--- /dev/null
+From 4afe2156eb639e563d6ef0c2706b66ea400348b2 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Tue, 18 Jun 2013 14:33:58 +0200
+Subject: can: usb_8dev: unregister netdev before free()ing
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 4afe2156eb639e563d6ef0c2706b66ea400348b2 upstream.
+
+The usb_8dev hardware has problems on some xhci USB hosts. The driver fails to
+read the firmware revision in the probe function. This leads to the following
+Oops:
+
+ [ 3356.635912] kernel BUG at net/core/dev.c:5701!
+
+The driver tries to free the netdev, which has already been registered, without
+unregistering it.
+
+This patch fixes the problem by unregistering the netdev in the error path.
+
+Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
+Reviewed-by: Bernd Krumboeck <krumboeck@universalnet.at>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Cc: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/usb_8dev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/usb/usb_8dev.c
++++ b/drivers/net/can/usb/usb_8dev.c
+@@ -977,7 +977,7 @@ static int usb_8dev_probe(struct usb_int
+ err = usb_8dev_cmd_version(priv, &version);
+ if (err) {
+ netdev_err(netdev, "can't get firmware version\n");
+- goto cleanup_cmd_msg_buffer;
++ goto cleanup_unregister_candev;
+ } else {
+ netdev_info(netdev,
+ "firmware: %d.%d, hardware: %d.%d\n",
+@@ -989,6 +989,9 @@ static int usb_8dev_probe(struct usb_int
+
+ return 0;
+
++cleanup_unregister_candev:
++ unregister_netdev(priv->netdev);
++
+ cleanup_cmd_msg_buffer:
+ kfree(priv->cmd_msg_buffer);
+
--- /dev/null
+From 44521527be36172864e6e7a6fba4b66e9aa48e40 Mon Sep 17 00:00:00 2001
+From: Aaron Lu <aaron.lu@intel.com>
+Date: Thu, 20 Jun 2013 09:38:34 +0800
+Subject: libata-acpi: add back ACPI based hotplug functionality
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+commit 44521527be36172864e6e7a6fba4b66e9aa48e40 upstream.
+
+Commit 30dcf76acc69 "libata: migrate ACPI code over to new bindings"
+mistakenly dropped the code to register hotplug notificaion handler
+for ATA port/devices, causing regression for people using ATA bay,
+as kernel bug #59871 shows.
+
+Fix this by adding back the hotplug notification handler registration
+code. Since this code has to be run once and notification needs to
+be installed on every ATA port/devices handle no matter if there is
+actual device attached, we can't do this in binding time for ATA
+device ACPI handle, as the binding only occurs when a SCSI device is
+created, i.e. there is device attached. So introduce the
+ata_acpi_hotplug_init() function to loop scan all ATA ACPI handles
+and if it is available, install the notificaion handler for it during
+ATA init time.
+
+With the ATA ACPI handle binding to SCSI device tree, it is possible
+now that when the SCSI hotplug work removes the SCSI device, the ACPI
+unbind function will find that the corresponding ACPI device has
+already been deleted by dock driver, causing a scaring message like:
+[ 128.263966] scsi 4:0:0:0: Oops, 'acpi_handle' corrupt
+Fix this by waiting for SCSI hotplug task finish in our notificaion
+handler, so that the removal of ACPI device done in ACPI unbind
+function triggered by the removal of SCSI device is run earlier when
+ACPI device is still available.
+
+[The only change I've made is to remove the two NULL params in
+register_hotplug_dock_device, which doesn't accept those params
+in pre-v3.10 kernels. - aaron.lu]
+
+[rjw: Rebased]
+References: https://bugzilla.kernel.org/show_bug.cgi?id=59871
+Reported-bisected-and-tested-by: Dirk Griesbach <spamthis@freenet.de>
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/ata/libata-acpi.c | 36 +++++++++++++++++++++++++++++++++++-
+ drivers/ata/libata-core.c | 2 ++
+ drivers/ata/libata.h | 2 ++
+ 3 files changed, 39 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-acpi.c
++++ b/drivers/ata/libata-acpi.c
+@@ -157,8 +157,10 @@ static void ata_acpi_handle_hotplug(stru
+
+ spin_unlock_irqrestore(ap->lock, flags);
+
+- if (wait)
++ if (wait) {
+ ata_port_wait_eh(ap);
++ flush_work(&ap->hotplug_task.work);
++ }
+ }
+
+ static void ata_acpi_dev_notify_dock(acpi_handle handle, u32 event, void *data)
+@@ -215,6 +217,38 @@ static const struct acpi_dock_ops ata_ac
+ .uevent = ata_acpi_ap_uevent,
+ };
+
++void ata_acpi_hotplug_init(struct ata_host *host)
++{
++ int i;
++
++ for (i = 0; i < host->n_ports; i++) {
++ struct ata_port *ap = host->ports[i];
++ acpi_handle handle;
++ struct ata_device *dev;
++
++ if (!ap)
++ continue;
++
++ handle = ata_ap_acpi_handle(ap);
++ if (handle) {
++ /* we might be on a docking station */
++ register_hotplug_dock_device(handle,
++ &ata_acpi_ap_dock_ops, ap);
++ }
++
++ ata_for_each_dev(dev, &ap->link, ALL) {
++ handle = ata_dev_acpi_handle(dev);
++ if (!handle)
++ continue;
++
++ /* we might be on a docking station */
++ register_hotplug_dock_device(handle,
++ &ata_acpi_dev_dock_ops,
++ dev);
++ }
++ }
++}
++
+ /**
+ * ata_acpi_dissociate - dissociate ATA host from ACPI objects
+ * @host: target ATA host
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6148,6 +6148,8 @@ int ata_host_register(struct ata_host *h
+ if (rc)
+ goto err_tadd;
+
++ ata_acpi_hotplug_init(host);
++
+ /* set cable, sata_spd_limit and report */
+ for (i = 0; i < host->n_ports; i++) {
+ struct ata_port *ap = host->ports[i];
+--- a/drivers/ata/libata.h
++++ b/drivers/ata/libata.h
+@@ -122,6 +122,7 @@ extern int ata_acpi_register(void);
+ extern void ata_acpi_unregister(void);
+ extern void ata_acpi_bind(struct ata_device *dev);
+ extern void ata_acpi_unbind(struct ata_device *dev);
++extern void ata_acpi_hotplug_init(struct ata_host *host);
+ #else
+ static inline void ata_acpi_dissociate(struct ata_host *host) { }
+ static inline int ata_acpi_on_suspend(struct ata_port *ap) { return 0; }
+@@ -134,6 +135,7 @@ static inline int ata_acpi_register(void
+ static inline void ata_acpi_unregister(void) { }
+ static inline void ata_acpi_bind(struct ata_device *dev) { }
+ static inline void ata_acpi_unbind(struct ata_device *dev) { }
++static inline void ata_acpi_hotplug_init(struct ata_host *host) {}
+ #endif
+
+ /* libata-scsi.c */
--- /dev/null
+From 35d865afbbdf79e492f7d61df92b1a9e1d93d26f Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 28 May 2013 10:54:03 +0200
+Subject: mac80211: work around broken APs not including HT info
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 35d865afbbdf79e492f7d61df92b1a9e1d93d26f upstream.
+
+There are some APs, notably 2G/3G/4G Wifi routers, specifically the
+"Onda PN51T", "Vodafone PocketWiFi 2", "ZTE MF60" and a similar
+T-Mobile branded device [1] that erroneously don't include all the
+needed information in (re)association response frames. Work around
+this by assuming the information is the same as it was in the
+beacon or probe response and using the data from there instead.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=58881.
+
+[1] https://bbs.archlinux.org/viewtopic.php?pid=1277305
+
+Note that this requires marking the first ieee802_11_parse_elems()
+argument const, otherwise we'd get a compiler warning.
+
+Reported-and-tested-by: Michal Zajac <manwe@manwe.pl>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ net/mac80211/ieee80211_i.h | 4 +-
+ net/mac80211/mlme.c | 87 +++++++++++++++++++++++++++++++++++++++++----
+ net/mac80211/util.c | 6 +--
+ 3 files changed, 85 insertions(+), 12 deletions(-)
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1520,9 +1520,9 @@ static inline void ieee80211_tx_skb(stru
+ ieee80211_tx_skb_tid(sdata, skb, 7);
+ }
+
+-void ieee802_11_parse_elems(u8 *start, size_t len,
++void ieee802_11_parse_elems(const u8 *start, size_t len,
+ struct ieee802_11_elems *elems);
+-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
++u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len,
+ struct ieee802_11_elems *elems,
+ u64 filter, u32 crc);
+ u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2422,8 +2422,11 @@ static bool ieee80211_assoc_success(stru
+ u16 capab_info, aid;
+ struct ieee802_11_elems elems;
+ struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
++ const struct cfg80211_bss_ies *bss_ies = NULL;
++ struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
+ u32 changed = 0;
+ int err;
++ bool ret;
+
+ /* AssocResp and ReassocResp have identical structure */
+
+@@ -2455,21 +2458,86 @@ static bool ieee80211_assoc_success(stru
+ ifmgd->aid = aid;
+
+ /*
++ * Some APs are erroneously not including some information in their
++ * (re)association response frames. Try to recover by using the data
++ * from the beacon or probe response. This seems to afflict mobile
++ * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
++ * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
++ */
++ if ((assoc_data->wmm && !elems.wmm_param) ||
++ (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
++ (!elems.ht_cap_elem || !elems.ht_operation)) ||
++ (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
++ (!elems.vht_cap_elem || !elems.vht_operation))) {
++ const struct cfg80211_bss_ies *ies;
++ struct ieee802_11_elems bss_elems;
++
++ rcu_read_lock();
++ ies = rcu_dereference(cbss->ies);
++ if (ies)
++ bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
++ GFP_ATOMIC);
++ rcu_read_unlock();
++ if (!bss_ies)
++ return false;
++
++ ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
++ &bss_elems);
++ if (assoc_data->wmm &&
++ !elems.wmm_param && bss_elems.wmm_param) {
++ elems.wmm_param = bss_elems.wmm_param;
++ sdata_info(sdata,
++ "AP bug: WMM param missing from AssocResp\n");
++ }
++
++ /*
++ * Also check if we requested HT/VHT, otherwise the AP doesn't
++ * have to include the IEs in the (re)association response.
++ */
++ if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
++ !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
++ elems.ht_cap_elem = bss_elems.ht_cap_elem;
++ sdata_info(sdata,
++ "AP bug: HT capability missing from AssocResp\n");
++ }
++ if (!elems.ht_operation && bss_elems.ht_operation &&
++ !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
++ elems.ht_operation = bss_elems.ht_operation;
++ sdata_info(sdata,
++ "AP bug: HT operation missing from AssocResp\n");
++ }
++ if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
++ !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
++ elems.vht_cap_elem = bss_elems.vht_cap_elem;
++ sdata_info(sdata,
++ "AP bug: VHT capa missing from AssocResp\n");
++ }
++ if (!elems.vht_operation && bss_elems.vht_operation &&
++ !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
++ elems.vht_operation = bss_elems.vht_operation;
++ sdata_info(sdata,
++ "AP bug: VHT operation missing from AssocResp\n");
++ }
++ }
++
++ /*
+ * We previously checked these in the beacon/probe response, so
+ * they should be present here. This is just a safety net.
+ */
+ if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
+ (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
+ sdata_info(sdata,
+- "HT AP is missing WMM params or HT capability/operation in AssocResp\n");
+- return false;
++ "HT AP is missing WMM params or HT capability/operation\n");
++ ret = false;
++ goto out;
+ }
+
+ if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
+ (!elems.vht_cap_elem || !elems.vht_operation)) {
+ sdata_info(sdata,
+- "VHT AP is missing VHT capability/operation in AssocResp\n");
+- return false;
++ "VHT AP is missing VHT capability/operation\n");
++ ret = false;
++ goto out;
+ }
+
+ mutex_lock(&sdata->local->sta_mtx);
+@@ -2480,7 +2548,8 @@ static bool ieee80211_assoc_success(stru
+ sta = sta_info_get(sdata, cbss->bssid);
+ if (WARN_ON(!sta)) {
+ mutex_unlock(&sdata->local->sta_mtx);
+- return false;
++ ret = false;
++ goto out;
+ }
+
+ sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
+@@ -2533,7 +2602,8 @@ static bool ieee80211_assoc_success(stru
+ sta->sta.addr);
+ WARN_ON(__sta_info_destroy(sta));
+ mutex_unlock(&sdata->local->sta_mtx);
+- return false;
++ ret = false;
++ goto out;
+ }
+
+ mutex_unlock(&sdata->local->sta_mtx);
+@@ -2573,7 +2643,10 @@ static bool ieee80211_assoc_success(stru
+ ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
+ ieee80211_sta_reset_beacon_monitor(sdata);
+
+- return true;
++ ret = true;
++ out:
++ kfree(bss_ies);
++ return ret;
+ }
+
+ static enum rx_mgmt_action __must_check
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -626,12 +626,12 @@ void ieee80211_queue_delayed_work(struct
+ }
+ EXPORT_SYMBOL(ieee80211_queue_delayed_work);
+
+-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
++u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len,
+ struct ieee802_11_elems *elems,
+ u64 filter, u32 crc)
+ {
+ size_t left = len;
+- u8 *pos = start;
++ const u8 *pos = start;
+ bool calc_crc = filter != 0;
+ DECLARE_BITMAP(seen_elems, 256);
+
+@@ -877,7 +877,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start
+ return crc;
+ }
+
+-void ieee802_11_parse_elems(u8 *start, size_t len,
++void ieee802_11_parse_elems(const u8 *start, size_t len,
+ struct ieee802_11_elems *elems)
+ {
+ ieee802_11_parse_elems_crc(start, len, elems, 0, 0);
--- /dev/null
+From b855f16b05a697ac1863adabe99bfba56e6d3199 Mon Sep 17 00:00:00 2001
+From: Tang Yuantian <yuantian.tang@freescale.com>
+Date: Wed, 10 Apr 2013 11:36:39 +0800
+Subject: of/base: release the node correctly in of_parse_phandle_with_args()
+
+From: Tang Yuantian <yuantian.tang@freescale.com>
+
+commit b855f16b05a697ac1863adabe99bfba56e6d3199 upstream.
+
+Call of_node_put() only when the out_args is NULL on success,
+or the node's reference count will not be correct because the caller
+will call of_node_put() again.
+
+Signed-off-by: Tang Yuantian <Yuantian.Tang@freescale.com>
+[grant.likely: tightened up the patch]
+Signed-off-by: Grant Likely <grant.likely@linaro.org>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/of/base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1166,11 +1166,11 @@ static int __of_parse_phandle_with_args(
+ out_args->args_count = count;
+ for (i = 0; i < count; i++)
+ out_args->args[i] = be32_to_cpup(list++);
++ } else {
++ of_node_put(node);
+ }
+
+ /* Found it! return success */
+- if (node)
+- of_node_put(node);
+ return 0;
+ }
+
powerpc-eeh-fix-fetching-bus-for-single-dev-pe.patch
ubifs-prepare-to-fix-a-horrid-bug.patch
ubifs-fix-a-horrid-bug.patch
+libata-acpi-add-back-acpi-based-hotplug-functionality.patch
+of-base-release-the-node-correctly-in-of_parse_phandle_with_args.patch
+can-usb_8dev-unregister-netdev-before-free-ing.patch
+mac80211-work-around-broken-aps-not-including-ht-info.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
