--- /dev/null
+From 7fc0357479eeff4ca808c4d8c09bc7631f576b8d Mon Sep 17 00:00:00 2001
+From: "Luis R. Rodriguez" <mcgrof@do-not-panic.com>
+Date: Mon, 25 Mar 2013 11:27:46 -0700
+Subject: ath9k: avoid queueing hw check work when suspended
+
+From: "Luis R. Rodriguez" <mcgrof@do-not-panic.com>
+
+commit 7fc0357479eeff4ca808c4d8c09bc7631f576b8d upstream.
+
+The following issue was reported.
+
+WARNING: at net/mac80211/util.c:599 ieee80211_can_queue_work.isra.7+0x32/0x40 [mac80211]()
+Hardware name: iMac12,1
+queueing ieee80211 work while going to suspend
+Pid: 0, comm: swapper/0 Tainted: PF O 3.8.2-206.fc18.x86_64 #1
+Call Trace: Mar 16 09:39:17 Parags-iMac kernel: [ 3993.642992] <IRQ>
+[<ffffffff8105e61f>] warn_slowpath_common+0x7f/0xc0
+[<ffffffffa0581420>] ? ath_start_rx_poll+0x70/0x70 [ath9k]
+<ffffffff8105e716>] warn_slowpath_fmt+0x46/0x50
+[<ffffffffa045b542>] ieee80211_can_queue_work.isra.7+0x32/0x40
+
+Fix this by avoiding to queue the work if our device has
+already been marked as suspended or stopped.
+
+Reported-by: Parag Warudkar <parag.lkml@gmail.com>
+Tested-by: Parag Warudkar <parag.lkml@gmail.com>
+Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/link.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/link.c
++++ b/drivers/net/wireless/ath/ath9k/link.c
+@@ -170,7 +170,8 @@ void ath_rx_poll(unsigned long data)
+ {
+ struct ath_softc *sc = (struct ath_softc *)data;
+
+- ieee80211_queue_work(sc->hw, &sc->hw_check_work);
++ if (!test_bit(SC_OP_INVALID, &sc->sc_flags))
++ ieee80211_queue_work(sc->hw, &sc->hw_check_work);
+ }
+
+ /*
--- /dev/null
+From 01d4ab96d2e7fceaad204e5a8710ce34e229b8c5 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Fri, 15 Mar 2013 16:18:44 +0100
+Subject: ath9k: limit tx path hang check to normal data queues
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 01d4ab96d2e7fceaad204e5a8710ce34e229b8c5 upstream.
+
+The beacon and multicast-buffer queues are managed by the beacon
+tasklet, and the generic tx path hang check does not help in any way
+here. Running it on those queues anyway can introduce some race
+conditions leading to unnecessary chip resets.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/link.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/link.c
++++ b/drivers/net/wireless/ath/ath9k/link.c
+@@ -28,21 +28,21 @@ void ath_tx_complete_poll_work(struct wo
+ int i;
+ bool needreset = false;
+
+- for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+- if (ATH_TXQ_SETUP(sc, i)) {
+- txq = &sc->tx.txq[i];
+- ath_txq_lock(sc, txq);
+- if (txq->axq_depth) {
+- if (txq->axq_tx_inprogress) {
+- needreset = true;
+- ath_txq_unlock(sc, txq);
+- break;
+- } else {
+- txq->axq_tx_inprogress = true;
+- }
++ for (i = 0; i < IEEE80211_NUM_ACS; i++) {
++ txq = sc->tx.txq_map[i];
++
++ ath_txq_lock(sc, txq);
++ if (txq->axq_depth) {
++ if (txq->axq_tx_inprogress) {
++ needreset = true;
++ ath_txq_unlock(sc, txq);
++ break;
++ } else {
++ txq->axq_tx_inprogress = true;
+ }
+- ath_txq_unlock_complete(sc, txq);
+ }
++ ath_txq_unlock_complete(sc, txq);
++ }
+
+ if (needreset) {
+ ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
--- /dev/null
+From 74632d11a133b5baf6b9d622dd19d2f944d93d94 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Fri, 15 Mar 2013 14:53:31 +0100
+Subject: ath9k_hw: revert chainmask to user configuration after calibration
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 74632d11a133b5baf6b9d622dd19d2f944d93d94 upstream.
+
+The commit 'ath9k_hw: fix calibration issues on chainmask that don't
+include chain 0' changed the hardware chainmask to the chip chainmask
+for the duration of the calibration, but the revert to user
+configuration in the reset path runs too early.
+
+That causes some issues with limiting the number of antennas (including
+spurious failure in hardware-generated packets).
+
+Fix this by reverting the chainmask after the essential parts of the
+calibration that need the workaround, and before NF calibration is run.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Reported-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
+Tested-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_calib.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+@@ -976,6 +976,7 @@ static bool ar9003_hw_init_cal(struct at
+ AR_PHY_CL_TAB_1,
+ AR_PHY_CL_TAB_2 };
+
++ /* Use chip chainmask only for calibration */
+ ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
+
+ if (rtt) {
+@@ -1131,6 +1132,9 @@ skip_tx_iqcal:
+ ar9003_hw_rtt_disable(ah);
+ }
+
++ /* Revert chainmask to runtime parameters */
++ ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
++
+ /* Initialize list pointers */
+ ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
+ ah->supp_cals = IQ_MISMATCH_CAL;
--- /dev/null
+From f901b6bc404b67d96eca739857c097e022727b71 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Wed, 27 Mar 2013 11:36:42 +0100
+Subject: can: sja1000: fix define conflict on SH
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit f901b6bc404b67d96eca739857c097e022727b71 upstream.
+
+Thias patch fixes a define conflict between the SH architecture and the sja1000
+driver:
+
+ drivers/net/can/sja1000/sja1000.h:59:0: warning:
+ "REG_SR" redefined [enabled by default]
+ arch/sh/include/asm/ptrace_32.h:25:0: note:
+ this is the location of the previous definition
+
+A SJA1000_ prefix is added to the offending sja1000 define only, to make a
+minimal patch suited for stable. A later patch will add a SJA1000_ prefix to
+all defines in sja1000.h.
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/sja1000/plx_pci.c | 4 ++--
+ drivers/net/can/sja1000/sja1000.c | 6 +++---
+ drivers/net/can/sja1000/sja1000.h | 2 +-
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/can/sja1000/plx_pci.c
++++ b/drivers/net/can/sja1000/plx_pci.c
+@@ -348,7 +348,7 @@ static inline int plx_pci_check_sja1000(
+ */
+ if ((priv->read_reg(priv, REG_CR) & REG_CR_BASICCAN_INITIAL_MASK) ==
+ REG_CR_BASICCAN_INITIAL &&
+- (priv->read_reg(priv, REG_SR) == REG_SR_BASICCAN_INITIAL) &&
++ (priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_BASICCAN_INITIAL) &&
+ (priv->read_reg(priv, REG_IR) == REG_IR_BASICCAN_INITIAL))
+ flag = 1;
+
+@@ -360,7 +360,7 @@ static inline int plx_pci_check_sja1000(
+ * See states on p. 23 of the Datasheet.
+ */
+ if (priv->read_reg(priv, REG_MOD) == REG_MOD_PELICAN_INITIAL &&
+- priv->read_reg(priv, REG_SR) == REG_SR_PELICAN_INITIAL &&
++ priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_PELICAN_INITIAL &&
+ priv->read_reg(priv, REG_IR) == REG_IR_PELICAN_INITIAL)
+ return flag;
+
+--- a/drivers/net/can/sja1000/sja1000.c
++++ b/drivers/net/can/sja1000/sja1000.c
+@@ -91,7 +91,7 @@ static void sja1000_write_cmdreg(struct
+ */
+ spin_lock_irqsave(&priv->cmdreg_lock, flags);
+ priv->write_reg(priv, REG_CMR, val);
+- priv->read_reg(priv, REG_SR);
++ priv->read_reg(priv, SJA1000_REG_SR);
+ spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
+ }
+
+@@ -499,7 +499,7 @@ irqreturn_t sja1000_interrupt(int irq, v
+
+ while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
+ n++;
+- status = priv->read_reg(priv, REG_SR);
++ status = priv->read_reg(priv, SJA1000_REG_SR);
+ /* check for absent controller due to hw unplug */
+ if (status == 0xFF && sja1000_is_absent(priv))
+ return IRQ_NONE;
+@@ -526,7 +526,7 @@ irqreturn_t sja1000_interrupt(int irq, v
+ /* receive interrupt */
+ while (status & SR_RBS) {
+ sja1000_rx(dev);
+- status = priv->read_reg(priv, REG_SR);
++ status = priv->read_reg(priv, SJA1000_REG_SR);
+ /* check for absent controller */
+ if (status == 0xFF && sja1000_is_absent(priv))
+ return IRQ_NONE;
+--- a/drivers/net/can/sja1000/sja1000.h
++++ b/drivers/net/can/sja1000/sja1000.h
+@@ -56,7 +56,7 @@
+ /* SJA1000 registers - manual section 6.4 (Pelican Mode) */
+ #define REG_MOD 0x00
+ #define REG_CMR 0x01
+-#define REG_SR 0x02
++#define SJA1000_REG_SR 0x02
+ #define REG_IR 0x03
+ #define REG_IER 0x04
+ #define REG_ALC 0x0B
--- /dev/null
+From 570637dc8eeb2faba06228d497ff40bb019bcc93 Mon Sep 17 00:00:00 2001
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Mon, 18 Mar 2013 15:50:10 +0100
+Subject: HID: usbhid: fix build problem
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+commit 570637dc8eeb2faba06228d497ff40bb019bcc93 upstream.
+
+Fix build problem caused by typo introduced by 620ae90ed8
+("HID: usbhid: quirk for MSI GX680R led panel").
+
+Reported-by: fengguang.wu@intel.com
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/usbhid/hid-quirks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -73,7 +73,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
+- { USB_VENDIR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
++ { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
--- /dev/null
+From 620ae90ed8ca8b6e40cb9e10279b4f5ef9f0ab81 Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@redhat.com>
+Date: Mon, 18 Mar 2013 09:47:02 -0400
+Subject: HID: usbhid: quirk for MSI GX680R led panel
+
+From: Josh Boyer <jwboyer@redhat.com>
+
+commit 620ae90ed8ca8b6e40cb9e10279b4f5ef9f0ab81 upstream.
+
+This keyboard backlight device causes a 10 second delay to boot. Add it
+to the quirk list with HID_QUIRK_NO_INIT_REPORTS.
+
+This fixes Red Hat bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=907221
+
+Signed-off-by: Josh Boyer <jwboyer@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -587,6 +587,9 @@
+ #define USB_VENDOR_ID_MONTEREY 0x0566
+ #define USB_DEVICE_ID_GENIUS_KB29E 0x3004
+
++#define USB_VENDOR_ID_MSI 0x1770
++#define USB_DEVICE_ID_MSI_GX680R_LED_PANEL 0xff00
++
+ #define USB_VENDOR_ID_NATIONAL_SEMICONDUCTOR 0x0400
+ #define USB_DEVICE_ID_N_S_HARMONY 0xc359
+
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -73,6 +73,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
++ { USB_VENDIR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
--- /dev/null
+From 3d464d9b71ef2f2b40a4bc9dcf06794fd1be9d12 Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@redhat.com>
+Date: Mon, 18 Mar 2013 09:45:42 -0400
+Subject: HID: usbhid: quirk for Realtek Multi-card reader
+
+From: Josh Boyer <jwboyer@redhat.com>
+
+commit 3d464d9b71ef2f2b40a4bc9dcf06794fd1be9d12 upstream.
+
+This device needs to be added to the quirks list with HID_QUIRK_NO_INIT_REPORTS,
+otherwise it causes 10 seconds timeout during report initialization.
+
+This fixes Red Hat bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=806587
+
+Signed-off-by: Josh Boyer <jwboyer@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -678,6 +678,9 @@
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001 0x3001
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008
+
++#define USB_VENDOR_ID_REALTEK 0x0bda
++#define USB_DEVICE_ID_REALTEK_READER 0x0152
++
+ #define USB_VENDOR_ID_ROCCAT 0x1e7d
+ #define USB_DEVICE_ID_ROCCAT_ARVO 0x30d4
+ #define USB_DEVICE_ID_ROCCAT_ISKU 0x319c
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -80,6 +80,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET },
++ { USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_SIGMATEL, USB_DEVICE_ID_SIGMATEL_STMP3780, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
--- /dev/null
+From 246bbedb9aaf27e2207501d93a869023a439fce5 Mon Sep 17 00:00:00 2001
+From: Horia Geanta <horia.geanta@freescale.com>
+Date: Wed, 20 Mar 2013 16:31:58 +0200
+Subject: Revert "crypto: caam - add IPsec ESN support"
+
+From: Horia Geanta <horia.geanta@freescale.com>
+
+commit 246bbedb9aaf27e2207501d93a869023a439fce5 upstream.
+
+This reverts commit 891104ed008e8646c7860fe5bc70b0aac55dcc6c.
+
+Current IPsec ESN implementation for authencesn(cbc(aes), hmac(sha))
+(separate encryption and integrity algorithms) does not conform
+to RFC4303.
+
+ICV is generated by hashing the sequence
+SPI, SeqNum-High, SeqNum-Low, IV, Payload
+instead of
+SPI, SeqNum-Low, IV, Payload, SeqNum-High.
+
+Reported-by: Chaoxing Lin <Chaoxing.Lin@ultra-3eti.com>
+Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
+Reviewed-by: Kim Phillips <kim.phillips@freescale.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/caam/caamalg.c | 27 ++-------------------------
+ drivers/crypto/caam/compat.h | 1 -
+ 2 files changed, 2 insertions(+), 26 deletions(-)
+
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -1650,11 +1650,7 @@ struct caam_alg_template {
+ };
+
+ static struct caam_alg_template driver_algs[] = {
+- /*
+- * single-pass ipsec_esp descriptor
+- * authencesn(*,*) is also registered, although not present
+- * explicitly here.
+- */
++ /* single-pass ipsec_esp descriptor */
+ {
+ .name = "authenc(hmac(md5),cbc(aes))",
+ .driver_name = "authenc-hmac-md5-cbc-aes-caam",
+@@ -2217,9 +2213,7 @@ static int __init caam_algapi_init(void)
+ for (i = 0; i < ARRAY_SIZE(driver_algs); i++) {
+ /* TODO: check if h/w supports alg */
+ struct caam_crypto_alg *t_alg;
+- bool done = false;
+
+-authencesn:
+ t_alg = caam_alg_alloc(ctrldev, &driver_algs[i]);
+ if (IS_ERR(t_alg)) {
+ err = PTR_ERR(t_alg);
+@@ -2233,25 +2227,8 @@ authencesn:
+ dev_warn(ctrldev, "%s alg registration failed\n",
+ t_alg->crypto_alg.cra_driver_name);
+ kfree(t_alg);
+- } else {
++ } else
+ list_add_tail(&t_alg->entry, &priv->alg_list);
+- if (driver_algs[i].type == CRYPTO_ALG_TYPE_AEAD &&
+- !memcmp(driver_algs[i].name, "authenc", 7) &&
+- !done) {
+- char *name;
+-
+- name = driver_algs[i].name;
+- memmove(name + 10, name + 7, strlen(name) - 7);
+- memcpy(name + 7, "esn", 3);
+-
+- name = driver_algs[i].driver_name;
+- memmove(name + 10, name + 7, strlen(name) - 7);
+- memcpy(name + 7, "esn", 3);
+-
+- done = true;
+- goto authencesn;
+- }
+- }
+ }
+ if (!list_empty(&priv->alg_list))
+ dev_info(ctrldev, "%s algorithms registered in /proc/crypto\n",
+--- a/drivers/crypto/caam/compat.h
++++ b/drivers/crypto/caam/compat.h
+@@ -23,7 +23,6 @@
+ #include <linux/types.h>
+ #include <linux/debugfs.h>
+ #include <linux/circ_buf.h>
+-#include <linux/string.h>
+ #include <net/xfrm.h>
+
+ #include <crypto/algapi.h>
--- /dev/null
+From 991155bacb91c988c45586525771758ddadd44ce Mon Sep 17 00:00:00 2001
+From: Horia Geanta <horia.geanta@freescale.com>
+Date: Wed, 20 Mar 2013 16:31:38 +0200
+Subject: Revert "crypto: talitos - add IPsec ESN support"
+
+From: Horia Geanta <horia.geanta@freescale.com>
+
+commit 991155bacb91c988c45586525771758ddadd44ce upstream.
+
+This reverts commit e763eb699be723fb41af818118068c6b3afdaf8d.
+
+Current IPsec ESN implementation for authencesn(cbc(aes), hmac(sha))
+(separate encryption and integrity algorithms) does not conform
+to RFC4303.
+
+ICV is generated by hashing the sequence
+SPI, SeqNum-High, SeqNum-Low, IV, Payload
+instead of
+SPI, SeqNum-Low, IV, Payload, SeqNum-High.
+
+Reported-by: Chaoxing Lin <Chaoxing.Lin@ultra-3eti.com>
+Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
+Reviewed-by: Kim Phillips <kim.phillips@freescale.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/talitos.c | 30 ++----------------------------
+ 1 file changed, 2 insertions(+), 28 deletions(-)
+
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -38,7 +38,6 @@
+ #include <linux/spinlock.h>
+ #include <linux/rtnetlink.h>
+ #include <linux/slab.h>
+-#include <linux/string.h>
+
+ #include <crypto/algapi.h>
+ #include <crypto/aes.h>
+@@ -1974,11 +1973,7 @@ struct talitos_alg_template {
+ };
+
+ static struct talitos_alg_template driver_algs[] = {
+- /*
+- * AEAD algorithms. These use a single-pass ipsec_esp descriptor.
+- * authencesn(*,*) is also registered, although not present
+- * explicitly here.
+- */
++ /* AEAD algorithms. These use a single-pass ipsec_esp descriptor */
+ { .type = CRYPTO_ALG_TYPE_AEAD,
+ .alg.crypto = {
+ .cra_name = "authenc(hmac(sha1),cbc(aes))",
+@@ -2820,9 +2815,7 @@ static int talitos_probe(struct platform
+ if (hw_supports(dev, driver_algs[i].desc_hdr_template)) {
+ struct talitos_crypto_alg *t_alg;
+ char *name = NULL;
+- bool authenc = false;
+
+-authencesn:
+ t_alg = talitos_alg_alloc(dev, &driver_algs[i]);
+ if (IS_ERR(t_alg)) {
+ err = PTR_ERR(t_alg);
+@@ -2837,8 +2830,6 @@ authencesn:
+ err = crypto_register_alg(
+ &t_alg->algt.alg.crypto);
+ name = t_alg->algt.alg.crypto.cra_driver_name;
+- authenc = authenc ? !authenc :
+- !(bool)memcmp(name, "authenc", 7);
+ break;
+ case CRYPTO_ALG_TYPE_AHASH:
+ err = crypto_register_ahash(
+@@ -2851,25 +2842,8 @@ authencesn:
+ dev_err(dev, "%s alg registration failed\n",
+ name);
+ kfree(t_alg);
+- } else {
++ } else
+ list_add_tail(&t_alg->entry, &priv->alg_list);
+- if (authenc) {
+- struct crypto_alg *alg =
+- &driver_algs[i].alg.crypto;
+-
+- name = alg->cra_name;
+- memmove(name + 10, name + 7,
+- strlen(name) - 7);
+- memcpy(name + 7, "esn", 3);
+-
+- name = alg->cra_driver_name;
+- memmove(name + 10, name + 7,
+- strlen(name) - 7);
+- memcpy(name + 7, "esn", 3);
+-
+- goto authencesn;
+- }
+- }
+ }
+ }
+ if (!list_empty(&priv->alg_list))
--- /dev/null
+From 36ef0b473fbf43d5db23eea4616cc1d18cec245f Mon Sep 17 00:00:00 2001
+From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
+Date: Sun, 17 Mar 2013 11:54:04 +0200
+Subject: rtlwifi: usb: add missing freeing of skbuff
+
+From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
+
+commit 36ef0b473fbf43d5db23eea4616cc1d18cec245f upstream.
+
+Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -854,6 +854,7 @@ static void _rtl_usb_transmit(struct iee
+ if (unlikely(!_urb)) {
+ RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+ "Can't allocate urb. Drop skb!\n");
++ kfree_skb(skb);
+ return;
+ }
+ urb_list = &rtlusb->tx_pending[ep_num];
bluetooth-fix-not-closing-sco-sockets-in-the-bt_connect2-state.patch
bluetooth-add-support-for-dell.patch
bluetooth-add-support-for-dell_2.patch
+staging-comedi-s626-fix-continuous-acquisition.patch
+revert-crypto-talitos-add-ipsec-esn-support.patch
+revert-crypto-caam-add-ipsec-esn-support.patch
+sysfs-fix-race-between-readdir-and-lseek.patch
+sysfs-handle-failure-path-correctly-for-readdir.patch
+can-sja1000-fix-define-conflict-on-sh.patch
+ath9k_hw-revert-chainmask-to-user-configuration-after-calibration.patch
+ath9k-limit-tx-path-hang-check-to-normal-data-queues.patch
+ath9k-avoid-queueing-hw-check-work-when-suspended.patch
+hid-usbhid-quirk-for-realtek-multi-card-reader.patch
+hid-usbhid-quirk-for-msi-gx680r-led-panel.patch
+hid-usbhid-fix-build-problem.patch
+rtlwifi-usb-add-missing-freeing-of-skbuff.patch
--- /dev/null
+From e4317ce877a31dbb9d96375391c1c4ad2210d637 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 22 Mar 2013 15:16:29 +0000
+Subject: staging: comedi: s626: fix continuous acquisition
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit e4317ce877a31dbb9d96375391c1c4ad2210d637 upstream.
+
+For the s626 driver, there is a bug in the handling of asynchronous
+commands on the AI subdevice when the stop source is `TRIG_NONE`. The
+command should run continuously until cancelled, but the interrupt
+handler stops the command running after the first scan.
+
+The command set-up function `s626_ai_cmd()` contains this code:
+
+ switch (cmd->stop_src) {
+ case TRIG_COUNT:
+ /* data arrives as one packet */
+ devpriv->ai_sample_count = cmd->stop_arg;
+ devpriv->ai_continous = 0;
+ break;
+ case TRIG_NONE:
+ /* continous acquisition */
+ devpriv->ai_continous = 1;
+ devpriv->ai_sample_count = 0;
+ break;
+ }
+
+The interrupt handler `s626_irq_handler()` contains this code:
+
+ if (!(devpriv->ai_continous))
+ devpriv->ai_sample_count--;
+ if (devpriv->ai_sample_count <= 0) {
+ devpriv->ai_cmd_running = 0;
+ /* ... */
+ }
+
+So `devpriv->ai_sample_count` is only decremented for the `TRIG_COUNT`
+case, but `devpriv->ai_cmd_running` is set to 0 (and the command
+stopped) regardless.
+
+Fix this in `s626_ai_cmd()` by setting `devpriv->ai_sample_count = 1`
+for the `TRIG_NONE` case. The interrupt handler will not decrement it
+so it will remain greater than 0 and the check for stopping the
+acquisition will fail.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/s626.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/drivers/s626.c
++++ b/drivers/staging/comedi/drivers/s626.c
+@@ -1482,7 +1482,7 @@ static int s626_ai_cmd(struct comedi_dev
+ case TRIG_NONE:
+ /* continous acquisition */
+ devpriv->ai_continous = 1;
+- devpriv->ai_sample_count = 0;
++ devpriv->ai_sample_count = 1;
+ break;
+ }
+
--- /dev/null
+From 991f76f837bf22c5bb07261cfd86525a0a96650c Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@canonical.com>
+Date: Wed, 20 Mar 2013 23:25:24 +0800
+Subject: sysfs: fix race between readdir and lseek
+
+From: Ming Lei <ming.lei@canonical.com>
+
+commit 991f76f837bf22c5bb07261cfd86525a0a96650c upstream.
+
+While readdir() is running, lseek() may set filp->f_pos as zero,
+then may leave filp->private_data pointing to one sysfs_dirent
+object without holding its reference counter, so the sysfs_dirent
+object may be used after free in next readdir().
+
+This patch holds inode->i_mutex to avoid the problem since
+the lock is always held in readdir path.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Tested-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: Ming Lei <ming.lei@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/sysfs/dir.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/fs/sysfs/dir.c
++++ b/fs/sysfs/dir.c
+@@ -1058,10 +1058,21 @@ static int sysfs_readdir(struct file * f
+ return 0;
+ }
+
++static loff_t sysfs_dir_llseek(struct file *file, loff_t offset, int whence)
++{
++ struct inode *inode = file->f_path.dentry->d_inode;
++ loff_t ret;
++
++ mutex_lock(&inode->i_mutex);
++ ret = generic_file_llseek(file, offset, whence);
++ mutex_unlock(&inode->i_mutex);
++
++ return ret;
++}
+
+ const struct file_operations sysfs_dir_operations = {
+ .read = generic_read_dir,
+ .readdir = sysfs_readdir,
+ .release = sysfs_dir_release,
+- .llseek = generic_file_llseek,
++ .llseek = sysfs_dir_llseek,
+ };
--- /dev/null
+From e5110f411d2ee35bf8d202ccca2e89c633060dca Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@canonical.com>
+Date: Wed, 20 Mar 2013 23:25:25 +0800
+Subject: sysfs: handle failure path correctly for readdir()
+
+From: Ming Lei <ming.lei@canonical.com>
+
+commit e5110f411d2ee35bf8d202ccca2e89c633060dca upstream.
+
+In case of 'if (filp->f_pos == 0 or 1)' of sysfs_readdir(),
+the failure from filldir() isn't handled, and the reference counter
+of the sysfs_dirent object pointed by filp->private_data will be
+released without clearing filp->private_data, so use after free
+bug will be triggered later.
+
+This patch returns immeadiately under the situation for fixing the bug,
+and it is reasonable to return from readdir() when filldir() fails.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Tested-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: Ming Lei <ming.lei@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/sysfs/dir.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/sysfs/dir.c
++++ b/fs/sysfs/dir.c
+@@ -1020,6 +1020,8 @@ static int sysfs_readdir(struct file * f
+ ino = parent_sd->s_ino;
+ if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0)
+ filp->f_pos++;
++ else
++ return 0;
+ }
+ if (filp->f_pos == 1) {
+ if (parent_sd->s_parent)
+@@ -1028,6 +1030,8 @@ static int sysfs_readdir(struct file * f
+ ino = parent_sd->s_ino;
+ if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
+ filp->f_pos++;
++ else
++ return 0;
+ }
+ mutex_lock(&sysfs_mutex);
+ for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);
projects / thirdparty / kernel / stable-queue.git / commitdiff
