diff --git a/bcma-Fix-mem-leak-in-bcma_bus_scan.patch b/bcma-Fix-mem-leak-in-bcma_bus_scan.patch new file mode 100644 index 000000000..d888e8c8b --- /dev/null +++ b/bcma-Fix-mem-leak-in-bcma_bus_scan.patch @@ -0,0 +1,51 @@ +From f9721ed2707661af75a414d09cdcd71f99a13f62 Mon Sep 17 00:00:00 2001 +From: Jesper Juhl +Date: Sun, 29 Jan 2012 21:34:04 +0100 +Subject: [PATCH] bcma: Fix mem leak in bcma_bus_scan() + +bcma_bus_scan() leaks 'struct bcma_device' bytes if +bcma_get_next_core() returns error. + +Restructure the code so we always kfree() the memory we allocate to +the variable 'core' before it goes out of scope. + +Signed-off-by: Jesper Juhl +Signed-off-by: John W. Linville +--- + drivers/bcma/scan.c | 19 +++++++++++-------- + 1 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c +index cad9948..3a2f672 100644 +--- a/drivers/bcma/scan.c ++++ b/drivers/bcma/scan.c +@@ -399,15 +399,18 @@ int bcma_bus_scan(struct bcma_bus *bus) + core->bus = bus; + + err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core); +- if (err == -ENODEV) { +- core_num++; +- continue; +- } else if (err == -ENXIO) +- continue; +- else if (err == -ESPIPE) +- break; +- else if (err < 0) ++ if (err < 0) { ++ kfree(core); ++ if (err == -ENODEV) { ++ core_num++; ++ continue; ++ } else if (err == -ENXIO) { ++ continue; ++ } else if (err == -ESPIPE) { ++ break; ++ } + return err; ++ } + + core->core_index = core_num++; + bus->nr_cores++; +-- +1.7.4.4 + diff --git a/iwlwifi-make-Tx-aggregation-enabled-on-ra-be-at-DEBU.patch b/iwlwifi-make-Tx-aggregation-enabled-on-ra-be-at-DEBU.patch new file mode 100644 index 000000000..0537e8133 --- /dev/null +++ b/iwlwifi-make-Tx-aggregation-enabled-on-ra-be-at-DEBU.patch @@ -0,0 +1,30 @@ +From 5fb8c182d26472ea24cbbadb6a3e355d7621cca4 Mon Sep 17 00:00:00 2001 +From: John W. Linville +Date: Tue, 31 Jan 2012 14:40:49 -0500 +Subject: [PATCH] iwlwifi: make "Tx aggregation enabled on ra =" be at DEBUG + level + +Average users either don't care or they think that message indicates a +problem... + +Signed-off-by: John W. Linville +--- + drivers/net/wireless/iwlwifi/iwl-agn-tx.c | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c +index c664c27..339e8d9 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c +@@ -620,7 +620,7 @@ int iwlagn_tx_agg_oper(struct iwl_priv *priv, struct ieee80211_vif *vif, + sta_priv->lq_sta.lq.agg_params.agg_frame_cnt_limit = + sta_priv->max_agg_bufsize; + +- IWL_INFO(priv, "Tx aggregation enabled on ra = %pM tid = %d\n", ++ IWL_DEBUG_HT(priv, "Tx aggregation enabled on ra = %pM tid = %d\n", + sta->addr, tid); + + return iwl_send_lq_cmd(priv, ctx, +-- +1.7.4.4 + diff --git a/kernel.spec b/kernel.spec index 31ad2d3ef..96d222af6 100644 --- a/kernel.spec +++ b/kernel.spec @@ -815,9 +815,14 @@ Patch50105: b43-add-option-to-avoid-duplicating-device-support-w.patch Patch50106: mac80211-update-oper_channel-on-ibss-join.patch Patch50107: mac80211-set-bss_conf.idle-when-vif-is-connected.patch Patch50108: iwlwifi-fix-PCI-E-transport-inta-race.patch +Patch50109: bcma-Fix-mem-leak-in-bcma_bus_scan.patch +Patch50110: rt2800lib-fix-wrong-128dBm-when-signal-is-stronger-t.patch +Patch50111: iwlwifi-make-Tx-aggregation-enabled-on-ra-be-at-DEBU.patch +Patch50112: ssb-fix-cardbus-slot-in-hostmode.patch +Patch50113: iwlwifi-don-t-mess-up-QoS-counters-with-non-QoS-fram.patch +Patch50114: mac80211-timeout-a-single-frame-in-the-rx-reorder-bu.patch Patch50200: ath9k-use-WARN_ON_ONCE-in-ath_rc_get_highest_rix.patch -Patch50201: iwlwifi-don-t-mess-up-QoS-counters-with-non-QoS-fram.patch %endif @@ -1575,10 +1580,15 @@ ApplyPatch b43-add-option-to-avoid-duplicating-device-support-w.patch ApplyPatch mac80211-update-oper_channel-on-ibss-join.patch ApplyPatch mac80211-set-bss_conf.idle-when-vif-is-connected.patch ApplyPatch iwlwifi-fix-PCI-E-transport-inta-race.patch +ApplyPatch bcma-Fix-mem-leak-in-bcma_bus_scan.patch +ApplyPatch rt2800lib-fix-wrong-128dBm-when-signal-is-stronger-t.patch +ApplyPatch iwlwifi-make-Tx-aggregation-enabled-on-ra-be-at-DEBU.patch +ApplyPatch ssb-fix-cardbus-slot-in-hostmode.patch +ApplyPatch iwlwifi-don-t-mess-up-QoS-counters-with-non-QoS-fram.patch +ApplyPatch mac80211-timeout-a-single-frame-in-the-rx-reorder-bu.patch ApplyPatch ath9k-use-WARN_ON_ONCE-in-ath_rc_get_highest_rix.patch -ApplyPatch iwlwifi-don-t-mess-up-QoS-counters-with-non-QoS-fram.patch ApplyPatch rt2x00_fix_MCU_request_failures.patch cd .. @@ -2286,6 +2296,13 @@ fi # and build. %changelog +* Fri Feb 3 2012 John W. Linville +- bcma: Fix mem leak in bcma_bus_scan() +- rt2800lib: fix wrong -128dBm when signal is stronger than -12dBm +- iwlwifi: make "Tx aggregation enabled on ra =" be at DEBUG level +- ssb: fix cardbus slot in hostmode +- mac80211: timeout a single frame in the rx reorder buffer + * Fri Feb 03 2012 Dave Jones - Linux 3.2.3 diff --git a/mac80211-timeout-a-single-frame-in-the-rx-reorder-bu.patch b/mac80211-timeout-a-single-frame-in-the-rx-reorder-bu.patch new file mode 100644 index 000000000..8d836d2bb --- /dev/null +++ b/mac80211-timeout-a-single-frame-in-the-rx-reorder-bu.patch @@ -0,0 +1,33 @@ +From 07ae2dfcf4f7143ce191c6436da1c33f179af0d6 Mon Sep 17 00:00:00 2001 +From: Eliad Peller +Date: Wed, 1 Feb 2012 18:48:09 +0200 +Subject: [PATCH] mac80211: timeout a single frame in the rx reorder buffer + +The current code checks for stored_mpdu_num > 1, causing +the reorder_timer to be triggered indefinitely, but the +frame is never timed-out (until the next packet is received) + +Signed-off-by: Eliad Peller +Cc: +Acked-by: Johannes Berg +Signed-off-by: John W. Linville +--- + net/mac80211/rx.c | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 7514091..5a5e504 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -611,7 +611,7 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw, + index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) % + tid_agg_rx->buf_size; + if (!tid_agg_rx->reorder_buf[index] && +- tid_agg_rx->stored_mpdu_num > 1) { ++ tid_agg_rx->stored_mpdu_num) { + /* + * No buffers ready to be released, but check whether any + * frames in the reorder buffer have timed out. +-- +1.7.4.4 + diff --git a/rt2800lib-fix-wrong-128dBm-when-signal-is-stronger-t.patch b/rt2800lib-fix-wrong-128dBm-when-signal-is-stronger-t.patch new file mode 100644 index 000000000..7fc6c20d0 --- /dev/null +++ b/rt2800lib-fix-wrong-128dBm-when-signal-is-stronger-t.patch @@ -0,0 +1,55 @@ +From 7fc417556473f15efac269523c17eb92103c6484 Mon Sep 17 00:00:00 2001 +From: Luigi Tarenga +Date: Tue, 31 Jan 2012 18:51:23 +0100 +Subject: [PATCH] rt2800lib: fix wrong -128dBm when signal is stronger than + -12dBm + +This patch correct the type of variables containing the rssi +values read from the rxwi. + +In function rt2800_agc_to_rssi() 3 variables (rssi0, rssi1, rss2) +defined as int was assigned a 16bit signed values as unsigned. +From a test with a hi-gain antenna I verified that the rxwi +contains signed rssi values in the range -13/+81 (inclusive) +with 0 as an error condition. In case of negative values a +condition is triggered and the function return -128dBm while +the signal is at its maximum. This patch correct the cast so +negative values are not treated as very high positive values +(ex. -13 does not become 243). + +Signed-off-by: Luigi Tarenga +Reviewed-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +--- + drivers/net/wireless/rt2x00/rt2800lib.c | 8 ++++---- + 1 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c +index 22a1a8f..7bef66d 100644 +--- a/drivers/net/wireless/rt2x00/rt2800lib.c ++++ b/drivers/net/wireless/rt2x00/rt2800lib.c +@@ -514,9 +514,9 @@ EXPORT_SYMBOL_GPL(rt2800_write_tx_data); + + static int rt2800_agc_to_rssi(struct rt2x00_dev *rt2x00dev, u32 rxwi_w2) + { +- int rssi0 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI0); +- int rssi1 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI1); +- int rssi2 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI2); ++ s8 rssi0 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI0); ++ s8 rssi1 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI1); ++ s8 rssi2 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI2); + u16 eeprom; + u8 offset0; + u8 offset1; +@@ -552,7 +552,7 @@ static int rt2800_agc_to_rssi(struct rt2x00_dev *rt2x00dev, u32 rxwi_w2) + * which gives less energy... + */ + rssi0 = max(rssi0, rssi1); +- return max(rssi0, rssi2); ++ return (int)max(rssi0, rssi2); + } + + void rt2800_process_rxwi(struct queue_entry *entry, +-- +1.7.4.4 + diff --git a/ssb-fix-cardbus-slot-in-hostmode.patch b/ssb-fix-cardbus-slot-in-hostmode.patch new file mode 100644 index 000000000..ed5de4da2 --- /dev/null +++ b/ssb-fix-cardbus-slot-in-hostmode.patch @@ -0,0 +1,34 @@ +From a6c84622b7fa3ea5417a9d1d0ce0bc3e7fbe3be1 Mon Sep 17 00:00:00 2001 +From: Hauke Mehrtens +Date: Wed, 1 Feb 2012 00:13:53 +0100 +Subject: [PATCH] ssb: fix cardbus slot in hostmode + +ssb supports one extra device on the cardbus. This results in two +devices in total, one beeing the host controller itself and the other +the external device connected to the hostcontroller over cardbus. + +This makes the cardbus slot work on the Linksys WRT150N. + +Reported-by: Aaron Z +Signed-off-by: Hauke Mehrtens +Signed-off-by: John W. Linville +--- + drivers/ssb/driver_pcicore.c | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c +index 520e828..49d2091 100644 +--- a/drivers/ssb/driver_pcicore.c ++++ b/drivers/ssb/driver_pcicore.c +@@ -75,7 +75,7 @@ static u32 get_cfgspace_addr(struct ssb_pcicore *pc, + u32 tmp; + + /* We do only have one cardbus device behind the bridge. */ +- if (pc->cardbusmode && (dev >= 1)) ++ if (pc->cardbusmode && (dev > 1)) + goto out; + + if (bus == 0) { +-- +1.7.4.4 +