1. 28 May, 2015 5 commits
  2. 26 May, 2015 3 commits
  3. 21 May, 2015 6 commits
    • Eliad Peller's avatar
      iwlwifi: mvm: avoid use-after-free on iwl_mvm_d0i3_enable_tx() · 29220891
      Eliad Peller authored
      qos_seq points (to a struct) inside the command response data.
      
      Make sure to free the response only after qos_seq is not
      needed anymore.
      Reported-by: default avatarHeng Luo <heng.luo@intel.com>
      Signed-off-by: default avatarEliad Peller <eliadx.peller@intel.com>
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      29220891
    • Luciano Coelho's avatar
      iwlwifi: mvm: clean net-detect info if device was reset during suspend · a500e469
      Luciano Coelho authored
      If the device is reset during suspend with net-detect enabled, we
      leave the net-detect information dangling and this causes the next
      suspend to fail with a warning:
      
      [21795.351010] WARNING: at /root/iwlwifi/iwlwifi-stack-dev/drivers/net/wireless/iwlwifi/mvm/d3.c:989 __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]()
      [21795.353253] Modules linked in: iwlmvm(O) iwlwifi(O) mac80211(O) cfg80211(O) compat(O) [...]
      [21795.366168] CPU: 1 PID: 3645 Comm: bash Tainted: G           O 3.10.29-dev #1
      [21795.368785] Hardware name: Dell Inc. Latitude E6430/0CPWYR, BIOS A09 12/13/2012
      [21795.371441]  f8ec6748 f8ec6748 e51f3ce8 c168aa62 e51f3d10 c103a824 c1871238 f8ec6748
      [21795.374228]  000003dd f8eb982e f8eb982e 00000000 c3408ed4 c41edbbc e51f3d20 c103a862
      [21795.377006]  00000009 00000000 e51f3da8 f8eb982e c41ee3dc 00000004 e7970000 e51f3d74
      [21795.379792] Call Trace:
      [21795.382461]  [<c168aa62>] dump_stack+0x16/0x18
      [21795.385133]  [<c103a824>] warn_slowpath_common+0x64/0x80
      [21795.387803]  [<f8eb982e>] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
      [21795.390485]  [<f8eb982e>] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
      [21795.393124]  [<c103a862>] warn_slowpath_null+0x22/0x30
      [21795.395787]  [<f8eb982e>] __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
      [21795.398464]  [<f8eb9d7c>] iwl_mvm_suspend+0xec/0x140 [iwlmvm]
      [21795.401127]  [<c104be11>] ? del_timer_sync+0xa1/0xc0
      [21795.403800]  [<f8d4107e>] __ieee80211_suspend+0x1de/0xff0 [mac80211]
      [21795.406459]  [<c168e43d>] ? mutex_lock_nested+0x25d/0x350
      [21795.409084]  [<c1586b64>] ? rtnl_lock+0x14/0x20
      [21795.411685]  [<f8cf0076>] ieee80211_suspend+0x16/0x20 [mac80211]
      [21795.414318]  [<f8c4e014>] wiphy_suspend+0x74/0x710 [cfg80211]
      [21795.416916]  [<c141e612>] __device_suspend+0x1e2/0x220
      [21795.419521]  [<f8c4dfa0>] ? addresses_show+0xa0/0xa0 [cfg80211]
      [21795.422097]  [<c141f997>] dpm_suspend+0x67/0x210
      [21795.424661]  [<c141fd6f>] dpm_suspend_start+0x4f/0x60
      [21795.427219]  [<c108d8e0>] suspend_devices_and_enter+0x60/0x480
      [21795.429768]  [<c168646a>] ? printk+0x4d/0x4f
      [21795.432295]  [<c108de76>] pm_suspend+0x176/0x210
      [21795.434830]  [<c108ca5d>] state_store+0x5d/0xb0
      [21795.437410]  [<c108ca00>] ? wakeup_count_show+0x50/0x50
      [21795.439961]  [<c13208db>] kobj_attr_store+0x1b/0x30
      [21795.442514]  [<c11e3a4b>] sysfs_write_file+0xab/0x100
      [21795.445088]  [<c11e39a0>] ? sysfs_poll+0xa0/0xa0
      [21795.447659]  [<c1179655>] vfs_write+0xa5/0x1c0
      [21795.450212]  [<c1179af7>] SyS_write+0x57/0xa0
      [21795.452699]  [<c1699ec1>] sysenter_do_call+0x12/0x32
      [21795.455146] ---[ end trace faf5321baba2bfdb ]---
      
      To fix this, call the iwl_mvm_free_nd() function in case of any error
      during resume.  Additionally, rename the "out_unlock" label to err to
      make it clearer that it's only called in error conditions.
      
      Cc: stable@vger.kernel.org [3.19+]
      Signed-off-by: default avatarLuciano Coelho <luciano.coelho@intel.com>
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      a500e469
    • Luciano Coelho's avatar
      iwlwifi: mvm: take the UCODE_DOWN reference when resuming · dcfc7fb1
      Luciano Coelho authored
      The __iwl_mvm_resume() function always returns 1, which causes
      mac80211 to do a reconfig with IEEE80211_RECONFIG_TYPE_RESTART.  This
      type of reconfig calls iwl_mvm_restart_complete(), where we unref the
      IWL_MVM_REF_UCODE_DOWN, so we should always take the reference in this
      case.
      
      This prevents this kind of warning from happening:
      
      [40026.103025] WARNING: at /root/iwlwifi/iwlwifi-stack-dev/drivers/net/wireless/iwlwifi/mvm/mac80211.c:236 iwl_mvm_unref+0xc9/0xd0 [iwlmvm]()
      [40026.105145] Modules linked in: iwlmvm(O) iwlwifi(O) mac80211(O) cfg80211(O) compat(O) ctr ccm arc4 autofs4 snd_hda_codec_hdmi snd_hda_codec_idt joydev coretemp kvm_intel kvm aesni_intel ablk_helper cryptd lrw aes_i586 snd_hda_intel xts snd_hda_codec gf128mul snd_hwdep snd_pcm snd_seq_midi dell_wmi snd_rawmidi sparse_keymap snd_seq_midi_event snd_seq uvcvideo dell_laptop videobuf2_core dcdbas microcode videodev psmouse snd_timer videobuf2_vmalloc videobuf2_memops serio_raw snd_seq_device btusb i915 snd bluetooth lpc_ich drm_kms_helper soundcore snd_page_alloc drm i2c_algo_bit wmi parport_pc ppdev video binfmt_misc rpcsec_gss_krb5 nfsd mac_hid nfs_acl nfsv4 auth_rpcgss nfs fscache lockd sunrpc msdos lp parport sdhci_pci sdhci ahci libahci e1000e mmc_core ptp pps_core [last unloaded: compat]
      [40026.117640] CPU: 2 PID: 3827 Comm: bash Tainted: G        W  O 3.10.29-dev #1
      [40026.120216] Hardware name: Dell Inc. Latitude E6430/0CPWYR, BIOS A09 12/13/2012
      [40026.122815]  f8effd18 f8effd18 e740fd18 c168aa62 e740fd40 c103a824 c1871238 f8effd18
      [40026.125527]  000000ec f8ec79c9 f8ec79c9 d5d29ba4 d5d2a20c 00000000 e740fd50 c103a862
      [40026.128209]  00000009 00000000 e740fd7c f8ec79c9 f1c591c4 00000400 00000000 f8efb490
      [40026.130886] Call Trace:
      [40026.133506]  [<c168aa62>] dump_stack+0x16/0x18
      [40026.136115]  [<c103a824>] warn_slowpath_common+0x64/0x80
      [40026.138727]  [<f8ec79c9>] ? iwl_mvm_unref+0xc9/0xd0 [iwlmvm]
      [40026.141319]  [<f8ec79c9>] ? iwl_mvm_unref+0xc9/0xd0 [iwlmvm]
      [40026.143881]  [<c103a862>] warn_slowpath_null+0x22/0x30
      [40026.146453]  [<f8ec79c9>] iwl_mvm_unref+0xc9/0xd0 [iwlmvm]
      [40026.149030]  [<f8ec7a4d>] iwl_mvm_mac_reconfig_complete+0x7d/0x210 [iwlmvm]
      [40026.151645]  [<f8b74b20>] ? ftrace_raw_event_drv_reconfig_complete+0xc0/0xe0 [mac80211]
      [40026.154291]  [<f8b6769e>] ieee80211_reconfig+0x28e/0x2620 [mac80211]
      [40026.156920]  [<c10ef0ea>] ? ring_buffer_unlock_commit+0xba/0x100
      [40026.159585]  [<f8b4a04d>] ieee80211_resume+0x6d/0x80 [mac80211]
      [40026.162206]  [<f8a79722>] wiphy_resume+0x72/0x260 [cfg80211]
      [40026.164799]  [<c141e2e7>] ? device_resume+0x57/0x150
      [40026.167425]  [<f8a796b0>] ? wiphy_suspend+0x710/0x710 [cfg80211]
      [40026.170075]  [<c141e26e>] dpm_run_callback+0x2e/0x50
      [40026.172695]  [<c141e321>] device_resume+0x91/0x150
      [40026.175334]  [<c141f636>] dpm_resume+0xf6/0x200
      [40026.177922]  [<c141f920>] dpm_resume_end+0x10/0x20
      [40026.180489]  [<c108d9f7>] suspend_devices_and_enter+0x177/0x480
      [40026.183037]  [<c168646a>] ? printk+0x4d/0x4f
      [40026.185559]  [<c108de76>] pm_suspend+0x176/0x210
      [40026.188065]  [<c108ca5d>] state_store+0x5d/0xb0
      [40026.190581]  [<c108ca00>] ? wakeup_count_show+0x50/0x50
      [40026.193052]  [<c13208db>] kobj_attr_store+0x1b/0x30
      [40026.195608]  [<c11e3a4b>] sysfs_write_file+0xab/0x100
      [40026.198055]  [<c11e39a0>] ? sysfs_poll+0xa0/0xa0
      [40026.200469]  [<c1179655>] vfs_write+0xa5/0x1c0
      [40026.202893]  [<c1179af7>] SyS_write+0x57/0xa0
      [40026.205245]  [<c1699ec1>] sysenter_do_call+0x12/0x32
      [40026.207619] ---[ end trace db1d5a72a0381b0a ]---
      Signed-off-by: default avatarLuciano Coelho <luciano.coelho@intel.com>
      Reviewed-by: default avatarEliadX Peller <eliad@wizery.com>
      Reviewed-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      dcfc7fb1
    • Emmanuel Grumbach's avatar
      iwlwifi: mvm: BT Coex - duplicate the command if sent ASYNC · 165b3c4f
      Emmanuel Grumbach authored
      There are buses that can't handle ASYNC command without
      copying them. Duplicate the host command instead.
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      165b3c4f
    • Liad Kaufman's avatar
      iwlwifi: nvm: force mac from otp in case nvm mac is reserved · 18f84673
      Liad Kaufman authored
      Take the MAC address from the OTP even if one is present in
      the NVM, if that MAC address happens to be a reserved one.
      Signed-off-by: default avatarLiad Kaufman <liad.kaufman@intel.com>
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      18f84673
    • Haim Dreyfuss's avatar
      iwlwifi: mvm: Free fw_status after use to avoid memory leak · 2fc863a5
      Haim Dreyfuss authored
      fw_status is the only pointer pointing to a block of memory
      allocated above and should be freed after use.
      Note: this come from Klockwork static analyzer.
      
      Cc: stable@vger.kernel.org [3.19+]
      Fixes: 2021a89d ("iwlwifi: mvm: treat netdetect wake up separately")
      Signed-off-by: default avatarHaim Dreyfuss <haim.dreyfuss@intel.com>
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      2fc863a5
  4. 15 May, 2015 3 commits
  5. 10 May, 2015 1 commit
  6. 03 May, 2015 1 commit
  7. 29 Apr, 2015 21 commits