From: Greg Kroah-Hartman Date: Wed, 18 Dec 2013 19:13:24 +0000 (-0800) Subject: 3.10-stable patches X-Git-Tag: v3.4.75~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6ef982a97fb7f256a590749ddb50ff4d642df7e3;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: igb-fix-for-issue-where-values-could-be-too-high-for-udelay-function.patch iwlwifi-mvm-check-sta_id-drain-values-in-debugfs.patch mac80211-don-t-attempt-to-reorder-multicast-frames.patch mwifiex-fix-memory-leak-issue-for-ibss-join.patch --- diff --git a/queue-3.10/igb-fix-for-issue-where-values-could-be-too-high-for-udelay-function.patch b/queue-3.10/igb-fix-for-issue-where-values-could-be-too-high-for-udelay-function.patch new file mode 100644 index 00000000000..8a33c57d325 --- /dev/null +++ b/queue-3.10/igb-fix-for-issue-where-values-could-be-too-high-for-udelay-function.patch @@ -0,0 +1,39 @@ +From df29df92adda751ac04ca5149d30014b5199db81 Mon Sep 17 00:00:00 2001 +From: Carolyn Wyborny +Date: Sat, 14 Dec 2013 03:26:46 -0800 +Subject: igb: Fix for issue where values could be too high for udelay function. + +From: Carolyn Wyborny + +commit df29df92adda751ac04ca5149d30014b5199db81 upstream. + +This patch changes the igb_phy_has_link function to check the value of the +parameter before deciding to use udelay or mdelay in order to be sure that +the value is not too high for udelay function. + +Signed-off-by: Sunil K Pandey +Signed-off-by: Kevin B Smith +Signed-off-by: Carolyn Wyborny +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/intel/igb/e1000_phy.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/igb/e1000_phy.c ++++ b/drivers/net/ethernet/intel/igb/e1000_phy.c +@@ -1595,7 +1595,10 @@ s32 igb_phy_has_link(struct e1000_hw *hw + * ownership of the resources, wait and try again to + * see if they have relinquished the resources yet. + */ +- udelay(usec_interval); ++ if (usec_interval >= 1000) ++ mdelay(usec_interval/1000); ++ else ++ udelay(usec_interval); + } + ret_val = hw->phy.ops.read_reg(hw, PHY_STATUS, &phy_status); + if (ret_val) diff --git a/queue-3.10/iwlwifi-mvm-check-sta_id-drain-values-in-debugfs.patch b/queue-3.10/iwlwifi-mvm-check-sta_id-drain-values-in-debugfs.patch new file mode 100644 index 00000000000..39eb566654e --- /dev/null +++ b/queue-3.10/iwlwifi-mvm-check-sta_id-drain-values-in-debugfs.patch @@ -0,0 +1,36 @@ +From 60765a47a433d54e4744c285ad127f182dcd80aa Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Fri, 25 Oct 2013 13:06:06 +0200 +Subject: iwlwifi: mvm: check sta_id/drain values in debugfs + +From: Johannes Berg + +commit 60765a47a433d54e4744c285ad127f182dcd80aa upstream. + +The station ID must be valid, if it's out of range then +the array access may crash. Validate the station ID to +the array length, and also validate the drain value even +if that doesn't matter all that much. + +Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver") +Signed-off-by: Johannes Berg +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/debugfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c ++++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c +@@ -119,6 +119,10 @@ static ssize_t iwl_dbgfs_sta_drain_write + + if (sscanf(buf, "%d %d", &sta_id, &drain) != 2) + return -EINVAL; ++ if (sta_id < 0 || sta_id >= IWL_MVM_STATION_COUNT) ++ return -EINVAL; ++ if (drain < 0 || drain > 1) ++ return -EINVAL; + + mutex_lock(&mvm->mutex); + diff --git a/queue-3.10/mac80211-don-t-attempt-to-reorder-multicast-frames.patch b/queue-3.10/mac80211-don-t-attempt-to-reorder-multicast-frames.patch new file mode 100644 index 00000000000..516766a2287 --- /dev/null +++ b/queue-3.10/mac80211-don-t-attempt-to-reorder-multicast-frames.patch @@ -0,0 +1,36 @@ +From 051a41fa4ee14f5c39668f0980973b9a195de560 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 20 Nov 2013 11:28:27 +0100 +Subject: mac80211: don't attempt to reorder multicast frames + +From: Johannes Berg + +commit 051a41fa4ee14f5c39668f0980973b9a195de560 upstream. + +Multicast frames can't be transmitted as part of an aggregation +session (such a session couldn't even be set up) so don't try to +reorder them. Trying to do so would cause the reorder to stop +working correctly since multicast QoS frames (as transmitted by +the Aruba APs this was found with) would cause sequence number +confusion in the buffer. + +Reported-by: Blaise Gassend +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -864,7 +864,8 @@ static void ieee80211_rx_reorder_ampdu(s + u16 sc; + u8 tid, ack_policy; + +- if (!ieee80211_is_data_qos(hdr->frame_control)) ++ if (!ieee80211_is_data_qos(hdr->frame_control) || ++ is_multicast_ether_addr(hdr->addr1)) + goto dont_reorder; + + /* diff --git a/queue-3.10/mwifiex-fix-memory-leak-issue-for-ibss-join.patch b/queue-3.10/mwifiex-fix-memory-leak-issue-for-ibss-join.patch new file mode 100644 index 00000000000..35c4d13ec57 --- /dev/null +++ b/queue-3.10/mwifiex-fix-memory-leak-issue-for-ibss-join.patch @@ -0,0 +1,34 @@ +From 517543fd72d577dde2ebd9505dc4abf26d589f9a Mon Sep 17 00:00:00 2001 +From: Ujjal Roy +Date: Thu, 21 Nov 2013 11:08:56 -0800 +Subject: mwifiex: fix memory leak issue for ibss join + +From: Ujjal Roy + +commit 517543fd72d577dde2ebd9505dc4abf26d589f9a upstream. + +For IBSS join if the requested SSID matches current SSID, +it returns without freeing the allocated beacon IE buffer. + +Signed-off-by: Ujjal Roy +Signed-off-by: Bing Zhao +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mwifiex/sta_ioctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/mwifiex/sta_ioctl.c ++++ b/drivers/net/wireless/mwifiex/sta_ioctl.c +@@ -309,8 +309,8 @@ int mwifiex_bss_start(struct mwifiex_pri + if (bss_desc && bss_desc->ssid.ssid_len && + (!mwifiex_ssid_cmp(&priv->curr_bss_params.bss_descriptor. + ssid, &bss_desc->ssid))) { +- kfree(bss_desc); +- return 0; ++ ret = 0; ++ goto done; + } + + /* Exit Adhoc mode first */ diff --git a/queue-3.10/series b/queue-3.10/series index 4c447802df9..42ec93bcf47 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -38,3 +38,7 @@ ath9k-fix-xlna-bias-strength.patch selinux-handle-tcp-syn-ack-packets-correctly-in-selinux_ip_output.patch selinux-handle-tcp-syn-ack-packets-correctly-in-selinux_ip_postroute.patch revert-mac80211-allow-disable-power-save-in-mesh.patch +mac80211-don-t-attempt-to-reorder-multicast-frames.patch +iwlwifi-mvm-check-sta_id-drain-values-in-debugfs.patch +mwifiex-fix-memory-leak-issue-for-ibss-join.patch +igb-fix-for-issue-where-values-could-be-too-high-for-udelay-function.patch