--- /dev/null
+From 6c8afef551fef87a3bf24f8a74c69a7f2f72fc82 Mon Sep 17 00:00:00 2001
+From: Sujith <Sujith.Manoharan@atheros.com>
+Date: Tue, 9 Feb 2010 10:07:00 +0530
+Subject: ath9k: Fix sequence numbers for PAE frames
+
+From: Sujith <Sujith.Manoharan@atheros.com>
+
+commit 6c8afef551fef87a3bf24f8a74c69a7f2f72fc82 upstream.
+
+Currently, PAE frames are not assigned proper sequence numbers.
+Since sending PAE frames as part of aggregates breaks
+crupto with several APs, they are sent as normal MPDUs.
+Fix the seqeuence number issue by updating the frame with the
+internal sequence number.
+
+Tested-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1563,7 +1563,7 @@ static int ath_tx_setup_buffer(struct ie
+
+ bf->bf_frmlen = skb->len + FCS_LEN - (hdrlen & 3);
+
+- if (conf_is_ht(&sc->hw->conf) && !is_pae(skb))
++ if (conf_is_ht(&sc->hw->conf))
+ bf->bf_state.bf_type |= BUF_HT;
+
+ bf->bf_flags = setup_tx_flags(sc, skb, txctl->txq);
+@@ -1648,7 +1648,7 @@ static void ath_tx_start_dma(struct ath_
+ goto tx_done;
+ }
+
+- if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
++ if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) {
+ /*
+ * Try aggregation if it's a unicast data frame
+ * and the destination is HT capable.
--- /dev/null
+From ebfd32bba9b518d684009d9d21a56742337ca1b3 Mon Sep 17 00:00:00 2001
+From: Jonathan Brassow <jbrassow@redhat.com>
+Date: Tue, 16 Feb 2010 18:42:53 +0000
+Subject: dm log: userspace fix overhead_size calcuations
+
+From: Jonathan Brassow <jbrassow@redhat.com>
+
+commit ebfd32bba9b518d684009d9d21a56742337ca1b3 upstream.
+
+This patch fixes two bugs that revolve around the miscalculation and
+misuse of the variable 'overhead_size'. 'overhead_size' is the size of
+the various header structures used during communication.
+
+The first bug is the use of 'sizeof' with the pointer of a structure
+instead of the structure itself - resulting in the wrong size being
+computed. This is then used in a check to see if the payload
+(data_size) would be to large for the preallocated structure. Since the
+bug produces a smaller value for the overhead, it was possible for the
+structure to be breached. (Although the current users of the code do
+not currently send enough data to trigger this bug.)
+
+The second bug is that the 'overhead_size' value is used to compute how
+much of the preallocated space should be cleared before populating it
+with fresh data. This should have simply been 'sizeof(struct cn_msg)'
+not overhead_size. The fact that 'overhead_size' was computed
+incorrectly made this problem "less bad" - leaving only a pointer's
+worth of space at the end uncleared. Thus, this bug was never producing
+a bad result, but still needs to be fixed - especially now that the
+value is computed correctly.
+
+Signed-off-by: Jonathan Brassow <jbrassow@redhat.com
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-log-userspace-transfer.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/dm-log-userspace-transfer.c
++++ b/drivers/md/dm-log-userspace-transfer.c
+@@ -172,11 +172,15 @@ int dm_consult_userspace(const char *uui
+ {
+ int r = 0;
+ size_t dummy = 0;
+- int overhead_size =
+- sizeof(struct dm_ulog_request *) + sizeof(struct cn_msg);
++ int overhead_size = sizeof(struct dm_ulog_request) + sizeof(struct cn_msg);
+ struct dm_ulog_request *tfr = prealloced_ulog_tfr;
+ struct receiving_pkg pkg;
+
++ /*
++ * Given the space needed to hold the 'struct cn_msg' and
++ * 'struct dm_ulog_request' - do we have enough payload
++ * space remaining?
++ */
+ if (data_size > (DM_ULOG_PREALLOCED_SIZE - overhead_size)) {
+ DMINFO("Size of tfr exceeds preallocated size");
+ return -EINVAL;
+@@ -191,7 +195,7 @@ resend:
+ */
+ mutex_lock(&dm_ulog_lock);
+
+- memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size);
++ memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - sizeof(struct cn_msg));
+ memcpy(tfr->uuid, uuid, DM_UUID_LEN);
+ tfr->luid = luid;
+ tfr->seq = dm_ulog_seq++;
--- /dev/null
+From 9eef87da2a8ea4920e0d913ff977cac064b68ee0 Mon Sep 17 00:00:00 2001
+From: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
+Date: Tue, 16 Feb 2010 18:43:01 +0000
+Subject: dm mpath: fix stall when requeueing io
+
+From: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
+
+commit 9eef87da2a8ea4920e0d913ff977cac064b68ee0 upstream.
+
+This patch fixes the problem that system may stall if target's ->map_rq
+returns DM_MAPIO_REQUEUE in map_request().
+E.g. stall happens on 1 CPU box when a dm-mpath device with queue_if_no_path
+ bounces between all-paths-down and paths-up on I/O load.
+
+When target's ->map_rq returns DM_MAPIO_REQUEUE, map_request() requeues
+the request and returns to dm_request_fn(). Then, dm_request_fn()
+doesn't exit the I/O dispatching loop and continues processing
+the requeued request again.
+This map and requeue loop can be done with interrupt disabled,
+so 1 CPU system can be stalled if this situation happens.
+
+For example, commands below can stall my 1 CPU box within 1 minute or so:
+ # dmsetup table mp
+ mp: 0 2097152 multipath 1 queue_if_no_path 0 1 1 service-time 0 1 2 8:144 1 1
+ # while true; do dd if=/dev/mapper/mp of=/dev/null bs=1M count=100; done &
+ # while true; do \
+ > dmsetup message mp 0 "fail_path 8:144" \
+ > dmsetup suspend --noflush mp \
+ > dmsetup resume mp \
+ > dmsetup message mp 0 "reinstate_path 8:144" \
+ > done
+
+To fix the problem above, this patch changes dm_request_fn() to exit
+the I/O dispatching loop once if a request is requeued in map_request().
+
+Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
+Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1487,10 +1487,15 @@ static int dm_prep_fn(struct request_que
+ return BLKPREP_OK;
+ }
+
+-static void map_request(struct dm_target *ti, struct request *rq,
+- struct mapped_device *md)
++/*
++ * Returns:
++ * 0 : the request has been processed (not requeued)
++ * !0 : the request has been requeued
++ */
++static int map_request(struct dm_target *ti, struct request *clone,
++ struct mapped_device *md)
+ {
+- int r;
++ int r, requeued = 0;
+ struct request *clone = rq->special;
+ struct dm_rq_target_io *tio = clone->end_io_data;
+
+@@ -1516,6 +1521,7 @@ static void map_request(struct dm_target
+ case DM_MAPIO_REQUEUE:
+ /* The target wants to requeue the I/O */
+ dm_requeue_unmapped_request(clone);
++ requeued = 1;
+ break;
+ default:
+ if (r > 0) {
+@@ -1527,6 +1533,8 @@ static void map_request(struct dm_target
+ dm_kill_unmapped_request(clone, r);
+ break;
+ }
++
++ return requeued;
+ }
+
+ /*
+@@ -1568,12 +1576,16 @@ static void dm_request_fn(struct request
+
+ blk_start_request(rq);
+ spin_unlock(q->queue_lock);
+- map_request(ti, rq, md);
++ if (map_request(ti, clone, md))
++ goto requeued;
+ spin_lock_irq(q->queue_lock);
+ }
+
+ goto out;
+
++requeued:
++ spin_lock_irq(q->queue_lock);
++
+ plug_and_out:
+ if (!elv_queue_empty(q))
+ /* Some requests still remain, retry later */
--- /dev/null
+From 781248c1b50c776a9ef4be1130f84ced1cba42fe Mon Sep 17 00:00:00 2001
+From: Nikanth Karthikesan <knikanth@suse.de>
+Date: Tue, 16 Feb 2010 18:42:47 +0000
+Subject: dm stripe: avoid divide by zero with invalid stripe count
+
+From: Nikanth Karthikesan <knikanth@suse.de>
+
+commit 781248c1b50c776a9ef4be1130f84ced1cba42fe upstream.
+
+If a table containing zero as stripe count is passed into stripe_ctr
+the code attempts to divide by zero.
+
+This patch changes DM_TABLE_LOAD to return -EINVAL if the stripe count
+is zero.
+
+We now get the following error messages:
+ device-mapper: table: 253:0: striped: Invalid stripe count
+ device-mapper: ioctl: error adding target to table
+
+Signed-off-by: Nikanth Karthikesan <knikanth@suse.de>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-stripe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-stripe.c
++++ b/drivers/md/dm-stripe.c
+@@ -110,7 +110,7 @@ static int stripe_ctr(struct dm_target *
+ }
+
+ stripes = simple_strtoul(argv[0], &end, 10);
+- if (*end) {
++ if (!stripes || *end) {
+ ti->error = "Invalid stripe count";
+ return -EINVAL;
+ }
--- /dev/null
+From 098dfded5b1b09927995e89c6d689f85a0f53384 Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date: Fri, 5 Feb 2010 11:40:00 -0800
+Subject: iwlwifi: Fix to set correct ht configuration
+
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+commit 098dfded5b1b09927995e89c6d689f85a0f53384 upstream.
+
+iwl_set_rxon_ht() only get called in iwl_post_associate(); which cause
+possible incorrect ht configuration. Adding the call in iwl_mac_config() if
+IEEE80211_CONF_CHANGE_CHANNEL flag is set to re-configure and send rxon
+command.
+
+Fixes
+http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2146
+
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -2645,6 +2645,7 @@ int iwl_mac_config(struct ieee80211_hw *
+ if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
+ priv->staging_rxon.flags = 0;
+
++ iwl_set_rxon_ht(priv, ht_conf);
+ iwl_set_rxon_channel(priv, conf->channel);
+
+ iwl_set_flags_for_band(priv, conf->channel->band);
--- /dev/null
+From 0da780c269957783d341fc3559e6b4c9912af7b4 Mon Sep 17 00:00:00 2001
+From: Benoit Papillault <benoit.papillault@free.fr>
+Date: Fri, 5 Feb 2010 01:21:03 +0100
+Subject: mac80211: Fix probe request filtering in IBSS mode
+
+From: Benoit Papillault <benoit.papillault@free.fr>
+
+commit 0da780c269957783d341fc3559e6b4c9912af7b4 upstream.
+
+We only reply to probe request if either the requested SSID is the
+broadcast SSID or if the requested SSID matches our own SSID. This
+latter case was not properly handled since we were replying to different
+SSID with the same length as our own SSID.
+
+Signed-off-by: Benoit Papillault <benoit.papillault@free.fr>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ibss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -643,7 +643,7 @@ static void ieee80211_rx_mgmt_probe_req(
+ }
+ if (pos[1] != 0 &&
+ (pos[1] != ifibss->ssid_len ||
+- !memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
++ memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
+ /* Ignore ProbeReq for foreign SSID */
+ return;
+ }
nfs-too-many-getattr-and-access-calls-after-direct-i-o.patch
ecryptfs-add-getattr-function.patch
b43-fix-throughput-regression.patch
+ath9k-fix-sequence-numbers-for-pae-frames.patch
+mac80211-fix-probe-request-filtering-in-ibss-mode.patch
+iwlwifi-fix-to-set-correct-ht-configuration.patch
+dm-stripe-avoid-divide-by-zero-with-invalid-stripe-count.patch
+dm-log-userspace-fix-overhead_size-calcuations.patch
+dm-mpath-fix-stall-when-requeueing-io.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
