From f0b7aa6d95e1d11d5b9ef72fa3475eb97a1ceb1b Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 18 Feb 2010 09:46:14 -0800 Subject: [PATCH] more .32 patches --- ...-fix-sequence-numbers-for-pae-frames.patch | 44 ++++++++ ...rspace-fix-overhead_size-calcuations.patch | 67 ++++++++++++ ...m-mpath-fix-stall-when-requeueing-io.patch | 100 ++++++++++++++++++ ...de-by-zero-with-invalid-stripe-count.patch | 38 +++++++ ...-fix-to-set-correct-ht-configuration.patch | 36 +++++++ ...probe-request-filtering-in-ibss-mode.patch | 33 ++++++ queue-2.6.32/series | 6 ++ 7 files changed, 324 insertions(+) create mode 100644 queue-2.6.32/ath9k-fix-sequence-numbers-for-pae-frames.patch create mode 100644 queue-2.6.32/dm-log-userspace-fix-overhead_size-calcuations.patch create mode 100644 queue-2.6.32/dm-mpath-fix-stall-when-requeueing-io.patch create mode 100644 queue-2.6.32/dm-stripe-avoid-divide-by-zero-with-invalid-stripe-count.patch create mode 100644 queue-2.6.32/iwlwifi-fix-to-set-correct-ht-configuration.patch create mode 100644 queue-2.6.32/mac80211-fix-probe-request-filtering-in-ibss-mode.patch diff --git a/queue-2.6.32/ath9k-fix-sequence-numbers-for-pae-frames.patch b/queue-2.6.32/ath9k-fix-sequence-numbers-for-pae-frames.patch new file mode 100644 index 00000000000..111410f211a --- /dev/null +++ b/queue-2.6.32/ath9k-fix-sequence-numbers-for-pae-frames.patch @@ -0,0 +1,44 @@ +From 6c8afef551fef87a3bf24f8a74c69a7f2f72fc82 Mon Sep 17 00:00:00 2001 +From: Sujith +Date: Tue, 9 Feb 2010 10:07:00 +0530 +Subject: ath9k: Fix sequence numbers for PAE frames + +From: Sujith + +commit 6c8afef551fef87a3bf24f8a74c69a7f2f72fc82 upstream. + +Currently, PAE frames are not assigned proper sequence numbers. +Since sending PAE frames as part of aggregates breaks +crupto with several APs, they are sent as normal MPDUs. +Fix the seqeuence number issue by updating the frame with the +internal sequence number. + +Tested-by: Felix Fietkau +Signed-off-by: Sujith +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -1563,7 +1563,7 @@ static int ath_tx_setup_buffer(struct ie + + bf->bf_frmlen = skb->len + FCS_LEN - (hdrlen & 3); + +- if (conf_is_ht(&sc->hw->conf) && !is_pae(skb)) ++ if (conf_is_ht(&sc->hw->conf)) + bf->bf_state.bf_type |= BUF_HT; + + bf->bf_flags = setup_tx_flags(sc, skb, txctl->txq); +@@ -1648,7 +1648,7 @@ static void ath_tx_start_dma(struct ath_ + goto tx_done; + } + +- if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) { ++ if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) { + /* + * Try aggregation if it's a unicast data frame + * and the destination is HT capable. diff --git a/queue-2.6.32/dm-log-userspace-fix-overhead_size-calcuations.patch b/queue-2.6.32/dm-log-userspace-fix-overhead_size-calcuations.patch new file mode 100644 index 00000000000..d2415ef5797 --- /dev/null +++ b/queue-2.6.32/dm-log-userspace-fix-overhead_size-calcuations.patch @@ -0,0 +1,67 @@ +From ebfd32bba9b518d684009d9d21a56742337ca1b3 Mon Sep 17 00:00:00 2001 +From: Jonathan Brassow +Date: Tue, 16 Feb 2010 18:42:53 +0000 +Subject: dm log: userspace fix overhead_size calcuations + +From: Jonathan Brassow + +commit ebfd32bba9b518d684009d9d21a56742337ca1b3 upstream. + +This patch fixes two bugs that revolve around the miscalculation and +misuse of the variable 'overhead_size'. 'overhead_size' is the size of +the various header structures used during communication. + +The first bug is the use of 'sizeof' with the pointer of a structure +instead of the structure itself - resulting in the wrong size being +computed. This is then used in a check to see if the payload +(data_size) would be to large for the preallocated structure. Since the +bug produces a smaller value for the overhead, it was possible for the +structure to be breached. (Although the current users of the code do +not currently send enough data to trigger this bug.) + +The second bug is that the 'overhead_size' value is used to compute how +much of the preallocated space should be cleared before populating it +with fresh data. This should have simply been 'sizeof(struct cn_msg)' +not overhead_size. The fact that 'overhead_size' was computed +incorrectly made this problem "less bad" - leaving only a pointer's +worth of space at the end uncleared. Thus, this bug was never producing +a bad result, but still needs to be fixed - especially now that the +value is computed correctly. + +Signed-off-by: Jonathan Brassow +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-log-userspace-transfer.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/md/dm-log-userspace-transfer.c ++++ b/drivers/md/dm-log-userspace-transfer.c +@@ -172,11 +172,15 @@ int dm_consult_userspace(const char *uui + { + int r = 0; + size_t dummy = 0; +- int overhead_size = +- sizeof(struct dm_ulog_request *) + sizeof(struct cn_msg); ++ int overhead_size = sizeof(struct dm_ulog_request) + sizeof(struct cn_msg); + struct dm_ulog_request *tfr = prealloced_ulog_tfr; + struct receiving_pkg pkg; + ++ /* ++ * Given the space needed to hold the 'struct cn_msg' and ++ * 'struct dm_ulog_request' - do we have enough payload ++ * space remaining? ++ */ + if (data_size > (DM_ULOG_PREALLOCED_SIZE - overhead_size)) { + DMINFO("Size of tfr exceeds preallocated size"); + return -EINVAL; +@@ -191,7 +195,7 @@ resend: + */ + mutex_lock(&dm_ulog_lock); + +- memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size); ++ memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - sizeof(struct cn_msg)); + memcpy(tfr->uuid, uuid, DM_UUID_LEN); + tfr->luid = luid; + tfr->seq = dm_ulog_seq++; diff --git a/queue-2.6.32/dm-mpath-fix-stall-when-requeueing-io.patch b/queue-2.6.32/dm-mpath-fix-stall-when-requeueing-io.patch new file mode 100644 index 00000000000..c6e29092cff --- /dev/null +++ b/queue-2.6.32/dm-mpath-fix-stall-when-requeueing-io.patch @@ -0,0 +1,100 @@ +From 9eef87da2a8ea4920e0d913ff977cac064b68ee0 Mon Sep 17 00:00:00 2001 +From: Kiyoshi Ueda +Date: Tue, 16 Feb 2010 18:43:01 +0000 +Subject: dm mpath: fix stall when requeueing io + +From: Kiyoshi Ueda + +commit 9eef87da2a8ea4920e0d913ff977cac064b68ee0 upstream. + +This patch fixes the problem that system may stall if target's ->map_rq +returns DM_MAPIO_REQUEUE in map_request(). +E.g. stall happens on 1 CPU box when a dm-mpath device with queue_if_no_path + bounces between all-paths-down and paths-up on I/O load. + +When target's ->map_rq returns DM_MAPIO_REQUEUE, map_request() requeues +the request and returns to dm_request_fn(). Then, dm_request_fn() +doesn't exit the I/O dispatching loop and continues processing +the requeued request again. +This map and requeue loop can be done with interrupt disabled, +so 1 CPU system can be stalled if this situation happens. + +For example, commands below can stall my 1 CPU box within 1 minute or so: + # dmsetup table mp + mp: 0 2097152 multipath 1 queue_if_no_path 0 1 1 service-time 0 1 2 8:144 1 1 + # while true; do dd if=/dev/mapper/mp of=/dev/null bs=1M count=100; done & + # while true; do \ + > dmsetup message mp 0 "fail_path 8:144" \ + > dmsetup suspend --noflush mp \ + > dmsetup resume mp \ + > dmsetup message mp 0 "reinstate_path 8:144" \ + > done + +To fix the problem above, this patch changes dm_request_fn() to exit +the I/O dispatching loop once if a request is requeued in map_request(). + +Signed-off-by: Kiyoshi Ueda +Signed-off-by: Jun'ichi Nomura +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1487,10 +1487,15 @@ static int dm_prep_fn(struct request_que + return BLKPREP_OK; + } + +-static void map_request(struct dm_target *ti, struct request *rq, +- struct mapped_device *md) ++/* ++ * Returns: ++ * 0 : the request has been processed (not requeued) ++ * !0 : the request has been requeued ++ */ ++static int map_request(struct dm_target *ti, struct request *clone, ++ struct mapped_device *md) + { +- int r; ++ int r, requeued = 0; + struct request *clone = rq->special; + struct dm_rq_target_io *tio = clone->end_io_data; + +@@ -1516,6 +1521,7 @@ static void map_request(struct dm_target + case DM_MAPIO_REQUEUE: + /* The target wants to requeue the I/O */ + dm_requeue_unmapped_request(clone); ++ requeued = 1; + break; + default: + if (r > 0) { +@@ -1527,6 +1533,8 @@ static void map_request(struct dm_target + dm_kill_unmapped_request(clone, r); + break; + } ++ ++ return requeued; + } + + /* +@@ -1568,12 +1576,16 @@ static void dm_request_fn(struct request + + blk_start_request(rq); + spin_unlock(q->queue_lock); +- map_request(ti, rq, md); ++ if (map_request(ti, clone, md)) ++ goto requeued; + spin_lock_irq(q->queue_lock); + } + + goto out; + ++requeued: ++ spin_lock_irq(q->queue_lock); ++ + plug_and_out: + if (!elv_queue_empty(q)) + /* Some requests still remain, retry later */ diff --git a/queue-2.6.32/dm-stripe-avoid-divide-by-zero-with-invalid-stripe-count.patch b/queue-2.6.32/dm-stripe-avoid-divide-by-zero-with-invalid-stripe-count.patch new file mode 100644 index 00000000000..a6f003f408b --- /dev/null +++ b/queue-2.6.32/dm-stripe-avoid-divide-by-zero-with-invalid-stripe-count.patch @@ -0,0 +1,38 @@ +From 781248c1b50c776a9ef4be1130f84ced1cba42fe Mon Sep 17 00:00:00 2001 +From: Nikanth Karthikesan +Date: Tue, 16 Feb 2010 18:42:47 +0000 +Subject: dm stripe: avoid divide by zero with invalid stripe count + +From: Nikanth Karthikesan + +commit 781248c1b50c776a9ef4be1130f84ced1cba42fe upstream. + +If a table containing zero as stripe count is passed into stripe_ctr +the code attempts to divide by zero. + +This patch changes DM_TABLE_LOAD to return -EINVAL if the stripe count +is zero. + +We now get the following error messages: + device-mapper: table: 253:0: striped: Invalid stripe count + device-mapper: ioctl: error adding target to table + +Signed-off-by: Nikanth Karthikesan +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-stripe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-stripe.c ++++ b/drivers/md/dm-stripe.c +@@ -110,7 +110,7 @@ static int stripe_ctr(struct dm_target * + } + + stripes = simple_strtoul(argv[0], &end, 10); +- if (*end) { ++ if (!stripes || *end) { + ti->error = "Invalid stripe count"; + return -EINVAL; + } diff --git a/queue-2.6.32/iwlwifi-fix-to-set-correct-ht-configuration.patch b/queue-2.6.32/iwlwifi-fix-to-set-correct-ht-configuration.patch new file mode 100644 index 00000000000..3b14f7630b2 --- /dev/null +++ b/queue-2.6.32/iwlwifi-fix-to-set-correct-ht-configuration.patch @@ -0,0 +1,36 @@ +From 098dfded5b1b09927995e89c6d689f85a0f53384 Mon Sep 17 00:00:00 2001 +From: Wey-Yi Guy +Date: Fri, 5 Feb 2010 11:40:00 -0800 +Subject: iwlwifi: Fix to set correct ht configuration + +From: Wey-Yi Guy + +commit 098dfded5b1b09927995e89c6d689f85a0f53384 upstream. + +iwl_set_rxon_ht() only get called in iwl_post_associate(); which cause +possible incorrect ht configuration. Adding the call in iwl_mac_config() if +IEEE80211_CONF_CHANGE_CHANNEL flag is set to re-configure and send rxon +command. + +Fixes +http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2146 + +Signed-off-by: Wey-Yi Guy +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/iwlwifi/iwl-core.c ++++ b/drivers/net/wireless/iwlwifi/iwl-core.c +@@ -2645,6 +2645,7 @@ int iwl_mac_config(struct ieee80211_hw * + if ((le16_to_cpu(priv->staging_rxon.channel) != ch)) + priv->staging_rxon.flags = 0; + ++ iwl_set_rxon_ht(priv, ht_conf); + iwl_set_rxon_channel(priv, conf->channel); + + iwl_set_flags_for_band(priv, conf->channel->band); diff --git a/queue-2.6.32/mac80211-fix-probe-request-filtering-in-ibss-mode.patch b/queue-2.6.32/mac80211-fix-probe-request-filtering-in-ibss-mode.patch new file mode 100644 index 00000000000..d5315741ddd --- /dev/null +++ b/queue-2.6.32/mac80211-fix-probe-request-filtering-in-ibss-mode.patch @@ -0,0 +1,33 @@ +From 0da780c269957783d341fc3559e6b4c9912af7b4 Mon Sep 17 00:00:00 2001 +From: Benoit Papillault +Date: Fri, 5 Feb 2010 01:21:03 +0100 +Subject: mac80211: Fix probe request filtering in IBSS mode + +From: Benoit Papillault + +commit 0da780c269957783d341fc3559e6b4c9912af7b4 upstream. + +We only reply to probe request if either the requested SSID is the +broadcast SSID or if the requested SSID matches our own SSID. This +latter case was not properly handled since we were replying to different +SSID with the same length as our own SSID. + +Signed-off-by: Benoit Papillault +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/ibss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -643,7 +643,7 @@ static void ieee80211_rx_mgmt_probe_req( + } + if (pos[1] != 0 && + (pos[1] != ifibss->ssid_len || +- !memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) { ++ memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) { + /* Ignore ProbeReq for foreign SSID */ + return; + } diff --git a/queue-2.6.32/series b/queue-2.6.32/series index f3b7a218077..08008eb9cf3 100644 --- a/queue-2.6.32/series +++ b/queue-2.6.32/series @@ -87,3 +87,9 @@ drm-radeon-kms-use-udelay-for-short-delays.patch nfs-too-many-getattr-and-access-calls-after-direct-i-o.patch ecryptfs-add-getattr-function.patch b43-fix-throughput-regression.patch +ath9k-fix-sequence-numbers-for-pae-frames.patch +mac80211-fix-probe-request-filtering-in-ibss-mode.patch +iwlwifi-fix-to-set-correct-ht-configuration.patch +dm-stripe-avoid-divide-by-zero-with-invalid-stripe-count.patch +dm-log-userspace-fix-overhead_size-calcuations.patch +dm-mpath-fix-stall-when-requeueing-io.patch -- 2.47.3