1. 09 7月, 2009 7 次提交
  2. 08 7月, 2009 8 次提交
    • L
      mac80211: minstrel: avoid accessing negative indices in rix_to_ndx() · 3938b45c
      Luciano Coelho 提交于
      If rix is not found in mi->r[], i will become -1 after the loop.  This value
      is eventually used to access arrays, so we were accessing arrays with a
      negative index, which is obviously not what we want to do.  This patch fixes
      this potential problem.
      Signed-off-by: NLuciano Coelho <luciano.coelho@nokia.com>
      Acked-by: NFelix Fietkau <nbd@openwrt.org>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      3938b45c
    • J
      cfg80211: fix refcount leak · 2dce4c2b
      Johannes Berg 提交于
      The code in cfg80211's cfg80211_bss_update erroneously
      grabs a reference to the BSS, which means that it will
      never be freed.
      Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
      Cc: stable@kernel.org [2.6.29, 2.6.30]
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      2dce4c2b
    • J
      hp-wmi: fix rfkill bug · 76d8b64e
      Johannes Berg 提交于
      Fix the third (I think) polarity error I accidentally
      introduced in the rfkill rewrite to make wireless work
      again on (certain?) HP laptops.
      Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
      Tested-by: NMaciej Rutecki <maciej.rutecki@gmail.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      76d8b64e
    • A
      mac80211: fix allocation in mesh_queue_preq · 59615b5f
      Andrey Yurovsky 提交于
      We allocate a PREQ queue node in mesh_queue_preq, however the allocation
      may cause us to sleep.  Use GFP_ATOMIC to prevent this.
      
      [ 1869.126498] BUG: scheduling while atomic: ping/1859/0x10000100
      [ 1869.127164] Modules linked in: ath5k mac80211 ath
      [ 1869.128310] Pid: 1859, comm: ping Not tainted 2.6.30-wl #1
      [ 1869.128754] Call Trace:
      [ 1869.129293]  [<c1023a2b>] __schedule_bug+0x48/0x4d
      [ 1869.129866]  [<c13b5533>] __schedule+0x77/0x67a
      [ 1869.130544]  [<c1026f2e>] ? release_console_sem+0x17d/0x185
      [ 1869.131568]  [<c807cf47>] ? mesh_queue_preq+0x2b/0x165 [mac80211]
      [ 1869.132318]  [<c13b5b3e>] schedule+0x8/0x1f
      [ 1869.132807]  [<c1023c12>] __cond_resched+0x16/0x2f
      [ 1869.133478]  [<c13b5bf0>] _cond_resched+0x27/0x32
      [ 1869.134191]  [<c108a370>] kmem_cache_alloc+0x1c/0xcf
      [ 1869.134714]  [<c10273ae>] ? printk+0x15/0x17
      [ 1869.135670]  [<c807cf47>] mesh_queue_preq+0x2b/0x165 [mac80211]
      [ 1869.136731]  [<c807d1f8>] mesh_nexthop_lookup+0xee/0x12d [mac80211]
      [ 1869.138130]  [<c807417e>] ieee80211_xmit+0xe6/0x2b2 [mac80211]
      [ 1869.138935]  [<c80be46d>] ? ath5k_hw_setup_rx_desc+0x0/0x66 [ath5k]
      [ 1869.139831]  [<c80c97bc>] ? ath5k_tasklet_rx+0xba/0x506 [ath5k]
      [ 1869.140863]  [<c8075191>] ieee80211_subif_start_xmit+0x6c9/0x6e4
      [mac80211]
      [ 1869.141665]  [<c105cf1c>] ? handle_level_irq+0x78/0x9d
      [ 1869.142390]  [<c12e3f93>] dev_hard_start_xmit+0x168/0x1c7
      [ 1869.143092]  [<c12f1f17>] __qdisc_run+0xe1/0x1b7
      [ 1869.143612]  [<c12e25ff>] qdisc_run+0x18/0x1a
      [ 1869.144248]  [<c12e62f4>] dev_queue_xmit+0x16a/0x25a
      [ 1869.144785]  [<c13b6dcc>] ? _read_unlock_bh+0xe/0x10
      [ 1869.145465]  [<c12eacdb>] neigh_resolve_output+0x19c/0x1c7
      [ 1869.146182]  [<c130e2da>] ? ip_finish_output+0x0/0x51
      [ 1869.146697]  [<c130e2a0>] ip_finish_output2+0x182/0x1bc
      [ 1869.147358]  [<c130e327>] ip_finish_output+0x4d/0x51
      [ 1869.147863]  [<c130e9d5>] ip_output+0x80/0x85
      [ 1869.148515]  [<c130cc49>] dst_output+0x9/0xb
      [ 1869.149141]  [<c130dec6>] ip_local_out+0x17/0x1a
      [ 1869.149632]  [<c130e0bc>] ip_push_pending_frames+0x1f3/0x255
      [ 1869.150343]  [<c13247ff>] raw_sendmsg+0x5e6/0x667
      [ 1869.150883]  [<c1033c55>] ? insert_work+0x6a/0x73
      [ 1869.151834]  [<c8071e00>] ?
      ieee80211_invoke_rx_handlers+0x17da/0x1ae8 [mac80211]
      [ 1869.152630]  [<c132bd68>] inet_sendmsg+0x3b/0x48
      [ 1869.153232]  [<c12d7deb>] __sock_sendmsg+0x45/0x4e
      [ 1869.153740]  [<c12d8537>] sock_sendmsg+0xb8/0xce
      [ 1869.154519]  [<c80be46d>] ? ath5k_hw_setup_rx_desc+0x0/0x66 [ath5k]
      [ 1869.155289]  [<c1036b25>] ? autoremove_wake_function+0x0/0x30
      [ 1869.155859]  [<c115992b>] ? __copy_from_user_ll+0x11/0xce
      [ 1869.156573]  [<c1159d99>] ? copy_from_user+0x31/0x54
      [ 1869.157235]  [<c12df646>] ? verify_iovec+0x40/0x6e
      [ 1869.157778]  [<c12d869a>] sys_sendmsg+0x14d/0x1a5
      [ 1869.158714]  [<c8072c40>] ? __ieee80211_rx+0x49e/0x4ee [mac80211]
      [ 1869.159641]  [<c80c83fe>] ? ath5k_rxbuf_setup+0x6d/0x8d [ath5k]
      [ 1869.160543]  [<c80be46d>] ? ath5k_hw_setup_rx_desc+0x0/0x66 [ath5k]
      [ 1869.161434]  [<c80beba4>] ? ath5k_hw_get_rxdp+0xe/0x10 [ath5k]
      [ 1869.162319]  [<c80c97bc>] ? ath5k_tasklet_rx+0xba/0x506 [ath5k]
      [ 1869.163063]  [<c1005627>] ? enable_8259A_irq+0x40/0x43
      [ 1869.163594]  [<c101edb8>] ? __dequeue_entity+0x23/0x27
      [ 1869.164793]  [<c100187a>] ? __switch_to+0x2b/0x105
      [ 1869.165442]  [<c1021d5f>] ? finish_task_switch+0x5b/0x74
      [ 1869.166129]  [<c12d963a>] sys_socketcall+0x14b/0x17b
      [ 1869.166612]  [<c1002b95>] syscall_call+0x7/0xb
      Signed-off-by: NAndrey Yurovsky <andrey@cozybit.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      59615b5f
    • S
      iwmc3200wifi: add Kconfig help · a7a4e41e
      Samuel Ortiz 提交于
      We're missing a Kconfig help for the iwmc3200wifi driver.
      Signed-off-by: NSamuel Ortiz <samuel.ortiz@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      a7a4e41e
    • V
      ath9k: Fix leak in tx descriptor · cbfe89c6
      Vasanthakumar Thiagarajan 提交于
      When we reclaim the tx desc, we always assume that the
      last desc is a holding desc, which is not true, and skip it.
      If the tx queue is drained during channel change, internal
      reset and etc, the last descriptor may not be the holding
      descriptor and we fail to reclaim them. This results in the
      following two issues.
      
      1. Tx stuck - We drop all the frames coming from upper layer
      due to shortage in tx desc.
      
      2. Crash - If we fail to reclaim a tx descriptor, we miss to
      update the tx BA window with the seq number of the frame
      associated to that desc, which, at some point, result in
      the following crash due to an assert failure in ath_tx_addto_baw().
      
      This patch fixes these two issues.
      
       kernel BUG at ../drivers/net/wireless/ath/ath9k/xmit.c:180!
      [155064.304164] invalid opcode: 0000 [#1] SMP
       Call Trace:
        [<fbc6d83b>] ? ath9k_tx+0xeb/0x160 [ath9k]
        [<fbbc9591>]  ipv6? __ieee80211_tx+0x41/0x120 [mac80211]
        [<fbbcb5ae>] ?  aes_i586ieee80211_master_start_xmit+0x28e/0x560 [mac80211]
        [<c037e501>]  aes_generic? _spin_lock_irqsave+0x31/0x40
        [<c02f347b>] ? dev_hard_start_xmit+0x16b/0x1c0
        [<c03058b5>] ? __qdisc_run+0x1b5/0x200
        [<fbbcda5a>] ?  af_packetieee80211_select_queue+0xa/0x100 [mac80211]
        [<c02f53b7>] ?  i915dev_queue_xmit+0x2e7/0x3f0
        [<fbbc9b49>] ? ieee80211_subif_start_xmit+0x369/0x7a0 [mac80211]
        [<c031bc35>] ? ip_output+0x55/0xb0
        [<c02e0188>] ? show_memcpy_count+0x18/0x60
        [<c02eb186>] ? __kfree_skb+0x36/0x90
        [<c02f2202>] ?  binfmt_miscdev_queue_xmit_nit+0xd2/0x110
        [<c02f347b>] ? dev_hard_start_xmit+0x16b/0x1c0
        [<c03058b5>] ? __qdisc_run+0x1b5/0x200
        [<c033bca7>] ?  scoarp_create+0x57/0x2a0
        [<c02f53b7>] ?  bridgedev_queue_xmit+0x2e7/0x3f0
        [<c03034a0>] ? eth_header+0x0/0xc0
        [<c033b95f>]  stp? arp_xmit+0x5f/0x70
        [<c033bf4f>] ? arp_send+0x5f/0x70
        [<c033c8f5>]  bnep? arp_solicit+0x105/0x210
        [<c02fa5aa>] ? neigh_timer_handler+0x19a/0x390
        [<c013bf88>] ? run_timer_softirq+0x138/0x210
        [<c02fa410>] ?  ppdevneigh_timer_handler+0x0/0x390
        [<c02fa410>] ? neigh_timer_handler+0x0/0x390
      Signed-off-by: NVasanthakumar Thiagarajan <vasanth@atheros.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      cbfe89c6
    • L
      b43/b43legacy: fix radio LED initialization · fd4973c5
      Larry Finger 提交于
      Fix condition in which radio LED did not initialize correctly, and remove
      4 compilation warnings.
      
      After the recent changes in rfkill, the radio LED used by b43/b43legacy
      did not always initialize correctly.
      
      Both b43 and b43legacy used the deprecated variable radio_enabled in
      struct ieee80211_conf.
      Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      fd4973c5
    • J
      Wireless: nl80211, fix lock imbalance · 1f5fc70a
      Jiri Slaby 提交于
      Don't forget to unlock cfg80211_mutex in one fail path of
      nl80211_set_wiphy.
      Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      1f5fc70a
  3. 07 7月, 2009 3 次提交
    • D
      Revert "p54: Use SKB list handling helpers instead of by-hand code." · 0ca1b08e
      David S. Miller 提交于
      This reverts commit a1091aae.
      0ca1b08e
    • W
      sctp: fix warning at inet_sock_destruct() while release sctp socket · 1bc4ee40
      Wei Yongjun 提交于
      Commit 'net: Move rx skb_orphan call to where needed' broken sctp protocol
      with warning at inet_sock_destruct(). Actually, sctp can do this right with
      sctp_sock_rfree_frag() and sctp_skb_set_owner_r_frag() pair.
      
          sctp_sock_rfree_frag(skb);
          sctp_skb_set_owner_r_frag(skb, newsk);
      
      This patch not revert the commit d55d87fd,
      instead remove the sctp_sock_rfree_frag() function.
      
      ------------[ cut here ]------------
      WARNING: at net/ipv4/af_inet.c:151 inet_sock_destruct+0xe0/0x142()
      Modules linked in: sctp ipv6 dm_mirror dm_region_hash dm_log dm_multipath
      scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd [last unloaded: scsi_wait_scan]
      Pid: 1808, comm: sctp_test Not tainted 2.6.31-rc2 #40
      Call Trace:
       [<c042dd06>] warn_slowpath_common+0x6a/0x81
       [<c064a39a>] ? inet_sock_destruct+0xe0/0x142
       [<c042dd2f>] warn_slowpath_null+0x12/0x15
       [<c064a39a>] inet_sock_destruct+0xe0/0x142
       [<c05fde44>] __sk_free+0x19/0xcc
       [<c05fdf50>] sk_free+0x18/0x1a
       [<ca0d14ad>] sctp_close+0x192/0x1a1 [sctp]
       [<c0649f7f>] inet_release+0x47/0x4d
       [<c05fba4d>] sock_release+0x19/0x5e
       [<c05fbab3>] sock_close+0x21/0x25
       [<c049c31b>] __fput+0xde/0x189
       [<c049c3de>] fput+0x18/0x1a
       [<c049988f>] filp_close+0x56/0x60
       [<c042f422>] put_files_struct+0x5d/0xa1
       [<c042f49f>] exit_files+0x39/0x3d
       [<c043086a>] do_exit+0x1a5/0x5dd
       [<c04a86c2>] ? d_kill+0x35/0x3b
       [<c0438fa4>] ? dequeue_signal+0xa6/0x115
       [<c0430d05>] do_group_exit+0x63/0x8a
       [<c0439504>] get_signal_to_deliver+0x2e1/0x2f9
       [<c0401d9e>] do_notify_resume+0x7c/0x6b5
       [<c043f601>] ? autoremove_wake_function+0x0/0x34
       [<c04a864e>] ? __d_free+0x3d/0x40
       [<c04a867b>] ? d_free+0x2a/0x3c
       [<c049ba7e>] ? vfs_write+0x103/0x117
       [<c05fc8fa>] ? sys_socketcall+0x178/0x182
       [<c0402a56>] work_notifysig+0x13/0x19
      ---[ end trace 9db92c463e789fba ]---
      Signed-off-by: NWei Yongjun <yjwei@cn.fujitsu.com>
      Acked-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Acked-by: NVlad Yasevich <vladislav.yasevich@hp.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1bc4ee40
    • M
      tun/tap: Fix crashes if open() /dev/net/tun and then poll() it. · 3c8a9c63
      Mariusz Kozlowski 提交于
      Fix NULL pointer dereference in tun_chr_pool() introduced by commit
      33dccbb0 ("tun: Limit amount of queued
      packets per device") and triggered by this code:
      
      	int fd;
      	struct pollfd pfd;
      	fd = open("/dev/net/tun", O_RDWR);
      	pfd.fd = fd;
      	pfd.events = POLLIN | POLLOUT;
      	poll(&pfd, 1, 0);
      Reported-by: NEugene Kapun <abacabadabacaba@gmail.com>
      Signed-off-by: NMariusz Kozlowski <m.kozlowski@tuxland.pl>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3c8a9c63
  4. 06 7月, 2009 7 次提交
  5. 04 7月, 2009 15 次提交