1. Jul 27, 2013
  2. Jul 25, 2013
    • David S. Miller's avatar
      Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless · 1df86b4c
      David S. Miller authored
      
      
      John W. Linville says:
      
      ====================
      This is another batch of fixes intended for the 3.11 stream.  FWIW,
      this is the first request with fixes from the mac80211 and iwlwifi
      trees as well.
      
      Regarding the mac80211 bits, Johannes says:
      
      "Here I have a fix for RSSI thresholds in mesh, two minstrel fixes from
      Felix, an nl80211 fix from Michal and four various fixes I did myself."
      
      As for the iwlwifi bits, Johannes says:
      
      "Here I have a fix for debugfs directory creation (causing a spurious
      error message), two scanning fixes from David Spinadel, an LED fix and
      two patches related to a BA session problem that eventually caused
      firmware crashes from Emmanuel and a small BT fix for older devices as
      well as a workaround for a firmware problem with APs with very small
      beacon intervals from myself."
      
      Along with those:
      
      Arend van Spriel addresses a lock-up and a NULL pointer dereference
      in brcmfmac.
      
      Daniel Drake fixes an unhandled interrupt during device tear down
      in mwifiex.
      
      Larry Finger corrects a wil6210 build error.
      
      Oleksij Rempel fixes two ath9k_htc problems related to keeping the
      driver and firmware in sync.
      
      Solomon Peachy gives us a cw1200 fix to avoid an oops in monitor mode.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1df86b4c
    • Florian Fainelli's avatar
      net: fix comment above build_skb() · deceb4c0
      Florian Fainelli authored
      
      
      build_skb() specifies that the data parameter must come from a kmalloc'd
      area, this is only true if frag_size equals 0, because then build_skb()
      will use kzsize(data) to figure out the actual data size. Update the
      comment to reflect that special condition.
      
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      deceb4c0
    • Emilio López's avatar
      net: sun4i: fix timeout check · 2bf420a7
      Emilio López authored
      
      
      The current timeout check is comparing two constant values, so it won't
      ever detect a timeout. This patch reworks the affected code a bit so it
      has a chance at detecting timeouts correctly.
      
      Signed-off-by: default avatarEmilio López <emilio@elopez.com.ar>
      Acked-by: default avatarMaxime Ripard <maxime.ripard@free-electrons.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2bf420a7
    • Hannes Frederic Sowa's avatar
      ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanup · 905a6f96
      Hannes Frederic Sowa authored
      
      
      Otherwise we end up dereferencing the already freed net->ipv6.mrt pointer
      which leads to a panic (from Srivatsa S. Bhat):
      
      BUG: unable to handle kernel paging request at ffff882018552020
      IP: [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
      PGD 290a067 PUD 207ffe0067 PMD 207ff1d067 PTE 8000002018552060
      Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
      Modules linked in: ebtable_nat ebtables nfs fscache nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables nfsd lockd nfs_acl exportfs auth_rpcgss autofs4 sunrpc 8021q garp bridge stp llc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter
      +ip6_tables ipv6 vfat fat vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support cdc_ether usbnet mii microcode i2c_i801 i2c_core lpc_ich mfd_core shpchp ioatdma dca mlx4_core be2net wmi acpi_cpufreq mperf ext4 jbd2 mbcache dm_mirror dm_region_hash dm_log dm_mod
      CPU: 0 PID: 7 Comm: kworker/u33:0 Not tainted 3.11.0-rc1-ea45e-a #4
      Hardware name: IBM  -[8737R2A]-/00Y2738, BIOS -[B2E120RUS-1.20]- 11/30/2012
      Workqueue: netns cleanup_net
      task: ffff8810393641c0 ti: ffff881039366000 task.ti: ffff881039366000
      RIP: 0010:[<ffffffffa0366b02>]  [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
      RSP: 0018:ffff881039367bd8  EFLAGS: 00010286
      RAX: ffff881039367fd8 RBX: ffff882018552000 RCX: dead000000200200
      RDX: 0000000000000000 RSI: ffff881039367b68 RDI: ffff881039367b68
      RBP: ffff881039367bf8 R08: ffff881039367b68 R09: 2222222222222222
      R10: 2222222222222222 R11: 2222222222222222 R12: ffff882015a7a040
      R13: ffff882014eb89c0 R14: ffff8820289e2800 R15: 0000000000000000
      FS:  0000000000000000(0000) GS:ffff88103fc00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: ffff882018552020 CR3: 0000000001c0b000 CR4: 00000000000407f0
      Stack:
       ffff881039367c18 ffff882014eb89c0 ffff882015e28c00 0000000000000000
       ffff881039367c18 ffffffffa034d9d1 ffff8820289e2800 ffff882014eb89c0
       ffff881039367c58 ffffffff815bdecb ffffffff815bddf2 ffff882014eb89c0
      Call Trace:
       [<ffffffffa034d9d1>] rawv6_close+0x21/0x40 [ipv6]
       [<ffffffff815bdecb>] inet_release+0xfb/0x220
       [<ffffffff815bddf2>] ? inet_release+0x22/0x220
       [<ffffffffa032686f>] inet6_release+0x3f/0x50 [ipv6]
       [<ffffffff8151c1d9>] sock_release+0x29/0xa0
       [<ffffffff81525520>] sk_release_kernel+0x30/0x70
       [<ffffffffa034f14b>] icmpv6_sk_exit+0x3b/0x80 [ipv6]
       [<ffffffff8152fff9>] ops_exit_list+0x39/0x60
       [<ffffffff815306fb>] cleanup_net+0xfb/0x1a0
       [<ffffffff81075e3a>] process_one_work+0x1da/0x610
       [<ffffffff81075dc9>] ? process_one_work+0x169/0x610
       [<ffffffff81076390>] worker_thread+0x120/0x3a0
       [<ffffffff81076270>] ? process_one_work+0x610/0x610
       [<ffffffff8107da2e>] kthread+0xee/0x100
       [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70
       [<ffffffff8162a99c>] ret_from_fork+0x7c/0xb0
       [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70
      Code: 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 4c 8b 67 30 49 89 fd e8 db 3c 1e e1 49 8b 9c 24 90 08 00 00 48 85 db 74 06 <4c> 39 6b 20 74 20 bb f3 ff ff ff e8 8e 3c 1e e1 89 d8 4c 8b 65
      RIP  [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
       RSP <ffff881039367bd8>
      CR2: ffff882018552020
      
      Reported-by: default avatarSrivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
      Tested-by: default avatarSrivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
      Signed-off-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      905a6f96
    • Jerry Snitselaar's avatar
      fib_trie: potential out of bounds access in trie_show_stats() · f585a991
      Jerry Snitselaar authored
      
      
      With the <= max condition in the for loop, it will be always go 1
      element further than needed. If the condition for the while loop is
      never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
      end of nodesizes[].
      
      Signed-off-by: default avatarJerry Snitselaar <jerry.snitselaar@oracle.com>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f585a991
    • Dan Carpenter's avatar
      mlx5: use after free in mlx5_cmd_comp_handler() · 64d2c22a
      Dan Carpenter authored
      
      
      We can't dereference "ent" after passing it to free_cmd().
      
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      64d2c22a
    • Lekensteyn's avatar
      r8169: fix lockdep warning when removing interface · 4ea72445
      Lekensteyn authored
      
      
      The work queue is initialised in rtl_open (when the interface goes up),
      but canceled in rtl_remove_one (when the PCI device gets removed). If
      the network interface is not brought up, then the work queue struct is
      not initialised. When the device is removed, the attempt to cancel the
      uninitialised work queue causes a lockdep warning.
      
      This patch fixes the issue by moving cancel_work_sync to rtl_close (to
      match rtl_open). (Note that rtl_close is also called via
      unregister_netdev in rtl_remove_one.)
      
      Signed-off-by: default avatarPeter Wu <lekensteyn@gmail.com>
      Acked-by: default avatarFrancois Romieu <romieu@fr.zoreil.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4ea72445
  3. Jul 24, 2013
  4. Jul 23, 2013
  5. Jul 21, 2013
    • David S. Miller's avatar
      Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless · f5f7ab67
      David S. Miller authored
      
      
      John W. Linville says:
      
      ====================
      Please accept this batch of fixes intended for the 3.11 tree...
      
      Alexey Khoroshilov fixes a suspend-related race in ath9k_htc.
      
      Arnd Bergmann corrects the alignment of a structure in the ssb code
      to be compatible with ARM devices.
      
      Bob Copeland provides an ath5k fix that corrects a mistaken variable
      initialization.
      
      Felix Fietkau corrects some frame accounting for dropped frames
      in ath9k.
      
      Geert Uytterhoeven brings a Kconfig fix to indicate the DMA
      requirements for rt2x00.
      
      Larry Finger offers two rtlwifi fixes: one that properly initializes
      a callback; and, a scattered collection of Kconfig, Makefile, and
      EXPORT_SYMBOL changes that correct some build problems.
      
      Finally, Sujith Manoharan provides an ath9k fix to disable a feature
      on a specific hardware device.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f5f7ab67
    • David S. Miller's avatar
      Merge branch 'fixes-for-3.11' of git://gitorious.org/linux-can/linux-can · 8d716c7a
      David S. Miller authored
      
      
      Marc Kleine-Budde says:
      
      ====================
      here are two fixes for the v3.11 release cycle:
      
      Maximilian Schneider contributes a patch for the esd_usb2 CAN driver. It adds
      sanity checking to the data coming from the USB CAN adapter before using it.
      Alexey Khoroshilov from the Linux Driver Verification project fixes an urb leak
      in the error handling of the USB 8dev's usb_8dev_start() function.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8d716c7a
  6. Jul 20, 2013