From: Greg Kroah-Hartman Date: Mon, 1 Jul 2013 18:46:00 +0000 (-0700) Subject: 3.9-stable patches X-Git-Tag: v3.9.9~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=78c1523681bf5d11316829726691fdcafc4732bd;p=thirdparty%2Fkernel%2Fstable-queue.git 3.9-stable patches added patches: can-usb_8dev-unregister-netdev-before-free-ing.patch libata-acpi-add-back-acpi-based-hotplug-functionality.patch mac80211-work-around-broken-aps-not-including-ht-info.patch of-base-release-the-node-correctly-in-of_parse_phandle_with_args.patch --- diff --git a/queue-3.9/can-usb_8dev-unregister-netdev-before-free-ing.patch b/queue-3.9/can-usb_8dev-unregister-netdev-before-free-ing.patch new file mode 100644 index 00000000000..ee37e69d3fa --- /dev/null +++ b/queue-3.9/can-usb_8dev-unregister-netdev-before-free-ing.patch @@ -0,0 +1,51 @@ +From 4afe2156eb639e563d6ef0c2706b66ea400348b2 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Tue, 18 Jun 2013 14:33:58 +0200 +Subject: can: usb_8dev: unregister netdev before free()ing + +From: Marc Kleine-Budde + +commit 4afe2156eb639e563d6ef0c2706b66ea400348b2 upstream. + +The usb_8dev hardware has problems on some xhci USB hosts. The driver fails to +read the firmware revision in the probe function. This leads to the following +Oops: + + [ 3356.635912] kernel BUG at net/core/dev.c:5701! + +The driver tries to free the netdev, which has already been registered, without +unregistering it. + +This patch fixes the problem by unregistering the netdev in the error path. + +Reported-by: Michael Olbrich +Reviewed-by: Bernd Krumboeck +Signed-off-by: Marc Kleine-Budde +Cc: Oliver Hartkopp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/usb_8dev.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/can/usb/usb_8dev.c ++++ b/drivers/net/can/usb/usb_8dev.c +@@ -977,7 +977,7 @@ static int usb_8dev_probe(struct usb_int + err = usb_8dev_cmd_version(priv, &version); + if (err) { + netdev_err(netdev, "can't get firmware version\n"); +- goto cleanup_cmd_msg_buffer; ++ goto cleanup_unregister_candev; + } else { + netdev_info(netdev, + "firmware: %d.%d, hardware: %d.%d\n", +@@ -989,6 +989,9 @@ static int usb_8dev_probe(struct usb_int + + return 0; + ++cleanup_unregister_candev: ++ unregister_netdev(priv->netdev); ++ + cleanup_cmd_msg_buffer: + kfree(priv->cmd_msg_buffer); + diff --git a/queue-3.9/libata-acpi-add-back-acpi-based-hotplug-functionality.patch b/queue-3.9/libata-acpi-add-back-acpi-based-hotplug-functionality.patch new file mode 100644 index 00000000000..f9bbdf7f577 --- /dev/null +++ b/queue-3.9/libata-acpi-add-back-acpi-based-hotplug-functionality.patch @@ -0,0 +1,135 @@ +From 44521527be36172864e6e7a6fba4b66e9aa48e40 Mon Sep 17 00:00:00 2001 +From: Aaron Lu +Date: Thu, 20 Jun 2013 09:38:34 +0800 +Subject: libata-acpi: add back ACPI based hotplug functionality + +From: Aaron Lu + +commit 44521527be36172864e6e7a6fba4b66e9aa48e40 upstream. + +Commit 30dcf76acc69 "libata: migrate ACPI code over to new bindings" +mistakenly dropped the code to register hotplug notificaion handler +for ATA port/devices, causing regression for people using ATA bay, +as kernel bug #59871 shows. + +Fix this by adding back the hotplug notification handler registration +code. Since this code has to be run once and notification needs to +be installed on every ATA port/devices handle no matter if there is +actual device attached, we can't do this in binding time for ATA +device ACPI handle, as the binding only occurs when a SCSI device is +created, i.e. there is device attached. So introduce the +ata_acpi_hotplug_init() function to loop scan all ATA ACPI handles +and if it is available, install the notificaion handler for it during +ATA init time. + +With the ATA ACPI handle binding to SCSI device tree, it is possible +now that when the SCSI hotplug work removes the SCSI device, the ACPI +unbind function will find that the corresponding ACPI device has +already been deleted by dock driver, causing a scaring message like: +[ 128.263966] scsi 4:0:0:0: Oops, 'acpi_handle' corrupt +Fix this by waiting for SCSI hotplug task finish in our notificaion +handler, so that the removal of ACPI device done in ACPI unbind +function triggered by the removal of SCSI device is run earlier when +ACPI device is still available. + +[The only change I've made is to remove the two NULL params in +register_hotplug_dock_device, which doesn't accept those params +in pre-v3.10 kernels. - aaron.lu] + +[rjw: Rebased] +References: https://bugzilla.kernel.org/show_bug.cgi?id=59871 +Reported-bisected-and-tested-by: Dirk Griesbach +Signed-off-by: Aaron Lu +Acked-by: Tejun Heo +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/ata/libata-acpi.c | 36 +++++++++++++++++++++++++++++++++++- + drivers/ata/libata-core.c | 2 ++ + drivers/ata/libata.h | 2 ++ + 3 files changed, 39 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-acpi.c ++++ b/drivers/ata/libata-acpi.c +@@ -157,8 +157,10 @@ static void ata_acpi_handle_hotplug(stru + + spin_unlock_irqrestore(ap->lock, flags); + +- if (wait) ++ if (wait) { + ata_port_wait_eh(ap); ++ flush_work(&ap->hotplug_task.work); ++ } + } + + static void ata_acpi_dev_notify_dock(acpi_handle handle, u32 event, void *data) +@@ -215,6 +217,38 @@ static const struct acpi_dock_ops ata_ac + .uevent = ata_acpi_ap_uevent, + }; + ++void ata_acpi_hotplug_init(struct ata_host *host) ++{ ++ int i; ++ ++ for (i = 0; i < host->n_ports; i++) { ++ struct ata_port *ap = host->ports[i]; ++ acpi_handle handle; ++ struct ata_device *dev; ++ ++ if (!ap) ++ continue; ++ ++ handle = ata_ap_acpi_handle(ap); ++ if (handle) { ++ /* we might be on a docking station */ ++ register_hotplug_dock_device(handle, ++ &ata_acpi_ap_dock_ops, ap); ++ } ++ ++ ata_for_each_dev(dev, &ap->link, ALL) { ++ handle = ata_dev_acpi_handle(dev); ++ if (!handle) ++ continue; ++ ++ /* we might be on a docking station */ ++ register_hotplug_dock_device(handle, ++ &ata_acpi_dev_dock_ops, ++ dev); ++ } ++ } ++} ++ + /** + * ata_acpi_dissociate - dissociate ATA host from ACPI objects + * @host: target ATA host +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6148,6 +6148,8 @@ int ata_host_register(struct ata_host *h + if (rc) + goto err_tadd; + ++ ata_acpi_hotplug_init(host); ++ + /* set cable, sata_spd_limit and report */ + for (i = 0; i < host->n_ports; i++) { + struct ata_port *ap = host->ports[i]; +--- a/drivers/ata/libata.h ++++ b/drivers/ata/libata.h +@@ -122,6 +122,7 @@ extern int ata_acpi_register(void); + extern void ata_acpi_unregister(void); + extern void ata_acpi_bind(struct ata_device *dev); + extern void ata_acpi_unbind(struct ata_device *dev); ++extern void ata_acpi_hotplug_init(struct ata_host *host); + #else + static inline void ata_acpi_dissociate(struct ata_host *host) { } + static inline int ata_acpi_on_suspend(struct ata_port *ap) { return 0; } +@@ -134,6 +135,7 @@ static inline int ata_acpi_register(void + static inline void ata_acpi_unregister(void) { } + static inline void ata_acpi_bind(struct ata_device *dev) { } + static inline void ata_acpi_unbind(struct ata_device *dev) { } ++static inline void ata_acpi_hotplug_init(struct ata_host *host) {} + #endif + + /* libata-scsi.c */ diff --git a/queue-3.9/mac80211-work-around-broken-aps-not-including-ht-info.patch b/queue-3.9/mac80211-work-around-broken-aps-not-including-ht-info.patch new file mode 100644 index 00000000000..0584091d99b --- /dev/null +++ b/queue-3.9/mac80211-work-around-broken-aps-not-including-ht-info.patch @@ -0,0 +1,211 @@ +From 35d865afbbdf79e492f7d61df92b1a9e1d93d26f Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Tue, 28 May 2013 10:54:03 +0200 +Subject: mac80211: work around broken APs not including HT info + +From: Johannes Berg + +commit 35d865afbbdf79e492f7d61df92b1a9e1d93d26f upstream. + +There are some APs, notably 2G/3G/4G Wifi routers, specifically the +"Onda PN51T", "Vodafone PocketWiFi 2", "ZTE MF60" and a similar +T-Mobile branded device [1] that erroneously don't include all the +needed information in (re)association response frames. Work around +this by assuming the information is the same as it was in the +beacon or probe response and using the data from there instead. + +This fixes https://bugzilla.kernel.org/show_bug.cgi?id=58881. + +[1] https://bbs.archlinux.org/viewtopic.php?pid=1277305 + +Note that this requires marking the first ieee802_11_parse_elems() +argument const, otherwise we'd get a compiler warning. + +Reported-and-tested-by: Michal Zajac +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + + +--- + net/mac80211/ieee80211_i.h | 4 +- + net/mac80211/mlme.c | 87 +++++++++++++++++++++++++++++++++++++++++---- + net/mac80211/util.c | 6 +-- + 3 files changed, 85 insertions(+), 12 deletions(-) + +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1520,9 +1520,9 @@ static inline void ieee80211_tx_skb(stru + ieee80211_tx_skb_tid(sdata, skb, 7); + } + +-void ieee802_11_parse_elems(u8 *start, size_t len, ++void ieee802_11_parse_elems(const u8 *start, size_t len, + struct ieee802_11_elems *elems); +-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, ++u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, + struct ieee802_11_elems *elems, + u64 filter, u32 crc); + u32 ieee80211_mandatory_rates(struct ieee80211_local *local, +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -2422,8 +2422,11 @@ static bool ieee80211_assoc_success(stru + u16 capab_info, aid; + struct ieee802_11_elems elems; + struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf; ++ const struct cfg80211_bss_ies *bss_ies = NULL; ++ struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data; + u32 changed = 0; + int err; ++ bool ret; + + /* AssocResp and ReassocResp have identical structure */ + +@@ -2455,21 +2458,86 @@ static bool ieee80211_assoc_success(stru + ifmgd->aid = aid; + + /* ++ * Some APs are erroneously not including some information in their ++ * (re)association response frames. Try to recover by using the data ++ * from the beacon or probe response. This seems to afflict mobile ++ * 2G/3G/4G wifi routers, reported models include the "Onda PN51T", ++ * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device. ++ */ ++ if ((assoc_data->wmm && !elems.wmm_param) || ++ (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) && ++ (!elems.ht_cap_elem || !elems.ht_operation)) || ++ (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) && ++ (!elems.vht_cap_elem || !elems.vht_operation))) { ++ const struct cfg80211_bss_ies *ies; ++ struct ieee802_11_elems bss_elems; ++ ++ rcu_read_lock(); ++ ies = rcu_dereference(cbss->ies); ++ if (ies) ++ bss_ies = kmemdup(ies, sizeof(*ies) + ies->len, ++ GFP_ATOMIC); ++ rcu_read_unlock(); ++ if (!bss_ies) ++ return false; ++ ++ ieee802_11_parse_elems(bss_ies->data, bss_ies->len, ++ &bss_elems); ++ if (assoc_data->wmm && ++ !elems.wmm_param && bss_elems.wmm_param) { ++ elems.wmm_param = bss_elems.wmm_param; ++ sdata_info(sdata, ++ "AP bug: WMM param missing from AssocResp\n"); ++ } ++ ++ /* ++ * Also check if we requested HT/VHT, otherwise the AP doesn't ++ * have to include the IEs in the (re)association response. ++ */ ++ if (!elems.ht_cap_elem && bss_elems.ht_cap_elem && ++ !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) { ++ elems.ht_cap_elem = bss_elems.ht_cap_elem; ++ sdata_info(sdata, ++ "AP bug: HT capability missing from AssocResp\n"); ++ } ++ if (!elems.ht_operation && bss_elems.ht_operation && ++ !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) { ++ elems.ht_operation = bss_elems.ht_operation; ++ sdata_info(sdata, ++ "AP bug: HT operation missing from AssocResp\n"); ++ } ++ if (!elems.vht_cap_elem && bss_elems.vht_cap_elem && ++ !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) { ++ elems.vht_cap_elem = bss_elems.vht_cap_elem; ++ sdata_info(sdata, ++ "AP bug: VHT capa missing from AssocResp\n"); ++ } ++ if (!elems.vht_operation && bss_elems.vht_operation && ++ !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) { ++ elems.vht_operation = bss_elems.vht_operation; ++ sdata_info(sdata, ++ "AP bug: VHT operation missing from AssocResp\n"); ++ } ++ } ++ ++ /* + * We previously checked these in the beacon/probe response, so + * they should be present here. This is just a safety net. + */ + if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) && + (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) { + sdata_info(sdata, +- "HT AP is missing WMM params or HT capability/operation in AssocResp\n"); +- return false; ++ "HT AP is missing WMM params or HT capability/operation\n"); ++ ret = false; ++ goto out; + } + + if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) && + (!elems.vht_cap_elem || !elems.vht_operation)) { + sdata_info(sdata, +- "VHT AP is missing VHT capability/operation in AssocResp\n"); +- return false; ++ "VHT AP is missing VHT capability/operation\n"); ++ ret = false; ++ goto out; + } + + mutex_lock(&sdata->local->sta_mtx); +@@ -2480,7 +2548,8 @@ static bool ieee80211_assoc_success(stru + sta = sta_info_get(sdata, cbss->bssid); + if (WARN_ON(!sta)) { + mutex_unlock(&sdata->local->sta_mtx); +- return false; ++ ret = false; ++ goto out; + } + + sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)]; +@@ -2533,7 +2602,8 @@ static bool ieee80211_assoc_success(stru + sta->sta.addr); + WARN_ON(__sta_info_destroy(sta)); + mutex_unlock(&sdata->local->sta_mtx); +- return false; ++ ret = false; ++ goto out; + } + + mutex_unlock(&sdata->local->sta_mtx); +@@ -2573,7 +2643,10 @@ static bool ieee80211_assoc_success(stru + ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt); + ieee80211_sta_reset_beacon_monitor(sdata); + +- return true; ++ ret = true; ++ out: ++ kfree(bss_ies); ++ return ret; + } + + static enum rx_mgmt_action __must_check +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -626,12 +626,12 @@ void ieee80211_queue_delayed_work(struct + } + EXPORT_SYMBOL(ieee80211_queue_delayed_work); + +-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, ++u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, + struct ieee802_11_elems *elems, + u64 filter, u32 crc) + { + size_t left = len; +- u8 *pos = start; ++ const u8 *pos = start; + bool calc_crc = filter != 0; + DECLARE_BITMAP(seen_elems, 256); + +@@ -877,7 +877,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start + return crc; + } + +-void ieee802_11_parse_elems(u8 *start, size_t len, ++void ieee802_11_parse_elems(const u8 *start, size_t len, + struct ieee802_11_elems *elems) + { + ieee802_11_parse_elems_crc(start, len, elems, 0, 0); diff --git a/queue-3.9/of-base-release-the-node-correctly-in-of_parse_phandle_with_args.patch b/queue-3.9/of-base-release-the-node-correctly-in-of_parse_phandle_with_args.patch new file mode 100644 index 00000000000..963712d10b6 --- /dev/null +++ b/queue-3.9/of-base-release-the-node-correctly-in-of_parse_phandle_with_args.patch @@ -0,0 +1,39 @@ +From b855f16b05a697ac1863adabe99bfba56e6d3199 Mon Sep 17 00:00:00 2001 +From: Tang Yuantian +Date: Wed, 10 Apr 2013 11:36:39 +0800 +Subject: of/base: release the node correctly in of_parse_phandle_with_args() + +From: Tang Yuantian + +commit b855f16b05a697ac1863adabe99bfba56e6d3199 upstream. + +Call of_node_put() only when the out_args is NULL on success, +or the node's reference count will not be correct because the caller +will call of_node_put() again. + +Signed-off-by: Tang Yuantian +[grant.likely: tightened up the patch] +Signed-off-by: Grant Likely +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/of/base.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -1166,11 +1166,11 @@ static int __of_parse_phandle_with_args( + out_args->args_count = count; + for (i = 0; i < count; i++) + out_args->args[i] = be32_to_cpup(list++); ++ } else { ++ of_node_put(node); + } + + /* Found it! return success */ +- if (node) +- of_node_put(node); + return 0; + } + diff --git a/queue-3.9/series b/queue-3.9/series index 0eb05d4a4ee..988b1b0f7d6 100644 --- a/queue-3.9/series +++ b/queue-3.9/series @@ -19,3 +19,7 @@ crypto-algboss-hold-ref-count-on-larval.patch powerpc-eeh-fix-fetching-bus-for-single-dev-pe.patch ubifs-prepare-to-fix-a-horrid-bug.patch ubifs-fix-a-horrid-bug.patch +libata-acpi-add-back-acpi-based-hotplug-functionality.patch +of-base-release-the-node-correctly-in-of_parse_phandle_with_args.patch +can-usb_8dev-unregister-netdev-before-free-ing.patch +mac80211-work-around-broken-aps-not-including-ht-info.patch