Commit graph

310786 commits

Author SHA1 Message Date
Arik Nemtsov
624845b31c wl18xx: implement hw op for calculating hw block count per packet
Implement the calc_tx_blocks op for the 18xx family.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2012-06-05 15:54:53 +03:00
Arik Nemtsov
1349c4212a wl18xx: set normal/GEM Tx spare block counts
Initialize the Tx spare block counts for all operating modes in the 18xx
card.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2012-06-05 15:54:51 +03:00
Arik Nemtsov
cb7b5d86c8 wl18xx: set the number of Tx descriptors
Initialize the number of Tx-descriptors for the 18xx family.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2012-06-05 15:54:49 +03:00
Arik Nemtsov
9d1c973a7b wl18xx: create per-chip-family private storage
Make use of the wlcore provided private storage in the 18xx low-level
driver.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2012-06-05 15:54:46 +03:00
Luciano Coelho
274c66cdcd wl18xx: add trigger command and ack event operations
Add the operations that allow wlcore to trigger commands to the
firmware and acknowledge when an event has been fully received.

Allocate a private buffer to hold the maximum sized cmd. Send the
entire length of the buffer each time a command is sent to signal
EOT. Remove the previous EOT mechanism.

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
2012-06-05 15:54:42 +03:00
Luciano Coelho
46a1d51261 wl18xx: add some boot operations and hw-specific configurations
Implement the boot operation.  Add a wl18xx-specific configuration
structure (namely to configure the mac and phy parameters).

The default hw configuration matches the DVP board.

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
2012-06-05 15:54:34 +03:00
Luciano Coelho
0cd6543f68 wl18xx: add identify chip operation
Add identify_chip operation to detect the chip ID for wl185x and set
the correct firmware name.

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
2012-06-05 15:54:28 +03:00
Luciano Coelho
5d4a9fa692 wl18xx: add register table
Add the register table with the appropriate values for wl18xx.

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
2012-06-05 15:54:24 +03:00
Luciano Coelho
82b890cd4e wl18xx: add partition table
Define and add the partition table in the wlcore struct.

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
2012-06-05 15:54:19 +03:00
Luciano Coelho
554c36b737 wl18xx: add empty operations struct
We don't have any chip-specific operations yet, but now wlcore has
defined an operations structure and requires the pointer to be set.

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
2012-06-05 15:54:14 +03:00
Luciano Coelho
197c62832b wlcore_sdio/wl18xx: use SDIO revision number to identify wl18xx chips
At least in PG1, the wl18xx chips use the same SDIO vendor/device ID,
so it's not possible to figure out which driver is to be used.  As a
workaround, we can check the SDIO revision number, because wl18xx uses
3.00 and wl12xx does not.

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
2012-06-05 15:54:09 +03:00
Luciano Coelho
9a1a69901d wl18xx: add new module
Add the wl18xx module and the probe functions.  Use wlcore for the
main parts (not functional at this point due to differences in the
wl18xx initialization).

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
2012-06-05 15:54:04 +03:00
Vinicius Costa Gomes
ddcd0f4147 Bluetooth: Fix checking the wrong flag when accepting a socket
Most probably a typo, the check should have been for BT_SK_DEFER_SETUP
instead of BT_DEFER_SETUP (which right now only represents a socket
option).

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-06-05 06:26:26 +03:00
Samuel Ortiz
51ad304cc8 NFC: Monitor pn533 target mode
When receiving a DEP link down event, we should cancel all pending URBs
if we're activated as a target or if we're an initiator.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:34 +02:00
Samuel Ortiz
0201ed0349 NFC: Convert pn533 from semaphore to mutex
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:34 +02:00
Samuel Ortiz
41a8ec496d NFC: Set the proper baud rate when trying to activate pn533 targets
We get the right baud rate from the last polled modulation.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:33 +02:00
Samuel Ortiz
07922bb1e0 NFC: Destroy LLCP timout workqueue when releasing the link
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:33 +02:00
Samuel Ortiz
5e50ee3ae6 NFC: Switch to Initiator mode when getting NFC_ATTR_PROTOCOLS
That is needed for keeping backward compatibility with apps using the old
netlink polling API (NFC_ATTR_PROTOCOLS instead of NFC_ATTR_IM_PROTOCOLS).

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:33 +02:00
Samuel Ortiz
56af2568c2 NFC: Send a receiver ready frame only to reply to an I frame
Sending an RR as a reply to another RR is fine but not quite logical.
We should send RRs only as a reply to I frames.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:33 +02:00
Samuel Ortiz
8445796038 NFC: Requeue lost LLCP frames
When receiving an I or RR frame telling us that some of the pending queues
were not received, we should requeue them before the currently pending ones.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:33 +02:00
Samuel Ortiz
6fbbdc16be NFC: Implement pn533 polling loop
After going through all the modulations, the pn533 driver spends 2
seconds listening for targets.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:33 +02:00
Samuel Ortiz
51d9e803b9 NFC: Add type A and type F parameters for pn533 target mode
Without those settings several devices will not activate pn533 as a target.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:32 +02:00
Samuel Ortiz
d7f3345d3a NFC: Add passive initiator data for pn533
When trying to enable a DEP link as a passive initiator, pn533 needs to
provide the polling request command payload.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:32 +02:00
Samuel Ortiz
34a85bfcfb NFC: Configure pn533 RF timings
Those define the ATR_RES response timeout after which the pn533 considers the
target to be mute.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:32 +02:00
Samuel Ortiz
9f2f8ba172 NFC: Unregister device if pn533 initial configuration fails
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:32 +02:00
Samuel Ortiz
7c2a04a933 NFC: Reset poll mod list when stopping pn533 poll
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:31 +02:00
Samuel Ortiz
cb3a4503f4 NFC: Call the DEP link down ops even when in target mode
Even in target mode we need to let the driver know that we want to
bring the DEP link down.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:31 +02:00
Samuel Ortiz
5a0f6f3b46 NFC: Don't hold a NULL connecting LLCP socket lock
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:31 +02:00
Samuel Ortiz
dadb06f270 NFC: Implement the pn533 target mode Tx op
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:31 +02:00
Samuel Ortiz
103b34cf5f NFC: Implement the pn533 target mode data fetching routine
This one needs to be called as soon as we are activated as a target, for
the pn533 to receive the first SYMM and keep the LLCP link alive.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:31 +02:00
Samuel Ortiz
73167ced31 NFC: Introduce target mode rx data callback
This routine will be called by drivers whenever they receive data in target
mode. This should be unexpected events and as such should be handled by a
standalone API (i.e. not as a callback pointer from an existing API).

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:31 +02:00
Samuel Ortiz
be9ae4ce4e NFC: Introduce target mode tx ops
And rename the initiator mode data exchange ops for consistency sake.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:30 +02:00
Samuel Ortiz
f212ad5e99 NFC: Set the NFC device RF mode appropriately
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:30 +02:00
Samuel Ortiz
fc40a8c1a0 NFC: Add target mode activation netlink event
Userspace gets a netlink event upon target mode activation.
The LLCP layer is also signaled when we get an ATR_REQ in order to get
the remote general bytes.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:30 +02:00
Samuel Ortiz
ad3823cef6 NFC: Implement pn533 target mode polling loop
We only want to support p2p target mode for now, no host card emulation.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:29 +02:00
Samuel Ortiz
fe7c580073 NFC: Add target mode protocols to the polling loop startup routine
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:29 +02:00
Samuel Ortiz
ab73b75130 NFC: Export LLCP general bytes getter
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:29 +02:00
Samuel Ortiz
76762b7369 NFC: LLCP's MIUX is 10 bytes long, not 7
The mask is 0x7ff and not 0x7f and the return value is an u16.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:29 +02:00
Samuel Ortiz
93d7e490b7 NFC: Move LLCP MIU extension value to socket structure
The MIU extension value can be received during the PAX or during the
connection establishment process. It's definitely a connection related value
rather than a link one.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:29 +02:00
Samuel Ortiz
7a06e586b9 NFC: Move LLCP receiver window value to socket structure
RW can only be fetched from a CONNECT or a CC frame thus making it an
end points specific value, not a link one.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:28 +02:00
Samuel Ortiz
a69f32af86 NFC: Socket linked list
Simplify the LLCP sockets structure by putting all the connected ones
into a single linked list.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:28 +02:00
Samuel Ortiz
c7aa12252f NFC: Take a reference on the LLCP local pointer when creating a socket
LLCP sockets point to their local LLCP service, so they need to take a
reference on it.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2012-06-04 21:34:28 +02:00
Johannes Berg
fcb6ff5e2c iwlwifi: disable WoWLAN if !CONFIG_PM_SLEEP
If CONFIG_PM_SLEEP is disabled, then iwlwifi doesn't
support suspend/resume handlers and thus mac80211
(correctly) refuses advertising WoWLAN. Disable
WoWLAN in the driver in this case.

Cc: stable@kernel.org
Reported-by: Sebastian Kemper <sebastian_ml@gmx.net>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-06-04 15:27:07 -04:00
Arik Nemtsov
794454ce72 mac80211: fix non RCU-safe sta_list manipulation
sta_info_cleanup locks the sta_list using rcu_read_lock however
the delete operation isn't rcu safe. A race between sta_info_cleanup
timer being called and a STA being removed can occur which leads
to a panic while traversing sta_list. Fix this by switching to the
RCU-safe versions.

Cc: stable@vger.kernel.org
Reported-by: Eyal Shapira <eyal@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-06-04 15:26:54 -04:00
Seth Forshee
69aaedd3cf bcma: add ext PA workaround for BCM4331 and BCM43431
MacBook Pro models with BCM4331 wireless have been found to have the ext
PA lines disabled after resuming from S3 without external power attach.
This causes them to be unable to transmit. Add a workaround to ensure
that the ext PA lines are enabled on BCM4331. Also extend all handling
of ext PA line muxing to BCM43431 as is done in the Broadcom SDK.

BugLink: http://bugs.launchpad.net/bugs/925577
Cc: Arend van Spriel <arend@broadcom.com>
Cc: Hauke Mehrtens <hauke@hauke-m.de>
Cc: stable@vger.kernel.org
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-06-04 15:26:40 -04:00
Stanislaw Gruszka
e5851dac2c rt2x00: use atomic variable for seqno
Remove spinlock as atomic_t can be used instead. Note we use only 16
lower bits, upper bits are changed but we impilcilty cast to u16.

This fix possible deadlock on IBSS mode reproted by lockdep:

=================================
[ INFO: inconsistent lock state ]
3.4.0-wl+ #4 Not tainted
---------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
kworker/u:2/30374 [HC0[0]:SC0[0]:HE1:SE1] takes:
 (&(&intf->seqlock)->rlock){+.?...}, at: [<f9979a20>] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
{IN-SOFTIRQ-W} state was registered at:
  [<c04978ab>] __lock_acquire+0x47b/0x1050
  [<c0498504>] lock_acquire+0x84/0xf0
  [<c0835733>] _raw_spin_lock+0x33/0x40
  [<f9979a20>] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
  [<f9979f2a>] rt2x00queue_write_tx_frame+0x1a/0x300 [rt2x00lib]
  [<f997834f>] rt2x00mac_tx+0x7f/0x380 [rt2x00lib]
  [<f98fe363>] __ieee80211_tx+0x1b3/0x300 [mac80211]
  [<f98ffdf5>] ieee80211_tx+0x105/0x130 [mac80211]
  [<f99000dd>] ieee80211_xmit+0xad/0x100 [mac80211]
  [<f9900519>] ieee80211_subif_start_xmit+0x2d9/0x930 [mac80211]
  [<c0782e87>] dev_hard_start_xmit+0x307/0x660
  [<c079bb71>] sch_direct_xmit+0xa1/0x1e0
  [<c0784bb3>] dev_queue_xmit+0x183/0x730
  [<c078c27a>] neigh_resolve_output+0xfa/0x1e0
  [<c07b436a>] ip_finish_output+0x24a/0x460
  [<c07b4897>] ip_output+0xb7/0x100
  [<c07b2d60>] ip_local_out+0x20/0x60
  [<c07e01ff>] igmpv3_sendpack+0x4f/0x60
  [<c07e108f>] igmp_ifc_timer_expire+0x29f/0x330
  [<c04520fc>] run_timer_softirq+0x15c/0x2f0
  [<c0449e3e>] __do_softirq+0xae/0x1e0
irq event stamp: 18380437
hardirqs last  enabled at (18380437): [<c0526027>] __slab_alloc.clone.3+0x67/0x5f0
hardirqs last disabled at (18380436): [<c0525ff3>] __slab_alloc.clone.3+0x33/0x5f0
softirqs last  enabled at (18377616): [<c0449eb3>] __do_softirq+0x123/0x1e0
softirqs last disabled at (18377611): [<c041278d>] do_softirq+0x9d/0xe0

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&(&intf->seqlock)->rlock);
  <Interrupt>
    lock(&(&intf->seqlock)->rlock);

 *** DEADLOCK ***

4 locks held by kworker/u:2/30374:
 #0:  (wiphy_name(local->hw.wiphy)){++++.+}, at: [<c045cf99>] process_one_work+0x109/0x3f0
 #1:  ((&sdata->work)){+.+.+.}, at: [<c045cf99>] process_one_work+0x109/0x3f0
 #2:  (&ifibss->mtx){+.+.+.}, at: [<f98f005b>] ieee80211_ibss_work+0x1b/0x470 [mac80211]
 #3:  (&intf->beacon_skb_mutex){+.+...}, at: [<f997a644>] rt2x00queue_update_beacon+0x24/0x50 [rt2x00lib]

stack backtrace:
Pid: 30374, comm: kworker/u:2 Not tainted 3.4.0-wl+ #4
Call Trace:
 [<c04962a6>] print_usage_bug+0x1f6/0x220
 [<c0496a12>] mark_lock+0x2c2/0x300
 [<c0495ff0>] ? check_usage_forwards+0xc0/0xc0
 [<c04978ec>] __lock_acquire+0x4bc/0x1050
 [<c0527890>] ? __kmalloc_track_caller+0x1c0/0x1d0
 [<c0777fb6>] ? copy_skb_header+0x26/0x90
 [<c0498504>] lock_acquire+0x84/0xf0
 [<f9979a20>] ? rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
 [<c0835733>] _raw_spin_lock+0x33/0x40
 [<f9979a20>] ? rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
 [<f9979a20>] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
 [<f997a5cf>] rt2x00queue_update_beacon_locked+0x5f/0xb0 [rt2x00lib]
 [<f997a64d>] rt2x00queue_update_beacon+0x2d/0x50 [rt2x00lib]
 [<f9977e3a>] rt2x00mac_bss_info_changed+0x1ca/0x200 [rt2x00lib]
 [<f9977c70>] ? rt2x00mac_remove_interface+0x70/0x70 [rt2x00lib]
 [<f98e4dd0>] ieee80211_bss_info_change_notify+0xe0/0x1d0 [mac80211]
 [<f98ef7b8>] __ieee80211_sta_join_ibss+0x3b8/0x610 [mac80211]
 [<c0496ab4>] ? mark_held_locks+0x64/0xc0
 [<c0440012>] ? virt_efi_query_capsule_caps+0x12/0x50
 [<f98efb09>] ieee80211_sta_join_ibss+0xf9/0x140 [mac80211]
 [<f98f0456>] ieee80211_ibss_work+0x416/0x470 [mac80211]
 [<c0496d8b>] ? trace_hardirqs_on+0xb/0x10
 [<c077683b>] ? skb_dequeue+0x4b/0x70
 [<f98f207f>] ieee80211_iface_work+0x13f/0x230 [mac80211]
 [<c045cf99>] ? process_one_work+0x109/0x3f0
 [<c045d015>] process_one_work+0x185/0x3f0
 [<c045cf99>] ? process_one_work+0x109/0x3f0
 [<f98f1f40>] ? ieee80211_teardown_sdata+0xa0/0xa0 [mac80211]
 [<c045ed86>] worker_thread+0x116/0x270
 [<c045ec70>] ? manage_workers+0x1e0/0x1e0
 [<c0462f64>] kthread+0x84/0x90
 [<c0462ee0>] ? __init_kthread_worker+0x60/0x60
 [<c083d382>] kernel_thread_helper+0x6/0x10

Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-06-04 15:26:26 -04:00
Joe Perches
f304a99319 brcmfmac: Fix likely misuse of | for &
Using | with a constant is always true.
Likely this should have be &.

Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-06-04 15:26:11 -04:00
Joe Perches
5204267d2f mac80211: Fix likely misuse of | for &
Using | with a constant is always true.
Likely this should have be &.

cc: Ben Greear <greearb@candelatech.com>
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-06-04 15:25:56 -04:00
Felix Fietkau
d8c7aae64c mac80211: add missing rcu_read_lock/unlock in agg-rx session timer
Fixes a lockdep warning:

===================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
net/mac80211/agg-rx.c:148 invoked rcu_dereference_check() without protection!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 1
1 lock held by arecord/11226:
 #0:  (&tid_agg_rx->session_timer){+.-...}, at: [<ffffffff81066bb0>] call_timer_fn+0x0/0x360

stack backtrace:
Pid: 11226, comm: arecord Not tainted 3.1.0-kml #16
Call Trace:
 <IRQ>  [<ffffffff81093454>] lockdep_rcu_dereference+0xa4/0xc0
 [<ffffffffa02778c9>] sta_rx_agg_session_timer_expired+0xc9/0x110 [mac80211]
 [<ffffffffa0277800>] ? ieee80211_process_addba_resp+0x220/0x220 [mac80211]
 [<ffffffff81066c3a>] call_timer_fn+0x8a/0x360
 [<ffffffff81066bb0>] ? init_timer_deferrable_key+0x30/0x30
 [<ffffffff81477bb0>] ? _raw_spin_unlock_irq+0x30/0x70
 [<ffffffff81067049>] run_timer_softirq+0x139/0x310
 [<ffffffff81091d5e>] ? put_lock_stats.isra.25+0xe/0x40
 [<ffffffff810922ac>] ? lock_release_holdtime.part.26+0xdc/0x160
 [<ffffffffa0277800>] ? ieee80211_process_addba_resp+0x220/0x220 [mac80211]
 [<ffffffff8105cb78>] __do_softirq+0xc8/0x3c0
 [<ffffffff8108f088>] ? tick_dev_program_event+0x48/0x110
 [<ffffffff8108f16f>] ? tick_program_event+0x1f/0x30
 [<ffffffff81153b15>] ? putname+0x35/0x50
 [<ffffffff8147a43c>] call_softirq+0x1c/0x30
 [<ffffffff81004c55>] do_softirq+0xa5/0xe0
 [<ffffffff8105d1ee>] irq_exit+0xae/0xe0
 [<ffffffff8147ac6b>] smp_apic_timer_interrupt+0x6b/0x98
 [<ffffffff81479ab3>] apic_timer_interrupt+0x73/0x80
 <EOI>  [<ffffffff8146aac6>] ? free_debug_processing+0x1a1/0x1d5
 [<ffffffff81153b15>] ? putname+0x35/0x50
 [<ffffffff8146ab2b>] __slab_free+0x31/0x2ca
 [<ffffffff81477c3a>] ? _raw_spin_unlock_irqrestore+0x4a/0x90
 [<ffffffff81253b8f>] ? __debug_check_no_obj_freed+0x15f/0x210
 [<ffffffff81097054>] ? lock_release_nested+0x84/0xc0
 [<ffffffff8113ec55>] ? kmem_cache_free+0x105/0x250
 [<ffffffff81153b15>] ? putname+0x35/0x50
 [<ffffffff81153b15>] ? putname+0x35/0x50
 [<ffffffff8113ed8f>] kmem_cache_free+0x23f/0x250
 [<ffffffff81153b15>] putname+0x35/0x50
 [<ffffffff81146d8d>] do_sys_open+0x16d/0x1d0
 [<ffffffff81146e10>] sys_open+0x20/0x30
 [<ffffffff81478f42>] system_call_fastpath+0x16/0x1b

Reported-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-06-04 15:25:41 -04:00
Johannes Berg
71ecfa1893 mac80211: clean up remain-on-channel on interface stop
When any interface goes down, it could be the one that we
were doing a remain-on-channel with. We therefore need to
cancel the remain-on-channel and flush the related work
structs so they don't run after the interface has been
removed or even destroyed.

It's also possible in this case that an off-channel SKB
was never transmitted, so free it if this is the case.
Note that this can also happen if the driver finishes
the off-channel period without ever starting it.

Cc: stable@kernel.org
Reported-by: Nirav Shah <nirav.j2.shah@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-06-04 15:25:26 -04:00