1. 28 May, 2015 35 commits
  2. 26 May, 2015 3 commits
  3. 21 May, 2015 2 commits
    • Eliad Peller's avatar
      iwlwifi: mvm: avoid use-after-free on iwl_mvm_d0i3_enable_tx() · 29220891
      Eliad Peller authored
      qos_seq points (to a struct) inside the command response data.
      
      Make sure to free the response only after qos_seq is not
      needed anymore.
      Reported-by: default avatarHeng Luo <heng.luo@intel.com>
      Signed-off-by: default avatarEliad Peller <eliadx.peller@intel.com>
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      29220891
    • Luciano Coelho's avatar
      iwlwifi: mvm: clean net-detect info if device was reset during suspend · a500e469
      Luciano Coelho authored
      If the device is reset during suspend with net-detect enabled, we
      leave the net-detect information dangling and this causes the next
      suspend to fail with a warning:
      
      [21795.351010] WARNING: at /root/iwlwifi/iwlwifi-stack-dev/drivers/net/wireless/iwlwifi/mvm/d3.c:989 __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]()
      [21795.353253] Modules linked in: iwlmvm(O) iwlwifi(O) mac80211(O) cfg80211(O) compat(O) [...]
      [21795.366168] CPU: 1 PID: 3645 Comm: bash Tainted: G           O 3.10.29-dev #1
      [21795.368785] Hardware name: Dell Inc. Latitude E6430/0CPWYR, BIOS A09 12/13/2012
      [21795.371441]  f8ec6748 f8ec6748 e51f3ce8 c168aa62 e51f3d10 c103a824 c1871238 f8ec6748
      [21795.374228]  000003dd f8eb982e f8eb982e 00000000 c3408ed4 c41edbbc e51f3d20 c103a862
      [21795.377006]  00000009 00000000 e51f3da8 f8eb982e c41ee3dc 00000004 e7970000 e51f3d74
      [21795.379792] Call Trace:
      [21795.382461]  [<c168aa62>] dump_stack+0x16/0x18
      [21795.385133]  [<c103a824>] warn_slowpath_common+0x64/0x80
      [21795.387803]  [<f8eb982e>] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
      [21795.390485]  [<f8eb982e>] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
      [21795.393124]  [<c103a862>] warn_slowpath_null+0x22/0x30
      [21795.395787]  [<f8eb982e>] __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
      [21795.398464]  [<f8eb9d7c>] iwl_mvm_suspend+0xec/0x140 [iwlmvm]
      [21795.401127]  [<c104be11>] ? del_timer_sync+0xa1/0xc0
      [21795.403800]  [<f8d4107e>] __ieee80211_suspend+0x1de/0xff0 [mac80211]
      [21795.406459]  [<c168e43d>] ? mutex_lock_nested+0x25d/0x350
      [21795.409084]  [<c1586b64>] ? rtnl_lock+0x14/0x20
      [21795.411685]  [<f8cf0076>] ieee80211_suspend+0x16/0x20 [mac80211]
      [21795.414318]  [<f8c4e014>] wiphy_suspend+0x74/0x710 [cfg80211]
      [21795.416916]  [<c141e612>] __device_suspend+0x1e2/0x220
      [21795.419521]  [<f8c4dfa0>] ? addresses_show+0xa0/0xa0 [cfg80211]
      [21795.422097]  [<c141f997>] dpm_suspend+0x67/0x210
      [21795.424661]  [<c141fd6f>] dpm_suspend_start+0x4f/0x60
      [21795.427219]  [<c108d8e0>] suspend_devices_and_enter+0x60/0x480
      [21795.429768]  [<c168646a>] ? printk+0x4d/0x4f
      [21795.432295]  [<c108de76>] pm_suspend+0x176/0x210
      [21795.434830]  [<c108ca5d>] state_store+0x5d/0xb0
      [21795.437410]  [<c108ca00>] ? wakeup_count_show+0x50/0x50
      [21795.439961]  [<c13208db>] kobj_attr_store+0x1b/0x30
      [21795.442514]  [<c11e3a4b>] sysfs_write_file+0xab/0x100
      [21795.445088]  [<c11e39a0>] ? sysfs_poll+0xa0/0xa0
      [21795.447659]  [<c1179655>] vfs_write+0xa5/0x1c0
      [21795.450212]  [<c1179af7>] SyS_write+0x57/0xa0
      [21795.452699]  [<c1699ec1>] sysenter_do_call+0x12/0x32
      [21795.455146] ---[ end trace faf5321baba2bfdb ]---
      
      To fix this, call the iwl_mvm_free_nd() function in case of any error
      during resume.  Additionally, rename the "out_unlock" label to err to
      make it clearer that it's only called in error conditions.
      
      Cc: stable@vger.kernel.org [3.19+]
      Signed-off-by: default avatarLuciano Coelho <luciano.coelho@intel.com>
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      a500e469