aboutsummaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2009-01-22p54usb: fix nasty use after freeChristian Lamparter
In theory, the firmware acks the received a data frame, before signaling the driver to free it again. However Artur Skawina <art.08.09@gmail.com> has shown that it can happen in reverse order as well. This is very bad and could lead to memory corruptions, oopses and panics. Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue. Signed-off-by: Christian Lamparter <chunkeey@web.de> Tested-by: Artur Skawina <art.08.09@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22p54: more cryptographic accelerator fixesChristian Lamparter
If we let the firmware do the data encryption, we have to remove the ICV and (M)MIC at the end of the frame before we can give it back to mac80211. Or, these data frames have a few trailing bytes on cooked monitor interfaces. Signed-off-by: Christian Lamparter <chunkeey@web.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22p54: add missing break in eeprom parserChr
This patch fixes a obvious memory leak in the eeprom parser. Signed-off-by: Christian Lamparter <chunkeey@web.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22orinoco: use KERN_DEBUG for link status messagesPavel Roskin
KERN_INFO is too "loud" for messages that are generated by the ordinary events, such as accociation. Use of KERN_DEBUG is consistent with mac80211. Suggested by Michael Gilbert <michael.s.gilbert@gmail.com> Signed-off-by: Pavel Roskin <proski@gnu.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22rt2x00: Fix TX rate short preamble detectionIvo van Doorn
Mac80211 provides 2 structures to handle bitrates, namely ieee80211_rate and ieee80211_tx_rate. To determine the short preamble mode for an outgoing frame, the flag IEEE80211_TX_RC_USE_SHORT_PREAMBLE must be checked on ieee80211_tx_rate and not ieee80211_rate (which rt2x00 did). This fixes a regression which was triggered in 2.6.29-rcX as reported by Chris Clayton. Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Tested-By: Chris Clayton <chris2553@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22orinoco: move kmalloc(..., GFP_KERNEL) outside spinlock in ↵Andrey Borzenkov
orinoco_ioctl_set_genie [ 56.923623] BUG: sleeping function called from invalid context at /home/bor/src/linux-git/mm/slub.c:1599 [ 56.923644] in_atomic(): 0, irqs_disabled(): 1, pid: 3031, name: wpa_supplicant [ 56.923656] 2 locks held by wpa_supplicant/3031: [ 56.923662] #0: (rtnl_mutex){--..}, at: [<c02abd1f>] rtnl_lock+0xf/0x20 [ 56.923703] #1: (&priv->lock){++..}, at: [<dfc840c2>] orinoco_ioctl_set_genie+0x52/0x130 [orinoco] [ 56.923782] irq event stamp: 910 [ 56.923788] hardirqs last enabled at (909): [<c01957db>] __kmalloc+0x7b/0x140 [ 56.923820] hardirqs last disabled at (910): [<c0309419>] _spin_lock_irqsave+0x19/0x80 [ 56.923847] softirqs last enabled at (880): [<c0124f54>] __do_softirq+0xc4/0x110 [ 56.923865] softirqs last disabled at (871): [<c01049ae>] do_softirq+0x8e/0xe0 [ 56.923895] Pid: 3031, comm: wpa_supplicant Not tainted 2.6.29-rc2-1avb #1 [ 56.923905] Call Trace: [ 56.923919] [<c01049ae>] ? do_softirq+0x8e/0xe0 [ 56.923941] [<c011ad12>] __might_sleep+0xd2/0x100 [ 56.923952] [<c0195837>] __kmalloc+0xd7/0x140 [ 56.923963] [<c030946a>] ? _spin_lock_irqsave+0x6a/0x80 [ 56.923981] [<dfc840e9>] ? orinoco_ioctl_set_genie+0x79/0x130 [orinoco] [ 56.923999] [<dfc840c2>] ? orinoco_ioctl_set_genie+0x52/0x130 [orinoco] [ 56.924017] [<dfc840e9>] orinoco_ioctl_set_genie+0x79/0x130 [orinoco] [ 56.924036] [<c0209325>] ? copy_from_user+0x35/0x130 [ 56.924061] [<c02ffd96>] ioctl_standard_call+0x196/0x380 [ 56.924085] [<c029f945>] ? __dev_get_by_name+0x85/0xb0 [ 56.924096] [<c02ff88f>] wext_handle_ioctl+0x14f/0x230 [ 56.924113] [<dfc84070>] ? orinoco_ioctl_set_genie+0x0/0x130 [orinoco] [ 56.924132] [<c02a3da5>] dev_ioctl+0x495/0x570 [ 56.924155] [<c0293e05>] ? sys_sendto+0xa5/0xd0 [ 56.924171] [<c0142fe8>] ? mark_held_locks+0x48/0x90 [ 56.924183] [<c0292880>] ? sock_ioctl+0x0/0x280 [ 56.924193] [<c029297d>] sock_ioctl+0xfd/0x280 [ 56.924203] [<c0292880>] ? sock_ioctl+0x0/0x280 [ 56.924235] [<c01a51d0>] vfs_ioctl+0x20/0x80 [ 56.924246] [<c01a53e2>] do_vfs_ioctl+0x72/0x570 [ 56.924257] [<c0293e62>] ? sys_send+0x32/0x40 [ 56.924268] [<c02947c0>] ? sys_socketcall+0x1d0/0x2a0 [ 56.924280] [<c010339f>] ? sysenter_exit+0xf/0x16 [ 56.924292] [<c01a5919>] sys_ioctl+0x39/0x70 [ 56.924302] [<c0103371>] sysenter_do_call+0x12/0x31 Signed-off-by: Andrey Borzenkov <arvidjaar@mail.ru> Cc: stable@kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-21usb/mcs7830: Don't use buffers from stack for USB transfersChristian Eggers
mcs7830_set_reg() and mcs7830_get_reg() are called with buffers from stack which must not be used directly for USB transfers. This causes corruption of the stack particulary on non x86 architectures because DMA may be used for these transfers. Signed-off-by: Christian Eggers <christian.eggers@kathrein.de> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-21usbnet: allow type check of devdbg arguments in non-debug buildSteve Glendinning
Improve usbnet's devdbg to always type-check diagnostic arguments, like dev_dbg (device.h). This makes no change to the resulting size of usbnet modules. This patch also removes an #ifdef DEBUG directive from rndis_wlan so it's devdbg statements are always type-checked at compile time. Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com> Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-20via-velocity: fix hot spinroel kluin
while(--j >= 0) keeps spinning when j is unsigned: Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-20myri10ge: don't forget pci_disable_device()Brice Goglin
Don't forget to call pci_disable_device() in myri10ge_remove() and when myri10ge_probe() fails. By the way, update the copyright years. Signed-off-by: Brice Goglin <brice@myri.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-20Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2009-01-19wimax/i2400m: error paths that need to free an skb should use kfree_skb()Inaky Perez-Gonzalez
Roel Kluin reported a bug in two error paths where skbs were wrongly being freed using kfree(). He provided a fix where it was replaced to kfree_skb(), as it should be. However, in i2400mu_rx(), the error path was missing returning an indication of the failure. Changed to reset rx_skb to NULL and return it to the caller, i2400mu_rxd(). It will be treated as a transient error and just ignore the packet. Depending on the buffering conditions inside the device, the data packet might be dropped or the device will signal the host again for data-ready-to-read and the host will retry. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19mv643xx_eth: prevent interrupt storm on ifconfig downGabriel Paubert
Contrary to what the docs say, the 'extended interrupt cause' bit in the interrupt cause register (bit 1) appears to not be maskable on at least some of the mv643xx_eth platforms, making writing zeroes to the interrupt mask register but not the extended interrupt mask register insufficient to stop interrupts from occuring. Therefore, also write zeroes to the extended interrupt mask register when shutting down the port. This fixes the interrupt storm seen on the Pegasos board when shutting down the interface. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19mv643xx_eth: fix multicast filter programmingLennert Buytenhek
Commit 66e63ffbc04706568d8789cbb00eaa8ddbcae648 ("mv643xx_eth: implement ->set_rx_mode()") cleaned up mv643xx_eth's multicast filter programming, but broke it as well. The non-special multicast filter table (for multicast addresses that are not of the form 01:00:5e:00:00:xx) consists of 256 hash table buckets organised as 64 32-bit words, where the 'accept' bits are in the LSB of each byte, so in bits 24 16 8 0 of each 32-bit word. The old code got this right, but the referenced commit broke this by using bits 3 2 1 0 instead. This commit fixes this up. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19Revert "mv643xx_eth: use longer DMA bursts".Lennert Buytenhek
This reverts commit cd4ccf76bfd2c36d351e68be7e6a597268f98a1a. On the Pegasos board, we can't do DMA burst that are longer than one cache line. For now, go back to using 32 byte DMA bursts for all mv643xx_eth platforms -- we can switch the ARM-based platforms back to doing long 128 byte bursts in the next development cycle. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Reported-by: Alan Curry <pacman@kosh.dhis.org> Reported-by: Gabriel Paubert <paubert@iram.es> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19tg3: Fix firmware loadingMatt Carlson
This patch modifies how the tg3 driver handles device firmware. The patch starts by consolidating David Woodhouse's earlier patch under the same name. Specifically, the patch moves the request_firmware call into a separate tg3_request_firmware() function and calls that function from tg3_open() rather than tg3_init_one(). The patch then goes on to limit the number of devices that will make request_firmware calls. The original firmware patch unnecessarily requested TSO firmware for devices that did not need it. This patch reduces the set of devices making TSO firmware patches to approximately the following device set : 5703, 5704, and 5705. Finally, the patch reduces the effects of a request_firmware() failure. For those devices that are requesting TSO firmware, the driver will turn off the TSO capability. If TSO firmware becomes available at a later time, the device can be closed and then opened again to reacquire the TSO capability. Signed-off-by: Matt Carlson <mcarlson@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19ixgbe: Fix usage of netif_*_all_queues() with netif_carrier_{off|on}()Peter P Waskiewicz Jr
netif_carrier_off() is sufficient to stop Tx into the driver. Stopping the Tx queues is redundant and unnecessary. By the same token, netif_carrier_on() will be sufficient to re-enable Tx, so waking the queues is unnecessary. Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19ixgbe: fix tag stripping for VLAN ID 0Don Skidmore
Register VLAN ID 0 so that frames with VLAN ID 0 are received and get their tag stripped when ixgbe is not in DCB mode. VLAN ID 0 means that the frame is 'priority tagged' only - it is not a VLAN, but the priority value is the tag in valid. The functions ixgbe_vlan_rx_register() and ixgbe_vlan_rx_kill_vid() were moved up a couple functions to correct compiling issues with this change. Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com> Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by: Eric W Multanen <eric.w.multanen@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19ixgbe: fix dca issue with relaxed ordering turned onDon Skidmore
The is an issue where setting Relaxed Ordering (RO) bit (in a PCI-E write transaction) on 82598 causing the chipset to drop DCA hints. This patch forces RO not to be set for descriptors as well as payload. This will only be in effect while DCA is enabled and no performance difference was noticed in testing. Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com> Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19korina: drop leftover assignmentPhil Sutter
As the assigned value is being overwritten shortly after, it can be dropped and so the whole variable definition moved to the start of the function. Signed-off-by: Phil Sutter <n0-1@freewrt.org> Acked-by: Florian Fainelli <florian@openwrt.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19korina: adjust headroom for new skb's alsoPhil Sutter
This is copy and paste from the original driver. As skb_reserve() is also called within korina_alloc_ring() when initially allocating the receive descriptors, the same should be done when allocating new space after passing an skb to upper layers. Signed-off-by: Phil Sutter <n0-1@freewrt.org> Acked-by: Florian Fainelli <florian@openwrt.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19korina: fix loop back of receive descriptorsPhil Sutter
After the last loop iteration, i has the value RC32434_NUM_RDS and therefore leads to an index overflow when used afterwards to address the last element. This is yet another another bug introduced when rewriting parts of the driver for upstream preparation, as the original driver used 'RC32434_NUM_RDS - 1' instead. Signed-off-by: Phil Sutter <n0-1@freewrt.org> Acked-by: Florian Fainelli <florian@openwrt.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19cxgb3: Fix LRO misalignmentDivy Le Ray
The lro manager's frag_align_pad setting was missing, leading to misaligned access to the skb passed up to the stack. Tested-by: Rick Jones <rick.jones2@hp.com> Signed-off-by: Divy Le Ray <divy@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19macb: avoid lockup when TGO during underrunRichard Röjfors
In rare cases when an underrun occur, all macb buffers where consumed and the netif_queue was stopped infinitely. This happens then the TGO (transfer ongoing) bit in the TSR is set (and UND). It seems like clening up after the underrun makes the driver and the macb hardware end up in an inconsistent state. The result of this is that in the following calls to macb_tx no TX buffers are released -> the netif_queue was stopped, and never woken up again. The solution is to disable the transmitter, if TGO is set, before clening up after the underrun, and re-enable the transmitter when the cleaning up is done. Signed-off-by: Richard Röjfors <richard.rojfors@endian.se> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Version updateEilon Greenstein
Updating the version and the year of updated files Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Barriers for the compilerEilon Greenstein
To make sure no swapping are made by the compiler, changed HAS_WORK to inline functions and added all the necessary barriers Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Driver description updateEilon Greenstein
The Driver supports the 57711 and 57711E as well but the description was out of date Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Handling PHY FW load failureEilon Greenstein
If the default PHY version (0x4321) is read - the PHY FW load failed Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Legacy speeds autoneg failuresEilon Greenstein
10M/100M autoneg was not establishing link. Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Prevent self test loopback failuresEilon Greenstein
Setting loopback requires time to take effect Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: 1G-10G toggling raceEilon Greenstein
The HW should be configured so fast toggling between 1G and 10G will not be missed. Make sure that the HW is re-configured in full Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Overstepping array boundsEilon Greenstein
If the page size is > 8KB this violation happens Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Block nvram access when the device is inactiveEilon Greenstein
Don't dump eeprom when bnx2x adapter is down. Running ethtool -e causes an eeh without it when the device is down Signed-off-by: Paul Larson <pl@linux.vnet.ibm.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Read chip IDEilon Greenstein
Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Wrong HDR offset in CAMEilon Greenstein
Has a negative side effect when sending MAC update with no content (as done in the self-test) Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Potential race after iSCSI bootEilon Greenstein
The lock was release too soon. Make sure the HW is marked as locked until the boot driver was unloaded from FW perspective Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Handling probe failuresEilon Greenstein
Failures in the probe not handled correctly - separate the flow to handle different failures Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-19bnx2x: Free IRQEilon Greenstein
Error check could result with not freeing the IRQ Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-17Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/ehca: Use consistent types for ehca_plpar_hcall9() IB/ehca: Fix printk format warnings from u64 type change IPoIB: Do not print error messages for multicast join retries IB/mlx4: Fix memory ordering problem when posting LSO sends mlx4_core: Fix min() warning IPoIB: Fix deadlock between ipoib_open() and child interface create IPoIB: Fix hang in napi_disable() if P_Key is never found
2009-01-17Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6: move wm8400-regulator's probe function to .devinit.text
2009-01-17dell_rbu: use scnprintf() instead of less secure sprintf()Pavel Roskin
Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or /sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an oops. Signed-off-by: Pavel Roskin <proski@gnu.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-01-17move wm8400-regulator's probe function to .devinit.textUwe Kleine-König
A pointer to wm8400_regulator_probe is passed to the core via platform_driver_register and so the function must not disappear when the .init sections are discarded. Otherwise (if also having HOTPLUG=y) unbinding and binding a device to the driver via sysfs will result in an oops as does a device being registered late. An alternative to this patch is using platform_driver_probe instead of platform_driver_register plus removing the pointer to the probe function from the struct platform_driver. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
2009-01-16Merge branches 'ehca', 'ipoib' and 'mlx4' into for-linusRoland Dreier
2009-01-16IB/ehca: Use consistent types for ehca_plpar_hcall9()Stephen Rothwell
ehca_plpar_hcall9() takes an unsigned long array, so make all callers pass that in. This fixes warnings introduced by commit fe333321 ("powerpc: Change u64/s64 to a long long integer type"), which changed u64 from unsigned long to unsigned long long. Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Roland Dreier <rolandd@cisco.com>
2009-01-16IB/ehca: Fix printk format warnings from u64 type changeStephen Rothwell
Commit fe333321 ("powerpc: Change u64/s64 to a long long integer type") changed u64 from unsigned long to unsigned long long, which means that printk formats for printing u64 values should use "ll" instead of "l" to avoid warnings. Fix all the places affected by this in ehca. Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Roland Dreier <rolandd@cisco.com>
2009-01-16p54: fix p54_set_key's return codeChristian Lamparter
p54 doesn't support AES-128-CMAC offload. This patch will fix the noisy mac80211 warnings, when 802.11w is enabled: mac80211-phy189: failed to set key (4, ff:ff:ff:ff:ff:ff) to hardware (-22) mac80211-phy189: failed to set key (5, ff:ff:ff:ff:ff:ff) to hardware (-22) Signed-off-by: Christian Lamparter <chunkeey@web.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-16p54: set_tim must be atomic.Artur Skawina
Fix for: BUG: scheduling while atomic: named/2004/0x10000200 Pid: 2004, comm: named Not tainted 2.6.29-rc1-00271-ge9fa6b0 #45 Call Trace: [<c04d4ef7>] schedule+0x2a7/0x320 [<c03aed74>] __alloc_skb+0x34/0x110 [<c011f5b3>] __cond_resched+0x13/0x30 [<c04d501d>] _cond_resched+0x2d/0x40 [<c016d8c5>] kmem_cache_alloc+0x95/0xc0 [<c016b8d4>] check_object+0xc4/0x230 [<c03aed74>] __alloc_skb+0x34/0x110 [<c02ede91>] p54_alloc_skb+0x71/0xf0 [<c02ee36f>] p54_set_tim+0x3f/0xa0 [<c04ae064>] sta_info_set_tim_bit+0x64/0x80 [<c04c1017>] invoke_tx_handlers+0xd57/0xd80 [<c016c397>] free_debug_processing+0x197/0x210 [<c03ae215>] pskb_expand_head+0xf5/0x170 [<c04bfd94>] __ieee80211_tx_prepare+0x164/0x2f0 [<c04c1a8d>] ieee80211_skb_resize+0x6d/0xe0 [<c04c250f>] ieee80211_master_start_xmit+0x23f/0x550 [<c016d188>] __slab_alloc+0x2b8/0x4f0 [<c013a711>] getnstimeofday+0x51/0x120 [<c03b5e7b>] dev_hard_start_xmit+0x1db/0x240 [<c03c6a4b>] __qdisc_run+0x1ab/0x200 [<c0136aa1>] __run_hrtimer+0x31/0xf0 [<c03b6247>] dev_queue_xmit+0x247/0x500 [<c04c1e56>] ieee80211_subif_start_xmit+0x356/0x7d0 [<c0466ff7>] packet_rcv_spkt+0x37/0x150 [<c0466ff7>] packet_rcv_spkt+0x37/0x150 [<c03b5e7b>] dev_hard_start_xmit+0x1db/0x240 [<c03c6a4b>] __qdisc_run+0x1ab/0x200 [<c03b6247>] dev_queue_xmit+0x247/0x500 [<c03bc1e2>] neigh_resolve_output+0xe2/0x200 [<c0410080>] ip_finish_output+0x0/0x290 [<c0410267>] ip_finish_output+0x1e7/0x290 [<c040f355>] ip_local_out+0x15/0x20 [<c040f5d2>] ip_push_pending_frames+0x272/0x380 [<c042bbc6>] udp_push_pending_frames+0x146/0x3a0 [<c042d52a>] udp_sendmsg+0x2fa/0x6b0 [<c0433bc7>] inet_sendmsg+0x37/0x70 [<c03a7b7e>] sock_sendmsg+0xbe/0x100 [<c0133cd0>] autoremove_wake_function+0x0/0x50 [<c011c043>] __wake_up_common+0x43/0x70 [<c024a892>] copy_from_user+0x32/0x130 [<c024a892>] copy_from_user+0x32/0x130 [<c03b001e>] verify_iovec+0x2e/0xb0 [<c03a7d3f>] sys_sendmsg+0x17f/0x290 [<c017730a>] pipe_write+0x29a/0x570 [<c013a172>] update_wall_time+0x492/0x8e0 [<c013a711>] getnstimeofday+0x51/0x120 [<c011b05d>] sched_slice+0x3d/0x80 [<c013a711>] getnstimeofday+0x51/0x120 [<c0136657>] hrtimer_forward+0x147/0x1a0 [<c01101b0>] lapic_next_event+0x10/0x20 [<c013ccb3>] clockevents_program_event+0xa3/0x170 [<c03a9054>] sys_socketcall+0xa4/0x290 [<c0110920>] smp_apic_timer_interrupt+0x40/0x70 [<c0103165>] sysenter_do_call+0x12/0x25 Signed-off-by: Artur Skawina <art.08.09@gmail.com> Acked-by: Christian Lamparter <chunkeey@web.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-16rt2x00: fix a wrong parameter for __test_and_clear_bit() in rt2x00rfkill_free().Rami Rosen
When running modprobe rt73usb, and then rmmod rt73usb, and then iwconfig, the wlan0 device does not disappear. When repeating this process again, we get a kernel Oops errors and "BUG: unable to handle kernel paging request..." message in the kernel log. The reason for this is that there is an error in rt2x00rfkill_free(), which is called in the process of removing the device (rt2x00lib_remove_dev() in rt2x00dev.c). rt2x00rfkill_free() clears the RFKILL_STATE_ALLOCATED bit , which is bit number 1 () in rt2x00dev->flags instead of in rt2x00dev->rfkill_state. As a result, when checking the DEVICE_STATE_REGISTERED_HW bit (bit number 1 in rt2x00dev->flags) in rt2x00lib_remove_hw() it is **unset**, and we wrongly **don't** call ieee80211_unregister_hw(). This patch corrects this: the parameter for __test_and_clear_bit() in rt2x00rfkill_free() should be &rt2x00dev->rfkill_state and not &rt2x00dev->flags. Signed-off-by: Rami Rosen <ramirose@gmail.com> Acked-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-16iwlwifi: remove CMD_WANT_SKB flag if send_cmd_sync failureZhu Yi
In function iwl_send_cmd_sync(), if the flag CMD_WANT_SKB is set but we are not provided with a valid SKB (cmd->meta.u.skb == NULL), we need to remove the CMD_WANT_SKB flag from the TX cmd queue. Otherwise in case the cmd comes in later, it will possibly set an invalid address. Thus it causes an invalid memory access. This fixed the bug http://bugzilla.kernel.org/show_bug.cgi?id=11326. Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-16ath9k: Fix an operator typo in REG_DOMAIN_2GHZ_MASKJouni Malinen
Incorrect operator causes the REG_DOMAIN_2GHZ_MASK to be zero which surely was not the goal of this definition. Mask out the 11a flags correctly. Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 02:54:00 +0000