1. 27 7月, 2013 5 次提交
  2. 25 7月, 2013 7 次提交
    • D
      Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless · 1df86b4c
      David S. Miller 提交于
      John W. Linville says:
      
      ====================
      This is another batch of fixes intended for the 3.11 stream.  FWIW,
      this is the first request with fixes from the mac80211 and iwlwifi
      trees as well.
      
      Regarding the mac80211 bits, Johannes says:
      
      "Here I have a fix for RSSI thresholds in mesh, two minstrel fixes from
      Felix, an nl80211 fix from Michal and four various fixes I did myself."
      
      As for the iwlwifi bits, Johannes says:
      
      "Here I have a fix for debugfs directory creation (causing a spurious
      error message), two scanning fixes from David Spinadel, an LED fix and
      two patches related to a BA session problem that eventually caused
      firmware crashes from Emmanuel and a small BT fix for older devices as
      well as a workaround for a firmware problem with APs with very small
      beacon intervals from myself."
      
      Along with those:
      
      Arend van Spriel addresses a lock-up and a NULL pointer dereference
      in brcmfmac.
      
      Daniel Drake fixes an unhandled interrupt during device tear down
      in mwifiex.
      
      Larry Finger corrects a wil6210 build error.
      
      Oleksij Rempel fixes two ath9k_htc problems related to keeping the
      driver and firmware in sync.
      
      Solomon Peachy gives us a cw1200 fix to avoid an oops in monitor mode.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1df86b4c
    • F
      net: fix comment above build_skb() · deceb4c0
      Florian Fainelli 提交于
      build_skb() specifies that the data parameter must come from a kmalloc'd
      area, this is only true if frag_size equals 0, because then build_skb()
      will use kzsize(data) to figure out the actual data size. Update the
      comment to reflect that special condition.
      Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      deceb4c0
    • E
      net: sun4i: fix timeout check · 2bf420a7
      Emilio López 提交于
      The current timeout check is comparing two constant values, so it won't
      ever detect a timeout. This patch reworks the affected code a bit so it
      has a chance at detecting timeouts correctly.
      Signed-off-by: NEmilio López <emilio@elopez.com.ar>
      Acked-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      2bf420a7
    • H
      ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanup · 905a6f96
      Hannes Frederic Sowa 提交于
      Otherwise we end up dereferencing the already freed net->ipv6.mrt pointer
      which leads to a panic (from Srivatsa S. Bhat):
      
      BUG: unable to handle kernel paging request at ffff882018552020
      IP: [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
      PGD 290a067 PUD 207ffe0067 PMD 207ff1d067 PTE 8000002018552060
      Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
      Modules linked in: ebtable_nat ebtables nfs fscache nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables nfsd lockd nfs_acl exportfs auth_rpcgss autofs4 sunrpc 8021q garp bridge stp llc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter
      +ip6_tables ipv6 vfat fat vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support cdc_ether usbnet mii microcode i2c_i801 i2c_core lpc_ich mfd_core shpchp ioatdma dca mlx4_core be2net wmi acpi_cpufreq mperf ext4 jbd2 mbcache dm_mirror dm_region_hash dm_log dm_mod
      CPU: 0 PID: 7 Comm: kworker/u33:0 Not tainted 3.11.0-rc1-ea45e-a #4
      Hardware name: IBM  -[8737R2A]-/00Y2738, BIOS -[B2E120RUS-1.20]- 11/30/2012
      Workqueue: netns cleanup_net
      task: ffff8810393641c0 ti: ffff881039366000 task.ti: ffff881039366000
      RIP: 0010:[<ffffffffa0366b02>]  [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
      RSP: 0018:ffff881039367bd8  EFLAGS: 00010286
      RAX: ffff881039367fd8 RBX: ffff882018552000 RCX: dead000000200200
      RDX: 0000000000000000 RSI: ffff881039367b68 RDI: ffff881039367b68
      RBP: ffff881039367bf8 R08: ffff881039367b68 R09: 2222222222222222
      R10: 2222222222222222 R11: 2222222222222222 R12: ffff882015a7a040
      R13: ffff882014eb89c0 R14: ffff8820289e2800 R15: 0000000000000000
      FS:  0000000000000000(0000) GS:ffff88103fc00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: ffff882018552020 CR3: 0000000001c0b000 CR4: 00000000000407f0
      Stack:
       ffff881039367c18 ffff882014eb89c0 ffff882015e28c00 0000000000000000
       ffff881039367c18 ffffffffa034d9d1 ffff8820289e2800 ffff882014eb89c0
       ffff881039367c58 ffffffff815bdecb ffffffff815bddf2 ffff882014eb89c0
      Call Trace:
       [<ffffffffa034d9d1>] rawv6_close+0x21/0x40 [ipv6]
       [<ffffffff815bdecb>] inet_release+0xfb/0x220
       [<ffffffff815bddf2>] ? inet_release+0x22/0x220
       [<ffffffffa032686f>] inet6_release+0x3f/0x50 [ipv6]
       [<ffffffff8151c1d9>] sock_release+0x29/0xa0
       [<ffffffff81525520>] sk_release_kernel+0x30/0x70
       [<ffffffffa034f14b>] icmpv6_sk_exit+0x3b/0x80 [ipv6]
       [<ffffffff8152fff9>] ops_exit_list+0x39/0x60
       [<ffffffff815306fb>] cleanup_net+0xfb/0x1a0
       [<ffffffff81075e3a>] process_one_work+0x1da/0x610
       [<ffffffff81075dc9>] ? process_one_work+0x169/0x610
       [<ffffffff81076390>] worker_thread+0x120/0x3a0
       [<ffffffff81076270>] ? process_one_work+0x610/0x610
       [<ffffffff8107da2e>] kthread+0xee/0x100
       [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70
       [<ffffffff8162a99c>] ret_from_fork+0x7c/0xb0
       [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70
      Code: 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 4c 8b 67 30 49 89 fd e8 db 3c 1e e1 49 8b 9c 24 90 08 00 00 48 85 db 74 06 <4c> 39 6b 20 74 20 bb f3 ff ff ff e8 8e 3c 1e e1 89 d8 4c 8b 65
      RIP  [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
       RSP <ffff881039367bd8>
      CR2: ffff882018552020
      Reported-by: NSrivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
      Tested-by: NSrivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
      Signed-off-by: NHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      905a6f96
    • J
      fib_trie: potential out of bounds access in trie_show_stats() · f585a991
      Jerry Snitselaar 提交于
      With the <= max condition in the for loop, it will be always go 1
      element further than needed. If the condition for the while loop is
      never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
      end of nodesizes[].
      Signed-off-by: NJerry Snitselaar <jerry.snitselaar@oracle.com>
      Acked-by: NHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f585a991
    • D
      mlx5: use after free in mlx5_cmd_comp_handler() · 64d2c22a
      Dan Carpenter 提交于
      We can't dereference "ent" after passing it to free_cmd().
      Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      64d2c22a
    • L
      r8169: fix lockdep warning when removing interface · 4ea72445
      Lekensteyn 提交于
      The work queue is initialised in rtl_open (when the interface goes up),
      but canceled in rtl_remove_one (when the PCI device gets removed). If
      the network interface is not brought up, then the work queue struct is
      not initialised. When the device is removed, the attempt to cancel the
      uninitialised work queue causes a lockdep warning.
      
      This patch fixes the issue by moving cancel_work_sync to rtl_close (to
      match rtl_open). (Note that rtl_close is also called via
      unregister_netdev in rtl_remove_one.)
      Signed-off-by: NPeter Wu <lekensteyn@gmail.com>
      Acked-by: NFrancois Romieu <romieu@fr.zoreil.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4ea72445
  3. 24 7月, 2013 2 次提交
  4. 23 7月, 2013 12 次提交
  5. 21 7月, 2013 2 次提交
    • D
      Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless · f5f7ab67
      David S. Miller 提交于
      John W. Linville says:
      
      ====================
      Please accept this batch of fixes intended for the 3.11 tree...
      
      Alexey Khoroshilov fixes a suspend-related race in ath9k_htc.
      
      Arnd Bergmann corrects the alignment of a structure in the ssb code
      to be compatible with ARM devices.
      
      Bob Copeland provides an ath5k fix that corrects a mistaken variable
      initialization.
      
      Felix Fietkau corrects some frame accounting for dropped frames
      in ath9k.
      
      Geert Uytterhoeven brings a Kconfig fix to indicate the DMA
      requirements for rt2x00.
      
      Larry Finger offers two rtlwifi fixes: one that properly initializes
      a callback; and, a scattered collection of Kconfig, Makefile, and
      EXPORT_SYMBOL changes that correct some build problems.
      
      Finally, Sujith Manoharan provides an ath9k fix to disable a feature
      on a specific hardware device.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f5f7ab67
    • D
      Merge branch 'fixes-for-3.11' of git://gitorious.org/linux-can/linux-can · 8d716c7a
      David S. Miller 提交于
      Marc Kleine-Budde says:
      
      ====================
      here are two fixes for the v3.11 release cycle:
      
      Maximilian Schneider contributes a patch for the esd_usb2 CAN driver. It adds
      sanity checking to the data coming from the USB CAN adapter before using it.
      Alexey Khoroshilov from the Linux Driver Verification project fixes an urb leak
      in the error handling of the USB 8dev's usb_8dev_start() function.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8d716c7a
  6. 20 7月, 2013 12 次提交