| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 10 Apr 2014 13:45:47 -0400
From: "John W. Linville" <linville@...driver.com>
To: davem@...emloft.net
Cc: linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: pull request: wireless 2014-04-10
Dave,
Please pull this batch of fixes intended for the 3.15 stream!
Chun-Yeow Yeoh gives us an ath9k_htc fix so that mac80211 can report
last_tx_rate correctly for those devices..
Fariya Fatima has a number of small fixes for things identified by
the static analysis folks in the new rsi driver.
Felix Fietkau brings an ath9k fix to better support some older chips,
and a fix for a scheduling while atomic bug introduced by an earlier
patch.
Janusz Dziedzic produced an ath9k fix to only enable DFS when a
related build option is selected.
Paul Bolle removes some dead code in rtlwifi.
Rafał Miłecki fixes some b43 code that was accessing some registers
with operations for the wrong register width.
Please let me know if there are problems!
Thanks,
John
---
The following changes since commit f34c4a35d87949fbb0e0f31eba3c054e9f8199ba:
l2tp: take PMTU from tunnel UDP socket (2014-04-09 15:24:38 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless.git for-davem
for you to fetch changes up to 029d3ac9722d23e4f3b65656878cb3e4d9e280d4:
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem (2014-04-10 09:58:06 -0400)
----------------------------------------------------------------
Chun-Yeow Yeoh (1):
ath9k_htc: set IEEE80211_TX_STAT_AMPDU for acked aggregated frames
Fariya Fatima (6):
rsi: Potential null pointer derefernce issue fixed.
rsi: Fixed signedness bug reported by static code analyzer.
rsi: Fixed issue relating to variable de-referenced before check 'adapter'
rsi: Fixed issue relating to return value.
rsi: Fixed issue relating to index of q_num.
rsi: Fixed issue relating to doing dma on stack error.
Felix Fietkau (2):
ath9k_hw: reduce ANI firstep range for older chips
ath9k: fix a scheduling while atomic bug in CSA handling
Janusz Dziedzic (1):
ath9k: Enable DFS only when ATH9K_DFS_CERTIFIED
John W. Linville (1):
Merge branch 'master' of git://git.kernel.org/.../linville/wireless into for-davem
Paul Bolle (1):
rtlwifi: btcoexist: remove undefined Kconfig macros
Rafał Miłecki (1):
b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR
drivers/net/wireless/ath/ath9k/ar5008_phy.c | 4 +--
drivers/net/wireless/ath/ath9k/beacon.c | 7 ++---
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 +++-
drivers/net/wireless/ath/ath9k/init.c | 2 ++
drivers/net/wireless/b43/phy_n.c | 14 ++++-----
drivers/net/wireless/rsi/rsi_91x_core.c | 6 ++--
drivers/net/wireless/rsi/rsi_91x_debugfs.c | 35 ++++++++++------------
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 8 +++--
drivers/net/wireless/rsi/rsi_91x_sdio.c | 5 ++--
drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 6 ++--
drivers/net/wireless/rsi/rsi_91x_usb.c | 26 +++++++++++-----
.../net/wireless/rtlwifi/btcoexist/halbtcoutsrc.c | 10 -------
12 files changed, 66 insertions(+), 62 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 3b3e91057a4c..00fb8badbacc 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -1004,11 +1004,9 @@ static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
case ATH9K_ANI_FIRSTEP_LEVEL:{
u32 level = param;
- value = level * 2;
+ value = level;
REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
AR_PHY_FIND_SIG_FIRSTEP, value);
- REG_RMW_FIELD(ah, AR_PHY_FIND_SIG_LOW,
- AR_PHY_FIND_SIG_FIRSTEP_LOW, value);
if (level != aniState->firstepLevel) {
ath_dbg(common, ANI,
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 471e0f624e81..bd9e634879e6 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -312,10 +312,9 @@ static void ath9k_csa_update_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
void ath9k_csa_update(struct ath_softc *sc)
{
- ieee80211_iterate_active_interfaces(sc->hw,
- IEEE80211_IFACE_ITER_NORMAL,
- ath9k_csa_update_vif,
- sc);
+ ieee80211_iterate_active_interfaces_atomic(sc->hw,
+ IEEE80211_IFACE_ITER_NORMAL,
+ ath9k_csa_update_vif, sc);
}
void ath9k_beacon_tasklet(unsigned long data)
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index e8149e3dbdd5..289f3d8924b5 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -471,8 +471,11 @@ static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv,
if (!txok || !vif || !txs)
goto send_mac80211;
- if (txs->ts_flags & ATH9K_HTC_TXSTAT_ACK)
+ if (txs->ts_flags & ATH9K_HTC_TXSTAT_ACK) {
tx_info->flags |= IEEE80211_TX_STAT_ACK;
+ if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
+ tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
+ }
if (txs->ts_flags & ATH9K_HTC_TXSTAT_FILT)
tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index c0a4e866edca..cbbb02a6b13b 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -670,6 +670,7 @@ static const struct ieee80211_iface_combination if_comb[] = {
.num_different_channels = 1,
.beacon_int_infra_match = true,
},
+#ifdef CONFIG_ATH9K_DFS_CERTIFIED
{
.limits = if_dfs_limits,
.n_limits = ARRAY_SIZE(if_dfs_limits),
@@ -679,6 +680,7 @@ static const struct ieee80211_iface_combination if_comb[] = {
.radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
BIT(NL80211_CHAN_WIDTH_20),
}
+#endif
};
static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 05ee7f10cc8f..24ccbe96e0c8 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -5176,22 +5176,22 @@ static void b43_nphy_channel_setup(struct b43_wldev *dev,
int ch = new_channel->hw_value;
u16 old_band_5ghz;
- u32 tmp32;
+ u16 tmp16;
old_band_5ghz =
b43_phy_read(dev, B43_NPHY_BANDCTL) & B43_NPHY_BANDCTL_5GHZ;
if (new_channel->band == IEEE80211_BAND_5GHZ && !old_band_5ghz) {
- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR);
- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4);
+ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR);
+ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4);
b43_phy_set(dev, B43_PHY_B_BBCFG, 0xC000);
- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32);
+ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16);
b43_phy_set(dev, B43_NPHY_BANDCTL, B43_NPHY_BANDCTL_5GHZ);
} else if (new_channel->band == IEEE80211_BAND_2GHZ && old_band_5ghz) {
b43_phy_mask(dev, B43_NPHY_BANDCTL, ~B43_NPHY_BANDCTL_5GHZ);
- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR);
- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4);
+ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR);
+ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4);
b43_phy_mask(dev, B43_PHY_B_BBCFG, 0x3FFF);
- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32);
+ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16);
}
b43_chantab_phy_upload(dev, e);
diff --git a/drivers/net/wireless/rsi/rsi_91x_core.c b/drivers/net/wireless/rsi/rsi_91x_core.c
index e89535e86caf..1a8d32138593 100644
--- a/drivers/net/wireless/rsi/rsi_91x_core.c
+++ b/drivers/net/wireless/rsi/rsi_91x_core.c
@@ -102,10 +102,10 @@ static u8 rsi_core_determine_hal_queue(struct rsi_common *common)
}
get_queue_num:
- q_num = 0;
recontend_queue = false;
q_num = rsi_determine_min_weight_queue(common);
+
q_len = skb_queue_len(&common->tx_queue[ii]);
ii = q_num;
@@ -118,7 +118,9 @@ get_queue_num:
}
}
- common->tx_qinfo[q_num].pkt_contended = 0;
+ if (q_num < NUM_EDCA_QUEUES)
+ common->tx_qinfo[q_num].pkt_contended = 0;
+
/* Adjust the back off values for all queues again */
recontend_queue = rsi_recalculate_weights(common);
diff --git a/drivers/net/wireless/rsi/rsi_91x_debugfs.c b/drivers/net/wireless/rsi/rsi_91x_debugfs.c
index 7e4ef4554411..c466246a323f 100644
--- a/drivers/net/wireless/rsi/rsi_91x_debugfs.c
+++ b/drivers/net/wireless/rsi/rsi_91x_debugfs.c
@@ -289,32 +289,29 @@ int rsi_init_dbgfs(struct rsi_hw *adapter)
const struct rsi_dbg_files *files;
dev_dbgfs = kzalloc(sizeof(*dev_dbgfs), GFP_KERNEL);
+ if (!dev_dbgfs)
+ return -ENOMEM;
+
adapter->dfsentry = dev_dbgfs;
snprintf(devdir, sizeof(devdir), "%s",
wiphy_name(adapter->hw->wiphy));
- dev_dbgfs->subdir = debugfs_create_dir(devdir, NULL);
- if (IS_ERR(dev_dbgfs->subdir)) {
- if (dev_dbgfs->subdir == ERR_PTR(-ENODEV))
- rsi_dbg(ERR_ZONE,
- "%s:Debugfs has not been mounted\n", __func__);
- else
- rsi_dbg(ERR_ZONE, "debugfs:%s not created\n", devdir);
+ dev_dbgfs->subdir = debugfs_create_dir(devdir, NULL);
- adapter->dfsentry = NULL;
+ if (!dev_dbgfs->subdir) {
kfree(dev_dbgfs);
- return (int)PTR_ERR(dev_dbgfs->subdir);
- } else {
- for (ii = 0; ii < adapter->num_debugfs_entries; ii++) {
- files = &dev_debugfs_files[ii];
- dev_dbgfs->rsi_files[ii] =
- debugfs_create_file(files->name,
- files->perms,
- dev_dbgfs->subdir,
- common,
- &files->fops);
- }
+ return -ENOMEM;
+ }
+
+ for (ii = 0; ii < adapter->num_debugfs_entries; ii++) {
+ files = &dev_debugfs_files[ii];
+ dev_dbgfs->rsi_files[ii] =
+ debugfs_create_file(files->name,
+ files->perms,
+ dev_dbgfs->subdir,
+ common,
+ &files->fops);
}
return 0;
}
diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index 2361a6849ad7..73694295648f 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -738,7 +738,7 @@ int rsi_hal_load_key(struct rsi_common *common,
*
* Return: 0 on success, corresponding error code on failure.
*/
-static u8 rsi_load_bootup_params(struct rsi_common *common)
+static int rsi_load_bootup_params(struct rsi_common *common)
{
struct sk_buff *skb;
struct rsi_boot_params *boot_params;
@@ -1272,6 +1272,7 @@ int rsi_mgmt_pkt_recv(struct rsi_common *common, u8 *msg)
{
s32 msg_len = (le16_to_cpu(*(__le16 *)&msg[0]) & 0x0fff);
u16 msg_type = (msg[2]);
+ int ret;
rsi_dbg(FSM_ZONE, "%s: Msg Len: %d, Msg Type: %4x\n",
__func__, msg_len, msg_type);
@@ -1284,8 +1285,9 @@ int rsi_mgmt_pkt_recv(struct rsi_common *common, u8 *msg)
if (common->fsm_state == FSM_CARD_NOT_READY) {
rsi_set_default_parameters(common);
- if (rsi_load_bootup_params(common))
- return -ENOMEM;
+ ret = rsi_load_bootup_params(common);
+ if (ret)
+ return ret;
else
common->fsm_state = FSM_BOOT_PARAMS_SENT;
} else {
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
index 852453f386e2..2e39d38d6a9e 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -756,12 +756,13 @@ fail:
static void rsi_disconnect(struct sdio_func *pfunction)
{
struct rsi_hw *adapter = sdio_get_drvdata(pfunction);
- struct rsi_91x_sdiodev *dev =
- (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+ struct rsi_91x_sdiodev *dev;
if (!adapter)
return;
+ dev = (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+
dev->write_fail = 2;
rsi_mac80211_detach(adapter);
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
index f1cb99cafed8..20d11ccfffe3 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
@@ -247,7 +247,7 @@ static int rsi_process_pkt(struct rsi_common *common)
if (!common->rx_data_pkt) {
rsi_dbg(ERR_ZONE, "%s: Failed in memory allocation\n",
__func__);
- return -1;
+ return -ENOMEM;
}
status = rsi_sdio_host_intf_read_pkt(adapter,
@@ -260,12 +260,10 @@ static int rsi_process_pkt(struct rsi_common *common)
}
status = rsi_read_pkt(common, rcv_pkt_len);
- kfree(common->rx_data_pkt);
- return status;
fail:
kfree(common->rx_data_pkt);
- return -1;
+ return status;
}
/**
diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
index bb1bf96670eb..4c46e5631e2f 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -154,24 +154,30 @@ static int rsi_usb_reg_read(struct usb_device *usbdev,
u16 *value,
u16 len)
{
- u8 temp_buf[4];
- int status = 0;
+ u8 *buf;
+ int status = -ENOMEM;
+
+ buf = kmalloc(0x04, GFP_KERNEL);
+ if (!buf)
+ return status;
status = usb_control_msg(usbdev,
usb_rcvctrlpipe(usbdev, 0),
USB_VENDOR_REGISTER_READ,
USB_TYPE_VENDOR,
((reg & 0xffff0000) >> 16), (reg & 0xffff),
- (void *)temp_buf,
+ (void *)buf,
len,
HZ * 5);
- *value = (temp_buf[0] | (temp_buf[1] << 8));
+ *value = (buf[0] | (buf[1] << 8));
if (status < 0) {
rsi_dbg(ERR_ZONE,
"%s: Reg read failed with error code :%d\n",
__func__, status);
}
+ kfree(buf);
+
return status;
}
@@ -190,8 +196,12 @@ static int rsi_usb_reg_write(struct usb_device *usbdev,
u16 value,
u16 len)
{
- u8 usb_reg_buf[4];
- int status = 0;
+ u8 *usb_reg_buf;
+ int status = -ENOMEM;
+
+ usb_reg_buf = kmalloc(0x04, GFP_KERNEL);
+ if (!usb_reg_buf)
+ return status;
usb_reg_buf[0] = (value & 0x00ff);
usb_reg_buf[1] = (value & 0xff00) >> 8;
@@ -212,6 +222,8 @@ static int rsi_usb_reg_write(struct usb_device *usbdev,
"%s: Reg write failed with error code :%d\n",
__func__, status);
}
+ kfree(usb_reg_buf);
+
return status;
}
@@ -286,7 +298,7 @@ int rsi_usb_write_register_multiple(struct rsi_hw *adapter,
return -ENOMEM;
while (count) {
- transfer = min_t(int, count, 4096);
+ transfer = (u8)(min_t(u32, count, 4096));
memcpy(buf, data, transfer);
status = usb_control_msg(dev->usbdev,
usb_sndctrlpipe(dev->usbdev, 0),
diff --git a/drivers/net/wireless/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/rtlwifi/btcoexist/halbtcoutsrc.c
index b6722de64a31..33da3dfcfa4f 100644
--- a/drivers/net/wireless/rtlwifi/btcoexist/halbtcoutsrc.c
+++ b/drivers/net/wireless/rtlwifi/btcoexist/halbtcoutsrc.c
@@ -625,17 +625,7 @@ bool exhalbtc_initlize_variables(struct rtl_priv *adapter)
else
btcoexist->binded = true;
-#if (defined(CONFIG_PCI_HCI))
- btcoexist->chip_interface = BTC_INTF_PCI;
-#elif (defined(CONFIG_USB_HCI))
- btcoexist->chip_interface = BTC_INTF_USB;
-#elif (defined(CONFIG_SDIO_HCI))
- btcoexist->chip_interface = BTC_INTF_SDIO;
-#elif (defined(CONFIG_GSPI_HCI))
- btcoexist->chip_interface = BTC_INTF_GSPI;
-#else
btcoexist->chip_interface = BTC_INTF_UNKNOWN;
-#endif
if (NULL == btcoexist->adapter)
btcoexist->adapter = adapter;
--
John W. Linville Someday the world will need a hero, and you
linville@...driver.com might be all we have. Be ready.
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists