--- /dev/null
+From 249ee72249140fe5b9adc988f97298f0aa5db2fc Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Wed, 3 Oct 2012 21:07:52 +0200
+Subject: ath9k: use ieee80211_free_txskb
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 249ee72249140fe5b9adc988f97298f0aa5db2fc upstream.
+
+Using ieee80211_free_txskb for tx frames is required, since mac80211 clones
+skbs for which socket tx status is requested.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/beacon.c | 2 -
+ drivers/net/wireless/ath/ath9k/main.c | 2 -
+ drivers/net/wireless/ath/ath9k/xmit.c | 53 +++++++++++++++++---------------
+ 3 files changed, 31 insertions(+), 26 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/beacon.c
++++ b/drivers/net/wireless/ath/ath9k/beacon.c
+@@ -121,7 +121,7 @@ static void ath_tx_cabq(struct ieee80211
+
+ if (ath_tx_start(hw, skb, &txctl) != 0) {
+ ath_dbg(common, XMIT, "CABQ TX failed\n");
+- dev_kfree_skb_any(skb);
++ ieee80211_free_txskb(hw, skb);
+ }
+ }
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1147,7 +1147,7 @@ static void ath9k_tx(struct ieee80211_hw
+
+ return;
+ exit:
+- dev_kfree_skb_any(skb);
++ ieee80211_free_txskb(hw, skb);
+ }
+
+ static void ath9k_stop(struct ieee80211_hw *hw)
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -64,8 +64,7 @@ static void ath_tx_update_baw(struct ath
+ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
+ struct ath_txq *txq,
+ struct ath_atx_tid *tid,
+- struct sk_buff *skb,
+- bool dequeue);
++ struct sk_buff *skb);
+
+ enum {
+ MCS_HT20,
+@@ -201,7 +200,15 @@ static void ath_tx_flush_tid(struct ath_
+ fi = get_frame_info(skb);
+ bf = fi->bf;
+
+- if (bf && fi->retries) {
++ if (!bf) {
++ bf = ath_tx_setup_buffer(sc, txq, tid, skb);
++ if (!bf) {
++ ieee80211_free_txskb(sc->hw, skb);
++ continue;
++ }
++ }
++
++ if (fi->retries) {
+ list_add_tail(&bf->list, &bf_head);
+ ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
+ ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
+@@ -812,10 +819,13 @@ static enum ATH_AGGR_STATUS ath_tx_form_
+ fi = get_frame_info(skb);
+ bf = fi->bf;
+ if (!fi->bf)
+- bf = ath_tx_setup_buffer(sc, txq, tid, skb, true);
++ bf = ath_tx_setup_buffer(sc, txq, tid, skb);
+
+- if (!bf)
++ if (!bf) {
++ __skb_unlink(skb, &tid->buf_q);
++ ieee80211_free_txskb(sc->hw, skb);
+ continue;
++ }
+
+ bf->bf_state.bf_type = BUF_AMPDU | BUF_AGGR;
+ seqno = bf->bf_state.seqno;
+@@ -1717,9 +1727,11 @@ static void ath_tx_send_ampdu(struct ath
+ return;
+ }
+
+- bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb, false);
+- if (!bf)
++ bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
++ if (!bf) {
++ ieee80211_free_txskb(sc->hw, skb);
+ return;
++ }
+
+ bf->bf_state.bf_type = BUF_AMPDU;
+ INIT_LIST_HEAD(&bf_head);
+@@ -1743,11 +1755,6 @@ static void ath_tx_send_normal(struct at
+ struct ath_buf *bf;
+
+ bf = fi->bf;
+- if (!bf)
+- bf = ath_tx_setup_buffer(sc, txq, tid, skb, false);
+-
+- if (!bf)
+- return;
+
+ INIT_LIST_HEAD(&bf_head);
+ list_add_tail(&bf->list, &bf_head);
+@@ -1820,8 +1827,7 @@ u8 ath_txchainmask_reduction(struct ath_
+ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
+ struct ath_txq *txq,
+ struct ath_atx_tid *tid,
+- struct sk_buff *skb,
+- bool dequeue)
++ struct sk_buff *skb)
+ {
+ struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ struct ath_frame_info *fi = get_frame_info(skb);
+@@ -1833,7 +1839,7 @@ static struct ath_buf *ath_tx_setup_buff
+ bf = ath_tx_get_buffer(sc);
+ if (!bf) {
+ ath_dbg(common, XMIT, "TX buffers are full\n");
+- goto error;
++ return NULL;
+ }
+
+ ATH_TXBUF_RESET(bf);
+@@ -1862,18 +1868,12 @@ static struct ath_buf *ath_tx_setup_buff
+ ath_err(ath9k_hw_common(sc->sc_ah),
+ "dma_mapping_error() on TX\n");
+ ath_tx_return_buffer(sc, bf);
+- goto error;
++ return NULL;
+ }
+
+ fi->bf = bf;
+
+ return bf;
+-
+-error:
+- if (dequeue)
+- __skb_unlink(skb, &tid->buf_q);
+- dev_kfree_skb_any(skb);
+- return NULL;
+ }
+
+ /* FIXME: tx power */
+@@ -1902,9 +1902,14 @@ static void ath_tx_start_dma(struct ath_
+ */
+ ath_tx_send_ampdu(sc, tid, skb, txctl);
+ } else {
+- bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb, false);
+- if (!bf)
++ bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
++ if (!bf) {
++ if (txctl->paprd)
++ dev_kfree_skb_any(skb);
++ else
++ ieee80211_free_txskb(sc->hw, skb);
+ return;
++ }
+
+ bf->bf_state.bfs_paprd = txctl->paprd;
+
--- /dev/null
+From 17b572e82032bc246324ce136696656b66d4e3f1 Mon Sep 17 00:00:00 2001
+From: Jason Wessel <jason.wessel@windriver.com>
+Date: Sun, 26 Aug 2012 22:37:03 -0500
+Subject: kdb,vt_console: Fix missed data due to pager overruns
+
+From: Jason Wessel <jason.wessel@windriver.com>
+
+commit 17b572e82032bc246324ce136696656b66d4e3f1 upstream.
+
+It is possible to miss data when using the kdb pager. The kdb pager
+does not pay attention to the maximum column constraint of the screen
+or serial terminal. This result is not incrementing the shown lines
+correctly and the pager will print more lines that fit on the screen.
+Obviously that is less than useful when using a VGA console where you
+cannot scroll back.
+
+The pager will now look at the kdb_buffer string to see how many
+characters are printed. It might not be perfect considering you can
+output ASCII that might move the cursor position, but it is a
+substantially better approximation for viewing dmesg and trace logs.
+
+This also means that the vt screen needs to set the kdb COLUMNS
+variable.
+
+Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/vt/vt.c | 13 +++++++++++++
+ kernel/debug/kdb/kdb_io.c | 33 ++++++++++++++++++++++++++++-----
+ 2 files changed, 41 insertions(+), 5 deletions(-)
+
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -3475,6 +3475,19 @@ int con_debug_enter(struct vc_data *vc)
+ kdb_set(2, setargs);
+ }
+ }
++ if (vc->vc_cols < 999) {
++ int colcount;
++ char cols[4];
++ const char *setargs[3] = {
++ "set",
++ "COLUMNS",
++ cols,
++ };
++ if (kdbgetintenv(setargs[0], &colcount)) {
++ snprintf(cols, 4, "%i", vc->vc_cols);
++ kdb_set(2, setargs);
++ }
++ }
+ #endif /* CONFIG_KGDB_KDB */
+ return ret;
+ }
+--- a/kernel/debug/kdb/kdb_io.c
++++ b/kernel/debug/kdb/kdb_io.c
+@@ -552,6 +552,7 @@ int vkdb_printf(const char *fmt, va_list
+ {
+ int diag;
+ int linecount;
++ int colcount;
+ int logging, saved_loglevel = 0;
+ int saved_trap_printk;
+ int got_printf_lock = 0;
+@@ -584,6 +585,10 @@ int vkdb_printf(const char *fmt, va_list
+ if (diag || linecount <= 1)
+ linecount = 24;
+
++ diag = kdbgetintenv("COLUMNS", &colcount);
++ if (diag || colcount <= 1)
++ colcount = 80;
++
+ diag = kdbgetintenv("LOGGING", &logging);
+ if (diag)
+ logging = 0;
+@@ -690,7 +695,7 @@ kdb_printit:
+ gdbstub_msg_write(kdb_buffer, retlen);
+ } else {
+ if (dbg_io_ops && !dbg_io_ops->is_console) {
+- len = strlen(kdb_buffer);
++ len = retlen;
+ cp = kdb_buffer;
+ while (len--) {
+ dbg_io_ops->write_char(*cp);
+@@ -709,11 +714,29 @@ kdb_printit:
+ printk(KERN_INFO "%s", kdb_buffer);
+ }
+
+- if (KDB_STATE(PAGER) && strchr(kdb_buffer, '\n'))
+- kdb_nextline++;
++ if (KDB_STATE(PAGER)) {
++ /*
++ * Check printed string to decide how to bump the
++ * kdb_nextline to control when the more prompt should
++ * show up.
++ */
++ int got = 0;
++ len = retlen;
++ while (len--) {
++ if (kdb_buffer[len] == '\n') {
++ kdb_nextline++;
++ got = 0;
++ } else if (kdb_buffer[len] == '\r') {
++ got = 0;
++ } else {
++ got++;
++ }
++ }
++ kdb_nextline += got / (colcount + 1);
++ }
+
+ /* check for having reached the LINES number of printed lines */
+- if (kdb_nextline == linecount) {
++ if (kdb_nextline >= linecount) {
+ char buf1[16] = "";
+ #if defined(CONFIG_SMP)
+ char buf2[32];
+@@ -776,7 +799,7 @@ kdb_printit:
+ kdb_grepping_flag = 0;
+ kdb_printf("\n");
+ } else if (buf1[0] == ' ') {
+- kdb_printf("\n");
++ kdb_printf("\r");
+ suspend_grep = 1; /* for this recursion */
+ } else if (buf1[0] == '\n') {
+ kdb_nextline = linecount - 1;
--- /dev/null
+From 91502f099dfc5a1e8812898e26ee280713e1d002 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 11 Oct 2012 14:20:58 +1100
+Subject: md/raid10: use correct limit variable
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 91502f099dfc5a1e8812898e26ee280713e1d002 upstream.
+
+Clang complains that we are assigning a variable to itself. This should
+be using bad_sectors like the similar earlier check does.
+
+Bug has been present since 3.1-rc1. It is minor but could
+conceivably cause corruption or other bad behaviour.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid10.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3019,7 +3019,7 @@ static sector_t sync_request(struct mdde
+ else {
+ bad_sectors -= (sector - first_bad);
+ if (max_sync > bad_sectors)
+- max_sync = max_sync;
++ max_sync = bad_sectors;
+ continue;
+ }
+ }
--- /dev/null
+From 5aa8b572007c4bca1e6d3dd4c4820f1ae49d6bb2 Mon Sep 17 00:00:00 2001
+From: Amerigo Wang <amwang@redhat.com>
+Date: Tue, 9 Oct 2012 17:48:16 +0000
+Subject: pktgen: fix crash when generating IPv6 packets
+
+From: Amerigo Wang <amwang@redhat.com>
+
+commit 5aa8b572007c4bca1e6d3dd4c4820f1ae49d6bb2 upstream.
+
+For IPv6, sizeof(struct ipv6hdr) = 40, thus the following
+expression will result negative:
+
+ datalen = pkt_dev->cur_pkt_size - 14 -
+ sizeof(struct ipv6hdr) - sizeof(struct udphdr) -
+ pkt_dev->pkt_overhead;
+
+And, the check "if (datalen < sizeof(struct pktgen_hdr))" will be
+passed as "datalen" is promoted to unsigned, therefore will cause
+a crash later.
+
+This is a quick fix by checking if "datalen" is negative. The following
+patch will increase the default value of 'min_pkt_size' for IPv6.
+
+This bug should exist for a long time, so Cc -stable too.
+
+Signed-off-by: Cong Wang <amwang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/pktgen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -2932,7 +2932,7 @@ static struct sk_buff *fill_packet_ipv6(
+ sizeof(struct ipv6hdr) - sizeof(struct udphdr) -
+ pkt_dev->pkt_overhead;
+
+- if (datalen < sizeof(struct pktgen_hdr)) {
++ if (datalen < 0 || datalen < sizeof(struct pktgen_hdr)) {
+ datalen = sizeof(struct pktgen_hdr);
+ if (net_ratelimit())
+ pr_info("increased datalen to %d\n", datalen);
video-udlfb-fix-line-counting-in-fb_write.patch
viafb-don-t-touch-clock-state-on-olpc-xo-1.5.patch
timers-fix-endless-looping-between-cascade-and-internal_add_timer.patch
+ath9k-use-ieee80211_free_txskb.patch
+md-raid10-use-correct-limit-variable.patch
+kdb-vt_console-fix-missed-data-due-to-pager-overruns.patch
+pktgen-fix-crash-when-generating-ipv6-packets.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
