From: Greg Kroah-Hartman Date: Tue, 24 Sep 2013 14:47:06 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.97~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=49d806da9eb6952f09fa6fe6e2383a826e09662b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch ath9k-always-clear-ps-filter-bit-on-new-assoc.patch ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch hid-pantherlord-validate-output-report-details.patch --- diff --git a/queue-3.0/alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch b/queue-3.0/alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch new file mode 100644 index 00000000000..d80fb77d342 --- /dev/null +++ b/queue-3.0/alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch @@ -0,0 +1,31 @@ +From 83f72151352791836a1b9c1542614cc9bf71ac61 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 9 Sep 2013 10:20:48 +0200 +Subject: ALSA: hda - Add Toshiba Satellite C870 to MSI blacklist + +From: Takashi Iwai + +commit 83f72151352791836a1b9c1542614cc9bf71ac61 upstream. + +Toshiba Satellite C870 shows interrupt problems occasionally when +certain mixer controls like "Mic Switch" is toggled. This seems +worked around by not using MSI. + +Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=833585 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2461,6 +2461,7 @@ static struct snd_pci_quirk msi_black_li + SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */ + SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */ + SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */ ++ SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */ + SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */ + SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */ + {} diff --git a/queue-3.0/ath9k-always-clear-ps-filter-bit-on-new-assoc.patch b/queue-3.0/ath9k-always-clear-ps-filter-bit-on-new-assoc.patch new file mode 100644 index 00000000000..5c025c417e7 --- /dev/null +++ b/queue-3.0/ath9k-always-clear-ps-filter-bit-on-new-assoc.patch @@ -0,0 +1,30 @@ +From 026d5b07c03458f9c0ccd19c3850564a5409c325 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 6 Aug 2013 14:18:10 +0200 +Subject: ath9k: always clear ps filter bit on new assoc + +From: Felix Fietkau + +commit 026d5b07c03458f9c0ccd19c3850564a5409c325 upstream. + +Otherwise in some cases, EAPOL frames might be filtered during the +initial handshake, causing delays and assoc failures. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2433,6 +2433,7 @@ void ath_tx_node_init(struct ath_softc * + for (acno = 0, ac = &an->ac[acno]; + acno < WME_NUM_AC; acno++, ac++) { + ac->sched = false; ++ ac->clear_ps_filter = true; + ac->txq = sc->tx.txq_map[acno]; + INIT_LIST_HEAD(&ac->tid_q); + } diff --git a/queue-3.0/ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch b/queue-3.0/ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch new file mode 100644 index 00000000000..8282b6f9a29 --- /dev/null +++ b/queue-3.0/ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch @@ -0,0 +1,32 @@ +From a1c781bb20ac1e03280e420abd47a99eb8bbdd3b Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 13 Aug 2013 12:33:28 +0200 +Subject: ath9k: avoid accessing MRC registers on single-chain devices + +From: Felix Fietkau + +commit a1c781bb20ac1e03280e420abd47a99eb8bbdd3b upstream. + +They are not implemented, and accessing them might trigger errors + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/ar9003_phy.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c +@@ -1005,6 +1005,10 @@ static bool ar9003_hw_ani_control(struct + * is_on == 0 means MRC CCK is OFF (more noise imm) + */ + bool is_on = param ? 1 : 0; ++ ++ if (ah->caps.rx_chainmask == 1) ++ break; ++ + REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL, + AR_PHY_MRC_CCK_ENABLE, is_on); + REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL, diff --git a/queue-3.0/hid-pantherlord-validate-output-report-details.patch b/queue-3.0/hid-pantherlord-validate-output-report-details.patch new file mode 100644 index 00000000000..3f124e8918f --- /dev/null +++ b/queue-3.0/hid-pantherlord-validate-output-report-details.patch @@ -0,0 +1,46 @@ +From 412f30105ec6735224535791eed5cdc02888ecb4 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 28 Aug 2013 22:30:49 +0200 +Subject: HID: pantherlord: validate output report details + +From: Kees Cook + +commit 412f30105ec6735224535791eed5cdc02888ecb4 upstream. + +A HID device could send a malicious output report that would cause the +pantherlord HID driver to write beyond the output report allocation +during initialization, causing a heap overflow: + +[ 310.939483] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003 +... +[ 315.980774] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten + +CVE-2013-2892 + +Signed-off-by: Kees Cook +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-pl.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-pl.c ++++ b/drivers/hid/hid-pl.c +@@ -128,8 +128,14 @@ static int plff_init(struct hid_device * + strong = &report->field[0]->value[2]; + weak = &report->field[0]->value[3]; + debug("detected single-field device"); +- } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 && +- report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) { ++ } else if (report->field[0]->maxusage == 1 && ++ report->field[0]->usage[0].hid == ++ (HID_UP_LED | 0x43) && ++ report->maxfield >= 4 && ++ report->field[0]->report_count >= 1 && ++ report->field[1]->report_count >= 1 && ++ report->field[2]->report_count >= 1 && ++ report->field[3]->report_count >= 1) { + report->field[0]->value[0] = 0x00; + report->field[1]->value[0] = 0x00; + strong = &report->field[2]->value[0]; diff --git a/queue-3.0/series b/queue-3.0/series index ee51b2bd709..b5736b85d1f 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -12,3 +12,7 @@ usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch asoc-wm8960-fix-pll-register-writes.patch +alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch +ath9k-always-clear-ps-filter-bit-on-new-assoc.patch +ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch +hid-pantherlord-validate-output-report-details.patch