1. 28 5月, 2015 3 次提交
  2. 27 5月, 2015 2 次提交
  3. 26 5月, 2015 5 次提交
  4. 25 5月, 2015 1 次提交
  5. 23 5月, 2015 2 次提交
  6. 22 5月, 2015 6 次提交
    • E
      iwlwifi: mvm: avoid use-after-free on iwl_mvm_d0i3_enable_tx() · 29220891
      Eliad Peller 提交于
      qos_seq points (to a struct) inside the command response data.
      
      Make sure to free the response only after qos_seq is not
      needed anymore.
      Reported-by: NHeng Luo <heng.luo@intel.com>
      Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
      Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      29220891
    • L
      iwlwifi: mvm: clean net-detect info if device was reset during suspend · a500e469
      Luciano Coelho 提交于
      If the device is reset during suspend with net-detect enabled, we
      leave the net-detect information dangling and this causes the next
      suspend to fail with a warning:
      
      [21795.351010] WARNING: at /root/iwlwifi/iwlwifi-stack-dev/drivers/net/wireless/iwlwifi/mvm/d3.c:989 __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]()
      [21795.353253] Modules linked in: iwlmvm(O) iwlwifi(O) mac80211(O) cfg80211(O) compat(O) [...]
      [21795.366168] CPU: 1 PID: 3645 Comm: bash Tainted: G           O 3.10.29-dev #1
      [21795.368785] Hardware name: Dell Inc. Latitude E6430/0CPWYR, BIOS A09 12/13/2012
      [21795.371441]  f8ec6748 f8ec6748 e51f3ce8 c168aa62 e51f3d10 c103a824 c1871238 f8ec6748
      [21795.374228]  000003dd f8eb982e f8eb982e 00000000 c3408ed4 c41edbbc e51f3d20 c103a862
      [21795.377006]  00000009 00000000 e51f3da8 f8eb982e c41ee3dc 00000004 e7970000 e51f3d74
      [21795.379792] Call Trace:
      [21795.382461]  [<c168aa62>] dump_stack+0x16/0x18
      [21795.385133]  [<c103a824>] warn_slowpath_common+0x64/0x80
      [21795.387803]  [<f8eb982e>] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
      [21795.390485]  [<f8eb982e>] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
      [21795.393124]  [<c103a862>] warn_slowpath_null+0x22/0x30
      [21795.395787]  [<f8eb982e>] __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
      [21795.398464]  [<f8eb9d7c>] iwl_mvm_suspend+0xec/0x140 [iwlmvm]
      [21795.401127]  [<c104be11>] ? del_timer_sync+0xa1/0xc0
      [21795.403800]  [<f8d4107e>] __ieee80211_suspend+0x1de/0xff0 [mac80211]
      [21795.406459]  [<c168e43d>] ? mutex_lock_nested+0x25d/0x350
      [21795.409084]  [<c1586b64>] ? rtnl_lock+0x14/0x20
      [21795.411685]  [<f8cf0076>] ieee80211_suspend+0x16/0x20 [mac80211]
      [21795.414318]  [<f8c4e014>] wiphy_suspend+0x74/0x710 [cfg80211]
      [21795.416916]  [<c141e612>] __device_suspend+0x1e2/0x220
      [21795.419521]  [<f8c4dfa0>] ? addresses_show+0xa0/0xa0 [cfg80211]
      [21795.422097]  [<c141f997>] dpm_suspend+0x67/0x210
      [21795.424661]  [<c141fd6f>] dpm_suspend_start+0x4f/0x60
      [21795.427219]  [<c108d8e0>] suspend_devices_and_enter+0x60/0x480
      [21795.429768]  [<c168646a>] ? printk+0x4d/0x4f
      [21795.432295]  [<c108de76>] pm_suspend+0x176/0x210
      [21795.434830]  [<c108ca5d>] state_store+0x5d/0xb0
      [21795.437410]  [<c108ca00>] ? wakeup_count_show+0x50/0x50
      [21795.439961]  [<c13208db>] kobj_attr_store+0x1b/0x30
      [21795.442514]  [<c11e3a4b>] sysfs_write_file+0xab/0x100
      [21795.445088]  [<c11e39a0>] ? sysfs_poll+0xa0/0xa0
      [21795.447659]  [<c1179655>] vfs_write+0xa5/0x1c0
      [21795.450212]  [<c1179af7>] SyS_write+0x57/0xa0
      [21795.452699]  [<c1699ec1>] sysenter_do_call+0x12/0x32
      [21795.455146] ---[ end trace faf5321baba2bfdb ]---
      
      To fix this, call the iwl_mvm_free_nd() function in case of any error
      during resume.  Additionally, rename the "out_unlock" label to err to
      make it clearer that it's only called in error conditions.
      
      Cc: stable@vger.kernel.org [3.19+]
      Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
      Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      a500e469
    • L
      iwlwifi: mvm: take the UCODE_DOWN reference when resuming · dcfc7fb1
      Luciano Coelho 提交于
      The __iwl_mvm_resume() function always returns 1, which causes
      mac80211 to do a reconfig with IEEE80211_RECONFIG_TYPE_RESTART.  This
      type of reconfig calls iwl_mvm_restart_complete(), where we unref the
      IWL_MVM_REF_UCODE_DOWN, so we should always take the reference in this
      case.
      
      This prevents this kind of warning from happening:
      
      [40026.103025] WARNING: at /root/iwlwifi/iwlwifi-stack-dev/drivers/net/wireless/iwlwifi/mvm/mac80211.c:236 iwl_mvm_unref+0xc9/0xd0 [iwlmvm]()
      [40026.105145] Modules linked in: iwlmvm(O) iwlwifi(O) mac80211(O) cfg80211(O) compat(O) ctr ccm arc4 autofs4 snd_hda_codec_hdmi snd_hda_codec_idt joydev coretemp kvm_intel kvm aesni_intel ablk_helper cryptd lrw aes_i586 snd_hda_intel xts snd_hda_codec gf128mul snd_hwdep snd_pcm snd_seq_midi dell_wmi snd_rawmidi sparse_keymap snd_seq_midi_event snd_seq uvcvideo dell_laptop videobuf2_core dcdbas microcode videodev psmouse snd_timer videobuf2_vmalloc videobuf2_memops serio_raw snd_seq_device btusb i915 snd bluetooth lpc_ich drm_kms_helper soundcore snd_page_alloc drm i2c_algo_bit wmi parport_pc ppdev video binfmt_misc rpcsec_gss_krb5 nfsd mac_hid nfs_acl nfsv4 auth_rpcgss nfs fscache lockd sunrpc msdos lp parport sdhci_pci sdhci ahci libahci e1000e mmc_core ptp pps_core [last unloaded: compat]
      [40026.117640] CPU: 2 PID: 3827 Comm: bash Tainted: G        W  O 3.10.29-dev #1
      [40026.120216] Hardware name: Dell Inc. Latitude E6430/0CPWYR, BIOS A09 12/13/2012
      [40026.122815]  f8effd18 f8effd18 e740fd18 c168aa62 e740fd40 c103a824 c1871238 f8effd18
      [40026.125527]  000000ec f8ec79c9 f8ec79c9 d5d29ba4 d5d2a20c 00000000 e740fd50 c103a862
      [40026.128209]  00000009 00000000 e740fd7c f8ec79c9 f1c591c4 00000400 00000000 f8efb490
      [40026.130886] Call Trace:
      [40026.133506]  [<c168aa62>] dump_stack+0x16/0x18
      [40026.136115]  [<c103a824>] warn_slowpath_common+0x64/0x80
      [40026.138727]  [<f8ec79c9>] ? iwl_mvm_unref+0xc9/0xd0 [iwlmvm]
      [40026.141319]  [<f8ec79c9>] ? iwl_mvm_unref+0xc9/0xd0 [iwlmvm]
      [40026.143881]  [<c103a862>] warn_slowpath_null+0x22/0x30
      [40026.146453]  [<f8ec79c9>] iwl_mvm_unref+0xc9/0xd0 [iwlmvm]
      [40026.149030]  [<f8ec7a4d>] iwl_mvm_mac_reconfig_complete+0x7d/0x210 [iwlmvm]
      [40026.151645]  [<f8b74b20>] ? ftrace_raw_event_drv_reconfig_complete+0xc0/0xe0 [mac80211]
      [40026.154291]  [<f8b6769e>] ieee80211_reconfig+0x28e/0x2620 [mac80211]
      [40026.156920]  [<c10ef0ea>] ? ring_buffer_unlock_commit+0xba/0x100
      [40026.159585]  [<f8b4a04d>] ieee80211_resume+0x6d/0x80 [mac80211]
      [40026.162206]  [<f8a79722>] wiphy_resume+0x72/0x260 [cfg80211]
      [40026.164799]  [<c141e2e7>] ? device_resume+0x57/0x150
      [40026.167425]  [<f8a796b0>] ? wiphy_suspend+0x710/0x710 [cfg80211]
      [40026.170075]  [<c141e26e>] dpm_run_callback+0x2e/0x50
      [40026.172695]  [<c141e321>] device_resume+0x91/0x150
      [40026.175334]  [<c141f636>] dpm_resume+0xf6/0x200
      [40026.177922]  [<c141f920>] dpm_resume_end+0x10/0x20
      [40026.180489]  [<c108d9f7>] suspend_devices_and_enter+0x177/0x480
      [40026.183037]  [<c168646a>] ? printk+0x4d/0x4f
      [40026.185559]  [<c108de76>] pm_suspend+0x176/0x210
      [40026.188065]  [<c108ca5d>] state_store+0x5d/0xb0
      [40026.190581]  [<c108ca00>] ? wakeup_count_show+0x50/0x50
      [40026.193052]  [<c13208db>] kobj_attr_store+0x1b/0x30
      [40026.195608]  [<c11e3a4b>] sysfs_write_file+0xab/0x100
      [40026.198055]  [<c11e39a0>] ? sysfs_poll+0xa0/0xa0
      [40026.200469]  [<c1179655>] vfs_write+0xa5/0x1c0
      [40026.202893]  [<c1179af7>] SyS_write+0x57/0xa0
      [40026.205245]  [<c1699ec1>] sysenter_do_call+0x12/0x32
      [40026.207619] ---[ end trace db1d5a72a0381b0a ]---
      Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
      Reviewed-by: NEliadX Peller <eliad@wizery.com>
      Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      dcfc7fb1
    • E
      iwlwifi: mvm: BT Coex - duplicate the command if sent ASYNC · 165b3c4f
      Emmanuel Grumbach 提交于
      There are buses that can't handle ASYNC command without
      copying them. Duplicate the host command instead.
      Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      165b3c4f
    • L
      iwlwifi: nvm: force mac from otp in case nvm mac is reserved · 18f84673
      Liad Kaufman 提交于
      Take the MAC address from the OTP even if one is present in
      the NVM, if that MAC address happens to be a reserved one.
      Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
      Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      18f84673
    • H
      iwlwifi: mvm: Free fw_status after use to avoid memory leak · 2fc863a5
      Haim Dreyfuss 提交于
      fw_status is the only pointer pointing to a block of memory
      allocated above and should be freed after use.
      Note: this come from Klockwork static analyzer.
      
      Cc: stable@vger.kernel.org [3.19+]
      Fixes: 2021a89d ("iwlwifi: mvm: treat netdetect wake up separately")
      Signed-off-by: NHaim Dreyfuss <haim.dreyfuss@intel.com>
      Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      2fc863a5
  7. 21 5月, 2015 1 次提交
    • T
      net: phy: Make sure phy_start() always re-enables the phy interrupts · c15e10e7
      Tim Beale 提交于
      This is an alternative way of fixing:
       commit db9683fb ("net: phy: Make sure PHY_RESUMING state change
                            is always processed")
      
      When the PHY state transitions from PHY_HALTED to PHY_RESUMING, there are
      two things we need to do:
      1). Re-enable interrupts (and power up the physical link, if powered down)
      2). Update the PHY state and net-device based on the link status.
      
      There's no strict reason why #1 has to be done from within the main
      phy_state_machine() function. There is a risk that other changes to the
      PHY (e.g. setting speed/duplex, which calls phy_start_aneg()) could cause
      a subsequent state transition before phy_state_machine() has processed
      the PHY_RESUMING state change. This would leave the PHY with interrupts
      disabled and/or still in the BMCR_PDOWN/low-power mode.
      
      Moving enabling the interrupts and phy_resume() into phy_start() will
      guarantee this work always gets done. As the PHY is already in the HALTED
      state and interrupts are disabled, it shouldn't conflict with any work
      being done in phy_state_machine(). The downside of this change is that if
      the PHY_RESUMING state is ever entered from anywhere else, it'll also have
      to repeat this work.
      Signed-off-by: NTim Beale <tim.beale@alliedtelesis.co.nz>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c15e10e7
  8. 19 5月, 2015 1 次提交
  9. 18 5月, 2015 1 次提交
    • N
      rtnl/bond: don't send rtnl msg for unregistered iface · ed2a80ab
      Nicolas Dichtel 提交于
      Before the patch, the command 'ip link add bond2 type bond mode 802.3ad'
      causes the kernel to send a rtnl message for the bond2 interface, with an
      ifindex 0.
      
      'ip monitor' shows:
      0: bond2: <BROADCAST,MULTICAST,MASTER> mtu 1500 state DOWN group default
          link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
      9: bond2@NONE: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop state DOWN group default
          link/ether ea:3e:1f:53:92:7b brd ff:ff:ff:ff:ff:ff
      [snip]
      
      The patch fixes the spotted bug by checking in bond driver if the interface
      is registered before calling the notifier chain.
      It also adds a check in rtmsg_ifinfo() to prevent this kind of bug in the
      future.
      
      Fixes: d4261e56 ("bonding: create netlink event when bonding option is changed")
      CC: Jiri Pirko <jiri@resnulli.us>
      Reported-by: NJulien Meunier <julien.meunier@6wind.com>
      Signed-off-by: NNicolas Dichtel <nicolas.dichtel@6wind.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ed2a80ab
  10. 17 5月, 2015 1 次提交
    • T
      net: phy: Make sure PHY_RESUMING state change is always processed · db9683fb
      Tim Beale 提交于
      If phy_start_aneg() was called while the phydev is in the PHY_RESUMING
      state, then its state would immediately transition to PHY_AN (or
      PHY_FORCING). This meant the phy_state_machine() never processed the
      PHY_RESUMING state change, which meant interrupts weren't enabled for the
      PHY. If the PHY used low-power mode (i.e. using BMCR_PDOWN), then the
      physical link wouldn't get powered up again.
      
      There seems no point for phy_start_aneg() to make the PHY_RESUMING -->
      PHY_AN transition, as the state machine will do this anyway. I'm not sure
      about the case where autoneg is disabled, as my patch will change
      behaviour so that the PHY goes to PHY_NOLINK instead of PHY_FORCING. An
      alternative solution would be to move the phy_config_interrupt() and
      phy_resume() work out of the state machine and into phy_start().
      
      The background behind this: we're running linux v3.16.7 and from user-space
      we want to enable the eth port (i.e. do a SIOCSIFFLAGS ioctl with the
      IFF_UP flag) and immediately afterward set the interface's speed/duplex.
      Enabling the interface calls .ndo_open() then phy_start() and the PHY
      transitions PHY_HALTED --> PHY_RESUMING. Setting the speed/duplex ends up
      calling phy_ethtool_sset(), which calls phy_start_aneg() (meanwhile the
      phy_state_machine() hasn't processed the PHY_RESUMING state change yet).
      Signed-off-by: NTim Beale <tim.beale@alliedtelesis.co.nz>
      Reviewed-by: NFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      db9683fb
  11. 16 5月, 2015 3 次提交
  12. 15 5月, 2015 4 次提交
  13. 13 5月, 2015 3 次提交
  14. 12 5月, 2015 1 次提交
  15. 11 5月, 2015 3 次提交
  16. 10 5月, 2015 3 次提交