Commit c8577819009473311d5f74112e136f17d7859ee1
Exists in
ti-lsk-linux-4.1.y
and in
10 other branches
Merge tag 'master-2014-11-20' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
John W. Linville says: ==================== pull request: wireless 2014-11-20 Please full this little batch of fixes intended for the 3.18 stream! For the mac80211 patch, Johannes says: "Here's another last minute fix, for minstrel HT crashing depending on the value of some uninitialised stack." On top of that... Ben Greear fixes an ath9k regression in which a BSSID mask is miscalculated. Dmitry Torokhov corrects an error handling routing in brcmfmac which was checking an unsigned variable for a negative value. Johannes Berg avoids a build problem in brcmfmac for arches where linux/unaligned/access_ok.h and asm/unaligned.h conflict. Mathy Vanhoef addresses another brcmfmac issue so as to eliminate a use-after-free of the URB transfer buffer if a timeout occurs. Please let me know if there are problems! ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
Showing 5 changed files Side-by-side Diff
drivers/net/wireless/ath/ath9k/main.c
... | ... | @@ -974,9 +974,8 @@ |
974 | 974 | struct ath_vif *avp; |
975 | 975 | |
976 | 976 | /* |
977 | - * Pick the MAC address of the first interface as the new hardware | |
978 | - * MAC address. The hardware will use it together with the BSSID mask | |
979 | - * when matching addresses. | |
977 | + * The hardware will use primary station addr together with the | |
978 | + * BSSID mask when matching addresses. | |
980 | 979 | */ |
981 | 980 | memset(iter_data, 0, sizeof(*iter_data)); |
982 | 981 | memset(&iter_data->mask, 0xff, ETH_ALEN); |
... | ... | @@ -1205,6 +1204,8 @@ |
1205 | 1204 | list_add_tail(&avp->list, &avp->chanctx->vifs); |
1206 | 1205 | } |
1207 | 1206 | |
1207 | + ath9k_calculate_summary_state(sc, avp->chanctx); | |
1208 | + | |
1208 | 1209 | ath9k_assign_hw_queues(hw, vif); |
1209 | 1210 | |
1210 | 1211 | an->sc = sc; |
... | ... | @@ -1273,6 +1274,8 @@ |
1273 | 1274 | ath9k_beacon_remove_slot(sc, vif); |
1274 | 1275 | |
1275 | 1276 | ath_tx_node_cleanup(sc, &avp->mcast_node); |
1277 | + | |
1278 | + ath9k_calculate_summary_state(sc, avp->chanctx); | |
1276 | 1279 | |
1277 | 1280 | mutex_unlock(&sc->mutex); |
1278 | 1281 | } |
drivers/net/wireless/brcm80211/brcmfmac/of.c
drivers/net/wireless/brcm80211/brcmfmac/pcie.c
... | ... | @@ -19,10 +19,10 @@ |
19 | 19 | #include <linux/pci.h> |
20 | 20 | #include <linux/vmalloc.h> |
21 | 21 | #include <linux/delay.h> |
22 | -#include <linux/unaligned/access_ok.h> | |
23 | 22 | #include <linux/interrupt.h> |
24 | 23 | #include <linux/bcma/bcma.h> |
25 | 24 | #include <linux/sched.h> |
25 | +#include <asm/unaligned.h> | |
26 | 26 | |
27 | 27 | #include <soc.h> |
28 | 28 | #include <chipcommon.h> |
drivers/net/wireless/brcm80211/brcmfmac/usb.c
... | ... | @@ -669,10 +669,12 @@ |
669 | 669 | goto finalize; |
670 | 670 | } |
671 | 671 | |
672 | - if (!brcmf_usb_ioctl_resp_wait(devinfo)) | |
672 | + if (!brcmf_usb_ioctl_resp_wait(devinfo)) { | |
673 | + usb_kill_urb(devinfo->ctl_urb); | |
673 | 674 | ret = -ETIMEDOUT; |
674 | - else | |
675 | + } else { | |
675 | 676 | memcpy(buffer, tmpbuf, buflen); |
677 | + } | |
676 | 678 | |
677 | 679 | finalize: |
678 | 680 | kfree(tmpbuf); |
net/mac80211/rc80211_minstrel_ht.c
... | ... | @@ -252,19 +252,16 @@ |
252 | 252 | cur_thr = mi->groups[cur_group].rates[cur_idx].cur_tp; |
253 | 253 | cur_prob = mi->groups[cur_group].rates[cur_idx].probability; |
254 | 254 | |
255 | - tmp_group = tp_list[j - 1] / MCS_GROUP_RATES; | |
256 | - tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES; | |
257 | - tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp; | |
258 | - tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability; | |
259 | - | |
260 | - while (j > 0 && (cur_thr > tmp_thr || | |
261 | - (cur_thr == tmp_thr && cur_prob > tmp_prob))) { | |
262 | - j--; | |
255 | + do { | |
263 | 256 | tmp_group = tp_list[j - 1] / MCS_GROUP_RATES; |
264 | 257 | tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES; |
265 | 258 | tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp; |
266 | 259 | tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability; |
267 | - } | |
260 | + if (cur_thr < tmp_thr || | |
261 | + (cur_thr == tmp_thr && cur_prob <= tmp_prob)) | |
262 | + break; | |
263 | + j--; | |
264 | + } while (j > 0); | |
268 | 265 | |
269 | 266 | if (j < MAX_THR_RATES - 1) { |
270 | 267 | memmove(&tp_list[j + 1], &tp_list[j], (sizeof(*tp_list) * |