Commit c8577819009473311d5f74112e136f17d7859ee1

Authored by David S. Miller

Merge tag 'master-2014-11-20' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

John W. Linville says:

====================
pull request: wireless 2014-11-20

Please full this little batch of fixes intended for the 3.18 stream!

For the mac80211 patch, Johannes says:

"Here's another last minute fix, for minstrel HT crashing
depending on the value of some uninitialised stack."

On top of that...

Ben Greear fixes an ath9k regression in which a BSSID mask is
miscalculated.

Dmitry Torokhov corrects an error handling routing in brcmfmac which
was checking an unsigned variable for a negative value.

Johannes Berg avoids a build problem in brcmfmac for arches where
linux/unaligned/access_ok.h and asm/unaligned.h conflict.

Mathy Vanhoef addresses another brcmfmac issue so as to eliminate a
use-after-free of the URB transfer buffer if a timeout occurs.

Please let me know if there are problems!
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 5 changed files Side-by-side Diff

drivers/net/wireless/ath/ath9k/main.c
... ... @@ -974,9 +974,8 @@
974 974 struct ath_vif *avp;
975 975  
976 976 /*
977   - * Pick the MAC address of the first interface as the new hardware
978   - * MAC address. The hardware will use it together with the BSSID mask
979   - * when matching addresses.
  977 + * The hardware will use primary station addr together with the
  978 + * BSSID mask when matching addresses.
980 979 */
981 980 memset(iter_data, 0, sizeof(*iter_data));
982 981 memset(&iter_data->mask, 0xff, ETH_ALEN);
... ... @@ -1205,6 +1204,8 @@
1205 1204 list_add_tail(&avp->list, &avp->chanctx->vifs);
1206 1205 }
1207 1206  
  1207 + ath9k_calculate_summary_state(sc, avp->chanctx);
  1208 +
1208 1209 ath9k_assign_hw_queues(hw, vif);
1209 1210  
1210 1211 an->sc = sc;
... ... @@ -1273,6 +1274,8 @@
1273 1274 ath9k_beacon_remove_slot(sc, vif);
1274 1275  
1275 1276 ath_tx_node_cleanup(sc, &avp->mcast_node);
  1277 +
  1278 + ath9k_calculate_summary_state(sc, avp->chanctx);
1276 1279  
1277 1280 mutex_unlock(&sc->mutex);
1278 1281 }
drivers/net/wireless/brcm80211/brcmfmac/of.c
... ... @@ -40,8 +40,8 @@
40 40 return;
41 41  
42 42 irq = irq_of_parse_and_map(np, 0);
43   - if (irq < 0) {
44   - brcmf_err("interrupt could not be mapped: err=%d\n", irq);
  43 + if (!irq) {
  44 + brcmf_err("interrupt could not be mapped\n");
45 45 devm_kfree(dev, sdiodev->pdata);
46 46 return;
47 47 }
drivers/net/wireless/brcm80211/brcmfmac/pcie.c
... ... @@ -19,10 +19,10 @@
19 19 #include <linux/pci.h>
20 20 #include <linux/vmalloc.h>
21 21 #include <linux/delay.h>
22   -#include <linux/unaligned/access_ok.h>
23 22 #include <linux/interrupt.h>
24 23 #include <linux/bcma/bcma.h>
25 24 #include <linux/sched.h>
  25 +#include <asm/unaligned.h>
26 26  
27 27 #include <soc.h>
28 28 #include <chipcommon.h>
drivers/net/wireless/brcm80211/brcmfmac/usb.c
... ... @@ -669,10 +669,12 @@
669 669 goto finalize;
670 670 }
671 671  
672   - if (!brcmf_usb_ioctl_resp_wait(devinfo))
  672 + if (!brcmf_usb_ioctl_resp_wait(devinfo)) {
  673 + usb_kill_urb(devinfo->ctl_urb);
673 674 ret = -ETIMEDOUT;
674   - else
  675 + } else {
675 676 memcpy(buffer, tmpbuf, buflen);
  677 + }
676 678  
677 679 finalize:
678 680 kfree(tmpbuf);
net/mac80211/rc80211_minstrel_ht.c
... ... @@ -252,19 +252,16 @@
252 252 cur_thr = mi->groups[cur_group].rates[cur_idx].cur_tp;
253 253 cur_prob = mi->groups[cur_group].rates[cur_idx].probability;
254 254  
255   - tmp_group = tp_list[j - 1] / MCS_GROUP_RATES;
256   - tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES;
257   - tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp;
258   - tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability;
259   -
260   - while (j > 0 && (cur_thr > tmp_thr ||
261   - (cur_thr == tmp_thr && cur_prob > tmp_prob))) {
262   - j--;
  255 + do {
263 256 tmp_group = tp_list[j - 1] / MCS_GROUP_RATES;
264 257 tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES;
265 258 tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp;
266 259 tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability;
267   - }
  260 + if (cur_thr < tmp_thr ||
  261 + (cur_thr == tmp_thr && cur_prob <= tmp_prob))
  262 + break;
  263 + j--;
  264 + } while (j > 0);
268 265  
269 266 if (j < MAX_THR_RATES - 1) {
270 267 memmove(&tp_list[j + 1], &tp_list[j], (sizeof(*tp_list) *