Merge git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6: iwlwifi: fix device id registration for 6000 series 2x2 devices ath5k: update channel in sw state after stopping RX and TX rtl8187: use DMA-aware buffers with usb_control_msg mac80211: avoid NULL ptr deref when finding max_rates in PID and minstrel airo: airo_get_encode{,ext} potential buffer overflow Pulled directly by Linus because Davem is off playing shuffle-board at some Alaskan cruise, and the NULL ptr deref issue hits people and should get merged sooner rather than later. David - make us proud on the shuffle-board tournament!

Linus Torvalds committed 17 years ago

Commit 33468572 parents 5d41343 542cc799 files · +91 −33Browse files

Unified · Split

9 files

drivers/net/wireless/airo.c +8 −2
drivers/net/wireless/ath5k/base.c +13 −9
drivers/net/wireless/iwlwifi/iwl-6000.c +4 −4
drivers/net/wireless/iwlwifi/iwl-agn.c +2 −0
drivers/net/wireless/rtl818x/rtl8187.h +43 −14
drivers/net/wireless/rtl818x/rtl8187_dev.c +12 −1
drivers/net/wireless/rtl818x/rtl8187_rtl8225.c +7 −1
net/mac80211/rc80211_minstrel.c +1 −1
net/mac80211/rc80211_pid_algo.c +1 −1

drivers/net/wireless/airo.c+8−2

 	/* Copy the key to the user buffer */
 	dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf));
-	memcpy(extra, buf, dwrq->length);
+	if (dwrq->length != -1)
+		memcpy(extra, buf, dwrq->length);
+	else
+		dwrq->length = 0;
 	return 0;
 }
 	/* Copy the key to the user buffer */
 	ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
-	memcpy(extra, buf, ext->key_len);
+	if (ext->key_len != -1)
+		memcpy(extra, buf, ext->key_len);
+	else
+		ext->key_len = 0;
 	return 0;
 }

drivers/net/wireless/ath5k/base.c+13−9

  * Prototypes - MAC 802.11 stack related functions
  */
 static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
-static int ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel);
+static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
 static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
 	if (chan->center_freq != sc->curchan->center_freq ||
 		chan->hw_value != sc->curchan->hw_value) {
-		sc->curchan = chan;
-		sc->curband = &sc->sbands[chan->band];
 		/*
 		 * To switch channels clear any pending DMA operations;
 		 * wait long enough for the RX fifo to drain, reset the
 		 * hardware at the new frequency, and then re-enable
 		 * the relevant bits of the h/w.
 		 */
-		return ath5k_reset(sc, true, true);
+		return ath5k_reset(sc, chan);
 	}
 	return 0;
 	sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
 		AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
 		AR5K_INT_FATAL | AR5K_INT_GLOBAL;
-	ret = ath5k_reset(sc, false, false);
+	ret = ath5k_reset(sc, NULL);
 	if (ret)
 		goto done;
 	return NETDEV_TX_OK;
 }
+/*
+ * Reset the hardware.  If chan is not NULL, then also pause rx/tx
+ * and change to the given channel.
+ */
 static int
-ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel)
+ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
 {
 	struct ath5k_hw *ah = sc->ah;
 	int ret;
 	ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "resetting\n");
-	if (stop) {
+	if (chan) {
 		ath5k_hw_set_imr(ah, 0);
 		ath5k_txq_cleanup(sc);
 		ath5k_rx_stop(sc);
+		sc->curchan = chan;
+		sc->curband = &sc->sbands[chan->band];
 	}
 	ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true);
 	if (ret) {
 {
 	int ret;
-	ret = ath5k_reset(sc, true, true);
+	ret = ath5k_reset(sc, sc->curchan);
 	if (!ret)
 		ieee80211_wake_queues(sc->hw);

drivers/net/wireless/iwlwifi/iwl-6000.c+4−4

@@ -101,8 +101,8 @@ struct iwl_cfg iwl6000_2agn_cfg = { · 100 unmodified lines
101	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,	101	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,
102	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,	102	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
103	.mod_params = &iwl50_mod_params,	103	.mod_params = &iwl50_mod_params,
104	.valid_tx_ant = ANT_BC,	104	.valid_tx_ant = ANT_AB,
105	.valid_rx_ant = ANT_BC,	105	.valid_rx_ant = ANT_AB,
106	.need_pll_cfg = false,	106	.need_pll_cfg = false,
107	};	107	};
108		108
@@ -117,8 +117,8 @@ struct iwl_cfg iwl6050_2agn_cfg = { · 8 unmodified lines
117	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,	117	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,
118	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,	118	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
119	.mod_params = &iwl50_mod_params,	119	.mod_params = &iwl50_mod_params,
120	.valid_tx_ant = ANT_BC,	120	.valid_tx_ant = ANT_AB,
121	.valid_rx_ant = ANT_BC,	121	.valid_rx_ant = ANT_AB,
122	.need_pll_cfg = false,	122	.need_pll_cfg = false,
123	};	123	};
124		124

drivers/net/wireless/iwlwifi/iwl-agn.c+2−0

 	{IWL_PCI_DEVICE(0x0085, 0x1112, iwl6000_2ag_cfg)},
 	{IWL_PCI_DEVICE(0x0082, 0x1122, iwl6000_2ag_cfg)},
 	{IWL_PCI_DEVICE(0x422B, PCI_ANY_ID, iwl6000_3agn_cfg)},
+	{IWL_PCI_DEVICE(0x422C, PCI_ANY_ID, iwl6000_2agn_cfg)},
 	{IWL_PCI_DEVICE(0x4238, PCI_ANY_ID, iwl6000_3agn_cfg)},
+	{IWL_PCI_DEVICE(0x4239, PCI_ANY_ID, iwl6000_2agn_cfg)},
 	{IWL_PCI_DEVICE(0x0082, PCI_ANY_ID, iwl6000_2agn_cfg)},
 	{IWL_PCI_DEVICE(0x0085, PCI_ANY_ID, iwl6000_3agn_cfg)},
 	{IWL_PCI_DEVICE(0x0086, PCI_ANY_ID, iwl6050_3agn_cfg)},

drivers/net/wireless/rtl818x/rtl8187.h+43−14

 		__le64 buf;
 		struct sk_buff_head queue;
 	} b_tx_status; /* This queue is used by both -b and non-b devices */
+	struct mutex io_mutex;
+	union {
+		u8 bits8;
+		__le16 bits16;
+		__le32 bits32;
+	} *io_dmabuf;
 };
 void rtl8187_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data);
 {
 	u8 val;
+	mutex_lock(&priv->io_mutex);
 	usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
 			RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-			(unsigned long)addr, idx & 0x03, &val,
+			(unsigned long)addr, idx & 0x03,
-			sizeof(val), HZ / 2);
+			&priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+	val = priv->io_dmabuf->bits8;
+	mutex_unlock(&priv->io_mutex);
 	return val;
 }
 {
 	__le16 val;
+	mutex_lock(&priv->io_mutex);
 	usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
 			RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-			(unsigned long)addr, idx & 0x03, &val,
+			(unsigned long)addr, idx & 0x03,
-			sizeof(val), HZ / 2);
+			&priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+	val = priv->io_dmabuf->bits16;
+	mutex_unlock(&priv->io_mutex);
 	return le16_to_cpu(val);
 }
 {
 	__le32 val;
+	mutex_lock(&priv->io_mutex);
 	usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
 			RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-			(unsigned long)addr, idx & 0x03, &val,
+			(unsigned long)addr, idx & 0x03,
-			sizeof(val), HZ / 2);
+			&priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+	val = priv->io_dmabuf->bits32;
+	mutex_unlock(&priv->io_mutex);
 	return le32_to_cpu(val);
 }
 static inline void rtl818x_iowrite8_idx(struct rtl8187_priv *priv,
 					u8 *addr, u8 val, u8 idx)
 {
+	mutex_lock(&priv->io_mutex);
+	priv->io_dmabuf->bits8 = val;
 	usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
 			RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-			(unsigned long)addr, idx & 0x03, &val,
+			(unsigned long)addr, idx & 0x03,
-			sizeof(val), HZ / 2);
+			&priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+	mutex_unlock(&priv->io_mutex);
 }
 static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
 static inline void rtl818x_iowrite16_idx(struct rtl8187_priv *priv,
 					 __le16 *addr, u16 val, u8 idx)
 {
-	__le16 buf = cpu_to_le16(val);
+	mutex_lock(&priv->io_mutex);
+	priv->io_dmabuf->bits16 = cpu_to_le16(val);
 	usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
 			RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-			(unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
+			(unsigned long)addr, idx & 0x03,
-			HZ / 2);
+			&priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+	mutex_unlock(&priv->io_mutex);
 }
 static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
 static inline void rtl818x_iowrite32_idx(struct rtl8187_priv *priv,
 					 __le32 *addr, u32 val, u8 idx)
 {
-	__le32 buf = cpu_to_le32(val);
+	mutex_lock(&priv->io_mutex);
+	priv->io_dmabuf->bits32 = cpu_to_le32(val);
 	usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
 			RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-			(unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
+			(unsigned long)addr, idx & 0x03,
-			HZ / 2);
+			&priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+	mutex_unlock(&priv->io_mutex);
 }
 static inline void rtl818x_iowrite32(struct rtl8187_priv *priv, __le32 *addr,

drivers/net/wireless/rtl818x/rtl8187_dev.c+12−1

 	priv = dev->priv;
 	priv->is_rtl8187b = (id->driver_info == DEVICE_RTL8187B);
+	/* allocate "DMA aware" buffer for register accesses */
+	priv->io_dmabuf = kmalloc(sizeof(*priv->io_dmabuf), GFP_KERNEL);
+	if (!priv->io_dmabuf) {
+		err = -ENOMEM;
+		goto err_free_dev;
+	}
+	mutex_init(&priv->io_mutex);
 	SET_IEEE80211_DEV(dev, &intf->dev);
 	usb_set_intfdata(intf, dev);
 	priv->udev = udev;
 	err = ieee80211_register_hw(dev);
 	if (err) {
 		printk(KERN_ERR "rtl8187: Cannot register device\n");
-		goto err_free_dev;
+		goto err_free_dmabuf;
 	}
 	mutex_init(&priv->conf_mutex);
 	skb_queue_head_init(&priv->b_tx_status.queue);
 	return 0;
+ err_free_dmabuf:
+	kfree(priv->io_dmabuf);
  err_free_dev:
 	ieee80211_free_hw(dev);
 	usb_set_intfdata(intf, NULL);
 	priv = dev->priv;
 	usb_reset_device(priv->udev);
 	usb_put_dev(interface_to_usbdev(intf));
+	kfree(priv->io_dmabuf);
 	ieee80211_free_hw(dev);
 }

drivers/net/wireless/rtl818x/rtl8187_rtl8225.c+7−1

 	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80);
 	udelay(10);
+	mutex_lock(&priv->io_mutex);
+	priv->io_dmabuf->bits16 = data;
 	usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
 			RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-			addr, 0x8225, &data, sizeof(data), HZ / 2);
+			addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data),
+			HZ / 2);
+	mutex_unlock(&priv->io_mutex);
 	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80 | (1 << 2));
 	udelay(10);

net/mac80211/rc80211_minstrel.c+1−1

@@ -477,7 +477,7 @@ minstrel_alloc_sta(void priv, struct ieee80211_sta sta, gfp_t gfp) · 476 unmodified lines
477		477
478	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {	478	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
479	sband = hw->wiphy->bands[i];	479	sband = hw->wiphy->bands[i];
480	if (sband->n_bitrates > max_rates)	480	if (sband && sband->n_bitrates > max_rates)
481	max_rates = sband->n_bitrates;	481	max_rates = sband->n_bitrates;
482	}	482	}
483		483

net/mac80211/rc80211_pid_algo.c+1−1

@@ -378,7 +378,7 @@ static void rate_control_pid_alloc(struct ieee80211_hw hw, · 377 unmodified lines
378		378
379	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {	379	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
380	sband = hw->wiphy->bands[i];	380	sband = hw->wiphy->bands[i];
381	if (sband->n_bitrates > max_rates)	381	if (sband && sband->n_bitrates > max_rates)
382	max_rates = sband->n_bitrates;	382	max_rates = sband->n_bitrates;
383	}	383	}
384		384

Merge git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code