Commit Graph

11708 Commits

Author SHA1 Message Date
Steve Hodgson
2d18835d65 sfc: SFX7101: Remove workaround for bad link training
Early versions of the SFX7101 firmware could complete link training in
a state where it would not adequately cancel noise (Solarflare bug
10750).  We previously worked around this by resetting the PHY after
seeing many Ethernet CRC errors.  This workaround is unsafe since it
takes no account of the interval between errors; it also appears to
be unnecessary with production firmware.  Therefore remove it.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30 14:06:27 -08:00
Steve Hodgson
869b5b3888 sfc: SFT9001: Enable robust link training
Enable a firmware option that appears to be necessary for reliable
operation.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30 14:06:27 -08:00
Alexey Dobriyan
a11da890e4 sky2: fix hard hang with netconsoling and iface going up
Printing anything over netconsole before hw is up and running is,
of course, not going to work.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30 14:06:26 -08:00
Philippe De Muyter
f99ec0649a tulip: fix 21142 with 10Mbps without negotiation
with current kernels, tulip 21142 ethernet controllers fail to connect
to a 10Mbps only (i.e. without negotiation-partner) network.  It used
to work in 2.4 kernels.  Fix that.  Tested on a 21142 Rev 0x11.

Signed-off-by: Philippe De Muyter <phdm@macqel.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-29 17:35:04 -08:00
Roel Kluin
c25b9abbc2 drivers/net/skfp: if !capable(CAP_NET_ADMIN): inverted logic
Fix inverted logic

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-29 17:32:20 -08:00
Anton Vorontsov
e5664bb2a7 gianfar: Fix Wake-on-LAN support
commit 0f0ca340e5 ("phy: power
management support") caused a regression in the gianfar driver.

Now phylib turns off PHY power during suspend, and thus WOL
doesn't work anymore.

This patch workarounds the issue by enabling wakeup in the MDIO
device, i.e. just restores the old behaviour for the gianfar
driver. Note that this way all PHYs on a given MDIO bus won't
be turned off during suspend, which isn't good from the power
saving point of view.

A proper, per netdevice wakeup management support will need
a bit reworked phylib suspend/resume logic.

Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-29 17:31:13 -08:00
Roel Kluin
f307dbd88d smsc911x: timeout reaches -1
With a postfix decrement the timeout will reach -1 rather than 0,
so the warning will not be issued.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Steve Glendinning <steve.glendinning@smsc.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-29 17:30:00 -08:00
Steve Glendinning
1609559547 smsc9420: fix interrupt signalling test failures
smsc9420 performs an interrupt signalling test when the interface is
brought up.  The current code mistakenly sets its test flag to false
AFTER enabling the software interrupt source, making failure quite
likely.

This patch changes the code to set the test flag BEFORE enabling
interrupts. I've also removed an smp_wmb because the following spinlock
provides an implicit memory barrier.

Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-29 17:29:15 -08:00
Haiying Wang
b1c4a9dddf ucc_geth: Change uec phy id to the same format as gianfar's
The commit b31a1d8b41 ("gianfar: Convert
gianfar to an of_platform_driver") changes the gianfar's phy id to the
format like "mdio@xxxx:xx", but uec still uses the old format like
"xxxxxxxx:xx".  For the board whose UEC uses gianfar-mdio like
MPC8568MDS, the phy can not be attached because of the incompatible
phy id format. This patch changes uec's phy id to the same format as
gianfar's.

Signed-off-by: Haiying Wang <Haiying.Wang@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-29 17:28:04 -08:00
Inaky Perez-Gonzalez
1af7ad5104 wimax: fix build issue when debugfs is disabled
As reported by Toralf Förster and Randy Dunlap.

- http://linuxwimax.org/pipermail/wimax/2009-January/000460.html

- http://lkml.org/lkml/2009/1/29/279

The definitions needed for the wimax stack and i2400m driver debug
infrastructure was, by mistake, compiled depending on CONFIG_DEBUG_FS
(by them being placed in the debugfs.c files); thus the build broke in
2.6.29-rc3 when debugging was enabled (CONFIG_WIMAX_DEBUG) and
DEBUG_FS was disabled.

These definitions are always needed if debug is enabled at compile
time (independently of DEBUG_FS being or not enabled), so moving them
to a file that is always compiled fixes the issue.

Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-29 17:18:31 -08:00
Daniel Marjamäki
584dbe9475 netxen: fix memory leak in drivers/net/netxen_nic_init.c
For kernel bugzilla #12537:
http://bugzilla.kernel.org/show_bug.cgi?id=12537

Free memory.

Signed-off-by: Daniel Marjamäki <danielm77@spray.se>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-29 16:56:14 -08:00
Dhananjay Phadke
e125646ab5 netxen: revert jumbo ringsize
Reducing jumbo ring size below 1024 reduces throughput for old
firmwares (3.4.216 and older) running on older (NX2031) chip,
so restore it back to 1024.

This was reduced in commit 32ec803348
("netxen: reduce memory footprint").

Raising jumbo ring size from 512 to 1024, adds ~4MB per port, but
there's still big saving because of original patch (~20MB per port).

Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-29 16:05:19 -08:00
David S. Miller
ae9e47e9e8 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 2009-01-29 15:27:47 -08:00
Bob Copeland
be0093705c ath5k: fix locking in ath5k_config
ath5k_config updates the software context without taking sc->lock.

Changes-licensed-under: 3-Clause-BSD

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Acked-by: Nick Kossifidis <mickflemm@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-29 16:11:19 -05:00
Zhu, Yi
1f304e4e3b iwlwifi: fix kernel oops when ucode DMA memory allocation failure
The patch fixes memcpy to NULL address when the ucode DMA allocation failure.

This is a fix to bug
http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1861

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-29 15:46:43 -05:00
Larry Finger
eb83bbf574 rtl8187: Fix error in setting OFDM power settings for RTL8187L
After reports of poor performance, a review of the latest vendor driver
(rtl8187_linux_26.1025.0328.2007) for RTL8187L devices was undertaken.

A difference was found in the code used to index the OFDM power tables. When
the Linux driver was changed, my unit works at a much greater range than
before. I think this fixes Bugzilla #12380 and has been tested by at least
two other users.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Tested-by: Martín Ernesto Barreyro <barreyromartin@gmail.com>
Cc: Stable <stable@kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-29 15:46:42 -05:00
Jesse Brandeburg
15b2bee22a e1000: fix bug with shared interrupt during reset
A nasty bug was found where an MTU change (or anything else that caused a
reset) could race with the interrupt code.  The interrupt code was entered
by a shared interrupt during the MTU change.

This change prevents the interrupt code from running while the driver is in
the middle of its reset path.

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-27 16:41:58 -08:00
Manish Katiyar
a7a41acf99 r6040: Remove unused variable pdev from drivers/net/r6040.c
drivers/net/r6040.c:441: warning: unused variable 'pdev'

Signed-off-by: Manish Katiyar <mkatiyar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26 21:54:21 -08:00
Ira W. Snyder
8527bec548 virtio_net: use correct accessors for scatterlists
Without this fix, virtio_net makes incorrect usage of scatterlists. It sets
the end of the scatterlist chain after the first element, despite the fact
that more entries come after it.

If you try to run dma_map_sg() on one of the scatterlists given to you by
add_buf(), you will get a null pointer oops.

Signed-off-by: Ira W. Snyder <iws@ovro.caltech.edu>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26 21:00:33 -08:00
Linus Torvalds
5376071069 Merge master.kernel.org:/home/rmk/linux-2.6-arm
* master.kernel.org:/home/rmk/linux-2.6-arm: (22 commits)
  [ARM] fix section-based ioremap
  [NET] am79c961a: fix spin_lock usage
  [ARM] omap: usb: thou shalt not provide empty release functions
  [ARM] omap: watchdog: allow OMAP watchdog driver on OMAP34xx platforms
  [ARM] 5369/1: omap mmc: Add new omap hsmmc controller for 2430 and 34xx, v3
  [ARM] clkdev: fix clock matching
  [ARM] 5370/1: at91: fix rm9200 watchdog
  [ARM] 5368/1: arch/arm/mach-davinci/usb.c buildfix
  [ARM] 5365/1: s3cmci: Use new include path of dma.h
  [ARM] fix StrongARM-11x0 page copy implementation
  [ARM] omap: ensure OMAP drivers pass a struct device to clk_get()
  ARM: OMAP: Fix compile for h3 MMC
  ARM: OMAP: Remove unused platform devices, v3
  ARM: OMAP: Fix ASoC by enabling writes to XCCR and RCCR McBSP registers, v3
  ARM: OMAP: Fix OSK ASoC by registering I2C board info for tlvaic23
  ARM: OMAP: remove duplicated #include's
  ARM: OMAP: Fix DMA CCR programming for request line > 63, v3
  ARM: OMAP: Fix gpio.c compile on 15xx with CONFIG_DEBUGFS
  ARM: OMAP: Fix compile for beagle
  ARM: OMAP: Fix gpio by switching to generic gpio calls, v2
  ...
2009-01-26 15:12:47 -08:00
Anton Vorontsov
cd1f55a5b4 gianfar: Revive VLAN support
commit 77ecaf2d5a ("gianfar: Fix VLAN
HW feature related frame/buffer size calculation") wrongly removed
priv->vlgrp assignment, and now priv->vlgrp is always NULL.

This patch fixes the issue, plus fixes following sparse warning
introduced by the same commit:
gianfar.c:1406:13: warning: context imbalance in 'gfar_vlan_rx_register' - wrong count at exit

gfar_vlan_rx_register() checks for "if (old_grp == grp)" and tries
to return w/o dropping the lock.

According to net/8021q/vlan.c VLAN core issues rx_register() callback:
1. In register_vlan_dev() only on a newly created group;
2. In unregister_vlan_dev() only if the group becomes empty.

Thus the check in the gianfar driver isn't needed.

Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Acked-by: Andy Fleming <afleming@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26 14:33:23 -08:00
Vladislav Zolotarov
e8b5fc514d bnx2x: tx_has_work should not wait for FW
The current tx_has_work waited until all packets sent by the driver
are marked as completed by the FW. This is too greedy and it causes
the bnx2x_poll to spin in vain. The driver should only check that all
packets FW already completed are freed - only in unload flow the
driver should make sure that transmit queue is empty

Signed-off-by: Vladislav Zolotarov <vladz@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26 12:36:42 -08:00
Dhananjay Phadke
32ec803348 netxen: reduce memory footprint
o reduce rx ring size from 8192 to 4096.
o cut down old huge lro buffers.

Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26 12:35:19 -08:00
Dhananjay Phadke
cdff103649 netxen: fix vlan tso/checksum offload
o set netdev->vlan_features appropriately.
o fix tso descriptor initialization for vlan case.

Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26 12:34:57 -08:00
Jesse Brandeburg
78272bbab8 e1000e: workaround hw errata
There is a hardware errata in some revisions of the 82574 that needs
to be worked around in the driver by setting a register bit at init.

If this bit is not set A0 versions of the 82574 can generate
tx hangs.

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26 12:16:26 -08:00
David S. Miller
71be7a3602 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 2009-01-25 21:36:34 -08:00
Alex Williamson
e918085aaf virtio_net: Fix MAX_PACKET_LEN to support 802.1Q VLANs
802.1Q expanded the maximum ethernet frame size by 4 bytes for the
VLAN tag.  We're not taking this into account in virtio_net, which
means the buffers we provide to the backend in the virtqueue RX ring
aren't big enough to hold a full MTU VLAN packet.  For QEMU/KVM,
this results in the backend exiting with a packet truncation error.

Signed-off-by: Alex Williamson <alex.williamson@hp.com>
Acked-by: Mark McLoughlin <markmc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-25 18:06:26 -08:00
Uwe Kleine-König
fb22d72782 [NET] am79c961a: fix spin_lock usage
spin_lock functions take a pointer to the lock, not the lock itself.
This error was noticed by compiling ebsa110_defconfig for linux-rt where
the locking functions obviously are more picky about their arguments.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Cc: Roel Kluin <12o3l@tiscali.nl>
Cc: Steven Rostedt <srostedt@redhat.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2009-01-24 23:21:33 +00:00
Larry Finger
2fcbab044a rtl8187: Add termination packet to prevent stall
The RTL8187 and RTL8187B devices can stall unless an explicit termination
packet is sent.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-23 15:38:36 -05:00
Abbas, Mohamed
c338ba3ca5 iwlwifi: fix rs_get_rate WARN_ON()
In ieee80211_sta structure there is u64 supp_rates[IEEE80211_NUM_BANDS]
this is filled with all support rate from assoc_resp.  If we associate
with G-band AP only supp_rates of G-band will be set the other band
supp_rates will be set to 0. If the user type this command
this will cause mac80211 to set to new channel, mac80211
does not disassociate in setting new channel, so the active
band is now A-band. then in handling the new essid mac80211 will
kick in the assoc steps which involve sending disassociation frame.
in this mac80211 will WARN_ON sta->supp_rates[A_BAND] == 0.

This fixes:
http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1822
http://www.kerneloops.org/searchweek.php?search=rs_get_rate

Signed-off-by: mohamed abbas <mohamed.abbas@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-23 15:38:36 -05:00
Christian Lamparter
b4068a8049 p54usb: fix packet loss with first generation devices
Artur Skawina confirmed that the first generation devices needs the same
URB_ZERO_PACKET flag, in oder to finish the pending transfer properly.
The second generation has been successfully fixed by
"p54usb: fix random traffic stalls (LM87)" (43af18f06d5)

Signed-off-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-23 15:38:35 -05:00
Steve Glendinning
c64d2a9afb phy: Add suspend/resume support to SMSC PHYs
All supported SMSC PHYs implement the standard "power down" bit 11 of
BMCR, so this patch adds support using the generic genphy_{suspend,resume}
functions.

Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-22 14:07:43 -08:00
Anton Vorontsov
6f051069d8 phylib: Fix oops in suspend/resume paths
Suspend/resume routines check for phydrv != NULL, but that is
wrong because "phydrv" comes from container_of(drv). If drv is NULL,
then container_of(drv) will return non-NULL result, and the checks
won't work.

The Freescale TBI PHYs are driver-less, so "drv" is NULL, and that
leads to the following oops:

Unable to handle kernel paging request for data at address 0xffffffe4
Faulting instruction address: 0xc0215554
Oops: Kernel access of bad area, sig: 11 [#1]
[...]
NIP [c0215554] mdio_bus_suspend+0x34/0x70
LR [c01cc508] suspend_device+0x258/0x2bc
Call Trace:
[cfad3da0] [cfad3db8] 0xcfad3db8 (unreliable)
[cfad3db0] [c01cc508] suspend_device+0x258/0x2bc
[cfad3dd0] [c01cc62c] dpm_suspend+0xc0/0x140
[cfad3e20] [c01cc6f4] device_suspend+0x48/0x5c
[cfad3e40] [c0068dd8] suspend_devices_and_enter+0x8c/0x148
[cfad3e60] [c00690f8] enter_state+0x100/0x118
[cfad3e80] [c00691c0] state_store+0xb0/0xe4
[cfad3ea0] [c018c938] kobj_attr_store+0x24/0x3c
[cfad3eb0] [c00ea9a8] flush_write_buffer+0x58/0x7c
[cfad3ed0] [c00eadf0] sysfs_write_file+0x58/0xa0
[cfad3ef0] [c009e810] vfs_write+0xb4/0x16c
[cfad3f10] [c009ed40] sys_write+0x4c/0x90
[cfad3f40] [c0014954] ret_from_syscall+0x0/0x38
[...]

This patch fixes the issue, plus removes unneeded parentheses
and fixes indentation level in mdio_bus_suspend().

Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-22 13:51:24 -08:00
Eilon Greenstein
5422a22573 bnx2x: Version
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-22 13:47:13 -08:00
Eilon Greenstein
3910c8ae44 bnx2x: loopback test failure
A link change interrupt might be queued and activated after the loopback was set
and it will cause the loopback to fail. The PHY lock should be kept until the
loopback test is over.

That implies that the bnx2x_test_link should used within the loopback function
and not bnx2x_wait_for_link since that function also takes the PHY link

Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-22 13:47:12 -08:00
Eilon Greenstein
5650d9d4cb bnx2x: Missing rmb when waiting for FW response
Waiting for the FW to response requires a memory barrier

Signed-off-by: Michal Kalderon <michals@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-22 13:47:12 -08:00
Eilon Greenstein
7cde1c8b79 bnx2x: Calling napi_del
rmmod might hang without this patch since the reference counter is not going
down

Signed-off-by: Yitchak Gertner <gertner@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-22 13:47:11 -08:00
Eilon Greenstein
6eccabb301 bnx2x: Carrier off first call
Call carrier off should not be called after register_netdev since after
register netdev open can be called at any time followed by an interrupt that
will set it to carrier_on and the probe will resume control and set it to off

Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-22 13:45:06 -08:00
Eilon Greenstein
2dfe0e1fec bnx2x: Handling load failures
Failures on load were not handled correctly - separate the flow to handle

different failures

Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-22 13:45:06 -08:00
Eilon Greenstein
e94d8af3da bnx2x: Disable napi
Calling napi disabled unconditionally at netif stop

Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-22 13:45:05 -08:00
Eilon Greenstein
81f75bbf67 bnx2x: Reset HW before use
To avoid complications, make sure that the HW is in reset (as it should be)
before trying to take it out of reset. In normal flows, the HW is indeed in rest
so this should have no effect

Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-22 13:45:05 -08:00
Reinette Chatre
637f883739 iwlwifi: return NETDEV_TX_OK from _tx ops
be consistent with mac80211 drivers and return correct return code.
NETDEV_TX_OK is 0, but we need to be consistent wrt formatting amongst
implementations

re: http://marc.info/?l=linux-wireless&m=123119327419865&w=2

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Reviewed-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22 13:55:03 -05:00
Hin-Tak Leung
de2624966f zd1211rw: adding Sitecom WL-603 (0df6:0036) to the USB id list
Giuseppe Cala <jiveaxe@gmail.com> (The second "a" in "Cala" should be
a grave, U+00E0) reported success on zd1211-devs@lists.sourceforge.net.
The chip info is:
zd1211b chip 0df6:0036 v4810 high 00-0c-f6 AL2230_RF pa0 g--N-

The Sitecom WL-603 is detected as a zd1211b with a AL2230 RF transceiver chip.

Signed-off-by: Giuseppe Cala <jiveaxe@gmail.com>
Signed-off-by: Hin-Tak Leung <htl10@users.sourceforge.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22 13:55:03 -05:00
Christian Lamparter
e2fe154e91 p54usb: fix nasty use after free
In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina <art.08.09@gmail.com> has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.

Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue.

Signed-off-by: Christian Lamparter <chunkeey@web.de>
Tested-by: Artur Skawina <art.08.09@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22 13:55:02 -05:00
Christian Lamparter
12da401e0d p54: more cryptographic accelerator fixes
If we let the firmware do the data encryption, we have to remove the ICV and
(M)MIC at the end of the frame before we can give it back to mac80211.
Or, these data frames have a few trailing bytes on cooked monitor interfaces.

Signed-off-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22 13:55:02 -05:00
Chr
40ab73cc6c p54: add missing break in eeprom parser
This patch fixes a obvious memory leak in the eeprom parser.

Signed-off-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22 13:55:02 -05:00
Pavel Roskin
11eaea4167 orinoco: use KERN_DEBUG for link status messages
KERN_INFO is too "loud" for messages that are generated by the ordinary
events, such as accociation.  Use of KERN_DEBUG is consistent with
mac80211.

Suggested by Michael Gilbert <michael.s.gilbert@gmail.com>

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22 13:55:01 -05:00
Ivo van Doorn
7490889c10 rt2x00: Fix TX rate short preamble detection
Mac80211 provides 2 structures to handle bitrates, namely
ieee80211_rate and ieee80211_tx_rate. To determine the short preamble
mode for an outgoing frame, the flag IEEE80211_TX_RC_USE_SHORT_PREAMBLE
must be checked on ieee80211_tx_rate and not ieee80211_rate (which rt2x00 did).

This fixes a regression which was triggered in 2.6.29-rcX as reported by Chris Clayton.

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Tested-By: Chris Clayton <chris2553@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22 13:55:01 -05:00
Andrey Borzenkov
7fe99c4e28 orinoco: move kmalloc(..., GFP_KERNEL) outside spinlock in orinoco_ioctl_set_genie
[   56.923623] BUG: sleeping function called from invalid context at /home/bor/src/linux-git/mm/slub.c:1599
[   56.923644] in_atomic(): 0, irqs_disabled(): 1, pid: 3031, name: wpa_supplicant
[   56.923656] 2 locks held by wpa_supplicant/3031:
[   56.923662]  #0:  (rtnl_mutex){--..}, at: [<c02abd1f>] rtnl_lock+0xf/0x20
[   56.923703]  #1:  (&priv->lock){++..}, at: [<dfc840c2>] orinoco_ioctl_set_genie+0x52/0x130 [orinoco]
[   56.923782] irq event stamp: 910
[   56.923788] hardirqs last  enabled at (909): [<c01957db>] __kmalloc+0x7b/0x140
[   56.923820] hardirqs last disabled at (910): [<c0309419>] _spin_lock_irqsave+0x19/0x80
[   56.923847] softirqs last  enabled at (880): [<c0124f54>] __do_softirq+0xc4/0x110
[   56.923865] softirqs last disabled at (871): [<c01049ae>] do_softirq+0x8e/0xe0
[   56.923895] Pid: 3031, comm: wpa_supplicant Not tainted 2.6.29-rc2-1avb #1
[   56.923905] Call Trace:
[   56.923919]  [<c01049ae>] ? do_softirq+0x8e/0xe0
[   56.923941]  [<c011ad12>] __might_sleep+0xd2/0x100
[   56.923952]  [<c0195837>] __kmalloc+0xd7/0x140
[   56.923963]  [<c030946a>] ? _spin_lock_irqsave+0x6a/0x80
[   56.923981]  [<dfc840e9>] ? orinoco_ioctl_set_genie+0x79/0x130 [orinoco]
[   56.923999]  [<dfc840c2>] ? orinoco_ioctl_set_genie+0x52/0x130 [orinoco]
[   56.924017]  [<dfc840e9>] orinoco_ioctl_set_genie+0x79/0x130 [orinoco]
[   56.924036]  [<c0209325>] ? copy_from_user+0x35/0x130
[   56.924061]  [<c02ffd96>] ioctl_standard_call+0x196/0x380
[   56.924085]  [<c029f945>] ? __dev_get_by_name+0x85/0xb0
[   56.924096]  [<c02ff88f>] wext_handle_ioctl+0x14f/0x230
[   56.924113]  [<dfc84070>] ? orinoco_ioctl_set_genie+0x0/0x130 [orinoco]
[   56.924132]  [<c02a3da5>] dev_ioctl+0x495/0x570
[   56.924155]  [<c0293e05>] ? sys_sendto+0xa5/0xd0
[   56.924171]  [<c0142fe8>] ? mark_held_locks+0x48/0x90
[   56.924183]  [<c0292880>] ? sock_ioctl+0x0/0x280
[   56.924193]  [<c029297d>] sock_ioctl+0xfd/0x280
[   56.924203]  [<c0292880>] ? sock_ioctl+0x0/0x280
[   56.924235]  [<c01a51d0>] vfs_ioctl+0x20/0x80
[   56.924246]  [<c01a53e2>] do_vfs_ioctl+0x72/0x570
[   56.924257]  [<c0293e62>] ? sys_send+0x32/0x40
[   56.924268]  [<c02947c0>] ? sys_socketcall+0x1d0/0x2a0
[   56.924280]  [<c010339f>] ? sysenter_exit+0xf/0x16
[   56.924292]  [<c01a5919>] sys_ioctl+0x39/0x70
[   56.924302]  [<c0103371>] sysenter_do_call+0x12/0x31

Signed-off-by: Andrey Borzenkov <arvidjaar@mail.ru>
Cc: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22 13:55:01 -05:00
Christian Eggers
6d31748294 usb/mcs7830: Don't use buffers from stack for USB transfers
mcs7830_set_reg() and mcs7830_get_reg() are called with buffers
from stack which must not be used directly for USB transfers.
This causes corruption of the stack particulary on non x86
architectures because DMA may be used for these transfers.

Signed-off-by: Christian Eggers <christian.eggers@kathrein.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-21 12:56:24 -08:00