From: Greg Kroah-Hartman Date: Tue, 4 Oct 2016 16:22:08 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.8.1~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8f593ae4f3e3075c1236f77d3e1fb7a088e54d65;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch iwlwifi-pcie-fix-access-to-scratch-buffer.patch --- diff --git a/queue-4.4/iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch b/queue-4.4/iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch new file mode 100644 index 00000000000..caa28cffd74 --- /dev/null +++ b/queue-4.4/iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch @@ -0,0 +1,33 @@ +From ff6e58e648ed5f3cc43891767811d5c3c88bbd41 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Wed, 3 Aug 2016 22:06:43 +0300 +Subject: iwlwifi: mvm: don't use ret when not initialised + +From: Emmanuel Grumbach + +commit ff6e58e648ed5f3cc43891767811d5c3c88bbd41 upstream. + +fw-dbg code return ret but that variable was either 0 +or not initialised. Return 0 always. + +Signed-off-by: Emmanuel Grumbach +Fixes: 6a95126763fb ("iwlwifi: mvm: send dbg config hcmds to fw if set in tlv") +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/fw.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/iwlwifi/mvm/fw.c +@@ -935,7 +935,8 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl + } + + mvm->fw_dbg_conf = conf_id; +- return ret; ++ ++ return 0; + } + + static int iwl_mvm_config_ltr(struct iwl_mvm *mvm) diff --git a/queue-4.4/iwlwifi-pcie-fix-access-to-scratch-buffer.patch b/queue-4.4/iwlwifi-pcie-fix-access-to-scratch-buffer.patch new file mode 100644 index 00000000000..cf9fe94b1e9 --- /dev/null +++ b/queue-4.4/iwlwifi-pcie-fix-access-to-scratch-buffer.patch @@ -0,0 +1,43 @@ +From d5d0689aefc59c6a5352ca25d7e6d47d03f543ce Mon Sep 17 00:00:00 2001 +From: Sara Sharon +Date: Thu, 9 Jun 2016 17:19:35 +0300 +Subject: iwlwifi: pcie: fix access to scratch buffer + +From: Sara Sharon + +commit d5d0689aefc59c6a5352ca25d7e6d47d03f543ce upstream. + +This fixes a pretty ancient bug that hasn't manifested itself +until now. +The scratchbuf for command queue is allocated only for 32 slots +but is accessed with the queue write pointer - which can be +up to 256. +Since the scratch buf size was 16 and there are up to 256 TFDs +we never passed a page boundary when accessing the scratch buffer, +but when attempting to increase the size of the scratch buffer a +panic was quick to follow when trying to access the address resulted +in a page boundary. + +Signed-off-by: Sara Sharon +Fixes: 38c0f334b359 ("iwlwifi: use coherent DMA memory for command header") +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/pcie/tx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/pcie/tx.c ++++ b/drivers/net/wireless/iwlwifi/pcie/tx.c +@@ -1508,9 +1508,9 @@ static int iwl_pcie_enqueue_hcmd(struct + + /* start the TFD with the scratchbuf */ + scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE); +- memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size); ++ memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size); + iwl_pcie_txq_build_tfd(trans, txq, +- iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr), ++ iwl_pcie_get_scratchbuf_dma(txq, idx), + scratch_size, true); + + /* map first command fragment, if any remains */ diff --git a/queue-4.4/series b/queue-4.4/series index e066c91b414..a8020f2ae2f 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -22,3 +22,5 @@ ipvs-fix-bind-to-link-local-mcast-ipv6-address-in-backup.patch nvmem-declare-nvmem_cell_read-consistently.patch hwmon-adt7411-set-bit-3-in-cfg1-register.patch spi-sh-msiof-avoid-invalid-clock-generator-parameters.patch +iwlwifi-pcie-fix-access-to-scratch-buffer.patch +iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch