summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-11-17ath9k: Fix LED configurationSujith Manoharan
On some x86 platforms, the LED gpio is active high instead of active low. Identify such cards and modify the GPIO usage to make sure LED works properly. Cc: Russell Hu <rhu@qca.qualcomm.com> Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17ath9k: Use new QCA953x initvalsMiaoqing Pan
This patch updates the initvals for QCA953x v1.1 and v2.0 Signed-off-by: Miaoqing Pan <miaoqing@qca.qualcomm.com> Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17ath9k: Update QCA953x initvalsSujith Manoharan
* Duplicates have been marked. * New initvals for 1.1 and 2.0 versions. * xPA support. * Fix for low power issue. Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17ath9k_htc: Enable software crypto for mgmt frame in Tx for USB devicesChun-Yeow Yeoh
In secured mesh, the unicast mgmt frame is encrypted using the same key that used for encrypting the unicast data frame. This patch "ath9k_htc_firmware: fix the offset of CCMP header for mesh data frame" applied to open-ath9k-htc-firmware allows the ath9k_htc to be loaded without "nohwcrypt=1". Unfortunately, this is not working and we still need CCMP encryption of transmitted management frames to be done in software. So this patch allows the software encryption for transmitted management frame to be done in software but remain the hardware decryption for received management frame. This patch is tested with the following hardwares: - TP-Link TL-WN821N v3 802.11n [Atheros AR7010+AR9287] - AR9271 802.11n and managed to work with peer mesh STA equipped with ath9k. Signed-off-by: Chun-Yeow Yeoh <yeohchunyeow@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17ath9k|ath9k_htc: Seperate the software crypto flag for Tx and RxChun-Yeow Yeoh
Use the sw_mgmt_crypto_tx flag to trigger the CCMP encryption for transmitted management frames to be done in software while the sw_mgmt_crypto_rx flag is used to trigger the CCMP decryption for received management frames to be done in software. Signed-off-by: Chun-Yeow Yeoh <yeohchunyeow@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17mwifiex: enable auto TDLS support for SD8887Avinash Patil
Auto TDLS support is enabled per device. As of now add this feature only for SD8887. Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17mwifiex: support for parsing TDLS discovery framesAvinash Patil
This patch adds support for parsing TDLS discovery frames. After parsing, we update peer RSSI information. Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17mwifiex: add auto TDLS supportAvinash Patil
This patch adds auto TDLS support to mwifiex. Auto TDLS functionality works as follows: 1. Whenever userspace application has triggered TDLS connection with any peer, driver would store this peer mac address details in its database. 2. After this driver whenever driver receives packet on direct link, it would store rssi and timestamp in peer information. 3. Whenever a packet is to be transmitted to non-AP peer in station mode, driver would check if TDLS link can be established by looking at peer RSSI information. Driver would initiate TDLS setup in such cases. 4. Periodic timer is used for updating peer information. 5. Auto TDLS peer list & timer are cleared during disconnection or driver unload. Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17mwifiex: wmm support for TDLS linkAvinash Patil
This patch adds WMM support for TDLS link. Patch add WMM info IE for TDLS setup request/response frames while WMM parameter for TDLS confirm frame. Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17mwifiex: do not explicitly disable TDLS link during teardownAvinash Patil
When Teardown event from FW is indicated to userspace, userspace would trigger tdls_oper handler to disable TDLS link. We need not do this explicitly here. Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17mwifiex: update rx packet descriptor structure to match FWAvinash Patil
RX packet descriptor structure has recently changed in FW. This patch updates rxpd accordingly. Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17ath9k: fix the assignment of hw queues for mesh interfaceChun-Yeow Yeoh
We need to assign the hw queues for mesh interface. Otherwise, we are not able to bring up the mesh interface due to the IEEE80211_INVAL_HW_QUEUE error. Signed-off-by: Chun-Yeow Yeoh <yeohchunyeow@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17ath9k: common-spectral: don't depend from ATH9K_DEBUGFSOleksij Rempel
we can have here two variants. Add ATH9K_CMN_DEBUGFS y if ATH9K_CMN_DEBUGFS || ATH9K_HTC_DEBUGFS wich will add more configurations and testcases. Or remove ATH9K_HTC_DEBUGFS which need more time to be done. So, make common-spectral ignore ATH9K_DEBUGFS option for now. Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17ath9k_htc: ath9k_htc_op_ps_wakeup() can be statickbuild test robot
drivers/net/wireless/ath/ath9k/htc_drv_init.c:56:6: sparse: symbol 'ath9k_htc_op_ps_wakeup' was not declared. Should it be static? drivers/net/wireless/ath/ath9k/htc_drv_init.c:61:6: sparse: symbol 'ath9k_htc_op_ps_restore' was not declared. Should it be static? drivers/net/wireless/ath/ath9k/htc_drv_init.c:66:19: sparse: symbol 'ath9k_htc_ps_ops' was not declared. Should it be static? Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17ath9k: ath9k_op_ps_wakeup() can be statickbuild test robot
drivers/net/wireless/ath/ath9k/init.c:91:6: sparse: symbol 'ath9k_op_ps_wakeup' was not declared. Should it be static? drivers/net/wireless/ath/ath9k/init.c:96:6: sparse: symbol 'ath9k_op_ps_restore' was not declared. Should it be static? drivers/net/wireless/ath/ath9k/init.c:101:19: sparse: symbol 'ath9k_ps_ops' was not declared. Should it be static? Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17mwifiex: module load parameter for interface creationAvinash Patil
This patch adds module load parameter driver_mode for mwifiex which would enable driver to create AP or P2P client interface while loading module. driver_mode is bitmap of interface modes for station, AP and P2P client. Station interface is created by default and is unaffected by driver_mode parameter. Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17ath9k: fix misc debugfs when not using chan contextBen Greear
When channel-context is not enabled, all vifs belong to the first context, but it is not configured as 'assigned'. Fix misc debugfs file to print out info for non-assigned contexts, and also print whether ctx is assigned or not. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17Merge branch 'for-linville' of git://github.com/kvalo/athJohn W. Linville
Kalle Valo <kvalo@qca.qualcomm.com> says: "One ath6kl patch and rest for ath10k, but nothing really major which stands out. Most notable: o fix resume (Bartosz) o firmware restart is now faster and more reliable (Michal) o it's now possible to test hardware restart functionality without crashing the firmware using hw-restart parameter with simulate_fw_crash debugfs file (Michal)" Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17brcmfmac: fix error handling of irq_of_parse_and_mapDmitry Torokhov
Return value of irq_of_parse_and_map() is unsigned int, with 0 indicating failure, so testing for negative result never works. Signed-off-by: Dmitry Torokhov <dtor@chromium.org> Cc: stable@vger.kernel.org # v3.17 Acked-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17brcmfmac: kill URB when request timed outMathy Vanhoef
Kill the submitted URB in brcmf_usb_dl_cmd if the request timed out. This assures the URB is never submitted twice. It also prevents a possible use-after-free of the URB transfer buffer if a timeout occurs. Signed-off-by: Mathy Vanhoef <vanhoefm@gmail.com> Acked-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17ath9k: fix regression in bssidmask calculationBen Greear
The commit that went into 3.17: ath9k: Summarize hw state per channel context Group and set hw state (opmode, primary_sta, beacon conf) per channel context instead of whole list of vifs. This would allow each channel context to run in different mode (STA/AP). Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> broke multi-vif configuration due to not properly calculating the bssid mask. The test case that caught this was: create wlan0 and sta0-4 (6 total), not sure how much that matters. associate all 6 (works fine) disconnect 5 of them, leaving sta0 up Start trying to bring up the other 5 one at a time. It will fail, with iw events looking like this (in these logs, several sta are trying to come up, but symptom is the same with just one) The patch causing the regression made quite a few changes, but the part I think caused this particular problem was not recalculating the bssid mask when adding and removing interfaces. Re-adding those calls fixes my test case. Fix bad comment as well. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-17clk: pxa: fix pxa27x CCCR bit usageRobert Jarzmik
Trivial fix to check the A bit of CCCR for memory frequency calculations, where the shift of the bit index was missing, triggering a wrong calculation of memory frequency. Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by: Michael Turquette <mturquette@linaro.org>
2014-11-17clk-divider: Fix READ_ONLY when divider > 1James Hogan
Commit 79c6ab509558 (clk: divider: add CLK_DIVIDER_READ_ONLY flag) in v3.16 introduced the CLK_DIVIDER_READ_ONLY flag which caused the recalc_rate() and round_rate() clock callbacks to be omitted. However using this flag has the unfortunate side effect of causing the clock recalculation code when a clock rate change is attempted to always treat it as a pass-through clock, i.e. with a fixed divide of 1, which may not be the case. Child clock rates are then recalculated using the wrong parent rate. Therefore instead of dropping the recalc_rate() and round_rate() callbacks, alter clk_divider_bestdiv() to always report the current divider as the best divider so that it is never altered. For me the read only clock was the system clock, which divided the PLL rate by 2, from which both the UART and the SPI clocks were divided. Initial setting of the UART rate set it correctly, but when the SPI clock was set, the other child clocks were miscalculated. The UART clock was recalculated using the PLL rate as the parent rate, resulting in a UART new_rate of double what it should be, and a UART which spewed forth garbage when the rate changes were propagated. Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Thomas Abraham <thomas.ab@samsung.com> Cc: Tomasz Figa <t.figa@samsung.com> Cc: Max Schwarz <max.schwarz@online.de> Cc: <stable@vger.kernel.org> # v3.16+ Acked-by: Haojian Zhuang <haojian.zhuang@gmail.com> Signed-off-by: Michael Turquette <mturquette@linaro.org>
2014-11-17clk: qcom: Fix duplicate rbcpr clock nameGeorgi Djakov
There is a duplication in a clock name for apq8084 platform that causes the following warning: "RBCPR_CLK_SRC" redefined Resolve this by adding a MMSS_ prefix to this clock and making its name coherent with msm8974 platform. Fixes: 2b46cd23a5a2 ("clk: qcom: Add APQ8084 Multimedia Clock Controller (MMCC) support") Signed-off-by: Georgi Djakov <gdjakov@mm-sol.com> Reviewed-by: Stephen Boyd <sboyd@codeaurora.org> Signed-off-by: Michael Turquette <mturquette@linaro.org>
2014-11-17clk: at91: usb: fix at91sam9x5 recalc, round and set rateBoris Brezillon
First check for rate == 0 in set_rate and round_rate to avoid div by zero. Then, in order to get the closest rate, round all divisions to the closest result instead of rounding them down. Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com> Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: Michael Turquette <mturquette@linaro.org>
2014-11-17clk: at91: usb: fix at91rm9200 round and set rateBoris Brezillon
at91rm9200_clk_usb_set_rate might fail depending on the requested rate, because the parent_rate / rate remainder is not necessarily zero. Moreover, when rounding down the calculated rate we might alter the divisor calculation and end up with an invalid divisor. To solve those problems, accept a non zero remainder, and always round division to the closest result. Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com> Reported-by: Andreas Henriksson <andreas.henriksson@endian.se> Tested-by: Andreas Henriksson <andreas.henriksson@endian.se> Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: Michael Turquette <mturquette@linaro.org>
2014-11-17Merge remote-tracking branches 'asoc/fix/rt5670', 'asoc/fix/samsung' and ↵Mark Brown
'asoc/fix/sgtl5000' into asoc-linus
2014-11-17Merge remote-tracking branches 'asoc/fix/adsp', 'asoc/fix/cs41l51', ↵Mark Brown
'asoc/fix/dpcm', 'asoc/fix/es8328', 'asoc/fix/fsl-asrc', 'asoc/fix/max98090', 'asoc/fix/rcar', 'asoc/fix/rockchip' and 'asoc/fix/rt5645' into asoc-linus
2014-11-17Merge remote-tracking branch 'asoc/fix/core' into asoc-linusMark Brown
2014-11-17ath10k: fix mismatched wmi api callPeter Oh
Fix to use v10.2 wmi call for firmware v10.2. It turned out that peer association function was using v10.1 wmi call for v10.2 firmware during code review. Signed-off-by: Peter Oh <poh@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2014-11-17ath10k: advertise support for AP mode channel width changesRajkumar Manoharan
This will enable AP mode to change channel width dynamically based on 20/40 intolerance report sent by associated client. Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2014-11-17ath10k: add modpram 'skip_otp' to ignore empty otp error during BMIRajkumar Manoharan
This patch would help bring up wifi interface with default board data in case of failures in otp download. It is useful for initial calibration. Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2014-11-17ath10k: handle ieee80211 header and payload tracing separatelyRajkumar Manoharan
For packet log, the transmitted frame 802.11 header alone is sufficient. Recording entire packet is also consuming lot of disk space. To optimize this, tx and rx data tracepoints are splitted into header and payload tracepoints. To record tx ieee80211 headers trace-cmd record -e ath10k_tx_hdr To record complete packets trace-cmd record -e ath10k_tx_hdr -e ath10k_tx_payload Cc: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2014-11-17net: can: c_can: Add support for TI am4372 DCANRoger Quadros
AM4372 SoC has 2 DCAN modules. Add compatible id and raminit driver data for it. The driver data is same as AM3352 but this gives us flexibility to add AM4372 specific quirks if required later. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2014-11-17ASoC: wm_adsp: Avoid attempt to free buffers that might still be in useCharles Keepax
We should not free any buffers associated with writing out coefficients to the DSP until all the async writes have completed. This patch updates the out of memory path when allocating a new buffer to include a call to regmap_async_complete. Reported-by: JS Park <aitdark.park@samsung.com> Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2014-11-17ALSA: usb-audio: Set the Control Selector to SU_SELECTOR_CONTROL for UAC2Johan Rastén
Specified in section 5.2.5.6.1 of the USB Audio Class 2.0 definition. Solves the following error for C-Media 6632A (Asus Xonar U7): [ 8219.676164] cannot get ctl value: req = 0x81, wValue = 0x0, wIndex = 0x1400, type = 3 Signed-off-by: Johan Rastén <johan@oljud.se> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-11-17netfilter: nf_conntrack_h323: lookup route from proper net namespaceVasily Averin
Signed-off-by: Vasily Averin <vvs@parallels.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-11-17netfilter: xt_connlimit: honor conntrack zone if availableFlorian Westphal
Currently all the conntrack lookups are done using default zone. In case the skb has a ct attached (e.g. template) we should use this zone for lookups instead. This makes connlimit work with connections assigned to other zones. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-11-17bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queriesLinus Lüssing
Ebtables on the OUTPUT chain (NF_BR_LOCAL_OUT) would not work as expected for both locally generated IGMP and MLD queries. The IP header specific filter options are off by 14 Bytes for netfilter (actual output on interfaces is fine). NF_HOOK() expects the skb->data to point to the IP header, not the ethernet one (while dev_queue_xmit() does not). Luckily there is an br_dev_queue_push_xmit() helper function already - let's just use that. Introduced by eb1d16414339a6e113d89e2cca2556005d7ce919 ("bridge: Add core IGMP snooping support") Ebtables example: $ ebtables -I OUTPUT -p IPv6 -o eth1 --logical-out br0 \ --log --log-level 6 --log-ip6 --log-prefix="~EBT: " -j DROP before (broken): ~EBT: IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \ MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \ SRC=64a4:39c2:86dd:6000:0000:0020:0001:fe80 IPv6 \ DST=0000:0000:0000:0004:64ff:fea4:39c2:ff02, \ IPv6 priority=0x3, Next Header=2 after (working): ~EBT: IN= OUT=eth1 MAC source = 02:04:64:a4:39:c2 \ MAC dest = 33:33:00:00:00:01 proto = 0x86dd IPv6 \ SRC=fe80:0000:0000:0000:0004:64ff:fea4:39c2 IPv6 \ DST=ff02:0000:0000:0000:0000:0000:0000:0001, \ IPv6 priority=0x0, Next Header=0 Signed-off-by: Linus Lüssing <linus.luessing@web.de> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-11-17can: c_can: Add support for TI am3352 DCANRoger Quadros
AM3352 SoC has 2 DCAN modules. Add compatible id and raminit driver data for am3352 DCAN. Signed-off-by: Roger Quadros <rogerq@ti.com> Acked-by: Wolfram Sang <wsa@the-dreams.de> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2014-11-17can: c_can: Add support for TI DRA7 DCANRoger Quadros
DRA7 SoC has 2 CAN IPs. Provide compatible IDs and RAMINIT register data for both. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2014-11-17can: c_can: Disable pins when CAN interface is downRoger Quadros
DRA7 CAN IP suffers from a problem which causes it to be prevented from fully turning OFF (i.e. stuck in transition) if the module was disabled while there was traffic on the CAN_RX line. To work around this issue we select the SLEEP pin state by default on probe and use the DEFAULT pin state on CAN up and back to the SLEEP pin state on CAN down. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2014-11-17can: c_can: Add support for START pulse in RAMINIT sequenceRoger Quadros
Some SoCs e.g. (TI DRA7xx) need a START pulse to start the RAMINIT sequence i.e. START bit must be set and cleared before checking for the DONE bit status. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2014-11-17can: c_can: Add syscon/regmap RAMINIT mechanismRoger Quadros
Some TI SoCs like DRA7 have a RAMINIT register specification different from the other AMxx SoCs and as expected by the existing driver. To add more insanity, this register is shared with other IPs like DSS, PCIe and PWM. Provides a more generic mechanism to specify the RAMINIT register location and START/DONE bit position and use the syscon/regmap framework to access the register. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2014-11-17can: c_can: Add RAMINIT register information to driver dataRoger Quadros
Some platforms (e.g. TI) need special RAMINIT register handling. Provide a way to store RAMINIT register description in driver data. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2014-11-17can: c_can: Introduce c_can_driver_data structureRoger Quadros
We want to have more data than just can_dev_id to be present in the driver data e.g. TI platforms need RAMINIT register description. Introduce the c_can_driver_data structure and move the can_dev_id into it. Tidy up the way it is used on probe(). Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2014-11-17can: c_can: Add timeout to c_can_hw_raminit_ti()Roger Quadros
TI's RAMINIT DONE mechanism is buggy on AM43xx SoC and may not always be set after the START bit is set. Although it seems to work fine even in that case. So add a timeout mechanism to c_can_hw_raminit_wait_ti(). Don't bail out in that failure case but just print an error message. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2014-11-17netfilter: nfnetlink: fix insufficient validation in nfnetlink_bindPablo Neira Ayuso
Make sure the netlink group exists, otherwise you can trigger an out of bound array memory access from the netlink_bind() path. This splat can only be triggered only by superuser. [ 180.203600] UBSan: Undefined behaviour in ../net/netfilter/nfnetlink.c:467:28 [ 180.204249] index 9 is out of range for type 'int [9]' [ 180.204697] CPU: 0 PID: 1771 Comm: trinity-main Not tainted 3.18.0-rc4-mm1+ #122 [ 180.205365] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org +04/01/2014 [ 180.206498] 0000000000000018 0000000000000000 0000000000000009 ffff88007bdf7da8 [ 180.207220] ffffffff82b0ef5f 0000000000000092 ffffffff845ae2e0 ffff88007bdf7db8 [ 180.207887] ffffffff8199e489 ffff88007bdf7e18 ffffffff8199ea22 0000003900000000 [ 180.208639] Call Trace: [ 180.208857] dump_stack (lib/dump_stack.c:52) [ 180.209370] ubsan_epilogue (lib/ubsan.c:174) [ 180.209849] __ubsan_handle_out_of_bounds (lib/ubsan.c:400) [ 180.210512] nfnetlink_bind (net/netfilter/nfnetlink.c:467) [ 180.210986] netlink_bind (net/netlink/af_netlink.c:1483) [ 180.211495] SYSC_bind (net/socket.c:1541) Moreover, define the missing nf_tables and nf_acct multicast groups too. Reported-by: Andrey Ryabinin <a.ryabinin@samsung.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-11-17spi: Fix mapping from vmalloc-ed buffer to scatter listCharles Keepax
We can only use page_address on memory that has been mapped using kmap, when the buffer passed to the SPI has been allocated by vmalloc the page has not necessarily been mapped through kmap. This means sometimes page_address will return NULL causing the pointer we pass to sg_set_buf to be invalid. As we only call page_address so that we can pass a virtual address to sg_set_buf which will then immediately call virt_to_page on it, fix this by calling sg_set_page directly rather then relying on the sg_set_buf helper. Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2014-11-17ieee802154: fix byteorder for short address and panidAlexander Aring
This patch changes the byteorder handling for short and panid handling. We now except to get little endian in nl802154 for these attributes. Signed-off-by: Alexander Aring <alex.aring@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>