4.2-stable patches

added patches:
	iwlwifi-dvm-fix-d3-firmware-pn-programming.patch
	iwlwifi-fix-firmware-filename-for-3160.patch

diff --git a/queue-4.2/iwlwifi-dvm-fix-d3-firmware-pn-programming.patch b/queue-4.2/iwlwifi-dvm-fix-d3-firmware-pn-programming.patch
new file mode 100644 (file)
index 0000000..5cbbdb6
--- /dev/null
+++ b/queue-4.2/iwlwifi-dvm-fix-d3-firmware-pn-programming.patch
@@ -0,0 +1,34 @@
+From 5bd166872d8f99f156fac191299d24f828bb2348 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 15 Sep 2015 14:36:09 +0200
+Subject: iwlwifi: dvm: fix D3 firmware PN programming
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 5bd166872d8f99f156fac191299d24f828bb2348 upstream.
+
+The code to send the RX PN data (for each TID) to the firmware
+has a devastating bug: it overwrites the data for TID 0 with
+all the TID data, leaving the remaining TIDs zeroed. This will
+allow replays to actually be accepted by the firmware, which
+could allow waking up the system.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/dvm/lib.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
++++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
+@@ -1022,7 +1022,7 @@ static void iwlagn_wowlan_program_keys(s
+                       u8 *pn = seq.ccmp.pn;
+ 
+                       ieee80211_get_key_rx_seq(key, i, &seq);
+-                      aes_sc->pn = cpu_to_le64(
++                      aes_sc[i].pn = cpu_to_le64(
+                                       (u64)pn[5] |
+                                       ((u64)pn[4] << 8) |
+                                       ((u64)pn[3] << 16) |

diff --git a/queue-4.2/iwlwifi-fix-firmware-filename-for-3160.patch b/queue-4.2/iwlwifi-fix-firmware-filename-for-3160.patch
new file mode 100644 (file)
index 0000000..91b6bac
--- /dev/null
+++ b/queue-4.2/iwlwifi-fix-firmware-filename-for-3160.patch
@@ -0,0 +1,32 @@
+From b5a48134f8af08f5243328f8a0b05fc5ae7cf343 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 22 Sep 2015 10:47:27 +0200
+Subject: iwlwifi: fix firmware filename for 3160
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit b5a48134f8af08f5243328f8a0b05fc5ae7cf343 upstream.
+
+The MODULE_FIRMWARE() for 3160 should be using the 7260 version as
+it's done in the device configuration struct instead of referencing
+IWL3160_UCODE_API_OK which doesn't even exist.
+
+Reported-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-7000.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
+@@ -348,6 +348,6 @@ const struct iwl_cfg iwl7265d_n_cfg = {
+ };
+ 
+ MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+-MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
++MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+ MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+ MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));

diff --git a/queue-4.2/series b/queue-4.2/series
index d14adb32a2ccd1b8855554e26876c39715e94069..e91a9f54595ce9d3eab183105770d3fa3a07b4ec 100644 (file)
--- a/queue-4.2/series
+++ b/queue-4.2/series
@@ -1,3 +1,5 @@
 mac80211-fix-hwflags-debugfs-file-format.patch
 ath9k-declare-required-extra-tx-headroom.patch
 mmc-core-fix-init_card-in-52mhz.patch
+iwlwifi-dvm-fix-d3-firmware-pn-programming.patch
+iwlwifi-fix-firmware-filename-for-3160.patch