--- /dev/null
+From df29df92adda751ac04ca5149d30014b5199db81 Mon Sep 17 00:00:00 2001
+From: Carolyn Wyborny <carolyn.wyborny@intel.com>
+Date: Sat, 14 Dec 2013 03:26:46 -0800
+Subject: igb: Fix for issue where values could be too high for udelay function.
+
+From: Carolyn Wyborny <carolyn.wyborny@intel.com>
+
+commit df29df92adda751ac04ca5149d30014b5199db81 upstream.
+
+This patch changes the igb_phy_has_link function to check the value of the
+parameter before deciding to use udelay or mdelay in order to be sure that
+the value is not too high for udelay function.
+
+Signed-off-by: Sunil K Pandey <sunil.k.pandey@intel.com>
+Signed-off-by: Kevin B Smith <kevin.b.smith@intel.com>
+Signed-off-by: Carolyn Wyborny <carolyn.wyborny@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/igb/e1000_phy.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/igb/e1000_phy.c
++++ b/drivers/net/ethernet/intel/igb/e1000_phy.c
+@@ -1730,7 +1730,10 @@ s32 igb_phy_has_link(struct e1000_hw *hw
+ * ownership of the resources, wait and try again to
+ * see if they have relinquished the resources yet.
+ */
+- udelay(usec_interval);
++ if (usec_interval >= 1000)
++ mdelay(usec_interval/1000);
++ else
++ udelay(usec_interval);
+ }
+ ret_val = hw->phy.ops.read_reg(hw, PHY_STATUS, &phy_status);
+ if (ret_val)
--- /dev/null
+From 60765a47a433d54e4744c285ad127f182dcd80aa Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 25 Oct 2013 13:06:06 +0200
+Subject: iwlwifi: mvm: check sta_id/drain values in debugfs
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 60765a47a433d54e4744c285ad127f182dcd80aa upstream.
+
+The station ID must be valid, if it's out of range then
+the array access may crash. Validate the station ID to
+the array length, and also validate the drain value even
+if that doesn't matter all that much.
+
+Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/debugfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+@@ -119,6 +119,10 @@ static ssize_t iwl_dbgfs_sta_drain_write
+
+ if (sscanf(buf, "%d %d", &sta_id, &drain) != 2)
+ return -EINVAL;
++ if (sta_id < 0 || sta_id >= IWL_MVM_STATION_COUNT)
++ return -EINVAL;
++ if (drain < 0 || drain > 1)
++ return -EINVAL;
+
+ mutex_lock(&mvm->mutex);
+
--- /dev/null
+From 051a41fa4ee14f5c39668f0980973b9a195de560 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 20 Nov 2013 11:28:27 +0100
+Subject: mac80211: don't attempt to reorder multicast frames
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 051a41fa4ee14f5c39668f0980973b9a195de560 upstream.
+
+Multicast frames can't be transmitted as part of an aggregation
+session (such a session couldn't even be set up) so don't try to
+reorder them. Trying to do so would cause the reorder to stop
+working correctly since multicast QoS frames (as transmitted by
+the Aruba APs this was found with) would cause sequence number
+confusion in the buffer.
+
+Reported-by: Blaise Gassend <blaise@suitabletech.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -911,7 +911,8 @@ static void ieee80211_rx_reorder_ampdu(s
+ u16 sc;
+ u8 tid, ack_policy;
+
+- if (!ieee80211_is_data_qos(hdr->frame_control))
++ if (!ieee80211_is_data_qos(hdr->frame_control) ||
++ is_multicast_ether_addr(hdr->addr1))
+ goto dont_reorder;
+
+ /*
--- /dev/null
+From 517543fd72d577dde2ebd9505dc4abf26d589f9a Mon Sep 17 00:00:00 2001
+From: Ujjal Roy <royujjal@gmail.com>
+Date: Thu, 21 Nov 2013 11:08:56 -0800
+Subject: mwifiex: fix memory leak issue for ibss join
+
+From: Ujjal Roy <royujjal@gmail.com>
+
+commit 517543fd72d577dde2ebd9505dc4abf26d589f9a upstream.
+
+For IBSS join if the requested SSID matches current SSID,
+it returns without freeing the allocated beacon IE buffer.
+
+Signed-off-by: Ujjal Roy <royujjal@gmail.com>
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mwifiex/sta_ioctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
+@@ -319,8 +319,8 @@ int mwifiex_bss_start(struct mwifiex_pri
+ if (bss_desc && bss_desc->ssid.ssid_len &&
+ (!mwifiex_ssid_cmp(&priv->curr_bss_params.bss_descriptor.
+ ssid, &bss_desc->ssid))) {
+- kfree(bss_desc);
+- return 0;
++ ret = 0;
++ goto done;
+ }
+
+ /* Exit Adhoc mode first */
--- /dev/null
+From e9c56f8d2f851fb6d6ce6794c0f5463b862a878e Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+Date: Tue, 10 Dec 2013 19:40:43 +0100
+Subject: net: allwinner: emac: Add missing free_irq
+
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+
+commit e9c56f8d2f851fb6d6ce6794c0f5463b862a878e upstream.
+
+The sun4i-emac driver uses devm_request_irq at .ndo_open time, but relies on
+the managed device mechanism to actually free it. This causes an issue whenever
+someone wants to restart the interface, the interrupt still being held, and not
+yet released.
+
+Fall back to using the regular request_irq at .ndo_open time, and introduce a
+free_irq during .ndo_stop.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/allwinner/sun4i-emac.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
+@@ -717,8 +717,7 @@ static int emac_open(struct net_device *
+ if (netif_msg_ifup(db))
+ dev_dbg(db->dev, "enabling %s\n", dev->name);
+
+- if (devm_request_irq(db->dev, dev->irq, &emac_interrupt,
+- 0, dev->name, dev))
++ if (request_irq(dev->irq, &emac_interrupt, 0, dev->name, dev))
+ return -EAGAIN;
+
+ /* Initialize EMAC board */
+@@ -774,6 +773,8 @@ static int emac_stop(struct net_device *
+
+ emac_shutdown(ndev);
+
++ free_irq(ndev->irq, ndev);
++
+ return 0;
+ }
+
selinux-handle-tcp-syn-ack-packets-correctly-in-selinux_ip_postroute.patch
revert-mac80211-allow-disable-power-save-in-mesh.patch
mac80211-fix-scheduled-scan-rtnl-deadlock.patch
+mac80211-don-t-attempt-to-reorder-multicast-frames.patch
+iwlwifi-mvm-check-sta_id-drain-values-in-debugfs.patch
+mwifiex-fix-memory-leak-issue-for-ibss-join.patch
+net-allwinner-emac-add-missing-free_irq.patch
+igb-fix-for-issue-where-values-could-be-too-high-for-udelay-function.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
