mac80211: report deauth to cfg80211 for local state change

Even if the frame isn't transmitted to the AP, we need to
report it to cfg80211 so the state there can be updated
correctly.

Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
cfg80211: fix sending WoWLAN TCP wakeup settings

The code sending the current WoWLAN TCP wakeup settings in
nl80211_send_wowlan_tcp() is not closing the nested attribute,
thus causing the parser to get confused on the receiver side
in userspace (iw). Fix this.

Cc: stable@vger.kernel.org [3.9]
Reported-by: Deepak Arora <deepakx.arora@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
iwlwifi: mvm: Always use SCAN_TYPE_FORCED

The FW AUX framework does not handle well cases where time events
fail to be scheduled (and as a result issues assert 0x3330). Until
a proper fix is in place, WA this by always setting the scan type to
SCAN_TYPE_FORCED.

Cc: stable@vger.kernel.org
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
iwlwifi: mvm: tell firmware to let multicast frames in

Without this command, the firmware will filter out all the
multicast frames. Let them all in as for now. Later we will
want to optimize this to save power.

Cc: stable@vger.kernel.org
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
iwlwifi: mvm: Prevent setting assoc flag in MAC_CONTEXT_CMD

In the normal flow first MAC_CONTEXT_CMD for particular interface is
never sent while associated. The exception is fw restart flow when
resuming from suspend when WoWLAN is enabled. In this case successive
"add" and "modify" MAC_CONTEXT_CMD commands may be sent with assoc flag
set what cause FW mal functioning. To prevent this never set assoc flag
in MAC_CONTEXT_CMD with action "add".

Cc: stable@vger.kernel.org
Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
iwlwifi: mvm: fix aggregation drain flow

Move the counter for non-AMPDU frames to mvm. It is needed
for the drain flow which happens once the ieee80211_sta has
been freed, so keeping it in iwl_mvm_sta which is embed into
ieee80211_sta is not a good idea.

Also, since its purpose it to remove the STA in the fw only
after all the frames for this station have exited the shared
Tx queues, we need to decrement it in the reclaim flow. This
flow can happen after ieee80211_sta has been removed, which
means that we have no iwl_mvm_sta there. So we can't know
what is the vif type. Hence, we know audit these frames for
all the vif types.
In order to avoid spawning sta_drained_wk all the time, we
now check that we are in a flow in which draining might
happen - only when mvmsta is NULL. This is better than
previous code that would spawn sta_drained_wk all the time
in AP mode.

Cc: stable@vger.kernel.org [3.9]
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers: char: ipmi: Replaced kmalloc and strcpy with kstrdup

Replaced calls to kmalloc followed by strcpy with a sincle call to
kstrdup.  Patch found using coccinelle.

Signed-off-by: Alexandru Gheorghiu <gheorghiuandru@gmail.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/char/ipmi: memcpy, need additional 2 bytes to avoid memory overflow

When calling memcpy, read_data and write_data need additional 2 bytes.

  write_data:
    for checking:  "if (size > IPMI_MAX_MSG_LENGTH)"
    for operating: "memcpy(bt->write_data + 3, data + 1, size - 1)"

  read_data:
    for checking:  "if (msg_len < 3 || msg_len > IPMI_MAX_MSG_LENGTH)"
    for operating: "memcpy(data + 2, bt->read_data + 4, msg_len - 2)"

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
ipmi: Improve error messages on failed irq enable

When the interrupt enable message returns an error, the messages are
not entirely accurate nor helpful.  So improve them.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
ipmi: ipmi_devintf: compat_ioctl method fails to take ipmi_mutex

When a 32 bit version of ipmitool is used on a 64 bit kernel, the
ipmi_devintf code fails to correctly acquire ipmi_mutex.  This results in
incomplete data being retrieved in some cases, or other possible failures.
Add a wrapper around compat_ipmi_ioctl() to take ipmi_mutex to fix this.

Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Merge branch 'ipmi' (minor ipmi fixes from Corey)

Merge ipmi fixes from Corey Minyard:
 "Some minor fixes I had queued up.  The last one came in recently
  (patch 4) and it and patch 2 are candidates for stable-kernel."

* emailed patches from Corey Minyard <cminyard@mvista.com>:
  ipmi: ipmi_devintf: compat_ioctl method fails to take ipmi_mutex
  ipmi: Improve error messages on failed irq enable
  drivers/char/ipmi: memcpy, need additional 2 bytes to avoid memory overflow
  drivers: char: ipmi: Replaced kmalloc and strcpy with kstrdup
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says:

====================
The following patchset contains three Netfilter fixes and update
for the MAINTAINER file for your net tree, they are:

* Fix crash if nf_log_packet is called from conntrack, in that case
  both interfaces are NULL, from Hans Schillstrom. This bug introduced
  with the logging netns support in the previous merge window.

* Fix compilation of nf_log and nf_queue without CONFIG_PROC_FS,
  from myself. This bug was introduced in the previous merge window
  with the new netns support for the netfilter logging infrastructure.

* Fix possible crash in xt_TCPOPTSTRIP due to missing sanity
  checkings to validate that the TCP header is well-formed, from
  myself. I can find this bug in 2.6.25, probably it's been there
  since the beginning. I'll pass this to -stable.

* Update MAINTAINER file to point to new nf trees at git.kernel.org,
  remove Harald and use M: instead of P: (now obsolete tag) to
  keep Jozsef in the list of people.

Please, consider pulling this. Thanks!
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
tcp: gso: do not generate out of order packets

GSO TCP handler has following issues :

1) ooo_okay from original GSO packet is duplicated to all segments
2) segments (but the last one) are orphaned, so transmit path can not
get transmit queue number from the socket. This happens if GSO
segmentation is done before stacked device for example.

Result is we can send packets from a given TCP flow to different TX
queues (if using multiqueue NICS). This generates OOO problems and
spurious SACK & retransmits.

Fix this by keeping socket pointer set for all segments.

This means that every segment must also have a destructor, and the
original gso skb truesize must be split on all segments, to keep
precise sk->sk_wmem_alloc accounting.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Maciej Żenczykowski <maze@google.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
NET: mv643xx_eth: avoid lockdep dump on interface down

When the interface is shutdown, the mv643xx_eth driver hits the following
lockdep dump:

=================================
[ INFO: inconsistent lock state ]
3.8.0+ #303 Not tainted
---------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
NetworkManager/3449 [HC0[0]:SC0[0]:HE1:SE1] takes:
 (_xmit_ETHER#2){+.?...}, at: [<c02828e4>] txq_reclaim+0x60/0x230
{IN-SOFTIRQ-W} state was registered at:
  [<c007e93c>] mark_irqflags+0xf8/0x1c4
  [<c007ee60>] __lock_acquire+0x458/0x9a4
  [<c007f8b0>] lock_acquire+0x60/0x74
  [<c03ea914>] _raw_spin_lock+0x40/0x50
  [<c0334040>] sch_direct_xmit+0xa4/0x2e4
  [<c0320880>] dev_queue_xmit+0x174/0x508
  [<c03953b0>] ip6_finish_output2+0xd0/0x3c4
  [<c03b15bc>] mld_sendpack+0x190/0x368
  [<c03b3204>] mld_ifc_timer_expire+0xc/0x58
  [<c005133c>] call_timer_fn+0x6c/0xe0
  [<c0051588>] run_timer_softirq+0x1d8/0x210
  [<c004c004>] __do_softirq+0xe0/0x1b4
  [<c004c448>] irq_exit+0x64/0x6c
  [<c000f1e0>] handle_IRQ+0x34/0x84
  [<c000e0d0>] __irq_usr+0x30/0x80
irq event stamp: 160603
hardirqs last  enabled at (160603): [<c00c736c>] kfree+0xa8/0xe8
hardirqs last disabled at (160602): [<c00c72e0>] kfree+0x1c/0xe8
softirqs last  enabled at (160304): [<c028260c>] mib_counters_update+0x5ec/0x60c
softirqs last disabled at (160302): [<c03eab8c>] _raw_spin_lock_bh+0x14/0x54

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(_xmit_ETHER#2);
  <Interrupt>
    lock(_xmit_ETHER#2);

 *** DEADLOCK ***

1 lock held by NetworkManager/3449:
 #0:  (rtnl_mutex){+.+.+.}, at: [<c032e664>] rtnetlink_rcv+0xc/0x24

stack backtrace:
[<c0013e34>] (unwind_backtrace+0x0/0xf8) from [<c007e12c>] (print_usage_bug+0x150/0x1d4)
[<c007e12c>] (print_usage_bug+0x150/0x1d4) from [<c007e3f8>] (mark_lock_irq+0x248/0x290)
[<c007e3f8>] (mark_lock_irq+0x248/0x290) from [<c007e598>] (mark_lock+0x158/0x404)
[<c007e598>] (mark_lock+0x158/0x404) from [<c007e97c>] (mark_irqflags+0x138/0x1c4)
[<c007e97c>] (mark_irqflags+0x138/0x1c4) from [<c007ee60>] (__lock_acquire+0x458/0x9a4)
[<c007ee60>] (__lock_acquire+0x458/0x9a4) from [<c007f8b0>] (lock_acquire+0x60/0x74)
[<c007f8b0>] (lock_acquire+0x60/0x74) from [<c03ea914>] (_raw_spin_lock+0x40/0x50)
[<c03ea914>] (_raw_spin_lock+0x40/0x50) from [<c02828e4>] (txq_reclaim+0x60/0x230)
[<c02828e4>] (txq_reclaim+0x60/0x230) from [<c0282ad8>] (txq_deinit+0x24/0xcc)
[<c0282ad8>] (txq_deinit+0x24/0xcc) from [<c0282d28>] (mv643xx_eth_stop+0x1a8/0x1bc)
[<c0282d28>] (mv643xx_eth_stop+0x1a8/0x1bc) from [<c031e314>] (__dev_close_many+0x88/0xcc)
[<c031e314>] (__dev_close_many+0x88/0xcc) from [<c031e380>] (__dev_close+0x28/0x3c)
[<c031e380>] (__dev_close+0x28/0x3c) from [<c0320fa0>] (__dev_change_flags+0x7c/0x134)
[<c0320fa0>] (__dev_change_flags+0x7c/0x134) from [<c03210e0>] (dev_change_flags+0x10/0x48)
[<c03210e0>] (dev_change_flags+0x10/0x48) from [<c032da1c>] (do_setlink+0x1a0/0x730)
[<c032da1c>] (do_setlink+0x1a0/0x730) from [<c032f524>] (rtnl_newlink+0x304/0x4b0)
[<c032f524>] (rtnl_newlink+0x304/0x4b0) from [<c032ef8c>] (rtnetlink_rcv_msg+0x25c/0x2a0)
[<c032ef8c>] (rtnetlink_rcv_msg+0x25c/0x2a0) from [<c03383a0>] (netlink_rcv_skb+0xbc/0xd8)
[<c03383a0>] (netlink_rcv_skb+0xbc/0xd8) from [<c032e674>] (rtnetlink_rcv+0x1c/0x24)
[<c032e674>] (rtnetlink_rcv+0x1c/0x24) from [<c03361d8>] (netlink_unicast_kernel+0x88/0xd4)
[<c03361d8>] (netlink_unicast_kernel+0x88/0xd4) from [<c0337dd0>] (netlink_unicast+0x138/0x180)
[<c0337dd0>] (netlink_unicast+0x138/0x180) from [<c0338020>] (netlink_sendmsg+0x208/0x32c)
[<c0338020>] (netlink_sendmsg+0x208/0x32c) from [<c030ab48>] (sock_sendmsg+0x84/0xa4)
[<c030ab48>] (sock_sendmsg+0x84/0xa4) from [<c030aef4>] (__sys_sendmsg+0x2ac/0x2c4)
[<c030aef4>] (__sys_sendmsg+0x2ac/0x2c4) from [<c030c8ec>] (sys_sendmsg+0x3c/0x68)
[<c030c8ec>] (sys_sendmsg+0x3c/0x68) from [<c000e2e0>] (ret_fast_syscall+0x0/0x3c)

It seems that txq_reclaim() takes the netif tx lock:

        __netif_tx_lock(nq, smp_processor_id());

in a context outside of softirq context, and thus is susceptible to
deadlock should an interrupt occur.

Use __netif_tx_lock_bh()/__netif_tx_unlock_bh() instead.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
bonding: allow TSO being set on bonding master

In some situations, we need to disable TSO on bonding slaves.

bonding device automatically unset TSO in bond_fix_features(), and
performance is not good because :

1) We consume more cpu cycles.

2) GSO segmentation has some bugs leading to out of order TCP packets
if this segmentation is done before virtual device. This particular
problem will be addressed in a separate patch.

This patch allows TSO being set/unset on the bonding master,
so that GSO segmentation is done after bonding layer.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Michał Mirosław <mirqus@gmail.com>
Cc: Jay Vosburgh <fubar@us.ibm.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Cc: Maciej Żenczykowski <maze@google.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge tag 'ntb-bugfixes-3.10' of git://github.com/jonmason/ntb

Pull NTB update from Jon Mason:
 "NTB bug fixes to address Smatch/Coverity errors, link toggling bugs,
  and a few corner cases in the driver."

This pull request came in during the merge window, but without any
signage etc.  So I'm taking it late, because it wasn't _originally_
late.

* tag 'ntb-bugfixes-3.10' of git://github.com/jonmason/ntb:
  NTB: Multiple NTB client fix
  ntb_netdev: remove from list on exit
  NTB: memcpy lockup workaround
  NTB: Correctly handle receive buffers of the minimal size
  NTB: reset tx_index on link toggle
  NTB: Link toggle memory leak
  NTB: Handle 64bit BAR sizes
  NTB: fix pointer math issues
  ntb: off by one sanity checks
  NTB: variable dereferenced before check
Merge tag 'pm+acpi-3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management and ACPI fixes from Rafael Wysocki:

 - intel_pstate driver fixes and cleanups from Dirk Brandewie and Wei
   Yongjun.

 - cpufreq fixes related to ARM big.LITTLE support and the cpufreq-cpu0
   driver from Viresh Kumar.

 - Assorted cpufreq fixes from Srivatsa S Bhat, Borislav Petkov, Wolfram
   Sang, Alexander Shiyan, and Nishanth Menon.

 - Assorted ACPI fixes from Catalin Marinas, Lan Tianyu, Alex Hung,
   Jan-Simon Möller, and Rafael J Wysocki.

 - Fix for a kfree() under spinlock in the PM core from Shuah Khan.

 - PM documentation updates from Borislav Petkov and Zhang Rui.

* tag 'pm+acpi-3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (30 commits)
  cpufreq: Preserve sysfs files across suspend/resume
  ACPI / scan: Fix memory leak on acpi_scan_init_hotplug() error path
  PM / hibernate: Correct documentation
  PM / Documentation: remove inaccurate suspend/hibernate transition lantency statement
  PM: Documentation update for freeze state
  cpufreq / intel_pstate: use vzalloc() instead of vmalloc()/memset(0)
  cpufreq, ondemand: Remove leftover debug line
  PM: Avoid calling kfree() under spinlock in dev_pm_put_subsys_data()
  cpufreq / kirkwood: don't check resource with devm_ioremap_resource
  cpufreq / intel_pstate: remove #ifdef MODULE compile fence
  cpufreq / intel_pstate: Remove idle mode PID
  cpufreq / intel_pstate: fix ffmpeg regression
  cpufreq / intel_pstate: use lowest requested max performance
  cpufreq / intel_pstate: remove idle time and duration from sample and calculations
  cpufreq: Fix incorrect dependecies for ARM SA11xx drivers
  cpufreq: ARM big LITTLE: Fix Kconfig entries
  cpufreq: cpufreq-cpu0: Free parent node for error cases
  cpufreq: cpufreq-cpu0: defer probe when regulator is not ready
  cpufreq: Issue CPUFREQ_GOV_POLICY_EXIT notifier before dropping policy refcount
  cpufreq: governors: Fix CPUFREQ_GOV_POLICY_{INIT|EXIT} notifiers
  ...
staging: sep: fix driver build and kconfig

Fix build errors in staging/sep/ by making DX_SEP depend on
CRYPTO.

drivers/built-in.o: In function `sep_sha1_init':
sep_crypto.c:(.text+0x245ece): undefined reference to `crypto_enqueue_request'
drivers/built-in.o: In function `sep_sha1_update':
sep_crypto.c:(.text+0x245f4f): undefined reference to `crypto_enqueue_request'
drivers/built-in.o: In function `sep_sha1_final':
sep_crypto.c:(.text+0x245fcf): undefined reference to `crypto_enqueue_request'
drivers/built-in.o: In function `sep_sha1_finup':
sep_crypto.c:(.text+0x24604f): undefined reference to `crypto_enqueue_request'
drivers/built-in.o: In function `sep_sha1_digest':
sep_crypto.c:(.text+0x2460de): undefined reference to `crypto_enqueue_request'
drivers/built-in.o:sep_crypto.c:(.text+0x24616e): more undefined references to `crypto_enqueue_request' follow
drivers/built-in.o: In function `sep_crypto_block':
sep_crypto.c:(.text+0x247c81): undefined reference to `ablkcipher_walk_phys'
sep_crypto.c:(.text+0x247e40): undefined reference to `ablkcipher_walk_phys'
drivers/built-in.o: In function `sep_dequeuer':
sep_crypto.c:(.text+0x248ab9): undefined reference to `crypto_dequeue_request'
sep_crypto.c:(.text+0x248afa): undefined reference to `crypto_ahash_type'
sep_crypto.c:(.text+0x248fdf): undefined reference to `crypto_dequeue_request'
drivers/built-in.o: In function `sep_crypto_setup':
(.text+0x24902a): undefined reference to `crypto_init_queue'
drivers/built-in.o: In function `sep_crypto_setup':
(.text+0x24909c): undefined reference to `crypto_register_ahash'
drivers/built-in.o: In function `sep_crypto_setup':
(.text+0x2490c4): undefined reference to `crypto_register_alg'
drivers/built-in.o: In function `sep_crypto_setup':
(.text+0x2490f7): undefined reference to `crypto_unregister_alg'
drivers/built-in.o: In function `sep_crypto_setup':
(.text+0x249118): undefined reference to `crypto_unregister_ahash'
drivers/built-in.o: In function `sep_crypto_takedown':
(.text+0x249176): undefined reference to `crypto_unregister_ahash'
drivers/built-in.o: In function `sep_crypto_takedown':
(.text+0x249197): undefined reference to `crypto_unregister_alg'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: ste_rmi4: Suppress 'ignoring return value of ‘regulator_enable()' warning

drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c:
        In function ‘synaptics_rmi4_resume’:
drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c:1090:18:
        warning: ignoring return value of ‘regulator_enable’, declared
        with attribute warn_unused_result [-Wunused-result

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: devel@driverdev.osuosl.org
Acked-by: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging/drm: imx: add missing dependencies

The imx DRM driver needs a couple of extra Kconfig dependencies
to avoid random build failures:

drivers/staging/imx-drm/ipuv3-crtc.c:448:
 undefined reference to `ipu_idmac_put'
 drivers/staging/imx-drm/ipuv3-crtc.c:450: undefined reference to
 `ipu_dmfc_put' drivers/staging/imx-drm/ipuv3-crtc.c:452:
 undefined reference to `ipu_dp_put'
 drivers/staging/imx-drm/ipuv3-crtc.c:454: undefined reference to
 `ipu_di_put'
drivers/built-in.o: In function `ipu_probe':
 :(.text+0x4b4174): undefined reference to `device_reset'
drivers/built-in.o: In function `imx_tve_probe':
 drivers/staging/imx-drm/imx-tve.c:648: undefined reference to
 `devm_regmap_init_mmio_clk'
drivers/built-in.o: In function
 `imx_pd_connector_get_modes':
 drivers/staging/imx-drm/parallel-display.c:78: undefined
 reference to `of_get_drm_display_mode'

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Shawn Guo <shawn.guo@linaro.org>
Cc: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>