1. 27 Aug, 2008 9 commits
    • Jan-Espen Pettersen's avatar
      mac80211: don't send empty extended rates IE · 8ab65b03
      Jan-Espen Pettersen authored
      The association request includes a list of supported data rates.
      
      802.11b: 4 supported rates.
      802.11g: 12 (8 + 4) supported rates.
      802.11a: 8 supported rates.
      
      The rates tag of the assoc request has room for only 8 rates. In case of
      802.11g an extended rate tag is appended. However in net/wireless/mlme.c
      an extended (empty) rate tag is also appended if the number of rates is
      exact 8. This empty (length=0) extended rates tag causes some APs to
      deny association with code 18 (unsupported rates). These APs include my
      ZyXEL G-570U, and according to Tomas Winkler som Cisco APs.
      
      'If count == 8' has been used to check for the need for an extended rates
      tag. But count would also be equal to 8 if the for loop exited because of
      no more supported rates. Therefore a check for count being less than
      rates_len would seem more correct.
      
      Thanks to:
       * Dan Williams for newbie guidance
       * Tomas Winkler for confirming the problem
      Signed-off-by: default avatarJan-Espen Pettersen <sigsegv@radiotube.org>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      8ab65b03
    • Jouni Malinen's avatar
      mac80211: Fix debugfs file add/del for netdev · 93015f0f
      Jouni Malinen authored
      Previous version was using incorrect union structures for non-AP
      interfaces when adding and removing max_ratectrl_rateidx and
      force_unicast_rateidx entries. Depending on the vif type, this ended
      up in corrupting debugfs entries since the dentries inside different
      union structures ended up going being on top of eachother.. As the
      end result, debugfs files were being left behind with references to
      freed data (instant kernel oops on access) and directories were not
      removed properly when unloading mac80211 drivers. This patch fixes
      those issues by using only a single union structure based on the vif
      type.
      Signed-off-by: default avatarJouni Malinen <jouni.malinen@atheros.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      93015f0f
    • Julia Lawall's avatar
      net/mac80211/mesh.c: correct the argument to __mesh_table_free · 667d8af9
      Julia Lawall authored
      In the function mesh_table_grow, it is the new table not the argument table
      that should be freed if the function fails (cf commit
      bd9b448f)
      
      The semantic match that detects this problem is as follows:
      (http://www.emn.fr/x-info/coccinelle/)
      
      // <smpl>
      @r exists@
      local idexpression x;
      expression E,f;
      position p1,p2,p3;
      identifier l;
      statement S;
      @@
      
      x = mesh_table_alloc@p1(...)
      ...
      if (x == NULL) S
      ... when != E = x
          when != mesh_table_free(x)
      goto@p2 l;
      ... when != E = x
          when != f(...,x,...)
          when any
      (
      return \(0\|x\);
      |
      return@p3 ...;
      )
      
      @script:python@
      p1 << r.p1;
      p2 << r.p2;
      p3 << r.p3;
      @@
      
      print "%s: call on line %s not freed or saved before return on line %s via line %s" % (p1[0].file,p1[0].line,p3[0].line,p2[0].line)
      // </smpl>
      Signed-off-by: default avatarJulia Lawall <julia@diku.dk>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      667d8af9
    • Jouni Malinen's avatar
      mac80211: Use IWEVASSOCREQIE instead of IWEVCUSTOM · 087d833e
      Jouni Malinen authored
      The previous code was using IWEVCUSTOM to report IEs from AssocReq and
      AssocResp frames into user space. This can easily hit the 256 byte
      limit (IW_CUSTOM_MAX) with APs that include number of vendor IEs in
      AssocResp. This results in the event message not being sent and dmesg
      showing "wlan0 (WE) : Wireless Event too big (366)" type of errors.
      
      Convert mac80211 to use IWEVASSOCREQIE/IWEVASSOCRESPIE to avoid the
      issue of being unable to send association IEs as wireless events. These
      newer event types use binary encoding and larger maximum size
      (IW_GENERIC_IE_MAX = 1024), so the likelyhood of not being able to send
      the IEs is much smaller than with IWEVCUSTOM. As an extra benefit, the
      code is also quite a bit simpler since there is no need to allocate an
      extra buffer for hex encoding.
      Signed-off-by: default avatarJouni Malinen <jouni.malinen@atheros.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      087d833e
    • Felipe Balbi's avatar
      net: rfkill: add missing line break · 988b02f1
      Felipe Balbi authored
      Trivial patch adding a missing line break on
      rfkill_claim_show().
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@nokia.com>
      Acked-by: default avatarIvo van Doorn <IvDoorn@gmail.co>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      988b02f1
    • Jiri Slaby's avatar
      Ath5k: fix bintval setup · 67d2e2df
      Jiri Slaby authored
      bintval is set to the initial value at .config_interface which is too
      late, since it overwrites previously set value from .config. Move the
      initialization to the .add_interface.
      Signed-off-by: default avatarJiri Slaby <jirislaby@gmail.com>
      Cc: Nick Kossifidis <mickflemm@gmail.com>
      Cc: Luis R. Rodriguez <mcgrof@gmail.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      67d2e2df
    • Jiri Slaby's avatar
      Ath5k: lock beacons · 00482973
      Jiri Slaby authored
      Beacons setup and config was racy with beacon send. Ensure that
      ISR and reset functions see consistent state of bbuf.
      
      Use also dev_kfree_skb_any in ath5k_txbuf_free since we call it
      from atomic now.
      Signed-off-by: default avatarJiri Slaby <jirislaby@gmail.com>
      Cc: Nick Kossifidis <mickflemm@gmail.com>
      Cc: Luis R. Rodriguez <mcgrof@gmail.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      00482973
    • Dan Williams's avatar
      atmel: try open system authentication too · d0c2912f
      Dan Williams authored
      When the AP rejects a Shared Key authentication request, try Open System
      auth too.
      Signed-off-by: default avatarDan Williams <dcbw@redhat.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      d0c2912f
    • Dan Williams's avatar
      atmel: return ENOENT on request_firmware failure · 3c34a5d8
      Dan Williams authored
      Return errors from request_firmware() (like other drivers that do
      firmware load on device open) and make up plausible codes for other
      error conditions. Gives userspace tools like NetworkManager a clue that
      firmware may be missing when the result of setting IFF_UP is ENOENT.
      Signed-off-by: default avatarDan Williams <dcbw@redhat.com>
      
      v2: fix reversed check of atmel_wakeup_firmware() in probe_atmel_card()
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      3c34a5d8
  2. 25 Aug, 2008 12 commits
  3. 23 Aug, 2008 2 commits
    • Stephen Hemminger's avatar
      ipv6: protocol for address routes · f410a1fb
      Stephen Hemminger authored
      This fixes a problem spotted with zebra, but not sure if it is
      necessary a kernel problem.  With IPV6 when an address is added to an
      interface, Zebra creates a duplicate RIB entry, one as a connected
      route, and other as a kernel route.
      
      When an address is added to an interface the RTN_NEWADDR message
      causes Zebra to create a connected route. In IPV4 when an address is
      added to an interface a RTN_NEWROUTE message is set to user space with
      the protocol RTPROT_KERNEL. Zebra ignores these messages, because it
      already has the connected route.
      
      The problem is that route created in IPV6 has route protocol ==
      RTPROT_BOOT.  Was this a design decision or a bug? This fixes it. Same
      patch applies to both net-2.6 and stable.
      Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f410a1fb
    • Denis V. Lunev's avatar
      icmp: icmp_sk() should not use smp_processor_id() in preemptible code · fdc0bde9
      Denis V. Lunev authored
      Pass namespace into icmp_xmit_lock, obtain socket inside and return
      it as a result for caller.
      
      Thanks Alexey Dobryan for this report:
      
      Steps to reproduce:
      
      	CONFIG_PREEMPT=y
      	CONFIG_DEBUG_PREEMPT=y
      	tracepath <something>
      
      BUG: using smp_processor_id() in preemptible [00000000] code: tracepath/3205
      caller is icmp_sk+0x15/0x30
      Pid: 3205, comm: tracepath Not tainted 2.6.27-rc4 #1
      
      Call Trace:
       [<ffffffff8031af14>] debug_smp_processor_id+0xe4/0xf0
       [<ffffffff80409405>] icmp_sk+0x15/0x30
       [<ffffffff8040a17b>] icmp_send+0x4b/0x3f0
       [<ffffffff8025a415>] ? trace_hardirqs_on_caller+0xd5/0x160
       [<ffffffff8025a4ad>] ? trace_hardirqs_on+0xd/0x10
       [<ffffffff8023a475>] ? local_bh_enable_ip+0x95/0x110
       [<ffffffff804285b9>] ? _spin_unlock_bh+0x39/0x40
       [<ffffffff8025a26c>] ? mark_held_locks+0x4c/0x90
       [<ffffffff8025a4ad>] ? trace_hardirqs_on+0xd/0x10
       [<ffffffff8025a415>] ? trace_hardirqs_on_caller+0xd5/0x160
       [<ffffffff803e91b4>] ip_fragment+0x8d4/0x900
       [<ffffffff803e7030>] ? ip_finish_output2+0x0/0x290
       [<ffffffff803e91e0>] ? ip_finish_output+0x0/0x60
       [<ffffffff803e6650>] ? dst_output+0x0/0x10
       [<ffffffff803e922c>] ip_finish_output+0x4c/0x60
       [<ffffffff803e92e3>] ip_output+0xa3/0xf0
       [<ffffffff803e68d0>] ip_local_out+0x20/0x30
       [<ffffffff803e753f>] ip_push_pending_frames+0x27f/0x400
       [<ffffffff80406313>] udp_push_pending_frames+0x233/0x3d0
       [<ffffffff804067d1>] udp_sendmsg+0x321/0x6f0
       [<ffffffff8040d155>] inet_sendmsg+0x45/0x80
       [<ffffffff803b967f>] sock_sendmsg+0xdf/0x110
       [<ffffffff8024a100>] ? autoremove_wake_function+0x0/0x40
       [<ffffffff80257ce5>] ? validate_chain+0x415/0x1010
       [<ffffffff8027dc10>] ? __do_fault+0x140/0x450
       [<ffffffff802597d0>] ? __lock_acquire+0x260/0x590
       [<ffffffff803b9e55>] ? sockfd_lookup_light+0x45/0x80
       [<ffffffff803ba50a>] sys_sendto+0xea/0x120
       [<ffffffff80428e42>] ? _spin_unlock_irqrestore+0x42/0x80
       [<ffffffff803134bc>] ? __up_read+0x4c/0xb0
       [<ffffffff8024e0c6>] ? up_read+0x26/0x30
       [<ffffffff8020b8bb>] system_call_fastpath+0x16/0x1b
      
      icmp6_sk() is similar.
      Signed-off-by: default avatarDenis V. Lunev <den@openvz.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fdc0bde9
  4. 22 Aug, 2008 1 commit
  5. 21 Aug, 2008 3 commits
  6. 20 Aug, 2008 13 commits