Re: [PATCH V2 09/10] ath10k: Add support for code swap

2015-06-29 Thread Kalle Valo
Vasanthakumar Thiagarajan vthia...@qti.qualcomm.com writes:

 Code swap is a mechanism to use host memory to store
 some fw binary code segment. Ath10k host driver allocates
 and loads the code swap binary into the host memory and
 configures the target with the host allocated memory
 information at the address taken from code swap binary.
 This patch adds code swap support for firmware binary.
 Code swap binary for firmware bin is available in
 ATH10K_FW_IE_FW_CODE_SWAP_IMAGE.

 Signed-off-by: Vasanthakumar Thiagarajan vthia...@qti.qualcomm.com

[...]

 +static struct ath10k_swap_code_seg_info *
 +ath10k_swap_code_seg_alloc(struct ath10k *ar, size_t swap_bin_len)
 +{
 + struct ath10k_swap_code_seg_info *seg_info;
 + void *virt_addr;
 + dma_addr_t paddr;
 +
 + swap_bin_len = roundup(swap_bin_len, 2);
 + if (swap_bin_len  ATH10K_SWAP_CODE_SEG_BIN_LEN_MAX) {
 + ath10k_err(ar, refusing code swap bin because it is too big 
 %zd  %d\n,
 +swap_bin_len, ATH10K_SWAP_CODE_SEG_BIN_LEN_MAX);

kbuild found a bug here, I fixed it with the patch below. Please review:

--- a/drivers/net/wireless/ath/ath10k/swap.c
+++ b/drivers/net/wireless/ath/ath10k/swap.c
@@ -106,7 +106,7 @@ ath10k_swap_code_seg_alloc(struct ath10k *ar, size_t 
swap_bin_len)
 
swap_bin_len = roundup(swap_bin_len, 2);
if (swap_bin_len  ATH10K_SWAP_CODE_SEG_BIN_LEN_MAX) {
-   ath10k_err(ar, refusing code swap bin because it is too big 
%zd  %d\n,
+   ath10k_err(ar, refusing code swap bin because it is too big 
%zu  %d\n,
   swap_bin_len, ATH10K_SWAP_CODE_SEG_BIN_LEN_MAX);
return NULL;
}

-- 
Kalle Valo
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[PATCH] staging:wilc1000: code cleanup Fix reported by coccinelle

2015-06-29 Thread Mutharaju, Prasanna (P.)
From: Prasanna Karthik mkart...@visteon.com

Removed {} for single statement if block

Signed-off-by: Prasanna Karthik mkart...@visteon.com
---
 drivers/staging/wilc1000/fifo_buffer.c |   11 +--
 1 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/wilc1000/fifo_buffer.c 
b/drivers/staging/wilc1000/fifo_buffer.c
index b6c07cf..be38493 100644
--- a/drivers/staging/wilc1000/fifo_buffer.c
+++ b/drivers/staging/wilc1000/fifo_buffer.c
@@ -31,11 +31,10 @@ u32 FIFO_DeInit(tHANDLE hFifo)
u32 u32Error = 0;
tstrFifoHandler *pstrFifoHandler = (tstrFifoHandler *) hFifo;
if (pstrFifoHandler) {
-   if (pstrFifoHandler-pu8Buffer) {
+   if (pstrFifoHandler-pu8Buffer)
WILC_FREE (pstrFifoHandler-pu8Buffer);
-   } else {
+   else
u32Error = 1;
-   }
 
WILC_FREE (pstrFifoHandler);
} else {
@@ -52,11 +51,11 @@ u32 FIFO_ReadBytes(tHANDLE hFifo, u8 *pu8Buffer, u32 
u32BytesToRead, u32 *pu32By
if (pstrFifoHandler-u32TotalBytes) {
down(pstrFifoHandler-SemBuffer);
 
-   if (u32BytesToRead  pstrFifoHandler-u32TotalBytes) {
+   if (u32BytesToRead  pstrFifoHandler-u32TotalBytes)
*pu32BytesRead = pstrFifoHandler-u32TotalBytes;
-   } else {
+   else
*pu32BytesRead = u32BytesToRead;
-   }
+
if ((pstrFifoHandler-u32ReadOffset + u32BytesToRead) 
= pstrFifoHandler-u32BufferLength) {
WILC_memcpy(pu8Buffer, 
pstrFifoHandler-pu8Buffer + pstrFifoHandler-u32ReadOffset,
*pu32BytesRead);
-- 
1.7.0.4
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[PATCH] NFC: st21nfca,st-nci: fix use of uninitialized variables in error path

2015-06-29 Thread Nicolas Iooss
st21nfca_hci_load_session() calls kfree_skb() on unitialized variables
skb_pipe_info and skb_pipe_list if the call to nfc_hci_connect_gate()
failed.  Reword the error path to not use these variables when they are
not initialized.  While at it, there seemed to be a memory leak because
skb_pipe_info was only freed once, after the for-loop, even though
several ones were created by nfc_hci_send_cmd.

st_nci_hci_load_session() is similar to st21nfca_hci_load_session(), so
rework this function too.

Fixes: ec03ff1a8f9a (NFC: st21nfca: Remove skb_pipe_list and skb_pipe_info
useless allocation)

Signed-off-by: Nicolas Iooss nicolas.iooss_li...@m4x.org
---

As I haven't got the hardware needed to perform tests, I only compile-tested
this patch.

Moreover I may then have missed something important for example in the way
the memory is managed (I did not understand why skb_pipe_info was not freed
in the for loop).

 drivers/nfc/st-nci/st-nci_se.c  |  8 
 drivers/nfc/st21nfca/st21nfca.c | 11 ++-
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/nfc/st-nci/st-nci_se.c b/drivers/nfc/st-nci/st-nci_se.c
index 97addfa96c6f..c742ef65a05a 100644
--- a/drivers/nfc/st-nci/st-nci_se.c
+++ b/drivers/nfc/st-nci/st-nci_se.c
@@ -189,14 +189,14 @@ int st_nci_hci_load_session(struct nci_dev *ndev)
ST_NCI_DEVICE_MGNT_GATE,
ST_NCI_DEVICE_MGNT_PIPE);
if (r  0)
-   goto free_info;
+   return r;
 
/* Get pipe list */
r = nci_hci_send_cmd(ndev, ST_NCI_DEVICE_MGNT_GATE,
ST_NCI_DM_GETINFO, pipe_list, sizeof(pipe_list),
skb_pipe_list);
if (r  0)
-   goto free_info;
+   return r;
 
/* Complete the existing gate_pipe table */
for (i = 0; i  skb_pipe_list-len; i++) {
@@ -222,6 +222,7 @@ int st_nci_hci_load_session(struct nci_dev *ndev)
dm_pipe_info-src_host_id != ST_NCI_ESE_HOST_ID) {
pr_err(Unexpected apdu_reader pipe on host %x\n,
   dm_pipe_info-src_host_id);
+   kfree_skb(skb_pipe_info);
continue;
}
 
@@ -241,13 +242,12 @@ int st_nci_hci_load_session(struct nci_dev *ndev)
ndev-hci_dev-pipes[st_nci_gates[j].pipe].host =
dm_pipe_info-src_host_id;
}
+   kfree_skb(skb_pipe_info);
}
 
memcpy(ndev-hci_dev-init_data.gates, st_nci_gates,
   sizeof(st_nci_gates));
 
-free_info:
-   kfree_skb(skb_pipe_info);
kfree_skb(skb_pipe_list);
return r;
 }
diff --git a/drivers/nfc/st21nfca/st21nfca.c b/drivers/nfc/st21nfca/st21nfca.c
index d251f7229c4e..051286562fab 100644
--- a/drivers/nfc/st21nfca/st21nfca.c
+++ b/drivers/nfc/st21nfca/st21nfca.c
@@ -148,14 +148,14 @@ static int st21nfca_hci_load_session(struct nfc_hci_dev 
*hdev)
ST21NFCA_DEVICE_MGNT_GATE,
ST21NFCA_DEVICE_MGNT_PIPE);
if (r  0)
-   goto free_info;
+   return r;
 
/* Get pipe list */
r = nfc_hci_send_cmd(hdev, ST21NFCA_DEVICE_MGNT_GATE,
ST21NFCA_DM_GETINFO, pipe_list, sizeof(pipe_list),
skb_pipe_list);
if (r  0)
-   goto free_info;
+   return r;
 
/* Complete the existing gate_pipe table */
for (i = 0; i  skb_pipe_list-len; i++) {
@@ -181,6 +181,7 @@ static int st21nfca_hci_load_session(struct nfc_hci_dev 
*hdev)
info-src_host_id != ST21NFCA_ESE_HOST_ID) {
pr_err(Unexpected apdu_reader pipe on host %x\n,
info-src_host_id);
+   kfree_skb(skb_pipe_info);
continue;
}
 
@@ -200,6 +201,7 @@ static int st21nfca_hci_load_session(struct nfc_hci_dev 
*hdev)
hdev-pipes[st21nfca_gates[j].pipe].dest_host =
info-src_host_id;
}
+   kfree_skb(skb_pipe_info);
}
 
/*
@@ -214,13 +216,12 @@ static int st21nfca_hci_load_session(struct nfc_hci_dev 
*hdev)
st21nfca_gates[i].gate,
st21nfca_gates[i].pipe);
if (r  0)
-   goto free_info;
+   goto free_list;
}
}
 
memcpy(hdev-init_data.gates, st21nfca_gates, sizeof(st21nfca_gates));
-free_info:
-   kfree_skb(skb_pipe_info);
+free_list:
kfree_skb(skb_pipe_list);
return r;
 }
-- 
2.4.4

--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message 

Re: Null pointer dereference when station associates [introduced by 4.0.5?]

2015-06-29 Thread Tom Hughes

On 29/06/15 10:44, Tom Hughes wrote:

On 29/06/15 10:20, Tom Hughes wrote:

On 29/06/15 09:30, Tom Hughes wrote:

On 29/06/15 09:14, Johannes Berg wrote:

On Sat, 2015-06-27 at 16:34 +0100, Tom Hughes wrote:


Interestingly from what I can see this is trying to create a file
for the station at a path something like:

ieee80211/phy0/netdev:/stations/XX


indeed.


but in my (currently working) boot under 4.0.4 there is no netdev
directory under phy0 in debugfs... but then maybe that is the problem
as well if the inode pointer was null?



This is pretty strange - if the dentry pointer (sdata
-debugfs.subdir_stations) was NULL or an ERR_PTR(), the code would
return pretty much immediately.

So it looks like that pointer is valid, but it's -d_inode was NULL?

I'm not really sure how that could happen.


Indeed I'm a bit puzzled...


It looks like hostapd has something to do with it... If I stop hostapd and
remove ath9k and then reprobe it then the netdev dir appears:

gosford [~] % sudo modprobe ath9k
gosford [~] % sudo ls /sys/kernel/debug/ieee80211/phy1
ath9klong_retry_limit  reset  user_power
fragmentation_threshold  netdev:wlp2s0 rts_threshold  wep_iv
ht40allow_mappower short_retry_limit
hwflags  queuesstatistics
keys rctotal_ps_buffered

Then I start hostapd and it vanishes:


...and you also need to have selinux in enforcing mode.

It appears hostapd is trying to do something with debugfs and is
being denied directory search access:


So I think this happens when hostapd switches the interface
to AP mode, which causes the netdev to be torn down and then
recreated, and the debugfs directory along with it.

Except that if the netlink message to change the mode was
sent from a daemon whose selinux context prevents searching
debugfs the recreation somehow fails and leaves an invalid
state that later causes the null pointer deref.

Tom

--
Tom Hughes (t...@compton.nu)
http://compton.nu/
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: Null pointer dereference when station associates [introduced by 4.0.5?]

2015-06-29 Thread Tom Hughes

On 29/06/15 11:24, Tom Hughes wrote:


So I think this happens when hostapd switches the interface
to AP mode, which causes the netdev to be torn down and then
recreated, and the debugfs directory along with it.

Except that if the netlink message to change the mode was
sent from a daemon whose selinux context prevents searching
debugfs the recreation somehow fails and leaves an invalid
state that later causes the null pointer deref.


Think I have it...

The teardown runs ieee80211_debugfs_remove_netdev
which clears sdata-vif.debugfs_dir but does not clear 
sdata-debugfs.subdir_stations so that when ieee80211_debugfs_add_netdev 
later fails to create the top level
netdev directory we are left with a bogus pointer for the stations 
directory.


Then when we try and add an entry to the stations directory things blow up.

Tom

--
Tom Hughes (t...@compton.nu)
http://compton.nu/
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: Null pointer dereference when station associates [introduced by 4.0.5?]

2015-06-29 Thread Tom Hughes
On 29/06/15 09:30, Tom Hughes wrote:
 On 29/06/15 09:14, Johannes Berg wrote:
 On Sat, 2015-06-27 at 16:34 +0100, Tom Hughes wrote:

 Interestingly from what I can see this is trying to create a file
 for the station at a path something like:

 ieee80211/phy0/netdev:/stations/XX

 indeed.

 but in my (currently working) boot under 4.0.4 there is no netdev
 directory under phy0 in debugfs... but then maybe that is the problem
 as well if the inode pointer was null?


 This is pretty strange - if the dentry pointer (sdata
 -debugfs.subdir_stations) was NULL or an ERR_PTR(), the code would
 return pretty much immediately.

 So it looks like that pointer is valid, but it's -d_inode was NULL?

 I'm not really sure how that could happen.
 
 Indeed I'm a bit puzzled... 

It looks like hostapd has something to do with it... If I stop hostapd and
remove ath9k and then reprobe it then the netdev dir appears:

gosford [~] % sudo modprobe ath9k 
gosford [~] % sudo ls /sys/kernel/debug/ieee80211/phy1
ath9klong_retry_limit  reset  user_power
fragmentation_threshold  netdev:wlp2s0 rts_threshold  wep_iv
ht40allow_mappower short_retry_limit
hwflags  queuesstatistics
keys rctotal_ps_buffered

Then I start hostapd and it vanishes:

gosford [~] % sudo systemctl start hostapd
gosford [~] % sudo ls /sys/kernel/debug/ieee80211/phy1
ath9kkeys  rc statistics
fragmentation_threshold  long_retry_limit  reset  total_ps_buffered
ht40allow_mappower rts_threshold  user_power
hwflags  queuesshort_retry_limit  wep_iv

Tom

-- 
Tom Hughes (t...@compton.nu)
http://compton.nu/
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: Null pointer dereference when station associates [introduced by 4.0.5?]

2015-06-29 Thread Tom Hughes
On 29/06/15 10:20, Tom Hughes wrote:
 On 29/06/15 09:30, Tom Hughes wrote:
 On 29/06/15 09:14, Johannes Berg wrote:
 On Sat, 2015-06-27 at 16:34 +0100, Tom Hughes wrote:

 Interestingly from what I can see this is trying to create a file
 for the station at a path something like:

 ieee80211/phy0/netdev:/stations/XX

 indeed.

 but in my (currently working) boot under 4.0.4 there is no netdev
 directory under phy0 in debugfs... but then maybe that is the problem
 as well if the inode pointer was null?


 This is pretty strange - if the dentry pointer (sdata
 -debugfs.subdir_stations) was NULL or an ERR_PTR(), the code would
 return pretty much immediately.

 So it looks like that pointer is valid, but it's -d_inode was NULL?

 I'm not really sure how that could happen.

 Indeed I'm a bit puzzled...
 
 It looks like hostapd has something to do with it... If I stop hostapd and
 remove ath9k and then reprobe it then the netdev dir appears:
 
 gosford [~] % sudo modprobe ath9k
 gosford [~] % sudo ls /sys/kernel/debug/ieee80211/phy1
 ath9k  long_retry_limit  reset  user_power
 fragmentation_threshold  netdev:wlp2s0   rts_threshold  wep_iv
 ht40allow_map  power short_retry_limit
 hwflagsqueuesstatistics
 keys   rctotal_ps_buffered
 
 Then I start hostapd and it vanishes:

...and you also need to have selinux in enforcing mode.

It appears hostapd is trying to do something with debugfs and is
being denied directory search access:

time-Mon Jun 29 10:39:34 2015
type=PROCTITLE msg=audit(1435570774.085:16533): 
proctitle=2F7573722F7362696E2F686F7374617064002F6574632F686F73746170642F686F73746170642E636F6E66002D50002F72756E2F686F73746170642E706964002D42
type=SYSCALL msg=audit(1435570774.085:16533): arch=4003 syscall=102 
success=yes exit=36 a0=10 a1=bf93c910 a2=b777d000 a3=90517e8 items=0 ppid=1 
pid=7241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 
fsgid=0 tty=(none) ses=4294967295 comm=hostapd exe=/usr/sbin/hostapd 
subj=system_u:system_r:hostapd_t:s0 key=(null)
type=AVC msg=audit(1435570774.085:16533): avc:  denied  { search } for  
pid=7241 comm=hostapd name=phy7 dev=debugfs ino=5626659 
scontext=system_u:system_r:hostapd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 
tclass=dir permissive=1

It must then do something that breaks the kernel...

Tom

-- 
Tom Hughes (t...@compton.nu)
http://compton.nu/
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH] Trivial: spell distribution correctly in a comment.

2015-06-29 Thread Kalle Valo
Nik Nyby niko...@gnu.org writes:

 Signed-off-by: Nik Nyby niko...@gnu.org

Please use prefix ath6kl:  for ath6kl patches.

-- 
Kalle Valo
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH V2 09/10] ath10k: Add support for code swap

2015-06-29 Thread Vasanthakumar Thiagarajan

On Monday 29 June 2015 04:51 PM, Kalle Valo wrote:

Vasanthakumar Thiagarajan vthia...@qti.qualcomm.com writes:


Code swap is a mechanism to use host memory to store
some fw binary code segment. Ath10k host driver allocates
and loads the code swap binary into the host memory and
configures the target with the host allocated memory
information at the address taken from code swap binary.
This patch adds code swap support for firmware binary.
Code swap binary for firmware bin is available in
ATH10K_FW_IE_FW_CODE_SWAP_IMAGE.

Signed-off-by: Vasanthakumar Thiagarajan vthia...@qti.qualcomm.com


[...]


+static struct ath10k_swap_code_seg_info *
+ath10k_swap_code_seg_alloc(struct ath10k *ar, size_t swap_bin_len)
+{
+   struct ath10k_swap_code_seg_info *seg_info;
+   void *virt_addr;
+   dma_addr_t paddr;
+
+   swap_bin_len = roundup(swap_bin_len, 2);
+   if (swap_bin_len  ATH10K_SWAP_CODE_SEG_BIN_LEN_MAX) {
+   ath10k_err(ar, refusing code swap bin because it is too big %zd  
%d\n,
+  swap_bin_len, ATH10K_SWAP_CODE_SEG_BIN_LEN_MAX);


kbuild found a bug here, I fixed it with the patch below. Please review:

--- a/drivers/net/wireless/ath/ath10k/swap.c
+++ b/drivers/net/wireless/ath/ath10k/swap.c
@@ -106,7 +106,7 @@ ath10k_swap_code_seg_alloc(struct ath10k *ar, size_t 
swap_bin_len)

 swap_bin_len = roundup(swap_bin_len, 2);
 if (swap_bin_len  ATH10K_SWAP_CODE_SEG_BIN_LEN_MAX) {
-   ath10k_err(ar, refusing code swap bin because it is too big %zd  
%d\n,
+   ath10k_err(ar, refusing code swap bin because it is too big %zu  
%d\n,
swap_bin_len, ATH10K_SWAP_CODE_SEG_BIN_LEN_MAX);
 return NULL;
 }


Looks good. Thanks.


Vasanth

--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: iw and non-ASCII SSIDs

2015-06-29 Thread Paul Stewart
On Mon, Jun 29, 2015 at 1:23 AM, Johannes Berg
johan...@sipsolutions.net wrote:

 [please don't use HTML]

 On Mon, 2015-06-29 at 08:17 +, Joerg Pommnitz wrote:
  We don't have to break compatibility. The commandline syntax of iw is
  iw [options] command
  My suggestion would be a new option --binary-ssid that sets a flag
  and causes all SSID to be treated as a hex encoded binary blob:
  iw --binary-ssid dev wlan0 ibss join 0034AA 2412


Technically, I'd call this --hex-ssid considering the actual encoding
shown.


  and for consistency
  iw --binary-ssid dev wlan0 connect 0034AA
 
  Alternatively the option could be --escaped-ssid that would
  activate an escape processing for the SSID as you suggested. My
  preference is --binary-ssid, because I'm always a little bit unsure
  what actually arrives in the program after the shell has done its own
  escape processing.
 


 Yeah, that seems reasonable, though perhaps easier to do as

   iw dev wlan0 ibss join --binary-ssid 0034AA 2412

 since options before the command are treated as generic iw options.

 Then again, if all places that use an SSID were to use a
 parse_ssid(argv[7]) function then the former could also be
 implemented.

 johannes
 --
 To unsubscribe from this list: send the line unsubscribe linux-wireless in
 the body of a message to majord...@vger.kernel.org
 More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[PATCH v2] ath6kl: Trivial: spell distribution correctly in a comment.

2015-06-29 Thread Nik Nyby
This fixes two misspellings of distribution in a comment.

Signed-off-by: Nik Nyby niko...@gnu.org
---
 drivers/net/wireless/ath/ath6kl/htc.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath6kl/htc.h 
b/drivers/net/wireless/ath/ath6kl/htc.h
index 14cab14..112d8a9 100644
--- a/drivers/net/wireless/ath/ath6kl/htc.h
+++ b/drivers/net/wireless/ath/ath6kl/htc.h
@@ -427,7 +427,7 @@ struct htc_endpoint_credit_dist {
 };
 
 /*
- * credit distibution code that is passed into the distrbution function,
+ * credit distribution code that is passed into the distribution function,
  * there are mandatory and optional codes that must be handled
  */
 enum htc_credit_dist_reason {
-- 
2.1.4

--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[PATCH] Clear subdir_stations when stations directory is removed (was Re: Null pointer dereference when station associates [introduced by 4.0.5?])

2015-06-29 Thread Tom Hughes
On 29/06/15 11:28, Tom Hughes wrote:
 On 29/06/15 11:24, Tom Hughes wrote:
 
 So I think this happens when hostapd switches the interface
 to AP mode, which causes the netdev to be torn down and then
 recreated, and the debugfs directory along with it.

 Except that if the netlink message to change the mode was
 sent from a daemon whose selinux context prevents searching
 debugfs the recreation somehow fails and leaves an invalid
 state that later causes the null pointer deref.
 
 Think I have it...
 
 The teardown runs ieee80211_debugfs_remove_netdev
 which clears sdata-vif.debugfs_dir but does not clear 
 sdata-debugfs.subdir_stations so that when ieee80211_debugfs_add_netdev 
 later fails to create the top level
 netdev directory we are left with a bogus pointer for the stations 
 directory.
 
 Then when we try and add an entry to the stations directory things blow up.

Here's a proposed patch. I have booted 4.0.6 with this applied and so far
it hasn't failed even with selinux in enforcing mode.

commit 30624496e9f411081d7ea1a407deabe0e32d0c62
Author: Tom Hughes t...@compton.nu
Date:   Mon Jun 29 11:31:04 2015 +0100

Clear subdir_stations when stations directory is removed

If we don't do this, and we then fail to recreate the debugfs
directory during a mode change, then we will fail later trying
to add stations to this now bogus directory:

BUG: unable to handle kernel NULL pointer dereference at 006c
IP: [c0a92202] mutex_lock+0x12/0x30
Call Trace:
[c0678ab4] start_creating+0x44/0xc0
[c0679203] debugfs_create_dir+0x13/0xf0
[f8a938ae] ieee80211_sta_debugfs_add+0x6e/0x490 [mac80211]

Signed-off-by: Tom Hughes t...@compton.nu

diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 29236e8..c09c013 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -723,6 +723,7 @@ void ieee80211_debugfs_remove_netdev(struct 
ieee80211_sub_if_data *sdata)
 
debugfs_remove_recursive(sdata-vif.debugfs_dir);
sdata-vif.debugfs_dir = NULL;
+   sdata-debugfs.subdir_stations = NULL;
 }
 
 void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)

Tom

-- 
Tom Hughes (t...@compton.nu)
http://compton.nu/
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH] mac80211: remove compilation warning on mesh

2015-06-29 Thread Yeoh Chun-Yeow
On Mon, Jun 29, 2015 at 3:27 PM, Johannes Berg
johan...@sipsolutions.net wrote:
 On Mon, 2015-06-29 at 11:50 +0800, Chun-Yeow Yeoh wrote:
 Remove the warning on the following:
 mesh_hwmp.c: warning: ‘target_metric’ may be used
 uninitialized in this function [-Wmaybe-uninitialized]

 I don't see any such warning, and would prefer not to have a blanket
 initialization that might in the future suppress a valid warning.


Ok, noted.

FYI, I have compiled backports-20150626 and observed this warning.


Chun-Yeow
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH] mac80211: remove compilation warning on mesh

2015-06-29 Thread Johannes Berg
On Mon, 2015-06-29 at 11:50 +0800, Chun-Yeow Yeoh wrote:
 Remove the warning on the following:
 mesh_hwmp.c: warning: ‘target_metric’ may be used
 uninitialized in this function [-Wmaybe-uninitialized]
 
I don't see any such warning, and would prefer not to have a blanket
initialization that might in the future suppress a valid warning.

johannes
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: Null pointer dereference when station associates [introduced by 4.0.5?]

2015-06-29 Thread Johannes Berg
On Sat, 2015-06-27 at 16:34 +0100, Tom Hughes wrote:
 
 Interestingly from what I can see this is trying to create a file
 for the station at a path something like:
 
 ieee80211/phy0/netdev:/stations/XX

indeed.

 but in my (currently working) boot under 4.0.4 there is no netdev
 directory under phy0 in debugfs... but then maybe that is the problem
 as well if the inode pointer was null?
 

This is pretty strange - if the dentry pointer (sdata
-debugfs.subdir_stations) was NULL or an ERR_PTR(), the code would
return pretty much immediately.

So it looks like that pointer is valid, but it's -d_inode was NULL?

I'm not really sure how that could happen.

Since 4.0.4 was stable, and 4.0.5 crashes, you'd think there's
something wrong between those two kernels and there were no changes to
mac80211 related to these code paths in there.

johannes
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH] mac80211: remove compilation warning on mesh

2015-06-29 Thread Johannes Berg
On Mon, 2015-06-29 at 15:41 +0800, Yeoh Chun-Yeow wrote:
 On Mon, Jun 29, 2015 at 3:27 PM, Johannes Berg
 johan...@sipsolutions.net wrote:
  On Mon, 2015-06-29 at 11:50 +0800, Chun-Yeow Yeoh wrote:
   Remove the warning on the following:
   mesh_hwmp.c: warning: ‘target_metric’ may be used
   uninitialized in this function [-Wmaybe-uninitialized]
   
  I don't see any such warning, and would prefer not to have a 
  blanket
  initialization that might in the future suppress a valid warning.
  
 
 Ok, noted.
 
 FYI, I have compiled backports-20150626 and observed this warning
 

It probably depends on the compiler version?

johannes
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: Null pointer dereference when station associates [introduced by 4.0.5?]

2015-06-29 Thread Tom Hughes
On 29/06/15 09:14, Johannes Berg wrote:
 On Sat, 2015-06-27 at 16:34 +0100, Tom Hughes wrote:

 Interestingly from what I can see this is trying to create a file
 for the station at a path something like:

 ieee80211/phy0/netdev:/stations/XX
 
 indeed.
 
 but in my (currently working) boot under 4.0.4 there is no netdev
 directory under phy0 in debugfs... but then maybe that is the problem
 as well if the inode pointer was null?

 
 This is pretty strange - if the dentry pointer (sdata
 -debugfs.subdir_stations) was NULL or an ERR_PTR(), the code would
 return pretty much immediately.
 
 So it looks like that pointer is valid, but it's -d_inode was NULL?
 
 I'm not really sure how that could happen.

Indeed I'm a bit puzzled... I can't see anything obvious in the kernel
logs indicating a problem, but here's a listing of the phy0 directory:

[root@gosford]/home/tom# uname -a
Linux gosford.compton.nu 4.0.4-301.fc22.i686+PAE #1 SMP Thu May 21 13:27:48 UTC 
2015 i686 i686 i386 GNU/Linux
[root@gosford]/home/tom# ls /sys/kernel/debug/ieee80211/phy0 
ath9kkeys  rc statistics
fragmentation_threshold  long_retry_limit  reset  total_ps_buffered
ht40allow_mappower rts_threshold  user_power
hwflags  queuesshort_retry_limit  wep_iv

with no netdev directory at all.

Interestingly I just tried a different machine running on more or less
the same kernel with a USB wireless stick and that did get a netdev
directory...

 Since 4.0.4 was stable, and 4.0.5 crashes, you'd think there's
 something wrong between those two kernels and there were no changes to
 mac80211 related to these code paths in there.

Well 4.0.4 did hit it eventually, but it had been running stably
for a month first. I then rebooted (because networking is basically
wedged after this happens) and got 4.0.5 which hit it immediately as
did several more reboots before I went back to the older kernel.

Tom


-- 
Tom Hughes (t...@compton.nu)
http://compton.nu/
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: iw and non-ASCII SSIDs

2015-06-29 Thread Johannes Berg
[please don't use HTML]

On Mon, 2015-06-29 at 08:17 +, Joerg Pommnitz wrote:
 We don't have to break compatibility. The commandline syntax of iw is
 iw [options] command
 My suggestion would be a new option --binary-ssid that sets a flag 
 and causes all SSID to be treated as a hex encoded binary blob:
 iw --binary-ssid dev wlan0 ibss join 0034AA 2412
 and for consistency
 iw --binary-ssid dev wlan0 connect 0034AA
 
 Alternatively the option could be --escaped-ssid that would 
 activate an escape processing for the SSID as you suggested. My 
 preference is --binary-ssid, because I'm always a little bit unsure 
 what actually arrives in the program after the shell has done its own 
 escape processing.
 


Yeah, that seems reasonable, though perhaps easier to do as

  iw dev wlan0 ibss join --binary-ssid 0034AA 2412

since options before the command are treated as generic iw options.

Then again, if all places that use an SSID were to use a
parse_ssid(argv[7]) function then the former could also be
implemented.

johannes
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[PATCH] rtlwifi: Trivial: fix typo in comments

2015-06-29 Thread Nik Nyby
This fixes a typo in two comments: paht - path.

Signed-off-by: Nik Nyby niko...@gnu.org
---
 drivers/net/wireless/rtlwifi/rtl8192de/phy.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c 
b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
index 1961b8e..bb06fe8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
@@ -3515,14 +3515,14 @@ void rtl92d_update_bbrf_configuration(struct 
ieee80211_hw *hw)
for (rfpath = RF90_PATH_A; rfpath  rtlphy-num_total_rfpath;
 rfpath++) {
if (rtlhal-current_bandtype == BAND_ON_2_4G) {
-   /* MOD_AG for RF paht_A 0x18 BIT8,BIT16 */
+   /* MOD_AG for RF path_A 0x18 BIT8,BIT16 */
rtl_set_rfreg(hw, rfpath, RF_CHNLBW, BIT(8) | BIT(16) |
  BIT(18), 0);
/* RF0x0b[16:14] =3b'111 */
rtl_set_rfreg(hw, (enum radio_path)rfpath, 0x0B,
  0x1c000, 0x07);
} else {
-   /* MOD_AG for RF paht_A 0x18 BIT8,BIT16 */
+   /* MOD_AG for RF path_A 0x18 BIT8,BIT16 */
rtl_set_rfreg(hw, rfpath, RF_CHNLBW, BIT(8) |
  BIT(16) | BIT(18),
  (BIT(16) | BIT(8))  8);
-- 
2.1.4

--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH] b43: Fix typo in function name

2015-06-29 Thread Larry Finger

On 06/29/2015 07:45 PM, Nik Nyby wrote:

This fixes a typo in the b43_lo_g_maintenance_work function
name.

Signed-off-by: Nik Nyby niko...@gnu.org
---
  drivers/net/wireless/b43/lo.c| 4 ++--
  drivers/net/wireless/b43/lo.h| 2 +-
  drivers/net/wireless/b43/phy_g.c | 2 +-
  3 files changed, 4 insertions(+), 4 deletions(-)


This patch is OK; however, can there really be a typo in a function name? How do 
you ever know that the author did not mean to use a name that looks like a typo?


Please be careful with these.

Acked-by: Larry Finger larry.fin...@lwfinger.net

Larry



diff --git a/drivers/net/wireless/b43/lo.c b/drivers/net/wireless/b43/lo.c
index 916123a..a335f94 100644
--- a/drivers/net/wireless/b43/lo.c
+++ b/drivers/net/wireless/b43/lo.c
@@ -929,8 +929,8 @@ void b43_lo_g_adjust_to(struct b43_wldev *dev,
b43_lo_write(dev, cal-ctl);
  }

-/* Periodic LO maintanance work */
-void b43_lo_g_maintanance_work(struct b43_wldev *dev)
+/* Periodic LO maintenance work */
+void b43_lo_g_maintenance_work(struct b43_wldev *dev)
  {
struct b43_phy *phy = dev-phy;
struct b43_phy_g *gphy = phy-g;
diff --git a/drivers/net/wireless/b43/lo.h b/drivers/net/wireless/b43/lo.h
index 3b27e20..7b4df38 100644
--- a/drivers/net/wireless/b43/lo.h
+++ b/drivers/net/wireless/b43/lo.h
@@ -80,7 +80,7 @@ void b43_lo_g_adjust_to(struct b43_wldev *dev,

  void b43_gphy_dc_lt_init(struct b43_wldev *dev, bool update_all);

-void b43_lo_g_maintanance_work(struct b43_wldev *dev);
+void b43_lo_g_maintenance_work(struct b43_wldev *dev);
  void b43_lo_g_cleanup(struct b43_wldev *dev);
  void b43_lo_g_init(struct b43_wldev *dev);

diff --git a/drivers/net/wireless/b43/phy_g.c b/drivers/net/wireless/b43/phy_g.c
index 727ce6e..462310e 100644
--- a/drivers/net/wireless/b43/phy_g.c
+++ b/drivers/net/wireless/b43/phy_g.c
@@ -3004,7 +3004,7 @@ static void b43_gphy_op_pwork_15sec(struct b43_wldev *dev)
   phy-rev == 1) {
//TODO: implement rev1 workaround
}
-   b43_lo_g_maintanance_work(dev);
+   b43_lo_g_maintenance_work(dev);
b43_mac_enable(dev);
  }




--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH v4] Add new mac80211 driver mwlwifi.

2015-06-29 Thread Joe Perches
On Tue, 2015-06-30 at 01:49 +, David Lin wrote:
 The Linux driver for WRT1900AC. The work was initially developed as part of
 openwrt effort and maintained on https://github.com/kaloz/mwlwifi.

trivia:

Please add terminating newlines to logging messages.
This prevents interleaving output from multiple threads.

 diff --git a/drivers/net/wireless/mwlwifi/fwcmd.c 
 b/drivers/net/wireless/mwlwifi/fwcmd.c
[]
 +static bool mwl_fwcmd_chk_adapter(struct mwl_priv *priv)
 +{
[]
 + if (regval == 0x) {
 + wiphy_err(priv-hw-wiphy, adapter is not existed);

wiphy_err(priv-hw-wiphy, adapter is not existed\n);

 +static int mwl_fwcmd_wait_complete(struct mwl_priv *priv, unsigned short cmd)
 +{
[]
 + if (curr_iteration == 0) {
 + wiphy_err(priv-hw-wiphy, cmd 0x%04x=%s timed out,

wiphy_err(priv-hw-wiphy, cmd 0x%04x=%s timed out\n,

etc...


--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[PATCH] b43: Fix typo in function name

2015-06-29 Thread Nik Nyby
This fixes a typo in the b43_lo_g_maintenance_work function
name.

Signed-off-by: Nik Nyby niko...@gnu.org
---
 drivers/net/wireless/b43/lo.c| 4 ++--
 drivers/net/wireless/b43/lo.h| 2 +-
 drivers/net/wireless/b43/phy_g.c | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/b43/lo.c b/drivers/net/wireless/b43/lo.c
index 916123a..a335f94 100644
--- a/drivers/net/wireless/b43/lo.c
+++ b/drivers/net/wireless/b43/lo.c
@@ -929,8 +929,8 @@ void b43_lo_g_adjust_to(struct b43_wldev *dev,
b43_lo_write(dev, cal-ctl);
 }
 
-/* Periodic LO maintanance work */
-void b43_lo_g_maintanance_work(struct b43_wldev *dev)
+/* Periodic LO maintenance work */
+void b43_lo_g_maintenance_work(struct b43_wldev *dev)
 {
struct b43_phy *phy = dev-phy;
struct b43_phy_g *gphy = phy-g;
diff --git a/drivers/net/wireless/b43/lo.h b/drivers/net/wireless/b43/lo.h
index 3b27e20..7b4df38 100644
--- a/drivers/net/wireless/b43/lo.h
+++ b/drivers/net/wireless/b43/lo.h
@@ -80,7 +80,7 @@ void b43_lo_g_adjust_to(struct b43_wldev *dev,
 
 void b43_gphy_dc_lt_init(struct b43_wldev *dev, bool update_all);
 
-void b43_lo_g_maintanance_work(struct b43_wldev *dev);
+void b43_lo_g_maintenance_work(struct b43_wldev *dev);
 void b43_lo_g_cleanup(struct b43_wldev *dev);
 void b43_lo_g_init(struct b43_wldev *dev);
 
diff --git a/drivers/net/wireless/b43/phy_g.c b/drivers/net/wireless/b43/phy_g.c
index 727ce6e..462310e 100644
--- a/drivers/net/wireless/b43/phy_g.c
+++ b/drivers/net/wireless/b43/phy_g.c
@@ -3004,7 +3004,7 @@ static void b43_gphy_op_pwork_15sec(struct b43_wldev *dev)
   phy-rev == 1) {
//TODO: implement rev1 workaround
}
-   b43_lo_g_maintanance_work(dev);
+   b43_lo_g_maintenance_work(dev);
b43_mac_enable(dev);
 }
 
-- 
2.1.4

--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH] rtlwifi: Trivial: fix typo in comments

2015-06-29 Thread Larry Finger

On 06/29/2015 07:17 PM, Nik Nyby wrote:

This fixes a typo in two comments: paht - path.

Signed-off-by: Nik Nyby niko...@gnu.org
---
  drivers/net/wireless/rtlwifi/rtl8192de/phy.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)



Acked-by: Larry Finger larry.fin...@lwfinger.net

Larry


diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c 
b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
index 1961b8e..bb06fe8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
@@ -3515,14 +3515,14 @@ void rtl92d_update_bbrf_configuration(struct 
ieee80211_hw *hw)
for (rfpath = RF90_PATH_A; rfpath  rtlphy-num_total_rfpath;
 rfpath++) {
if (rtlhal-current_bandtype == BAND_ON_2_4G) {
-   /* MOD_AG for RF paht_A 0x18 BIT8,BIT16 */
+   /* MOD_AG for RF path_A 0x18 BIT8,BIT16 */
rtl_set_rfreg(hw, rfpath, RF_CHNLBW, BIT(8) | BIT(16) |
  BIT(18), 0);
/* RF0x0b[16:14] =3b'111 */
rtl_set_rfreg(hw, (enum radio_path)rfpath, 0x0B,
  0x1c000, 0x07);
} else {
-   /* MOD_AG for RF paht_A 0x18 BIT8,BIT16 */
+   /* MOD_AG for RF path_A 0x18 BIT8,BIT16 */
rtl_set_rfreg(hw, rfpath, RF_CHNLBW, BIT(8) |
  BIT(16) | BIT(18),
  (BIT(16) | BIT(8))  8);



--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


RE: [PATCH v4] Add new mac80211 driver mwlwifi.

2015-06-29 Thread David Lin
 Joe Perches wrote:
 
 On Tue, 2015-06-30 at 01:49 +, David Lin wrote:
  The Linux driver for WRT1900AC. The work was initially developed as
  part of openwrt effort and maintained on https://github.com/kaloz/mwlwifi.
 
 trivia:
 
 Please add terminating newlines to logging messages.
 This prevents interleaving output from multiple threads.
 
  diff --git a/drivers/net/wireless/mwlwifi/fwcmd.c
  b/drivers/net/wireless/mwlwifi/fwcmd.c
 []
  +static bool mwl_fwcmd_chk_adapter(struct mwl_priv *priv) {
 []
  +   if (regval == 0x) {
  +   wiphy_err(priv-hw-wiphy, adapter is not existed);
 
   wiphy_err(priv-hw-wiphy, adapter is not existed\n);
 
  +static int mwl_fwcmd_wait_complete(struct mwl_priv *priv, unsigned
  +short cmd) {
 []
  +   if (curr_iteration == 0) {
  +   wiphy_err(priv-hw-wiphy, cmd 0x%04x=%s timed out,
 
   wiphy_err(priv-hw-wiphy, cmd 0x%04x=%s timed out\n,
 
 etc...
 
Should be modified in next patch.
--
To unsubscribe from this list: send the line unsubscribe linux-wireless in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html