _raw_spin_unlock_bh+0x34/0x37
[  447.627359]   [<f7f9ae3b>] mesh_sync_offset_adjust_tbtt+0x95/0x99 [mac80211]
[  447.627451]   [<f7f7650f>] ieee80211_beacon_get_tim+0x28f/0x4e0 [mac80211]
[  447.627526]   [<f7fdc541>] ath5k_beacon_update+0x40/0x26b [ath5k]
[  447.627547]   [<f7fdfa09>] ath5k_bss_info_changed+0x175/0x1b2 [ath5k]
[  447.627569]   [<f7f5d8f7>] ieee80211_bss_info_change_notify+0x1ed/0x21a [mac80211]
[  447.627628]   [<f7f95fa4>] ieee80211_start_mesh+0xb9/0xbd [mac80211]
[  447.627712]   [<f7f6e610>] ieee80211_join_mesh+0x10c/0x116 [mac80211]
[  447.627782]   [<f7a96b90>] __cfg80211_join_mesh+0x176/0x1b3 [cfg80211]
[  447.627816]   [<f7a96c1c>] cfg80211_join_mesh+0x4f/0x6a [cfg80211]
[  447.627845]   [<f7a89891>] nl80211_join_mesh+0x1de/0x1ed [cfg80211]
[  447.627872]   [<c07cfa36>] genl_rcv_msg+0x1d5/0x1f3
[  447.627881]   [<c07cf009>] netlink_rcv_skb+0x37/0x78
[  447.627891]   [<c07cf85a>] genl_rcv+0x1e/0x25
[  447.627898]   [<c07cebf3>] netlink_unicast+0xc3/0x12d
[  447.627907]   [<c07cee46>] netlink_sendmsg+0x1e9/0x213
[  447.627915]   [<c079f282>] sock_sendmsg+0x79/0x96
[  447.627926]   [<c079f4d8>] __sys_sendmsg+0x180/0x215
[  447.627934]   [<c07a01f3>] sys_sendmsg+0x3b/0x52
[  447.627941]   [<c07a07b4>] sys_socketcall+0x238/0x2a2
[  447.627949]   [<c0885edf>] sysenter_do_call+0x12/0x38
[  447.627959] irq event stamp: 1929200
[  447.627963] hardirqs last  enabled at (1929200): [<c043a0e9>] tasklet_hi_action+0x3e/0xbf
[  447.627972] hardirqs last disabled at (1929199): [<c043a0c0>] tasklet_hi_action+0x15/0xbf
[  447.627981] softirqs last  enabled at (1929196): [<c043999d>] _local_bh_enable+0x12/0x14
[  447.627989] softirqs last disabled at (1929197): [<c040443b>] do_softirq+0x63/0xb8
[  447.627999]
[  447.627999] other info that might help us debug this:
[  447.628004]  Possible unsafe locking scenario:
[  447.628004]
[  447.628009]        CPU0
[  447.628012]        ----
[  447.628016]   lock(&(&ah->block)->rlock);
[  447.628023]   <Interrupt>
[  447.628027]     lock(&(&ah->block)->rlock);
[  447.628034]
[  447.628034]  *** DEADLOCK ***

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>







ath9k: fix decrypt_error initialization in ath_rx_tasklet()
2012-08-13T19:17:24+00:00

Lorenzo Bianconi
lorenzo.bianconi83@gmail.com

2012-08-10T09:00:24+00:00

e1352fde5682ab1bdd2a9e5d75c22d1fe210ef77

ath_rx_tasklet() calls ath9k_rx_skb_preprocess() and ath9k_rx_skb_postprocess()
in a loop over the received frames. The decrypt_error flag is
initialized to false
just outside ath_rx_tasklet() loop. ath9k_rx_accept(), called by
ath9k_rx_skb_preprocess(),
only sets decrypt_error to true and never to false.
Then ath_rx_tasklet() calls ath9k_rx_skb_postprocess() and passes
decrypt_error to it.
So, after a decryption error, in ath9k_rx_skb_postprocess(), we can
have a leftover value
from another processed frame. In that case, the frame will not be marked with
RX_FLAG_DECRYPTED even if it is decrypted correctly.
When using CCMP encryption this issue can lead to connection stuck
because of CCMP
PN corruption and a waste of CPU time since mac80211 tries to decrypt an already
deciphered frame with ieee80211_aes_ccm_decrypt.
Fix the issue initializing decrypt_error flag at the begging of the
ath_rx_tasklet() loop.

Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
Cc: <stable@kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>





ath_rx_tasklet() calls ath9k_rx_skb_preprocess() and ath9k_rx_skb_postprocess()
in a loop over the received frames. The decrypt_error flag is
initialized to false
just outside ath_rx_tasklet() loop. ath9k_rx_accept(), called by
ath9k_rx_skb_preprocess(),
only sets decrypt_error to true and never to false.
Then ath_rx_tasklet() calls ath9k_rx_skb_postprocess() and passes
decrypt_error to it.
So, after a decryption error, in ath9k_rx_skb_postprocess(), we can
have a leftover value
from another processed frame. In that case, the frame will not be marked with
RX_FLAG_DECRYPTED even if it is decrypted correctly.
When using CCMP encryption this issue can lead to connection stuck
because of CCMP
PN corruption and a waste of CPU time since mac80211 tries to decrypt an already
deciphered frame with ieee80211_aes_ccm_decrypt.
Fix the issue initializing decrypt_error flag at the begging of the
ath_rx_tasklet() loop.

Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
Cc: <stable@kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>







ath9k: stop btcoex on device suspend
2012-08-10T18:51:29+00:00

Rajkumar Manoharan
rmanohar@qca.qualcomm.com

2012-08-09T07:07:26+00:00

e19f15ac6437624b6214b2f0ec0d69fb7eb205fa

During suspend, the device will be moved to FULLSLEEP state.
As btcoex is never been stopped, the btcoex timer is running
and tries to access hw on fullsleep state. Fix that.

Cc: stable@vger.kernel.org
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>





During suspend, the device will be moved to FULLSLEEP state.
As btcoex is never been stopped, the btcoex timer is running
and tries to access hw on fullsleep state. Fix that.

Cc: stable@vger.kernel.org
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>







wireless: at76c50x: signedness bug in at76_dfu_get_state()
2012-08-10T18:50:26+00:00

Dan Carpenter
dan.carpenter@oracle.com

2012-08-09T06:57:30+00:00

5d774b74ef7d0428a3e45c9bb5b3a0915d2240cb

This return holds the number of bytes transfered (1 byte) or a negative
error code.  The type should be int instead of u8.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>





This return holds the number of bytes transfered (1 byte) or a negative
error code.  The type should be int instead of u8.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>







rndis_wlan: Fix potential memory leak in update_pmkid()
2012-08-10T18:50:25+00:00

Alexey Khoroshilov
khoroshilov@ispras.ru

2012-08-08T15:44:21+00:00

60f53cf99060472973f16452116d9c467f8b08c6

Do not leak memory by updating pointer with potentially NULL realloc return value.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>





Do not leak memory by updating pointer with potentially NULL realloc return value.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>