From 9011cd250e26d9159943895adf29453af1b93298 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?T=C3=B5nu=20Samuel?= Date: Sat, 12 Mar 2011 11:29:25 +0200 Subject: zd1211rw: TrendNet TEW-509UB id added MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Tõnu Samuel Signed-off-by: John W. Linville --- drivers/net/wireless/zd1211rw/zd_usb.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c index 81e8048..58236e6 100644 --- a/drivers/net/wireless/zd1211rw/zd_usb.c +++ b/drivers/net/wireless/zd1211rw/zd_usb.c @@ -60,6 +60,7 @@ static struct usb_device_id usb_ids[] = { { USB_DEVICE(0x157e, 0x300a), .driver_info = DEVICE_ZD1211 }, { USB_DEVICE(0x157e, 0x300b), .driver_info = DEVICE_ZD1211 }, { USB_DEVICE(0x157e, 0x3204), .driver_info = DEVICE_ZD1211 }, + { USB_DEVICE(0x157e, 0x3207), .driver_info = DEVICE_ZD1211 }, { USB_DEVICE(0x1740, 0x2000), .driver_info = DEVICE_ZD1211 }, { USB_DEVICE(0x6891, 0xa727), .driver_info = DEVICE_ZD1211 }, /* ZD1211B */ -- cgit v1.1 From f8a22a2b165c79a46e275097fcadab7fd151c504 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 15 Mar 2011 10:01:58 +0300 Subject: iwlwifi: missing unlock on error path We should unlock here instead of returning -EINVAL directly. Signed-off-by: Dan Carpenter Signed-off-by: John W. Linville --- drivers/net/wireless/iwlwifi/iwl-agn.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c index 581dc9f..321b18b 100644 --- a/drivers/net/wireless/iwlwifi/iwl-agn.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn.c @@ -3009,14 +3009,17 @@ static int iwl_mac_offchannel_tx_cancel_wait(struct ieee80211_hw *hw) mutex_lock(&priv->mutex); - if (!priv->_agn.offchan_tx_skb) - return -EINVAL; + if (!priv->_agn.offchan_tx_skb) { + ret = -EINVAL; + goto unlock; + } priv->_agn.offchan_tx_skb = NULL; ret = iwl_scan_cancel_timeout(priv, 200); if (ret) ret = -EIO; +unlock: mutex_unlock(&priv->mutex); return ret; -- cgit v1.1 From 3bf184a7e96ff21965fa524260f60af8ab4d9133 Mon Sep 17 00:00:00 2001 From: Joe Gunn Date: Tue, 15 Mar 2011 08:41:19 -0700 Subject: orinoco: Maintain lock until entry removed from list Removing an entry from the scan_list should be performed while holding the lock. Signed-off-by: Joseph J. Gunn Signed-off-by: John W. Linville --- drivers/net/wireless/orinoco/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c index f3d396e..62c6b2b 100644 --- a/drivers/net/wireless/orinoco/main.c +++ b/drivers/net/wireless/orinoco/main.c @@ -1376,13 +1376,13 @@ static void orinoco_process_scan_results(struct work_struct *work) spin_lock_irqsave(&priv->scan_lock, flags); list_for_each_entry_safe(sd, temp, &priv->scan_list, list) { - spin_unlock_irqrestore(&priv->scan_lock, flags); buf = sd->buf; len = sd->len; type = sd->type; list_del(&sd->list); + spin_unlock_irqrestore(&priv->scan_lock, flags); kfree(sd); if (len > 0) { -- cgit v1.1 From 2cea5b3c0ce976eae78bdaa192223f952185045c Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Wed, 16 Mar 2011 17:12:15 +0300 Subject: rt2x00: Add rt2870 device id Add ID for Asus USB-N11 Wi-FI adapter. Tested by me. Signed-off-by: Peter Lemenkov Acked-by: Ivo van Doorn Signed-off-by: John W. Linville --- drivers/net/wireless/rt2x00/rt2800usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c index f1a9214..12f5b2f 100644 --- a/drivers/net/wireless/rt2x00/rt2800usb.c +++ b/drivers/net/wireless/rt2x00/rt2800usb.c @@ -719,6 +719,7 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x0b05, 0x1732), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x0b05, 0x1742), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x0b05, 0x1784), USB_DEVICE_DATA(&rt2800usb_ops) }, + { USB_DEVICE(0x1761, 0x0b05), USB_DEVICE_DATA(&rt2800usb_ops) }, /* AzureWave */ { USB_DEVICE(0x13d3, 0x3247), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x13d3, 0x3273), USB_DEVICE_DATA(&rt2800usb_ops) }, @@ -913,7 +914,6 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x0b05, 0x1760), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x0b05, 0x1761), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x0b05, 0x1790), USB_DEVICE_DATA(&rt2800usb_ops) }, - { USB_DEVICE(0x1761, 0x0b05), USB_DEVICE_DATA(&rt2800usb_ops) }, /* AzureWave */ { USB_DEVICE(0x13d3, 0x3262), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x13d3, 0x3284), USB_DEVICE_DATA(&rt2800usb_ops) }, -- cgit v1.1 From 7a2a75bcc2a54c9b87c8b3831c5369717fcf513d Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Wed, 16 Mar 2011 17:12:16 +0300 Subject: rt2x00: Add Planex Communications, Inc. RT8070 Add Planex Communications, Inc. RT8070 under CONFIG_RT2800USB_UNKNOWN Signed-off-by: Peter Lemenkov Acked-by: Ivo van Doorn Signed-off-by: John W. Linville --- drivers/net/wireless/rt2x00/rt2800usb.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c index 12f5b2f..1f73cfa 100644 --- a/drivers/net/wireless/rt2x00/rt2800usb.c +++ b/drivers/net/wireless/rt2x00/rt2800usb.c @@ -961,6 +961,7 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x1d4d, 0x0010), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x1d4d, 0x0011), USB_DEVICE_DATA(&rt2800usb_ops) }, /* Planex */ + { USB_DEVICE(0x2019, 0x5201), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x2019, 0xab24), USB_DEVICE_DATA(&rt2800usb_ops) }, /* Qcom */ { USB_DEVICE(0x18e8, 0x6259), USB_DEVICE_DATA(&rt2800usb_ops) }, -- cgit v1.1 From 9a74597235e54c16c31da62835e2e9285c631044 Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Wed, 16 Mar 2011 17:12:17 +0300 Subject: rt2x00: Add 2L Central Europe BV 8070 Add 2L Central Europe BV 8070 under CONFIG_RT2800USB_UNKNOWN Signed-off-by: Peter Lemenkov Acked-by: Ivo van Doorn Signed-off-by: John W. Linville --- drivers/net/wireless/rt2x00/rt2800usb.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c index 1f73cfa..38adae9 100644 --- a/drivers/net/wireless/rt2x00/rt2800usb.c +++ b/drivers/net/wireless/rt2x00/rt2800usb.c @@ -937,6 +937,8 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x07d1, 0x3c13), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x07d1, 0x3c15), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x07d1, 0x3c17), USB_DEVICE_DATA(&rt2800usb_ops) }, + /* Edimax */ + { USB_DEVICE(0x7392, 0x4085), USB_DEVICE_DATA(&rt2800usb_ops) }, /* Encore */ { USB_DEVICE(0x203d, 0x14a1), USB_DEVICE_DATA(&rt2800usb_ops) }, /* Gemtek */ -- cgit v1.1 From 5da201a4c86aac6c46a071c5c8255601090b65b2 Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Wed, 16 Mar 2011 17:12:18 +0300 Subject: rt2x00: Add unknown Toshiba device Add unknown Toshiba device, mentioned in rt3572sta sources, under CONFIG_RT2800USB_UNKNOWN Signed-off-by: Peter Lemenkov Acked-by: Ivo van Doorn Signed-off-by: John W. Linville --- drivers/net/wireless/rt2x00/rt2800usb.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c index 38adae9..4e36865 100644 --- a/drivers/net/wireless/rt2x00/rt2800usb.c +++ b/drivers/net/wireless/rt2x00/rt2800usb.c @@ -975,6 +975,8 @@ static struct usb_device_id rt2800usb_device_table[] = { /* Sweex */ { USB_DEVICE(0x177f, 0x0153), USB_DEVICE_DATA(&rt2800usb_ops) }, { USB_DEVICE(0x177f, 0x0313), USB_DEVICE_DATA(&rt2800usb_ops) }, + /* Toshiba */ + { USB_DEVICE(0x0930, 0x0a07), USB_DEVICE_DATA(&rt2800usb_ops) }, /* Zyxel */ { USB_DEVICE(0x0586, 0x341a), USB_DEVICE_DATA(&rt2800usb_ops) }, #endif -- cgit v1.1 From 6e9d592f02f657361168c94e22d9602cad71a09c Mon Sep 17 00:00:00 2001 From: Ilia Mirkin Date: Thu, 17 Mar 2011 14:08:57 -0400 Subject: rtlwifi: Fix memset argument order These were found using the following semantic match: // @@expression E1; type T;@@ * memset(E1, ... * sizeof(T) * ..., ...); // Also take this opportunity to remove the unnecessary void* casts. Signed-off-by: Ilia Mirkin Tested-by: Larry Finger Acked-by: Larry Finger Signed-off-by: John W. Linville --- drivers/net/wireless/rtlwifi/efuse.c | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c index 4f92cba..f74a870 100644 --- a/drivers/net/wireless/rtlwifi/efuse.c +++ b/drivers/net/wireless/rtlwifi/efuse.c @@ -410,8 +410,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) if (!efuse_shadow_update_chk(hw)) { efuse_read_all_map(hw, &rtlefuse->efuse_map[EFUSE_INIT_MAP][0]); - memcpy((void *)&rtlefuse->efuse_map[EFUSE_MODIFY_MAP][0], - (void *)&rtlefuse->efuse_map[EFUSE_INIT_MAP][0], + memcpy(&rtlefuse->efuse_map[EFUSE_MODIFY_MAP][0], + &rtlefuse->efuse_map[EFUSE_INIT_MAP][0], rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]); RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, @@ -446,9 +446,9 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) if (word_en != 0x0F) { u8 tmpdata[8]; - memcpy((void *)tmpdata, - (void *)(&rtlefuse-> - efuse_map[EFUSE_MODIFY_MAP][base]), 8); + memcpy(tmpdata, + &rtlefuse->efuse_map[EFUSE_MODIFY_MAP][base], + 8); RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_LOUD, ("U-efuse\n"), tmpdata, 8); @@ -465,8 +465,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) efuse_power_switch(hw, true, false); efuse_read_all_map(hw, &rtlefuse->efuse_map[EFUSE_INIT_MAP][0]); - memcpy((void *)&rtlefuse->efuse_map[EFUSE_MODIFY_MAP][0], - (void *)&rtlefuse->efuse_map[EFUSE_INIT_MAP][0], + memcpy(&rtlefuse->efuse_map[EFUSE_MODIFY_MAP][0], + &rtlefuse->efuse_map[EFUSE_INIT_MAP][0], rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]); RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, ("<---\n")); @@ -479,13 +479,12 @@ void rtl_efuse_shadow_map_update(struct ieee80211_hw *hw) struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw)); if (rtlefuse->autoload_failflag == true) { - memset((void *)(&rtlefuse->efuse_map[EFUSE_INIT_MAP][0]), 128, - 0xFF); + memset(&rtlefuse->efuse_map[EFUSE_INIT_MAP][0], 0xFF, 128); } else efuse_read_all_map(hw, &rtlefuse->efuse_map[EFUSE_INIT_MAP][0]); - memcpy((void *)&rtlefuse->efuse_map[EFUSE_MODIFY_MAP][0], - (void *)&rtlefuse->efuse_map[EFUSE_INIT_MAP][0], + memcpy(&rtlefuse->efuse_map[EFUSE_MODIFY_MAP][0], + &rtlefuse->efuse_map[EFUSE_INIT_MAP][0], rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]); } @@ -694,8 +693,8 @@ static int efuse_pg_packet_read(struct ieee80211_hw *hw, u8 offset, u8 *data) if (offset > 15) return false; - memset((void *)data, PGPKT_DATA_SIZE * sizeof(u8), 0xff); - memset((void *)tmpdata, PGPKT_DATA_SIZE * sizeof(u8), 0xff); + memset(data, 0xff, PGPKT_DATA_SIZE * sizeof(u8)); + memset(tmpdata, 0xff, PGPKT_DATA_SIZE * sizeof(u8)); while (bcontinual && (efuse_addr < EFUSE_MAX_SIZE)) { if (readstate & PG_STATE_HEADER) { @@ -862,7 +861,7 @@ static void efuse_write_data_case2(struct ieee80211_hw *hw, u16 *efuse_addr, tmp_word_cnts = efuse_calculate_word_cnts(tmp_pkt.word_en); - memset((void *)originaldata, 8 * sizeof(u8), 0xff); + memset(originaldata, 0xff, 8 * sizeof(u8)); if (efuse_pg_packet_read(hw, tmp_pkt.offset, originaldata)) { badworden = efuse_word_enable_data_write(hw, @@ -917,7 +916,7 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw, target_pkt.offset = offset; target_pkt.word_en = word_en; - memset((void *)target_pkt.data, 8 * sizeof(u8), 0xFF); + memset(target_pkt.data, 0xFF, 8 * sizeof(u8)); efuse_word_enable_data_read(word_en, data, target_pkt.data); target_word_cnts = efuse_calculate_word_cnts(target_pkt.word_en); @@ -1022,7 +1021,7 @@ static u8 efuse_word_enable_data_write(struct ieee80211_hw *hw, u8 badworden = 0x0F; u8 tmpdata[8]; - memset((void *)tmpdata, PGPKT_DATA_SIZE, 0xff); + memset(tmpdata, 0xff, PGPKT_DATA_SIZE); RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, ("word_en = %x efuse_addr=%x\n", word_en, efuse_addr)); -- cgit v1.1 From 61e1b0b00c793ad5a32fe2181c9f77115fed5dc4 Mon Sep 17 00:00:00 2001 From: Mohammed Shafi Shajakhan Date: Mon, 21 Mar 2011 18:27:21 +0530 Subject: ath9k: Fix kernel panic in AR2427 Kernel panic occurs just after AR2427 establishes connection with AP. Unless aggregation is enabled we don't initialize the TID structure. Thus accesing the elements of the TID structure when aggregation is disabled, leads to NULL pointer dereferencing. [ 191.320358] Call Trace: [ 191.320364] [] ? ath9k_tx+0xa7/0x200 [ath9k] [ 191.320376] [] ? __ieee80211_tx+0x5c/0x1e0 [mac80211] [ 191.320386] [] ? ieee80211_tx+0x7b/0x90 [mac80211] [ 191.320395] [] ? ieee80211_xmit+0x9d/0x1d0 [mac80211] [ 191.320401] [] ? wake_up_state+0xf/0x20 [ 191.320405] [] ? signal_wake_up+0x28/0x40 [ 191.320410] [] ? default_spin_lock_flags+0x8/0x10 [ 191.320420] [] ? ieee80211_subif_start_xmit+0x2e8/0x7c0 [mac80211] [ 191.320425] [] ? do_page_fault+0x295/0x3a0 [ 191.320431] [] ? dev_hard_start_xmit+0x1ad/0x210 [ 191.320436] [] ? sch_direct_xmit+0x105/0x170 [ 191.320445] [] ? get_sta_flags+0x2a/0x40 [mac80211] [ 191.320449] [] ? dev_queue_xmit+0x37f/0x4b0 [ 191.320452] [] ? eth_header+0x0/0xb0 [ 191.320456] [] ? neigh_resolve_output+0xe9/0x310 [ 191.320461] [] ? ip6_output_finish+0xa5/0x110 [ 191.320464] [] ? ip6_output2+0x134/0x250 [ 191.320468] [] ? ip6_output+0x6d/0x100 [ 191.320471] [] ? mld_sendpack+0x395/0x3e0 [ 191.320475] [] ? add_grhead+0x31/0xa0 [ 191.320478] [] ? mld_send_cr+0x1bc/0x2b0 [ 191.320482] [] ? irq_exit+0x39/0x70 [ 191.320485] [] ? mld_ifc_timer_expire+0x10/0x40 [ 191.320489] [] ? run_timer_softirq+0x13e/0x2c0 [ 191.320493] [] ? common_interrupt+0x30/0x40 [ 191.320498] [] ? mld_ifc_timer_expire+0x0/0x40 [ 191.320502] [] ? __do_softirq+0x98/0x1b0 [ 191.320506] [] ? do_softirq+0x45/0x50 [ 191.320509] [] ? irq_exit+0x65/0x70 [ 191.320513] [] ? smp_apic_timer_interrupt+0x5c/0x8b [ 191.320516] [] ? apic_timer_interrupt+0x31/0x40 [ 191.320521] [] ? k_getrusage+0x12b/0x2f0 [ 191.320525] [] ? acpi_idle_enter_simple+0x117/0x148 [ 191.320529] [] ? cpuidle_idle_call+0x7a/0x100 [ 191.320532] [] ? cpu_idle+0x94/0xd0 [ 191.320536] [] ? rest_init+0x58/0x60 [ 191.320541] [] ? start_kernel+0x351/0x357 [ 191.320544] [] ? unknown_bootoption+0x0/0x19e [ 191.320548] [] ? i386_start_kernel+0xaa/0xb1 [ 191.320550] Code: 03 66 3d 00 03 0f 84 7c 02 00 00 83 c3 18 0f b6 03 8b 4d e0 89 c3 83 e3 0f 6b c3 48 89 5d d8 8d 04 06 8d 50 0c 89 55 d0 8b 40 20 <8b> 00 3b 01 0f 85 8e 02 00 00 f6 47 20 40 0f 84 29 ff ff ff 8b [ 191.320634] EIP: [] ath_tx_start+0x474/0x770 [ath9k] SS:ESP 0068:c0761a90 [ 191.320642] CR2: 0000000000000000 [ 191.320647] ---[ end trace 9296ef23b9076ece ]--- [ 191.320650] Kernel panic - not syncing: Fatal exception in interrupt Cc: stable@kernel.org Signed-off-by: Mohammed Shafi Shajakhan Signed-off-by: John W. Linville --- drivers/net/wireless/ath/ath9k/xmit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c index ef22096..26734e5 100644 --- a/drivers/net/wireless/ath/ath9k/xmit.c +++ b/drivers/net/wireless/ath/ath9k/xmit.c @@ -1725,8 +1725,8 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf, u8 tidno; spin_lock_bh(&txctl->txq->axq_lock); - - if (ieee80211_is_data_qos(hdr->frame_control) && txctl->an) { + if ((sc->sc_flags & SC_OP_TXAGGR) && txctl->an && + ieee80211_is_data_qos(hdr->frame_control)) { tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK; tid = ATH_AN_2_TID(txctl->an, tidno); -- cgit v1.1 From be36cacdddcc119ef7b33ae0b91631c3535a75ca Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 22 Mar 2011 11:00:37 +0100 Subject: iwlagn: fix error in command waiting Clearly a mistake, since pointers won't suddenly change their value... Signed-off-by: Johannes Berg Signed-off-by: John W. Linville --- drivers/net/wireless/iwlwifi/iwl-agn-lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c index 2003c1d..08ccb94 100644 --- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c @@ -2265,7 +2265,7 @@ signed long iwlagn_wait_notification(struct iwl_priv *priv, int ret; ret = wait_event_timeout(priv->_agn.notif_waitq, - &wait_entry->triggered, + wait_entry->triggered, timeout); spin_lock_bh(&priv->_agn.notif_wait_lock); -- cgit v1.1 From a3ad38e87eead6ce748c6e4eec0571ce53b5a0c2 Mon Sep 17 00:00:00 2001 From: "armadefuego@gmail.com" Date: Tue, 22 Mar 2011 09:49:15 -0700 Subject: orinoco: Clear dangling pointer on hardware busy On hardware busy the scan request pointer should be cleared, as higher levels will release. This avoids a crash when that pointer is erroneously used later. Signed-off-by: Joseph J. Gunn Signed-off-by: John W. Linville --- drivers/net/wireless/orinoco/cfg.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/orinoco/cfg.c b/drivers/net/wireless/orinoco/cfg.c index 09fae2f..736bbb9 100644 --- a/drivers/net/wireless/orinoco/cfg.c +++ b/drivers/net/wireless/orinoco/cfg.c @@ -153,6 +153,9 @@ static int orinoco_scan(struct wiphy *wiphy, struct net_device *dev, priv->scan_request = request; err = orinoco_hw_trigger_scan(priv, request->ssids); + /* On error the we aren't processing the request */ + if (err) + priv->scan_request = NULL; return err; } -- cgit v1.1 From 19b9675069cb06ae17d1595ac517d475d75e6bb9 Mon Sep 17 00:00:00 2001 From: Senthil Balasubramanian Date: Wed, 23 Mar 2011 23:07:21 +0530 Subject: ath9k: Fix kernel panic caused by invalid rate index access. With the recent tx status optimization in mac80211, we bail out as and and when invalid rate index is found. So the behavior of resetting rate idx to -1 and count to 0 has changed for the rate indexes that were not part of the driver's retry series. This has resulted in ath9k using incorrect rate table index which caused the system to panic. Ideally ath9k need to loop only for the indexes that were part of the retry series and so simply use hw->max_rates as the loop counter. Pasted the stack trace of the panic issue for reference. [ 754.093192] BUG: unable to handle kernel paging request at ffff88046a9025b0 [ 754.093256] IP: [] ath_tx_status+0x209/0x2f0 [ath9k] [ 754.094888] Call Trace: [ 754.094903] [ 754.094928] [] ieee80211_tx_status+0x203/0x9e0 [mac80211] [ 754.094975] [] ? __ieee80211_wake_queue+0x125/0x140 [mac80211] [ 754.095017] [] ath_tx_complete_buf+0x1b9/0x370 [ath9k] [ 754.095054] [] ath_tx_complete_aggr+0x51f/0xb50 [ath9k] [ 754.095098] [] ? ieee80211_prepare_and_rx_handle+0x173/0xab0 [mac80211] [ 754.095148] [] ? _raw_spin_unlock_irqrestore+0x32/0x40 [ 754.095186] [] ath_tx_tasklet+0x365/0x4b0 [ath9k] [ 754.095224] [] ? clockevents_program_event+0x62/0xa0 [ 754.095261] [] ath9k_tasklet+0x168/0x1c0 [ath9k] [ 754.095298] [] tasklet_action+0x6b/0xe0 [ 754.095331] [] __do_softirq+0x98/0x120 [ 754.095361] [] call_softirq+0x1c/0x30 [ 754.095393] [] do_softirq+0x65/0xa0 [ 754.095423] [] irq_exit+0x8d/0x90 [ 754.095453] [] do_IRQ+0x61/0xe0 [ 754.095482] [] ret_from_intr+0x0/0x15 [ 754.095513] [ 754.095531] [] ? native_sched_clock+0x15/0x70 [ 754.096475] [] ? acpi_idle_enter_bm+0x24d/0x285 [processor] [ 754.096475] [] ? acpi_idle_enter_bm+0x246/0x285 [processor] [ 754.096475] [] cpuidle_idle_call+0x82/0x100 [ 754.096475] [] cpu_idle+0xa6/0xf0 [ 754.096475] [] rest_init+0x91/0xa0 [ 754.096475] [] start_kernel+0x3fd/0x408 [ 754.096475] [] x86_64_start_reservations+0x132/0x136 [ 754.096475] [] x86_64_start_kernel+0x106/0x115 [ 754.096475] RIP [] ath_tx_status+0x209/0x2f0 [ath9k] Signed-off-by: Senthil Balasubramanian Signed-off-by: John W. Linville --- drivers/net/wireless/ath/ath9k/rc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c index 960d717..a3241cd 100644 --- a/drivers/net/wireless/ath/ath9k/rc.c +++ b/drivers/net/wireless/ath/ath9k/rc.c @@ -1328,7 +1328,7 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband, hdr = (struct ieee80211_hdr *)skb->data; fc = hdr->frame_control; - for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) { + for (i = 0; i < sc->hw->max_rates; i++) { struct ieee80211_tx_rate *rate = &tx_info->status.rates[i]; if (!rate->count) break; -- cgit v1.1 From d78f4b3e2c4dfb9487624f7157af04ab4260e189 Mon Sep 17 00:00:00 2001 From: Senthil Balasubramanian Date: Wed, 23 Mar 2011 23:07:22 +0530 Subject: ath9k: Fix TX queue stuck issue. commit 86271e460a66003dc1f4cbfd845adafb790b7587 introduced a regression that caused mac80211 queues in stopped state. ath_drain_all_txq is called in driver flush which would reset the stopped flag and the mac80211 queues were never started after that. iperf traffic is completely stalled due to this issue. Restart the mac80211 queues in driver flush only if the txqs were drained. Signed-off-by: Senthil Balasubramanian Signed-off-by: John W. Linville --- drivers/net/wireless/ath/ath9k/main.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c index 115f162..5248257 100644 --- a/drivers/net/wireless/ath/ath9k/main.c +++ b/drivers/net/wireless/ath/ath9k/main.c @@ -2160,6 +2160,8 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop) if (!ath_drain_all_txq(sc, false)) ath_reset(sc, false); + ieee80211_wake_queues(hw); + out: ieee80211_queue_delayed_work(hw, &sc->tx_complete_work, 0); mutex_unlock(&sc->mutex); -- cgit v1.1