1. 12 Jun, 2013 5 commits
    • Mark A. Greer's avatar
      mwifiex: debugfs: Fix out of bounds array access · f873ded2
      Mark A. Greer authored
      When reading the contents of '/sys/kernel/debug/mwifiex/p2p0/info',
      the following panic occurs:
      
      $ cat /sys/kernel/debug/mwifiex/p2p0/info
      Unable to handle kernel paging request at virtual address 74706164
      pgd = de530000
      [74706164] *pgd=00000000
      Internal error: Oops: 5 [#1] SMP ARM
      Modules linked in: phy_twl4030_usb omap2430 musb_hdrc mwifiex_sdio mwifiex
      CPU: 0 PID: 1635 Comm: cat Not tainted 3.10.0-rc1-00010-g1268390 #1
      task: de16b6c0 ti: de048000 task.ti: de048000
      PC is at strnlen+0xc/0x4c
      LR is at string+0x3c/0xf8
      pc : [<c02c123c>]    lr : [<c02c2d1c>]    psr: a0000013
      sp : de049e10  ip : c06efba0  fp : de6d2092
      r10: bf01a260  r9 : ffffffff  r8 : 74706164
      r7 : 0000ffff  r6 : ffffffff  r5 : de6d209c  r4 : 00000000
      r3 : ff0a0004  r2 : 74706164  r1 : ffffffff  r0 : 74706164
      Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
      Control: 10c5387d  Table: 9e530019  DAC: 00000015
      Process cat (pid: 1635, stack limit = 0xde048240)
      Stack: (0xde049e10 to 0xde04a000)
      9e00:                                     de6d2092 00000002 bf01a25e de6d209c
      9e20: de049e80 c02c438c 0000000a ff0a0004 ffffffff 00000000 00000000 de049e48
      9e40: 00000000 2192df6d ff0a0004 ffffffff 00000000 de6d2092 de049ef8 bef3cc00
      9e60: de6b0000 dc358000 de6d2000 00000000 00000003 c02c45a4 bf01790c bf01a254
      9e80: 74706164 bf018698 00000000 de59c3c0 de048000 de049f80 00001000 bef3cc00
      9ea0: 00000008 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      9ec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      9ee0: 00000000 00000000 00000000 00000001 00000000 00000000 6669776d 20786569
      9f00: 20302e31 2e343128 392e3636 3231702e 00202933 00000000 00000003 c0294898
      9f20: 00000000 00000000 00000000 00000000 de59c3c0 c0107c04 de554000 de59c3c0
      9f40: 00001000 bef3cc00 de049f80 bef3cc00 de049f80 00000000 00000003 c0108a00
      9f60: de048000 de59c3c0 00000000 00000000 de59c3c0 00001000 bef3cc00 c0108b60
      9f80: 00000000 00000000 00001000 bef3cc00 00000003 00000003 c0014128 de048000
      9fa0: 00000000 c0013f80 00001000 bef3cc00 00000003 bef3cc00 00001000 00000000
      9fc0: 00001000 bef3cc00 00000003 00000003 00000001 00000001 00000001 00000003
      9fe0: 00000000 bef3cbdc 00011984 b6f1127c 60000010 00000003 18dbdd2c 7f7bfffd
      [<c02c123c>] (strnlen+0xc/0x4c) from [<c02c2d1c>] (string+0x3c/0xf8)
      [<c02c2d1c>] (string+0x3c/0xf8) from [<c02c438c>] (vsnprintf+0x1e8/0x3e8)
      [<c02c438c>] (vsnprintf+0x1e8/0x3e8) from [<c02c45a4>] (sprintf+0x18/0x24)
      [<c02c45a4>] (sprintf+0x18/0x24) from [<bf01790c>] (mwifiex_info_read+0xfc/0x3e8 [mwifiex])
      [<bf01790c>] (mwifiex_info_read+0xfc/0x3e8 [mwifiex]) from [<c0108a00>] (vfs_read+0xb0/0x144)
      [<c0108a00>] (vfs_read+0xb0/0x144) from [<c0108b60>] (SyS_read+0x44/0x70)
      [<c0108b60>] (SyS_read+0x44/0x70) from [<c0013f80>] (ret_fast_syscall+0x0/0x30)
      Code: e12fff1e e3510000 e1a02000 0a00000d (e5d03000)
      ---[ end trace ca98273dc605a04f ]---
      
      The panic is caused by the mwifiex_info_read() routine assuming that
      there can only be four modes (0-3) which is an invalid assumption.
      For example, when testing P2P, the mode is '8' (P2P_CLIENT) so the
      code accesses data beyond the bounds of the bss_modes[] array which
      causes the panic.  Fix this by updating bss_modes[] to support the
      current list of modes and adding a check to prevent the out-of-bounds
      access from occuring in the future when more modes are added.
      Signed-off-by: default avatarMark A. Greer <mgreer@animalcreek.com>
      Acked-by: default avatarBing Zhao <bzhao@marvell.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      f873ded2
    • Johan Hedberg's avatar
      Bluetooth: Fix mgmt handling of power on failures · 96570ffc
      Johan Hedberg authored
      If hci_dev_open fails we need to ensure that the corresponding
      mgmt_set_powered command gets an appropriate response. This patch fixes
      the missing response by adding a new mgmt_set_powered_failed function
      that's used to indicate a power on failure to mgmt. Since a situation
      with the device being rfkilled may require special handling in user
      space the patch uses a new dedicated mgmt status code for this.
      Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
      Cc: stable@vger.kernel.org
      Acked-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      96570ffc
    • Johan Hedberg's avatar
      Bluetooth: Fix missing length checks for L2CAP signalling PDUs · cb3b3152
      Johan Hedberg authored
      There has been code in place to check that the L2CAP length header
      matches the amount of data received, but many PDU handlers have not been
      checking that the data received actually matches that expected by the
      specific PDU. This patch adds passing the length header to the specific
      handler functions and ensures that those functions fail cleanly in the
      case of an incorrect amount of data.
      Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      cb3b3152
    • Bing Zhao's avatar
      Bluetooth: btmrvl: support Marvell Bluetooth device SD8897 · 22f2efed
      Bing Zhao authored
      The register offsets have been changed in SD8897 and newer chips.
      Define a new btmrvl_sdio_card_reg map for SD88xx.
      Signed-off-by: default avatarBing Zhao <bzhao@marvell.com>
      Signed-off-by: default avatarFrank Huang <frankh@marvell.com>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      22f2efed
    • Johan Hedberg's avatar
      Bluetooth: Fix checks for LE support on LE-only controllers · 757aee0f
      Johan Hedberg authored
      LE-only controllers do not support extended features so any kind of host
      feature bit checks do not make sense for them. This patch fixes code
      used for both single-mode (LE-only) and dual-mode (BR/EDR/LE) to use the
      HCI_LE_ENABLED flag instead of the "Host LE supported" feature bit for
      LE support tests.
      Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
      Acked-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      757aee0f
  2. 28 May, 2013 10 commits
  3. 27 May, 2013 4 commits
  4. 24 May, 2013 3 commits
  5. 23 May, 2013 3 commits
  6. 22 May, 2013 3 commits
  7. 21 May, 2013 4 commits
  8. 17 May, 2013 8 commits
    • Felix Fietkau's avatar
      ath9k: fix draining aggregation tid buffers · 6bb4880d
      Felix Fietkau authored
      After a tx attempt, an A-MPDU subframe can still have fi->retries at 0
      (if the retry count wasn't incremented due to powersave).
      In that case it is still tracked as part of the block ack window, so
      when draining the tid queue, its sequence number needs to be cleared
      from the pending frame bitmap.
      Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      6bb4880d
    • Felix Fietkau's avatar
      ath9k: fix rate handling/reporting · 0c585dda
      Felix Fietkau authored
      This patch fixes some issues introduced in the rate control API rework.
      When not running aggregation, copy bf->rates into info->control.rates
      before applying the rate control status to it.
      In ath_lookup_rate, the rates need to be pulled from bf->rates, not the
      tx info.
      Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      0c585dda
    • Felix Fietkau's avatar
      ath9k: fix aggregation stop/flush handling · 16e23428
      Felix Fietkau authored
      When aggregation stop is requested, don't run the mac80211 aggregation
      stop callback yet, while the session is still blocked.
      Also, when aggregation flush is requested, don't run the callback at all.
      Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      16e23428
    • Sujith Manoharan's avatar
      ath9k_hw: Enable manual peak calibration for AR9485 · e99c60b5
      Sujith Manoharan authored
      Manual peak calibration is currently enabled only for
      AR9462 and AR9565. This is also required for AR9485.
      The initvals are also modified to disable HW peak calibration.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarSujith Manoharan <c_manoha@qca.qualcomm.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      e99c60b5
    • Albert Pool's avatar
      rtlwifi: rtl8192cu: Add new USB ID · 707a6152
      Albert Pool authored
      This adds the USB ID of the On Networks N300MA, clone of Netgear WNA3100M.
      Signed-off-by: default avatarAlbert Pool <albertpool@solcon.nl>
      Signed-off-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
      Reported-by: default avatarAna Rey <Anazul77@hotmail.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      707a6152
    • Arend van Spriel's avatar
      brcmfmac: announce P2P_DEVICE support in wiphy structure · 9af221b3
      Arend van Spriel authored
      P2P_DEVICE support was removed from brcmfmac for v3.9 kernel with
      the commit below:
      
      commit 1527c343
      Author: Arend van Spriel <arend@broadcom.com>
      Date:   Thu Apr 4 12:10:11 2013 +0200
      
          brcmfmac: remove advertising P2P device support
      
      However, it got merged into wireless-next. But for 3.10 brcmfmac does
      support P2P device. Putting it back with this commit.
      Reviewed-by: default avatarHante Meuleman <meuleman@broadcom.com>
      Signed-off-by: default avatarArend van Spriel <arend@broadcom.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      9af221b3
    • Larry Finger's avatar
      rtlwifi: rtl8188ee: Fix warning when building on big-endian systems · 58dd3ff8
      Larry Finger authored
      In http://lkml.indiana.edu/hypermail/linux/kernel/1305.1/index.html,
      Geert Uytterhoeven reports a new warning when building 3.10-rc1 in
      this driver. This is caused by using a "#if" test to see if __LITTLE_ENDIAN
      is set, which fails for all big-endian systems. Change to "ifdef".
      Signed-off-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      58dd3ff8
    • Sujith Manoharan's avatar
      ath9k: Fix crash on module unload · af690092
      Sujith Manoharan authored
      Make sure that any open relayfs files are closed before
      unregistering with mac80211, otherwise this crash is seen:
      
      [ 1331.097846] BUG: unable to handle kernel paging request at 6b6b6b8b
      [ 1331.098170] IP: [<c063d0d6>] debugfs_remove+0x26/0x80
      [ 1331.098170] *pdpt = 000000002f9aa001 *pde = 0000000000000000
      [ 1331.098170] Oops: 0000 [#1] PREEMPT SMP
      [ 1331.098170] Modules linked in: iptable_raw xt_CT nf_conntrack_ipv4 nf_defrag]
      [ 1331.098170] Pid: 4794, comm: rmmod Tainted: G        WC   3.9.1+ #5 To Be Fi.
      [ 1331.098170] EIP: 0060:[<c063d0d6>] EFLAGS: 00010202 CPU: 0
      [ 1331.098170] EIP is at debugfs_remove+0x26/0x80
      [ 1331.098170] EAX: f2f3acd0 EBX: f2f3acd0 ECX: 00000006 EDX: f8622348
      [ 1331.098170] ESI: 6b6b6b6b EDI: 00000001 EBP: ee251e14 ESP: ee251e0c
      [ 1331.098170]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
      [ 1331.098170] CR0: 8005003b CR2: 6b6b6b8b CR3: 2e7b7000 CR4: 000007e0
      [ 1331.098170] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
      [ 1331.098170] DR6: ffff0ff0 DR7: 00000400
      [ 1331.098170] Process rmmod (pid: 4794, ti=ee250000 task=efaa2560 task.ti=ee25)
      [ 1331.098170] Stack:
      [ 1331.098170]  f241e170 0000000a ee251e1c f861394d ee251e28 c04e3088 f241e170 4
      [ 1331.098170]  c04e30fe f45482b0 ee251e54 c04e3187 f25e86b0 ee251e54 f8618748 0
      [ 1331.098170]  0000000a 00000001 ee251e68 f860065b f2509e20 f25085a0 f5b6e8a4 8
      [ 1331.098170] Call Trace:
      [ 1331.098170]  [<f861394d>] remove_buf_file_handler+0xd/0x20 [ath9k]
      [ 1331.098170]  [<c04e3088>] relay_remove_buf+0x18/0x30
      [ 1331.098170]  [<c04e30fe>] relay_close_buf+0x2e/0x40
      [ 1331.098170]  [<c04e3187>] relay_close+0x77/0xf0
      [ 1331.098170]  [<f8618748>] ? dpd_exit+0x38/0x40 [ath9k]
      [ 1331.098170]  [<f860065b>] ath9k_deinit_softc+0x8b/0xa0 [ath9k]
      [ 1331.098170]  [<f86006b8>] ath9k_deinit_device+0x48/0x60 [ath9k]
      [ 1331.098170]  [<f86107f1>] ath_pci_remove+0x31/0x50 [ath9k]
      [ 1331.098170]  [<c06dbff8>] pci_device_remove+0x38/0xc0
      [ 1331.098170]  [<c079daa4>] __device_release_driver+0x64/0xc0
      [ 1331.098170]  [<c079db97>] driver_detach+0x97/0xa0
      [ 1331.098170]  [<c079cacc>] bus_remove_driver+0x6c/0xe0
      [ 1331.098170]  [<c079c197>] ? bus_put+0x17/0x20
      [ 1331.098170]  [<c079cae3>] ? bus_remove_driver+0x83/0xe0
      [ 1331.098170]  [<c079e709>] driver_unregister+0x49/0x80
      [ 1331.098170]  [<c06dc138>] pci_unregister_driver+0x18/0x80
      [ 1331.098170]  [<f8610602>] ath_pci_exit+0x12/0x20 [ath9k]
      [ 1331.098170]  [<f8619ce0>] ath9k_exit+0x17/0x337 [ath9k]
      [ 1331.098170]  [<c09e537d>] ? mutex_unlock+0xd/0x10
      [ 1331.098170]  [<c04bd36c>] sys_delete_module+0x17c/0x250
      [ 1331.098170]  [<c0540dc4>] ? do_munmap+0x244/0x2d0
      [ 1331.098170]  [<c0540e96>] ? vm_munmap+0x46/0x60
      [ 1331.098170]  [<c09e8dc4>] ? restore_all+0xf/0xf
      [ 1331.098170]  [<c09ebf50>] ? __do_page_fault+0x4c0/0x4c0
      [ 1331.098170]  [<c04b18e4>] ? trace_hardirqs_on_caller+0xf4/0x180
      [ 1331.098170]  [<c09ef28d>] sysenter_do_call+0x12/0x38
      [ 1331.098170] Code: 90 8d 74 26 00 55 89 e5 83 ec 08 89 1c 24 89 74 24 04 3e 82
      [ 1331.098170] EIP: [<c063d0d6>] debugfs_remove+0x26/0x80 SS:ESP 0068:ee251e0c
      [ 1331.098170] CR2: 000000006b6b6b8b
      [ 1331.727971] ---[ end trace b5bb9f2066cef7f9 ]---
      
      Cc: <stable@vger.kernel.org>
      Acked-by: default avatarSimon Wunderlich <siwu@hrz.tu-chemnitz.de>
      Tested-by: default avatarBen Greear <greearb@candelatech.com>
      Signed-off-by: default avatarSujith Manoharan <c_manoha@qca.qualcomm.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      af690092