3.0-stable patches

added patches:
	alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch
	ath9k-always-clear-ps-filter-bit-on-new-assoc.patch
	ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch
	hid-pantherlord-validate-output-report-details.patch

diff --git a/queue-3.0/alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch b/queue-3.0/alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch
new file mode 100644 (file)
index 0000000..d80fb77
--- /dev/null
+++ b/queue-3.0/alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch
@@ -0,0 +1,31 @@
+From 83f72151352791836a1b9c1542614cc9bf71ac61 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 9 Sep 2013 10:20:48 +0200
+Subject: ALSA: hda - Add Toshiba Satellite C870 to MSI blacklist
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 83f72151352791836a1b9c1542614cc9bf71ac61 upstream.
+
+Toshiba Satellite C870 shows interrupt problems occasionally when
+certain mixer controls like "Mic Switch" is toggled.  This seems
+worked around by not using MSI.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=833585
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2461,6 +2461,7 @@ static struct snd_pci_quirk msi_black_li
+       SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+       SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+       SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++      SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+       SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+       SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+       {}

diff --git a/queue-3.0/ath9k-always-clear-ps-filter-bit-on-new-assoc.patch b/queue-3.0/ath9k-always-clear-ps-filter-bit-on-new-assoc.patch
new file mode 100644 (file)
index 0000000..5c025c4
--- /dev/null
+++ b/queue-3.0/ath9k-always-clear-ps-filter-bit-on-new-assoc.patch
@@ -0,0 +1,30 @@
+From 026d5b07c03458f9c0ccd19c3850564a5409c325 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 6 Aug 2013 14:18:10 +0200
+Subject: ath9k: always clear ps filter bit on new assoc
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 026d5b07c03458f9c0ccd19c3850564a5409c325 upstream.
+
+Otherwise in some cases, EAPOL frames might be filtered during the
+initial handshake, causing delays and assoc failures.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2433,6 +2433,7 @@ void ath_tx_node_init(struct ath_softc *
+       for (acno = 0, ac = &an->ac[acno];
+            acno < WME_NUM_AC; acno++, ac++) {
+               ac->sched    = false;
++              ac->clear_ps_filter = true;
+               ac->txq = sc->tx.txq_map[acno];
+               INIT_LIST_HEAD(&ac->tid_q);
+       }

diff --git a/queue-3.0/ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch b/queue-3.0/ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch
new file mode 100644 (file)
index 0000000..8282b6f
--- /dev/null
+++ b/queue-3.0/ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch
@@ -0,0 +1,32 @@
+From a1c781bb20ac1e03280e420abd47a99eb8bbdd3b Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 13 Aug 2013 12:33:28 +0200
+Subject: ath9k: avoid accessing MRC registers on single-chain devices
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit a1c781bb20ac1e03280e420abd47a99eb8bbdd3b upstream.
+
+They are not implemented, and accessing them might trigger errors
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_phy.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1005,6 +1005,10 @@ static bool ar9003_hw_ani_control(struct
+                * is_on == 0 means MRC CCK is OFF (more noise imm)
+                */
+               bool is_on = param ? 1 : 0;
++
++              if (ah->caps.rx_chainmask == 1)
++                      break;
++
+               REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+                             AR_PHY_MRC_CCK_ENABLE, is_on);
+               REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,

diff --git a/queue-3.0/hid-pantherlord-validate-output-report-details.patch b/queue-3.0/hid-pantherlord-validate-output-report-details.patch
new file mode 100644 (file)
index 0000000..3f124e8
--- /dev/null
+++ b/queue-3.0/hid-pantherlord-validate-output-report-details.patch
@@ -0,0 +1,46 @@
+From 412f30105ec6735224535791eed5cdc02888ecb4 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 28 Aug 2013 22:30:49 +0200
+Subject: HID: pantherlord: validate output report details
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 412f30105ec6735224535791eed5cdc02888ecb4 upstream.
+
+A HID device could send a malicious output report that would cause the
+pantherlord HID driver to write beyond the output report allocation
+during initialization, causing a heap overflow:
+
+[  310.939483] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003
+...
+[  315.980774] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten
+
+CVE-2013-2892
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-pl.c |   10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -128,8 +128,14 @@ static int plff_init(struct hid_device *
+                       strong = &report->field[0]->value[2];
+                       weak = &report->field[0]->value[3];
+                       debug("detected single-field device");
+-              } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+-                              report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++              } else if (report->field[0]->maxusage == 1 &&
++                         report->field[0]->usage[0].hid ==
++                              (HID_UP_LED | 0x43) &&
++                         report->maxfield >= 4 &&
++                         report->field[0]->report_count >= 1 &&
++                         report->field[1]->report_count >= 1 &&
++                         report->field[2]->report_count >= 1 &&
++                         report->field[3]->report_count >= 1) {
+                       report->field[0]->value[0] = 0x00;
+                       report->field[1]->value[0] = 0x00;
+                       strong = &report->field[2]->value[0];

diff --git a/queue-3.0/series b/queue-3.0/series
index ee51b2bd709a79ef34a13132a7cac35cbc4a5da1..b5736b85d1fe1417c43b939da77a5509f03cc4ac 100644 (file)
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -12,3 +12,7 @@ usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch
 usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch
 rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch
 asoc-wm8960-fix-pll-register-writes.patch
+alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch
+ath9k-always-clear-ps-filter-bit-on-new-assoc.patch
+ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch
+hid-pantherlord-validate-output-report-details.patch