From 746db510395e32ff57b9f8582e520df6b3fac618 Mon Sep 17 00:00:00 2001 From: "John W. Linville" Date: Fri, 10 Oct 2008 14:16:46 -0400 Subject: [PATCH 01/17] rtl8187: add device ID 0bda:8198 Reported by zOOmER.gm@gmail.com to work here: http://bugzilla.kernel.org/show_bug.cgi?id=11728 Signed-off-by: John W. Linville --- drivers/net/wireless/rtl8187_dev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c index e9902613e2ee..782327767278 100644 --- a/drivers/net/wireless/rtl8187_dev.c +++ b/drivers/net/wireless/rtl8187_dev.c @@ -37,6 +37,7 @@ static struct usb_device_id rtl8187_table[] __devinitdata = { {USB_DEVICE(0x0bda, 0x8187), .driver_info = DEVICE_RTL8187}, {USB_DEVICE(0x0bda, 0x8189), .driver_info = DEVICE_RTL8187B}, {USB_DEVICE(0x0bda, 0x8197), .driver_info = DEVICE_RTL8187B}, + {USB_DEVICE(0x0bda, 0x8198), .driver_info = DEVICE_RTL8187B}, /* Netgear */ {USB_DEVICE(0x0846, 0x6100), .driver_info = DEVICE_RTL8187}, {USB_DEVICE(0x0846, 0x6a00), .driver_info = DEVICE_RTL8187}, From 45527c2c4f698f8927239cfdec9f515cafed5f10 Mon Sep 17 00:00:00 2001 From: Rami Rosen Date: Tue, 7 Oct 2008 09:50:01 +0200 Subject: [PATCH 02/17] iwlwifi: fix compilation warning when CONFIG_IWLWIFI_DEBUG is not set. When CONFIG_IWLWIFI_DEBUG is not set and CONFIG_IWLWIFI is set, we get this compilation warning: /wireless-next-2.6/drivers/net/wireless/iwlwifi/iwl-agn-rs.c: In function 'rs_free_sta': /wireless-next-2.6/drivers/net/wireless/iwlwifi/iwl-agn-rs.c:2425: warning: unused variable 'priv' This patch fixes it by adding __maybe_unused attribute. Signed-off-by: Rami Rosen Signed-off-by: John W. Linville --- drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c index 93944de923ca..e2a58e477036 100644 --- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c @@ -2422,7 +2422,7 @@ static void rs_free_sta(void *priv_r, struct ieee80211_sta *sta, void *priv_sta) { struct iwl_lq_sta *lq_sta = priv_sta; - struct iwl_priv *priv = priv_r; + struct iwl_priv *priv __maybe_unused = priv_r; IWL_DEBUG_RATE("enter\n"); kfree(lq_sta); From 63044e9f54b6bac50d2380bf4d14f63e9e7de72b Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 7 Oct 2008 12:04:29 +0200 Subject: [PATCH 03/17] mac80211: fix debugfs lockup When debugfs_create_dir fails, sta_info_debugfs_add_work will not terminate because it will find the same station again and again. This is possible whenever debugfs fails for whatever reason; one reason is a race condition in mac80211, unfortunately we cannot do much about it, so just document it, it just means some station may be missing from debugfs. Signed-off-by: Johannes Berg Cc: Robin Holt Signed-off-by: John W. Linville --- net/mac80211/debugfs_sta.c | 11 +++++++++++ net/mac80211/sta_info.c | 7 ++++++- net/mac80211/sta_info.h | 1 + 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c index b9902e425f09..189d0bafa91a 100644 --- a/net/mac80211/debugfs_sta.c +++ b/net/mac80211/debugfs_sta.c @@ -249,11 +249,22 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta) DECLARE_MAC_BUF(mbuf); u8 *mac; + sta->debugfs.add_has_run = true; + if (!stations_dir) return; mac = print_mac(mbuf, sta->sta.addr); + /* + * This might fail due to a race condition: + * When mac80211 unlinks a station, the debugfs entries + * remain, but it is already possible to link a new + * station with the same address which triggers adding + * it to debugfs; therefore, if the old station isn't + * destroyed quickly enough the old station's debugfs + * dir might still be around. + */ sta->debugfs.dir = debugfs_create_dir(mac, stations_dir); if (!sta->debugfs.dir) return; diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index 9b72d15bc8dc..7fef8ea1f5ec 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -635,7 +635,12 @@ static void sta_info_debugfs_add_work(struct work_struct *work) spin_lock_irqsave(&local->sta_lock, flags); list_for_each_entry(tmp, &local->sta_list, list) { - if (!tmp->debugfs.dir) { + /* + * debugfs.add_has_run will be set by + * ieee80211_sta_debugfs_add regardless + * of what else it does. + */ + if (!tmp->debugfs.add_has_run) { sta = tmp; __sta_info_pin(sta); break; diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h index a6b51862a89d..168a39a298bd 100644 --- a/net/mac80211/sta_info.h +++ b/net/mac80211/sta_info.h @@ -300,6 +300,7 @@ struct sta_info { struct dentry *inactive_ms; struct dentry *last_seq_ctrl; struct dentry *agg_status; + bool add_has_run; } debugfs; #endif From 3eadd751eb8cb8090a65b4fa72c6360fd1aa5f06 Mon Sep 17 00:00:00 2001 From: Larry Finger Date: Tue, 7 Oct 2008 08:27:45 -0700 Subject: [PATCH 04/17] p54: Fix compilation problem on PPC The commit entitled "p54: Fix sparse warnings" introduced a compile error on PPC architecture. Thanks to Johannes Berg for reporting this problem. Signed-off-by: Signed-off-by: John W. Linville --- drivers/net/wireless/p54/p54common.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c index 1994aa199d37..117c7d3a52b0 100644 --- a/drivers/net/wireless/p54/p54common.c +++ b/drivers/net/wireless/p54/p54common.c @@ -479,7 +479,6 @@ static int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len) printk(KERN_ERR "p54: eeprom parse failed!\n"); return err; } -EXPORT_SYMBOL_GPL(p54_parse_eeprom); static int p54_rssi_to_dbm(struct ieee80211_hw *dev, int rssi) { From 09914813da37f1ee9d77998a0701629cfbbd98f4 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 7 Oct 2008 19:31:17 +0200 Subject: [PATCH 05/17] mac80211: fix HT information element parsing There's no checking that the HT IEs are of the right length which can be used by an attacker to cause an out-of-bounds access by sending a too short HT information/capability IE. Fix it by simply pretending those IEs didn't exist when too short. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville --- net/mac80211/ieee80211_i.h | 6 ++---- net/mac80211/mlme.c | 3 --- net/mac80211/util.c | 8 ++++---- 3 files changed, 6 insertions(+), 11 deletions(-) diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index 8025b294588b..156e42a003ae 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -816,8 +816,8 @@ struct ieee802_11_elems { u8 *ext_supp_rates; u8 *wmm_info; u8 *wmm_param; - u8 *ht_cap_elem; - u8 *ht_info_elem; + struct ieee80211_ht_cap *ht_cap_elem; + struct ieee80211_ht_addt_info *ht_info_elem; u8 *mesh_config; u8 *mesh_id; u8 *peer_link; @@ -844,8 +844,6 @@ struct ieee802_11_elems { u8 ext_supp_rates_len; u8 wmm_info_len; u8 wmm_param_len; - u8 ht_cap_elem_len; - u8 ht_info_elem_len; u8 mesh_config_len; u8 mesh_id_len; u8 peer_link_len; diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 49f86fa56bff..87665d7bb4f9 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -1348,10 +1348,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) { struct ieee80211_ht_bss_info bss_info; ieee80211_ht_cap_ie_to_ht_info( - (struct ieee80211_ht_cap *) elems.ht_cap_elem, &sta->sta.ht_info); ieee80211_ht_addt_info_ie_to_ht_bss_info( - (struct ieee80211_ht_addt_info *) elems.ht_info_elem, &bss_info); ieee80211_handle_ht(local, 1, &sta->sta.ht_info, &bss_info); } @@ -1709,7 +1707,6 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, struct ieee80211_ht_bss_info bss_info; ieee80211_ht_addt_info_ie_to_ht_bss_info( - (struct ieee80211_ht_addt_info *) elems.ht_info_elem, &bss_info); changed |= ieee80211_handle_ht(local, 1, &conf->ht_conf, &bss_info); diff --git a/net/mac80211/util.c b/net/mac80211/util.c index f32561ec224c..cee4884b9d06 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -529,12 +529,12 @@ void ieee802_11_parse_elems(u8 *start, size_t len, elems->ext_supp_rates_len = elen; break; case WLAN_EID_HT_CAPABILITY: - elems->ht_cap_elem = pos; - elems->ht_cap_elem_len = elen; + if (elen >= sizeof(struct ieee80211_ht_cap)) + elems->ht_cap_elem = (void *)pos; break; case WLAN_EID_HT_EXTRA_INFO: - elems->ht_info_elem = pos; - elems->ht_info_elem_len = elen; + if (elen >= sizeof(struct ieee80211_ht_addt_info)) + elems->ht_info_elem = (void *)pos; break; case WLAN_EID_MESH_ID: elems->mesh_id = pos; From d5d7c584810b3be2b70c979af3283a1e48b6574d Mon Sep 17 00:00:00 2001 From: Tomas Winkler Date: Wed, 8 Oct 2008 09:37:28 +0800 Subject: [PATCH 06/17] iwlwifi: fix ct kill configuration for 5350 This patch fixes ct kill configuration for 5350. Temperature units that HW expects are in Celsius not in kelvins. Signed-off-by: Tomas Winkler Signed-off-by: Zhu Yi Signed-off-by: John W. Linville --- drivers/net/wireless/iwlwifi/iwl-5000.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c index f6003e7996af..5155b8a760a7 100644 --- a/drivers/net/wireless/iwlwifi/iwl-5000.c +++ b/drivers/net/wireless/iwlwifi/iwl-5000.c @@ -833,12 +833,12 @@ static int iwl5000_hw_set_hw_params(struct iwl_priv *priv) switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) { case CSR_HW_REV_TYPE_5100: case CSR_HW_REV_TYPE_5300: - /* 5X00 wants in Celsius */ + case CSR_HW_REV_TYPE_5350: + /* 5X00 and 5350 wants in Celsius */ priv->hw_params.ct_kill_threshold = CT_KILL_THRESHOLD; break; case CSR_HW_REV_TYPE_5150: - case CSR_HW_REV_TYPE_5350: - /* 5X50 wants in Kelvin */ + /* 5150 wants in Kelvin */ priv->hw_params.ct_kill_threshold = CELSIUS_TO_KELVIN(CT_KILL_THRESHOLD); break; From c74e90a9e37c4a3923905189a6ebbd7ef61e6e67 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Wed, 8 Oct 2008 10:18:36 +0200 Subject: [PATCH 07/17] mac80211: fix debugfs netdev rename If, for some reason, a netdev has no debugfs dir, we shouldn't try to rename that dir. Signed-off-by: Johannes Berg Cc: Robin Holt Signed-off-by: John W. Linville --- net/mac80211/debugfs_netdev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c index 2a4515623776..2ad504fc3414 100644 --- a/net/mac80211/debugfs_netdev.c +++ b/net/mac80211/debugfs_netdev.c @@ -545,8 +545,12 @@ static int netdev_notify(struct notifier_block *nb, sdata = IEEE80211_DEV_TO_SUB_IF(dev); - sprintf(buf, "netdev:%s", dev->name); dir = sdata->debugfsdir; + + if (!dir) + return 0; + + sprintf(buf, "netdev:%s", dev->name); if (!debugfs_rename(dir->d_parent, dir, dir->d_parent, buf)) printk(KERN_ERR "mac80211: debugfs: failed to rename debugfs " "dir to %s\n", buf); From 33c0360bf74d5fded34cb08d3512ada32ad661e4 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Wed, 8 Oct 2008 10:23:48 +0200 Subject: [PATCH 08/17] cfg80211: fix debugfs error handling If something goes wrong creating the debugfs dir or when debugfs is not compiled in, the current code might lead to trouble; make it more robust. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville --- net/wireless/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/wireless/core.c b/net/wireless/core.c index 24fdd4cd22cb..5031db7b275b 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -184,7 +184,8 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev, if (result) goto out_unlock; - if (!debugfs_rename(rdev->wiphy.debugfsdir->d_parent, + if (rdev->wiphy.debugfsdir && + !debugfs_rename(rdev->wiphy.debugfsdir->d_parent, rdev->wiphy.debugfsdir, rdev->wiphy.debugfsdir->d_parent, newname)) @@ -317,6 +318,8 @@ int wiphy_register(struct wiphy *wiphy) drv->wiphy.debugfsdir = debugfs_create_dir(wiphy_name(&drv->wiphy), ieee80211_debugfs_dir); + if (IS_ERR(drv->wiphy.debugfsdir)) + drv->wiphy.debugfsdir = NULL; res = 0; out_unlock: From 552a71515eef5cba9af8bfe608149557059c4463 Mon Sep 17 00:00:00 2001 From: Andrey Borzenkov Date: Fri, 10 Oct 2008 20:22:38 +0400 Subject: [PATCH 09/17] orinoco: fix unsafe locking in orinoco_cs_resume [ 6972.562035] ================================= [ 6972.562040] [ INFO: inconsistent lock state ] [ 6972.562048] 2.6.27-1avb #17 [ 6972.562053] --------------------------------- [ 6972.562060] inconsistent {in-hardirq-W} -> {hardirq-on-W} usage. [ 6972.562068] pm-suspend/17062 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 6972.562076] (&priv->lock){++..}, at: [] orinoco_cs_resume+0x5b/0xd0 [orinoco_cs] [ 6972.562122] {in-hardirq-W} state was registered at: [ 6972.562128] [] __lock_acquire+0x6cb/0x1640 [ 6972.562171] [] lock_acquire+0x5c/0x80 [ 6972.562181] [] _spin_lock_irqsave+0x49/0x80 [ 6972.562210] [] orinoco_interrupt+0x4d/0x16d0 [orinoco] [ 6972.562257] [] handle_IRQ_event+0x31/0x60 [ 6972.562278] [] handle_level_irq+0x6e/0xe0 [ 6972.562291] [] do_IRQ+0xb0/0x130 [ 6972.562313] [] 0xffffffff Signed-off-by: Andrey Borzenkov Signed-off-by: John W. Linville --- drivers/net/wireless/orinoco_cs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/orinoco_cs.c b/drivers/net/wireless/orinoco_cs.c index 9eaa252c2430..65fd054e0172 100644 --- a/drivers/net/wireless/orinoco_cs.c +++ b/drivers/net/wireless/orinoco_cs.c @@ -403,6 +403,7 @@ static int orinoco_cs_resume(struct pcmcia_device *link) struct orinoco_private *priv = netdev_priv(dev); struct orinoco_pccard *card = priv->card; int err = 0; + unsigned long flags; if (! test_bit(0, &card->hard_reset_in_progress)) { err = orinoco_reinit_firmware(dev); @@ -412,7 +413,7 @@ static int orinoco_cs_resume(struct pcmcia_device *link) return -EIO; } - spin_lock(&priv->lock); + spin_lock_irqsave(&priv->lock, flags); netif_device_attach(dev); priv->hw_unavailable--; @@ -424,7 +425,7 @@ static int orinoco_cs_resume(struct pcmcia_device *link) dev->name, err); } - spin_unlock(&priv->lock); + spin_unlock_irqrestore(&priv->lock, flags); } return err; From c25bab54fe30d26a2cddf7058d77da72be630b23 Mon Sep 17 00:00:00 2001 From: David Kilroy Date: Fri, 10 Oct 2008 22:58:32 +0100 Subject: [PATCH 10/17] orinoco: fix unsafe locking in spectrum_cs_suspend A similar problem was highlighted in the orinoco_cs driver by lockdep. This patch fixes the spectrum_cs driver. Signed-off-by: David Kilroy Signed-off-by: John W. Linville --- drivers/net/wireless/spectrum_cs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/spectrum_cs.c b/drivers/net/wireless/spectrum_cs.c index 67b26d3c3cd5..f5513cd4db35 100644 --- a/drivers/net/wireless/spectrum_cs.c +++ b/drivers/net/wireless/spectrum_cs.c @@ -450,10 +450,11 @@ spectrum_cs_suspend(struct pcmcia_device *link) { struct net_device *dev = link->priv; struct orinoco_private *priv = netdev_priv(dev); + unsigned long flags; int err = 0; /* Mark the device as stopped, to block IO until later */ - spin_lock(&priv->lock); + spin_lock_irqsave(&priv->lock, flags); err = __orinoco_down(dev); if (err) @@ -463,7 +464,7 @@ spectrum_cs_suspend(struct pcmcia_device *link) netif_device_detach(dev); priv->hw_unavailable++; - spin_unlock(&priv->lock); + spin_unlock_irqrestore(&priv->lock, flags); return err; } From d048e503a2b01e771ee87921c24d89d7ec3f0c2f Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 11 Oct 2008 03:29:55 +0300 Subject: [PATCH 11/17] mac80211: Fix scan RX processing oops ieee80211_bss_info_update() can return NULL. Verify that this is not the case before calling ieee802111_rx_bss_put() which would trigger an oops in interrupt context in atomic_dec_and_lock(). Signed-off-by: Jouni Malinen Acked-by: Johannes Berg Acked-by: Benoit Papillault Signed-off-by: John W. Linville --- net/mac80211/scan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c index 8e6685e7ae85..416bb41099f3 100644 --- a/net/mac80211/scan.c +++ b/net/mac80211/scan.c @@ -388,7 +388,8 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb, bss = ieee80211_bss_info_update(sdata->local, rx_status, mgmt, skb->len, &elems, freq, beacon); - ieee80211_rx_bss_put(sdata->local, bss); + if (bss) + ieee80211_rx_bss_put(sdata->local, bss); dev_kfree_skb(skb); return RX_QUEUED; From 96d46d5d792d96f80e9bd274ab6d433b8a3c22bc Mon Sep 17 00:00:00 2001 From: Manish Katiyar Date: Mon, 13 Oct 2008 16:22:42 +0530 Subject: [PATCH 12/17] libertas : Remove unused variable warning for "old_channel" from cmd.c Below patch removes the following warning during compilation. drivers/net/wireless/libertas/cmd.c:826: warning: unused variable 'old_channel' Signed-off-by : Manish Katiyar Acked-by: Dan Williams Signed-off-by: John W. Linville --- drivers/net/wireless/libertas/cmd.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c index a912fb68c099..297696de2da0 100644 --- a/drivers/net/wireless/libertas/cmd.c +++ b/drivers/net/wireless/libertas/cmd.c @@ -823,7 +823,9 @@ int lbs_update_channel(struct lbs_private *priv) int lbs_set_channel(struct lbs_private *priv, u8 channel) { struct cmd_ds_802_11_rf_channel cmd; +#ifdef DEBUG u8 old_channel = priv->curbssparams.channel; +#endif int ret = 0; lbs_deb_enter(LBS_DEB_CMD); From 4233df6b748193d45f79fb7448991a473061a65d Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Mon, 13 Oct 2008 13:35:05 +0200 Subject: [PATCH 13/17] ath9k/mac80211: disallow fragmentation in ath9k, report to userspace As I've reported, ath9k currently fails utterly when fragmentation is enabled. This makes ath9k "support" hardware fragmentation by not supporting fragmentation at all to avoid the double-free issue. The patch also changes mac80211 to report errors from the driver operation to userspace. That hack in ath9k should be removed once the rate control algorithm it has is fixed, and we can at that time consider removing the hw fragmentation support entirely since it's not used by any driver. Signed-off-by: Johannes Berg Cc: stable@kernel.org Acked-by: Luis R. Rodriguez Signed-off-by: John W. Linville --- drivers/net/wireless/ath9k/main.c | 8 +++++++- net/mac80211/wext.c | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c index 74726990d59e..f05f584ab7bc 100644 --- a/drivers/net/wireless/ath9k/main.c +++ b/drivers/net/wireless/ath9k/main.c @@ -1640,6 +1640,11 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw, return ret; } +static int ath9k_no_fragmentation(struct ieee80211_hw *hw, u32 value) +{ + return -EOPNOTSUPP; +} + static struct ieee80211_ops ath9k_ops = { .tx = ath9k_tx, .start = ath9k_start, @@ -1664,7 +1669,8 @@ static struct ieee80211_ops ath9k_ops = { .get_tsf = ath9k_get_tsf, .reset_tsf = ath9k_reset_tsf, .tx_last_beacon = NULL, - .ampdu_action = ath9k_ampdu_action + .ampdu_action = ath9k_ampdu_action, + .set_frag_threshold = ath9k_no_fragmentation, }; static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c index 7e0d53abde24..742f811ca416 100644 --- a/net/mac80211/wext.c +++ b/net/mac80211/wext.c @@ -775,7 +775,7 @@ static int ieee80211_ioctl_siwfrag(struct net_device *dev, * configure it here */ if (local->ops->set_frag_threshold) - local->ops->set_frag_threshold( + return local->ops->set_frag_threshold( local_to_hw(local), local->fragmentation_threshold); From e1a65b5828edfddb29c6fb4eb556fa503295146b Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Mon, 13 Oct 2008 09:15:01 -0700 Subject: [PATCH 14/17] mac80211: fixme for kernel-doc Fix kernel-doc warnings in mac80211.h. Fields need real explanations added to them. Warning(lin2627-g3-kdocfixes//include/net/mac80211.h:659): No description found for parameter 'icv_len' Warning(lin2627-g3-kdocfixes//include/net/mac80211.h:659): No description found for parameter 'iv_len' Signed-off-by: Randy Dunlap Signed-off-by: John W. Linville --- include/net/mac80211.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/net/mac80211.h b/include/net/mac80211.h index 5617a1613c91..d861197f83c7 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -645,7 +645,8 @@ enum ieee80211_key_flags { * - Temporal Encryption Key (128 bits) * - Temporal Authenticator Tx MIC Key (64 bits) * - Temporal Authenticator Rx MIC Key (64 bits) - * + * @icv_len: FIXME + * @iv_len: FIXME */ struct ieee80211_key_conf { enum ieee80211_key_alg alg; From ec366eba3b8d96fdb2e629c64fa2750be2723ba7 Mon Sep 17 00:00:00 2001 From: Christian Lamparter Date: Mon, 13 Oct 2008 23:41:53 +0200 Subject: [PATCH 15/17] p54usb: Device ID updates This patch updates p54usb's device list. It adds the ID for SMC 2862W-G v2 and marks the "Spinnaker Proto board" as a first generation device. Reported-by: Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville --- drivers/net/wireless/p54/p54usb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c index 1912f5e9a0a9..75d749bccb0d 100644 --- a/drivers/net/wireless/p54/p54usb.c +++ b/drivers/net/wireless/p54/p54usb.c @@ -39,6 +39,7 @@ static struct usb_device_id p54u_table[] __devinitdata = { {USB_DEVICE(0x0846, 0x4200)}, /* Netgear WG121 */ {USB_DEVICE(0x0846, 0x4210)}, /* Netgear WG121 the second ? */ {USB_DEVICE(0x0846, 0x4220)}, /* Netgear WG111 */ + {USB_DEVICE(0x09aa, 0x1000)}, /* Spinnaker Proto board */ {USB_DEVICE(0x0cde, 0x0006)}, /* Medion 40900, Roper Europe */ {USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */ {USB_DEVICE(0x1915, 0x2234)}, /* Linksys WUSB54G OEM */ @@ -63,8 +64,8 @@ static struct usb_device_id p54u_table[] __devinitdata = { {USB_DEVICE(0x0cde, 0x0006)}, /* Medion MD40900 */ {USB_DEVICE(0x0cde, 0x0008)}, /* Sagem XG703A */ {USB_DEVICE(0x0d8e, 0x3762)}, /* DLink DWL-G120 Cohiba */ - {USB_DEVICE(0x09aa, 0x1000)}, /* Spinnaker Proto board */ {USB_DEVICE(0x124a, 0x4025)}, /* IOGear GWU513 (GW3887IK chip) */ + {USB_DEVICE(0x1260, 0xee22)}, /* SMC 2862W-G version 2 */ {USB_DEVICE(0x13b1, 0x000a)}, /* Linksys WUSB54G ver 2 */ {USB_DEVICE(0x13B1, 0x000C)}, /* Linksys WUSB54AG */ {USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */ From eaca90dab6ab9853223029deffdd226f41b2028c Mon Sep 17 00:00:00 2001 From: Florent Fourcot Date: Mon, 13 Oct 2008 16:34:26 -0700 Subject: [PATCH 16/17] rtl8187: Add USB ID for Belkin F5D7050 with RTL8187B chip The Belkin F5D7050rev5000de (id 050d:705e) has the Realtek RTL8187B chip and works with the 2.6.27 driver. Signed-off-by: Larry Finger Signed-off-by: John W. Linville --- drivers/net/wireless/rtl8187_dev.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c index 782327767278..431e3c78bf27 100644 --- a/drivers/net/wireless/rtl8187_dev.c +++ b/drivers/net/wireless/rtl8187_dev.c @@ -33,6 +33,8 @@ MODULE_LICENSE("GPL"); static struct usb_device_id rtl8187_table[] __devinitdata = { /* Asus */ {USB_DEVICE(0x0b05, 0x171d), .driver_info = DEVICE_RTL8187}, + /* Belkin */ + {USB_DEVICE(0x050d, 0x705e), .driver_info = DEVICE_RTL8187B}, /* Realtek */ {USB_DEVICE(0x0bda, 0x8187), .driver_info = DEVICE_RTL8187}, {USB_DEVICE(0x0bda, 0x8189), .driver_info = DEVICE_RTL8187B}, From 8713a7ccd88d93d9f8a72436088d6627c82490db Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 14 Oct 2008 23:57:43 +0200 Subject: [PATCH 17/17] rt2x00: fix regression introduced by "mac80211: free up 2 bytes in skb->cb" The hw_key pointer is used (and obviously NULL) after skb->cb is memset to 0. This patch grabs the iv_len before the memset call. Signed-off-by: Felix Fietkau Signed-off-by: Stephen Blackheath Acked-by: Johannes Berg Signed-off-by: John W. Linville --- drivers/net/wireless/rt2x00/rt2x00queue.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c index 1676ac484790..451d410ecdae 100644 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c @@ -374,7 +374,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb) struct queue_entry *entry = rt2x00queue_get_entry(queue, Q_INDEX); struct txentry_desc txdesc; struct skb_frame_desc *skbdesc; - unsigned int iv_len; + unsigned int iv_len = 0; if (unlikely(rt2x00queue_full(queue))) return -EINVAL; @@ -395,6 +395,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb) entry->skb = skb; rt2x00queue_create_tx_descriptor(entry, &txdesc); + if (IEEE80211_SKB_CB(skb)->control.hw_key != NULL) + iv_len = IEEE80211_SKB_CB(skb)->control.hw_key->iv_len; + /* * All information is retreived from the skb->cb array, * now we should claim ownership of the driver part of that @@ -410,9 +413,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb) * the frame so we can provide it to the driver seperately. */ if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc.flags) && - !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags) && - (IEEE80211_SKB_CB(skb)->control.hw_key != NULL)) { - iv_len = IEEE80211_SKB_CB(skb)->control.hw_key->iv_len; + !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags)) { rt2x00crypto_tx_remove_iv(skb, iv_len); }