Search Linux Wireless

Re: pull request: wireless-2.6 2010-05-28

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

I have pulled wireless-2.6 GIT (master-2010-05-28) into Linus-tree
(2.6.34-git15) [0] and Intel Linux-Wireless Bug #2208 is present.

Two people confirmed the patch in [2] fixes:
1. iwlwifi-2.6 GIT master (commit f10a237c95abd6d64a3a24553bd1d3bcddd9108b)
2. compat-wireless (2010-05-21)

And it fixes also the above mentionned combination.

As a suggestion:
What about "copying" bug-reports (incl. its history) from IWL-BTS into
linux-wireless ML?
For example (dri-devel related) bug-reports from
bugzilla.freedesktop.org are "copied" into dri-devel ML.

Hope [2] gets quickly into wireless-2.6 GIT.

Kind Regards,
- Sedat -

References:
------------------
[0] commit 24010e460454ec0d2f4f0213b667b4349cbdb8e1:
Merge branch 'drm-linus' of git://git./linux/kernel/git/airlied/drm-2.6
[1] http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2208
[2] http://bugzilla.intellinuxwireless.org/attachment.cgi?id=2447
[3] http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2208#c8
[4] http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2208#c9

[  446.893181] BUG: unable to handle kernel NULL pointer dereference at (null)
[  446.893192] IP: [<f8e9eb54>]
iwl3945_get_channels_for_scan+0xb4/0x315 [iwl3945]
[  446.893214] *pde = 00000000
[  446.893220] Oops: 0000 [#1] PREEMPT SMP
[  446.893228] last sysfs file:
/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
[  446.893233] Modules linked in: btrfs zlib_deflate crc32c libcrc32c
ufs qnx4 hfsplus hfs minix ntfs vfat msdos fat jfs xfs exportfs
reiserfs ext2 radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core
acpi_cpufreq mperf cpufreq_ondemand cpufreq_stats freq_table
cpufreq_performance cpufreq_conservative cpufreq_powersave sco bridge
stp bnep rfcomm l2cap bluetooth aes_i586 aes_generic ppdev lp
kvm_intel kvm binfmt_misc ipv6 af_packet fuse ext4 jbd2 crc16
snd_hda_codec_si3054 snd_hda_codec_analog snd_hda_intel snd_hda_codec
snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss
snd_seq_midi arc4 snd_rawmidi ecb snd_seq_midi_event iwl3945 iwlcore
snd_seq snd_timer snd_seq_device sierra usbserial snd parport_pc
mac80211 hp_wmi parport soundcore snd_page_alloc cfg80211 rfkill
joydev pcmcia irda pcspkr intel_agp tifm_7xx1 tifm_core rng_core
iTCO_wdt iTCO_vendor_support hp_accel yenta_socket pcmcia_rsrc
pcmcia_core psmouse evdev tpm_infineon crc_ccitt wmi video output
serio_raw lis3lv02d container battery rtc_cmos tpm_tis tpm rtc_core
tpm_bios rtc_lib input_polldev ac processor button ext3 jbd mbcache
dm_mod usbhid hid sg sr_mod cdrom sd_mod fan pata_acpi ata_generic
sdhci_pci sdhci ata_piix uhci_hcd ahci libahci mmc_core led_class
ehci_hcd tg3 libata thermal scsi_mod usbcore nls_base [last unloaded:
i2c_core]
[  446.893460]
[  446.893466] Pid: 1312, comm: iwl3945 Not tainted
2.6.34-git15.sd.1-iniza-686-kms #1 30AC/HP Compaq nc6400 (RH572EA#ABD)
[  446.893473] EIP: 0060:[<f8e9eb54>] EFLAGS: 00010283 CPU: 0
[  446.893488] EIP is at iwl3945_get_channels_for_scan+0xb4/0x315 [iwl3945]
[  446.893494] EAX: f712a000 EBX: f0548ae0 ECX: 00000000 EDX: 00000000
[  446.893500] ESI: f05c00f2 EDI: 00000058 EBP: 00000000 ESP: f6bc5ecc
[  446.893505]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[  446.893511] Process iwl3945 (pid: 1312, ti=f6bc4000 task=f04c79c0
task.ti=f6bc4000)
[  446.893516] Stack:
[  446.893519]  00000067 f04c79ec 00000000 00000000 00000000 00210001
c10272fc c13b0401
[  446.893532] <0> c1225b2d c13b0400 f054f0f0 0002ff00 00000058
00000021 0057f0f0 f0548ae0
[  446.893546] <0> 00000000 00000005 f05c0000 f8ea1cc1 00000000
f05c00f2 00000000 c1071393
[  446.893561] Call Trace:
[  446.893572]  [<c10272fc>] ? add_preempt_count+0x8f/0x91
[  446.893581]  [<c1225b2d>] ? _raw_spin_lock_irqsave+0x1c/0x35
[  446.893598]  [<f8ea1cc1>] ? iwl3945_request_scan+0x697/0x799 [iwl3945]
[  446.893607]  [<c1071393>] ? perf_event_task_sched_in+0xe/0x71
[  446.893614]  [<c1225cf8>] ? _raw_spin_unlock_irq+0x1e/0x28
[  446.893631]  [<f8e62768>] ? iwl_bg_start_internal_scan+0x280/0x299 [iwlcore]
[  446.893639]  [<c103c530>] ? run_workqueue+0x65/0xe1
[  446.893654]  [<f8e624e8>] ? iwl_bg_start_internal_scan+0x0/0x299 [iwlcore]
[  446.893661]  [<c103c65b>] ? worker_thread+0xaf/0xbb
[  446.893669]  [<c103f22a>] ? autoremove_wake_function+0x0/0x29
[  446.893676]  [<c103c5ac>] ? worker_thread+0x0/0xbb
[  446.893683]  [<c103ef3f>] ? kthread+0x5f/0x64
[  446.893690]  [<c103eee0>] ? kthread+0x0/0x64
[  446.893698]  [<c10033b6>] ? kernel_thread_helper+0x6/0x10
[  446.893702] Code: 88 44 24 1c 83 e8 02 88 44 24 2d 8d 4f ff 0f b7
c7 89 44 24 30 66 89 4c 24 3a e9 ea 01 00 00 8b 54 24 10 8b 4c 24 08
8b 6c 90 20 <39> 4d 00 0f 85 d1 01 00 00 66 8b 4d 06 89 d8 88 4e 01 8b
54 24
[  446.893784] EIP: [<f8e9eb54>]
iwl3945_get_channels_for_scan+0xb4/0x315 [iwl3945] SS:ESP
0068:f6bc5ecc
[  446.893801] CR2: 0000000000000000
[  446.893812] ---[ end trace 7a6cdfd823c4f035 ]---


On Fri, May 28, 2010 at 8:09 PM, John W. Linville
<linville@xxxxxxxxxxxxx> wrote:
> Dave,
>
> Here are a few small fixes intended for 2.6.35.  Included are a null
> pointer dereference fix, and a use-after-free fix, as well as some more
> minor stuff.  It also include the revert of a earlier patch that I
> inadvertantly merged out of order, effectively creating a bug rather
> than fixing one.  The reverted patch will now be pointed at 2.6.36
> instead.
>
> Please let me know if there are problems!
>
> Thanks,
>
> John
>
> ---
>
> The following changes since commit 045de01a174d9f0734f657eb4b3313d89b4fd5ad:
>  Scott Feldman (1):
>        netlink: bug fix: wrong size was calculated for vfinfo list blob
>
> are available in the git repository at:
>
>  git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6.git master
>
> Christian Lamparter (1):
>      ar9170usb: fix read from freed driver context
>
> Christoph Fritz (1):
>      ssb: fix NULL ptr deref when pcihost_wrapper is used
>
> Johannes Berg (1):
>      mac80211: make a function static
>
> John W. Linville (1):
>      Revert "rt2x00: Fix rt2800usb TX descriptor writing."
>
> Justin P. Mattock (1):
>      ath9k: Fix ath_print in xmit for hardware reset.
>
> Prarit Bhargava (1):
>      libertas: fix uninitialized variable warning
>
> Vasanthakumar Thiagarajan (1):
>      ath9k: Fix bug in the way "bf_tx_aborted" of struct ath_buf is used
>
>  drivers/net/wireless/ath/ar9170/usb.c   |   14 ++++++++++++--
>  drivers/net/wireless/ath/ath9k/xmit.c   |    6 ++++--
>  drivers/net/wireless/libertas/rx.c      |    5 ++---
>  drivers/net/wireless/rt2x00/rt2800usb.c |    2 +-
>  drivers/ssb/pci.c                       |    9 ++++++---
>  drivers/ssb/sprom.c                     |    1 +
>  net/mac80211/chan.c                     |    2 +-
>  7 files changed, 27 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
> index 82ab532..a93dc18 100644
> --- a/drivers/net/wireless/ath/ar9170/usb.c
> +++ b/drivers/net/wireless/ath/ar9170/usb.c
> @@ -739,17 +739,27 @@ err_out:
>  static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
>  {
>        struct device *parent = aru->udev->dev.parent;
> +       struct usb_device *udev;
> +
> +       /*
> +        * Store a copy of the usb_device pointer locally.
> +        * This is because device_release_driver initiates
> +        * ar9170_usb_disconnect, which in turn frees our
> +        * driver context (aru).
> +        */
> +       udev = aru->udev;
>
>        complete(&aru->firmware_loading_complete);
>
>        /* unbind anything failed */
>        if (parent)
>                device_lock(parent);
> -       device_release_driver(&aru->udev->dev);
> +
> +       device_release_driver(&udev->dev);
>        if (parent)
>                device_unlock(parent);
>
> -       usb_put_dev(aru->udev);
> +       usb_put_dev(udev);
>  }
>
>  static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
> diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
> index 3db1917..859aa4a 100644
> --- a/drivers/net/wireless/ath/ath9k/xmit.c
> +++ b/drivers/net/wireless/ath/ath9k/xmit.c
> @@ -1198,7 +1198,7 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
>                int r;
>
>                ath_print(common, ATH_DBG_FATAL,
> -                         "Unable to stop TxDMA. Reset HAL!\n");
> +                         "Failed to stop TX DMA. Resetting hardware!\n");
>
>                spin_lock_bh(&sc->sc_resetlock);
>                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
> @@ -1728,6 +1728,8 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
>        } else
>                bf->bf_isnullfunc = false;
>
> +       bf->bf_tx_aborted = false;
> +
>        return 0;
>  }
>
> @@ -1989,7 +1991,7 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
>        int nbad = 0;
>        int isaggr = 0;
>
> -       if (bf->bf_tx_aborted)
> +       if (bf->bf_lastbf->bf_tx_aborted)
>                return 0;
>
>        isaggr = bf_isaggr(bf);
> diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
> index a115bfa..7a377f5 100644
> --- a/drivers/net/wireless/libertas/rx.c
> +++ b/drivers/net/wireless/libertas/rx.c
> @@ -329,9 +329,8 @@ static int process_rxed_802_11_packet(struct lbs_private *priv,
>        /* create the exported radio header */
>
>        /* radiotap header */
> -       radiotap_hdr.hdr.it_version = 0;
> -       /* XXX must check this value for pad */
> -       radiotap_hdr.hdr.it_pad = 0;
> +       memset(&radiotap_hdr, 0, sizeof(radiotap_hdr));
> +       /* XXX must check radiotap_hdr.hdr.it_pad for pad */
>        radiotap_hdr.hdr.it_len = cpu_to_le16 (sizeof(struct rx_radiotap_hdr));
>        radiotap_hdr.hdr.it_present = cpu_to_le32 (RX_RADIOTAP_PRESENT);
>        radiotap_hdr.rate = convert_mv_rate_to_radiotap(prxpd->rx_rate);
> diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
> index 6991613..0f8b84b 100644
> --- a/drivers/net/wireless/rt2x00/rt2800usb.c
> +++ b/drivers/net/wireless/rt2x00/rt2800usb.c
> @@ -413,7 +413,7 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
>         */
>        rt2x00_desc_read(txi, 0, &word);
>        rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_PKT_LEN,
> -                          skb->len - TXINFO_DESC_SIZE);
> +                          skb->len + TXWI_DESC_SIZE);
>        rt2x00_set_field32(&word, TXINFO_W0_WIV,
>                           !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
>        rt2x00_set_field32(&word, TXINFO_W0_QSEL, 2);
> diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
> index 989e275..6dcda86 100644
> --- a/drivers/ssb/pci.c
> +++ b/drivers/ssb/pci.c
> @@ -625,9 +625,12 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
>                ssb_printk(KERN_ERR PFX "No SPROM available!\n");
>                return -ENODEV;
>        }
> -
> -       bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
> -               SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
> +       if (bus->chipco.dev) {  /* can be unavailible! */
> +               bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
> +                       SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
> +       } else {
> +               bus->sprom_offset = SSB_SPROM_BASE1;
> +       }
>
>        buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
>        if (!buf)
> diff --git a/drivers/ssb/sprom.c b/drivers/ssb/sprom.c
> index 007bc3a..4f7cc8d 100644
> --- a/drivers/ssb/sprom.c
> +++ b/drivers/ssb/sprom.c
> @@ -185,6 +185,7 @@ bool ssb_is_sprom_available(struct ssb_bus *bus)
>        /* this routine differs from specs as we do not access SPROM directly
>           on PCMCIA */
>        if (bus->bustype == SSB_BUSTYPE_PCI &&
> +           bus->chipco.dev &&  /* can be unavailible! */
>            bus->chipco.dev->id.revision >= 31)
>                return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;
>
> diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
> index 5d218c5..32be11e 100644
> --- a/net/mac80211/chan.c
> +++ b/net/mac80211/chan.c
> @@ -5,7 +5,7 @@
>  #include <linux/nl80211.h>
>  #include "ieee80211_i.h"
>
> -enum ieee80211_chan_mode
> +static enum ieee80211_chan_mode
>  __ieee80211_get_channel_mode(struct ieee80211_local *local,
>                             struct ieee80211_sub_if_data *ignore)
>  {
> --
> John W. Linville                Someday the world will need a hero, and you
> linville@xxxxxxxxxxxxx                  might be all we have.  Be ready.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux