From: Greg Kroah-Hartman Date: Mon, 1 Apr 2013 20:15:40 +0000 (-0700) Subject: 3.8-stable patches X-Git-Tag: v3.8.6~49 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=eb9907f6eebc2b36b2430acb5ebedfea875a1f53;p=thirdparty%2Fkernel%2Fstable-queue.git 3.8-stable patches added patches: ath9k-avoid-queueing-hw-check-work-when-suspended.patch ath9k_hw-revert-chainmask-to-user-configuration-after-calibration.patch ath9k-limit-tx-path-hang-check-to-normal-data-queues.patch can-sja1000-fix-define-conflict-on-sh.patch hid-usbhid-fix-build-problem.patch hid-usbhid-quirk-for-msi-gx680r-led-panel.patch hid-usbhid-quirk-for-realtek-multi-card-reader.patch revert-crypto-caam-add-ipsec-esn-support.patch revert-crypto-talitos-add-ipsec-esn-support.patch rtlwifi-usb-add-missing-freeing-of-skbuff.patch staging-comedi-s626-fix-continuous-acquisition.patch sysfs-fix-race-between-readdir-and-lseek.patch sysfs-handle-failure-path-correctly-for-readdir.patch --- diff --git a/queue-3.8/ath9k-avoid-queueing-hw-check-work-when-suspended.patch b/queue-3.8/ath9k-avoid-queueing-hw-check-work-when-suspended.patch new file mode 100644 index 00000000000..4ab94507fd2 --- /dev/null +++ b/queue-3.8/ath9k-avoid-queueing-hw-check-work-when-suspended.patch @@ -0,0 +1,46 @@ +From 7fc0357479eeff4ca808c4d8c09bc7631f576b8d Mon Sep 17 00:00:00 2001 +From: "Luis R. Rodriguez" +Date: Mon, 25 Mar 2013 11:27:46 -0700 +Subject: ath9k: avoid queueing hw check work when suspended + +From: "Luis R. Rodriguez" + +commit 7fc0357479eeff4ca808c4d8c09bc7631f576b8d upstream. + +The following issue was reported. + +WARNING: at net/mac80211/util.c:599 ieee80211_can_queue_work.isra.7+0x32/0x40 [mac80211]() +Hardware name: iMac12,1 +queueing ieee80211 work while going to suspend +Pid: 0, comm: swapper/0 Tainted: PF O 3.8.2-206.fc18.x86_64 #1 +Call Trace: Mar 16 09:39:17 Parags-iMac kernel: [ 3993.642992] +[] warn_slowpath_common+0x7f/0xc0 +[] ? ath_start_rx_poll+0x70/0x70 [ath9k] +] warn_slowpath_fmt+0x46/0x50 +[] ieee80211_can_queue_work.isra.7+0x32/0x40 + +Fix this by avoiding to queue the work if our device has +already been marked as suspended or stopped. + +Reported-by: Parag Warudkar +Tested-by: Parag Warudkar +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/link.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/link.c ++++ b/drivers/net/wireless/ath/ath9k/link.c +@@ -170,7 +170,8 @@ void ath_rx_poll(unsigned long data) + { + struct ath_softc *sc = (struct ath_softc *)data; + +- ieee80211_queue_work(sc->hw, &sc->hw_check_work); ++ if (!test_bit(SC_OP_INVALID, &sc->sc_flags)) ++ ieee80211_queue_work(sc->hw, &sc->hw_check_work); + } + + /* diff --git a/queue-3.8/ath9k-limit-tx-path-hang-check-to-normal-data-queues.patch b/queue-3.8/ath9k-limit-tx-path-hang-check-to-normal-data-queues.patch new file mode 100644 index 00000000000..601c994dd4e --- /dev/null +++ b/queue-3.8/ath9k-limit-tx-path-hang-check-to-normal-data-queues.patch @@ -0,0 +1,59 @@ +From 01d4ab96d2e7fceaad204e5a8710ce34e229b8c5 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Fri, 15 Mar 2013 16:18:44 +0100 +Subject: ath9k: limit tx path hang check to normal data queues + +From: Felix Fietkau + +commit 01d4ab96d2e7fceaad204e5a8710ce34e229b8c5 upstream. + +The beacon and multicast-buffer queues are managed by the beacon +tasklet, and the generic tx path hang check does not help in any way +here. Running it on those queues anyway can introduce some race +conditions leading to unnecessary chip resets. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/link.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/link.c ++++ b/drivers/net/wireless/ath/ath9k/link.c +@@ -28,21 +28,21 @@ void ath_tx_complete_poll_work(struct wo + int i; + bool needreset = false; + +- for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) +- if (ATH_TXQ_SETUP(sc, i)) { +- txq = &sc->tx.txq[i]; +- ath_txq_lock(sc, txq); +- if (txq->axq_depth) { +- if (txq->axq_tx_inprogress) { +- needreset = true; +- ath_txq_unlock(sc, txq); +- break; +- } else { +- txq->axq_tx_inprogress = true; +- } ++ for (i = 0; i < IEEE80211_NUM_ACS; i++) { ++ txq = sc->tx.txq_map[i]; ++ ++ ath_txq_lock(sc, txq); ++ if (txq->axq_depth) { ++ if (txq->axq_tx_inprogress) { ++ needreset = true; ++ ath_txq_unlock(sc, txq); ++ break; ++ } else { ++ txq->axq_tx_inprogress = true; + } +- ath_txq_unlock_complete(sc, txq); + } ++ ath_txq_unlock_complete(sc, txq); ++ } + + if (needreset) { + ath_dbg(ath9k_hw_common(sc->sc_ah), RESET, diff --git a/queue-3.8/ath9k_hw-revert-chainmask-to-user-configuration-after-calibration.patch b/queue-3.8/ath9k_hw-revert-chainmask-to-user-configuration-after-calibration.patch new file mode 100644 index 00000000000..f99682405d2 --- /dev/null +++ b/queue-3.8/ath9k_hw-revert-chainmask-to-user-configuration-after-calibration.patch @@ -0,0 +1,50 @@ +From 74632d11a133b5baf6b9d622dd19d2f944d93d94 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Fri, 15 Mar 2013 14:53:31 +0100 +Subject: ath9k_hw: revert chainmask to user configuration after calibration + +From: Felix Fietkau + +commit 74632d11a133b5baf6b9d622dd19d2f944d93d94 upstream. + +The commit 'ath9k_hw: fix calibration issues on chainmask that don't +include chain 0' changed the hardware chainmask to the chip chainmask +for the duration of the calibration, but the revert to user +configuration in the reset path runs too early. + +That causes some issues with limiting the number of antennas (including +spurious failure in hardware-generated packets). + +Fix this by reverting the chainmask after the essential parts of the +calibration that need the workaround, and before NF calibration is run. + +Signed-off-by: Felix Fietkau +Reported-by: Wojciech Dubowik +Tested-by: Wojciech Dubowik +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/ar9003_calib.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c +@@ -976,6 +976,7 @@ static bool ar9003_hw_init_cal(struct at + AR_PHY_CL_TAB_1, + AR_PHY_CL_TAB_2 }; + ++ /* Use chip chainmask only for calibration */ + ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask); + + if (rtt) { +@@ -1131,6 +1132,9 @@ skip_tx_iqcal: + ar9003_hw_rtt_disable(ah); + } + ++ /* Revert chainmask to runtime parameters */ ++ ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask); ++ + /* Initialize list pointers */ + ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL; + ah->supp_cals = IQ_MISMATCH_CAL; diff --git a/queue-3.8/can-sja1000-fix-define-conflict-on-sh.patch b/queue-3.8/can-sja1000-fix-define-conflict-on-sh.patch new file mode 100644 index 00000000000..c16a91d6456 --- /dev/null +++ b/queue-3.8/can-sja1000-fix-define-conflict-on-sh.patch @@ -0,0 +1,91 @@ +From f901b6bc404b67d96eca739857c097e022727b71 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Wed, 27 Mar 2013 11:36:42 +0100 +Subject: can: sja1000: fix define conflict on SH + +From: Marc Kleine-Budde + +commit f901b6bc404b67d96eca739857c097e022727b71 upstream. + +Thias patch fixes a define conflict between the SH architecture and the sja1000 +driver: + + drivers/net/can/sja1000/sja1000.h:59:0: warning: + "REG_SR" redefined [enabled by default] + arch/sh/include/asm/ptrace_32.h:25:0: note: + this is the location of the previous definition + +A SJA1000_ prefix is added to the offending sja1000 define only, to make a +minimal patch suited for stable. A later patch will add a SJA1000_ prefix to +all defines in sja1000.h. + +Reported-by: Fengguang Wu +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/sja1000/plx_pci.c | 4 ++-- + drivers/net/can/sja1000/sja1000.c | 6 +++--- + drivers/net/can/sja1000/sja1000.h | 2 +- + 3 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/can/sja1000/plx_pci.c ++++ b/drivers/net/can/sja1000/plx_pci.c +@@ -348,7 +348,7 @@ static inline int plx_pci_check_sja1000( + */ + if ((priv->read_reg(priv, REG_CR) & REG_CR_BASICCAN_INITIAL_MASK) == + REG_CR_BASICCAN_INITIAL && +- (priv->read_reg(priv, REG_SR) == REG_SR_BASICCAN_INITIAL) && ++ (priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_BASICCAN_INITIAL) && + (priv->read_reg(priv, REG_IR) == REG_IR_BASICCAN_INITIAL)) + flag = 1; + +@@ -360,7 +360,7 @@ static inline int plx_pci_check_sja1000( + * See states on p. 23 of the Datasheet. + */ + if (priv->read_reg(priv, REG_MOD) == REG_MOD_PELICAN_INITIAL && +- priv->read_reg(priv, REG_SR) == REG_SR_PELICAN_INITIAL && ++ priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_PELICAN_INITIAL && + priv->read_reg(priv, REG_IR) == REG_IR_PELICAN_INITIAL) + return flag; + +--- a/drivers/net/can/sja1000/sja1000.c ++++ b/drivers/net/can/sja1000/sja1000.c +@@ -91,7 +91,7 @@ static void sja1000_write_cmdreg(struct + */ + spin_lock_irqsave(&priv->cmdreg_lock, flags); + priv->write_reg(priv, REG_CMR, val); +- priv->read_reg(priv, REG_SR); ++ priv->read_reg(priv, SJA1000_REG_SR); + spin_unlock_irqrestore(&priv->cmdreg_lock, flags); + } + +@@ -499,7 +499,7 @@ irqreturn_t sja1000_interrupt(int irq, v + + while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) { + n++; +- status = priv->read_reg(priv, REG_SR); ++ status = priv->read_reg(priv, SJA1000_REG_SR); + /* check for absent controller due to hw unplug */ + if (status == 0xFF && sja1000_is_absent(priv)) + return IRQ_NONE; +@@ -526,7 +526,7 @@ irqreturn_t sja1000_interrupt(int irq, v + /* receive interrupt */ + while (status & SR_RBS) { + sja1000_rx(dev); +- status = priv->read_reg(priv, REG_SR); ++ status = priv->read_reg(priv, SJA1000_REG_SR); + /* check for absent controller */ + if (status == 0xFF && sja1000_is_absent(priv)) + return IRQ_NONE; +--- a/drivers/net/can/sja1000/sja1000.h ++++ b/drivers/net/can/sja1000/sja1000.h +@@ -56,7 +56,7 @@ + /* SJA1000 registers - manual section 6.4 (Pelican Mode) */ + #define REG_MOD 0x00 + #define REG_CMR 0x01 +-#define REG_SR 0x02 ++#define SJA1000_REG_SR 0x02 + #define REG_IR 0x03 + #define REG_IER 0x04 + #define REG_ALC 0x0B diff --git a/queue-3.8/hid-usbhid-fix-build-problem.patch b/queue-3.8/hid-usbhid-fix-build-problem.patch new file mode 100644 index 00000000000..78e7a68f019 --- /dev/null +++ b/queue-3.8/hid-usbhid-fix-build-problem.patch @@ -0,0 +1,31 @@ +From 570637dc8eeb2faba06228d497ff40bb019bcc93 Mon Sep 17 00:00:00 2001 +From: Jiri Kosina +Date: Mon, 18 Mar 2013 15:50:10 +0100 +Subject: HID: usbhid: fix build problem + +From: Jiri Kosina + +commit 570637dc8eeb2faba06228d497ff40bb019bcc93 upstream. + +Fix build problem caused by typo introduced by 620ae90ed8 +("HID: usbhid: quirk for MSI GX680R led panel"). + +Reported-by: fengguang.wu@intel.com +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/usbhid/hid-quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -73,7 +73,7 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET }, +- { USB_VENDIR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS }, diff --git a/queue-3.8/hid-usbhid-quirk-for-msi-gx680r-led-panel.patch b/queue-3.8/hid-usbhid-quirk-for-msi-gx680r-led-panel.patch new file mode 100644 index 00000000000..41582f0abd1 --- /dev/null +++ b/queue-3.8/hid-usbhid-quirk-for-msi-gx680r-led-panel.patch @@ -0,0 +1,45 @@ +From 620ae90ed8ca8b6e40cb9e10279b4f5ef9f0ab81 Mon Sep 17 00:00:00 2001 +From: Josh Boyer +Date: Mon, 18 Mar 2013 09:47:02 -0400 +Subject: HID: usbhid: quirk for MSI GX680R led panel + +From: Josh Boyer + +commit 620ae90ed8ca8b6e40cb9e10279b4f5ef9f0ab81 upstream. + +This keyboard backlight device causes a 10 second delay to boot. Add it +to the quirk list with HID_QUIRK_NO_INIT_REPORTS. + +This fixes Red Hat bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=907221 + +Signed-off-by: Josh Boyer +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/usbhid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -587,6 +587,9 @@ + #define USB_VENDOR_ID_MONTEREY 0x0566 + #define USB_DEVICE_ID_GENIUS_KB29E 0x3004 + ++#define USB_VENDOR_ID_MSI 0x1770 ++#define USB_DEVICE_ID_MSI_GX680R_LED_PANEL 0xff00 ++ + #define USB_VENDOR_ID_NATIONAL_SEMICONDUCTOR 0x0400 + #define USB_DEVICE_ID_N_S_HARMONY 0xc359 + +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -73,6 +73,7 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET }, ++ { USB_VENDIR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS }, diff --git a/queue-3.8/hid-usbhid-quirk-for-realtek-multi-card-reader.patch b/queue-3.8/hid-usbhid-quirk-for-realtek-multi-card-reader.patch new file mode 100644 index 00000000000..f8da077f758 --- /dev/null +++ b/queue-3.8/hid-usbhid-quirk-for-realtek-multi-card-reader.patch @@ -0,0 +1,45 @@ +From 3d464d9b71ef2f2b40a4bc9dcf06794fd1be9d12 Mon Sep 17 00:00:00 2001 +From: Josh Boyer +Date: Mon, 18 Mar 2013 09:45:42 -0400 +Subject: HID: usbhid: quirk for Realtek Multi-card reader + +From: Josh Boyer + +commit 3d464d9b71ef2f2b40a4bc9dcf06794fd1be9d12 upstream. + +This device needs to be added to the quirks list with HID_QUIRK_NO_INIT_REPORTS, +otherwise it causes 10 seconds timeout during report initialization. + +This fixes Red Hat bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=806587 + +Signed-off-by: Josh Boyer +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/usbhid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -678,6 +678,9 @@ + #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001 0x3001 + #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008 + ++#define USB_VENDOR_ID_REALTEK 0x0bda ++#define USB_DEVICE_ID_REALTEK_READER 0x0152 ++ + #define USB_VENDOR_ID_ROCCAT 0x1e7d + #define USB_DEVICE_ID_ROCCAT_ARVO 0x30d4 + #define USB_DEVICE_ID_ROCCAT_ISKU 0x319c +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -80,6 +80,7 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET }, ++ { USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_SIGMATEL, USB_DEVICE_ID_SIGMATEL_STMP3780, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET }, diff --git a/queue-3.8/revert-crypto-caam-add-ipsec-esn-support.patch b/queue-3.8/revert-crypto-caam-add-ipsec-esn-support.patch new file mode 100644 index 00000000000..4ad239f23de --- /dev/null +++ b/queue-3.8/revert-crypto-caam-add-ipsec-esn-support.patch @@ -0,0 +1,93 @@ +From 246bbedb9aaf27e2207501d93a869023a439fce5 Mon Sep 17 00:00:00 2001 +From: Horia Geanta +Date: Wed, 20 Mar 2013 16:31:58 +0200 +Subject: Revert "crypto: caam - add IPsec ESN support" + +From: Horia Geanta + +commit 246bbedb9aaf27e2207501d93a869023a439fce5 upstream. + +This reverts commit 891104ed008e8646c7860fe5bc70b0aac55dcc6c. + +Current IPsec ESN implementation for authencesn(cbc(aes), hmac(sha)) +(separate encryption and integrity algorithms) does not conform +to RFC4303. + +ICV is generated by hashing the sequence +SPI, SeqNum-High, SeqNum-Low, IV, Payload +instead of +SPI, SeqNum-Low, IV, Payload, SeqNum-High. + +Reported-by: Chaoxing Lin +Signed-off-by: Horia Geanta +Reviewed-by: Kim Phillips +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/caam/caamalg.c | 27 ++------------------------- + drivers/crypto/caam/compat.h | 1 - + 2 files changed, 2 insertions(+), 26 deletions(-) + +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -1650,11 +1650,7 @@ struct caam_alg_template { + }; + + static struct caam_alg_template driver_algs[] = { +- /* +- * single-pass ipsec_esp descriptor +- * authencesn(*,*) is also registered, although not present +- * explicitly here. +- */ ++ /* single-pass ipsec_esp descriptor */ + { + .name = "authenc(hmac(md5),cbc(aes))", + .driver_name = "authenc-hmac-md5-cbc-aes-caam", +@@ -2217,9 +2213,7 @@ static int __init caam_algapi_init(void) + for (i = 0; i < ARRAY_SIZE(driver_algs); i++) { + /* TODO: check if h/w supports alg */ + struct caam_crypto_alg *t_alg; +- bool done = false; + +-authencesn: + t_alg = caam_alg_alloc(ctrldev, &driver_algs[i]); + if (IS_ERR(t_alg)) { + err = PTR_ERR(t_alg); +@@ -2233,25 +2227,8 @@ authencesn: + dev_warn(ctrldev, "%s alg registration failed\n", + t_alg->crypto_alg.cra_driver_name); + kfree(t_alg); +- } else { ++ } else + list_add_tail(&t_alg->entry, &priv->alg_list); +- if (driver_algs[i].type == CRYPTO_ALG_TYPE_AEAD && +- !memcmp(driver_algs[i].name, "authenc", 7) && +- !done) { +- char *name; +- +- name = driver_algs[i].name; +- memmove(name + 10, name + 7, strlen(name) - 7); +- memcpy(name + 7, "esn", 3); +- +- name = driver_algs[i].driver_name; +- memmove(name + 10, name + 7, strlen(name) - 7); +- memcpy(name + 7, "esn", 3); +- +- done = true; +- goto authencesn; +- } +- } + } + if (!list_empty(&priv->alg_list)) + dev_info(ctrldev, "%s algorithms registered in /proc/crypto\n", +--- a/drivers/crypto/caam/compat.h ++++ b/drivers/crypto/caam/compat.h +@@ -23,7 +23,6 @@ + #include + #include + #include +-#include + #include + + #include diff --git a/queue-3.8/revert-crypto-talitos-add-ipsec-esn-support.patch b/queue-3.8/revert-crypto-talitos-add-ipsec-esn-support.patch new file mode 100644 index 00000000000..172e38178b9 --- /dev/null +++ b/queue-3.8/revert-crypto-talitos-add-ipsec-esn-support.patch @@ -0,0 +1,99 @@ +From 991155bacb91c988c45586525771758ddadd44ce Mon Sep 17 00:00:00 2001 +From: Horia Geanta +Date: Wed, 20 Mar 2013 16:31:38 +0200 +Subject: Revert "crypto: talitos - add IPsec ESN support" + +From: Horia Geanta + +commit 991155bacb91c988c45586525771758ddadd44ce upstream. + +This reverts commit e763eb699be723fb41af818118068c6b3afdaf8d. + +Current IPsec ESN implementation for authencesn(cbc(aes), hmac(sha)) +(separate encryption and integrity algorithms) does not conform +to RFC4303. + +ICV is generated by hashing the sequence +SPI, SeqNum-High, SeqNum-Low, IV, Payload +instead of +SPI, SeqNum-Low, IV, Payload, SeqNum-High. + +Reported-by: Chaoxing Lin +Signed-off-by: Horia Geanta +Reviewed-by: Kim Phillips +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/talitos.c | 30 ++---------------------------- + 1 file changed, 2 insertions(+), 28 deletions(-) + +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -38,7 +38,6 @@ + #include + #include + #include +-#include + + #include + #include +@@ -1974,11 +1973,7 @@ struct talitos_alg_template { + }; + + static struct talitos_alg_template driver_algs[] = { +- /* +- * AEAD algorithms. These use a single-pass ipsec_esp descriptor. +- * authencesn(*,*) is also registered, although not present +- * explicitly here. +- */ ++ /* AEAD algorithms. These use a single-pass ipsec_esp descriptor */ + { .type = CRYPTO_ALG_TYPE_AEAD, + .alg.crypto = { + .cra_name = "authenc(hmac(sha1),cbc(aes))", +@@ -2820,9 +2815,7 @@ static int talitos_probe(struct platform + if (hw_supports(dev, driver_algs[i].desc_hdr_template)) { + struct talitos_crypto_alg *t_alg; + char *name = NULL; +- bool authenc = false; + +-authencesn: + t_alg = talitos_alg_alloc(dev, &driver_algs[i]); + if (IS_ERR(t_alg)) { + err = PTR_ERR(t_alg); +@@ -2837,8 +2830,6 @@ authencesn: + err = crypto_register_alg( + &t_alg->algt.alg.crypto); + name = t_alg->algt.alg.crypto.cra_driver_name; +- authenc = authenc ? !authenc : +- !(bool)memcmp(name, "authenc", 7); + break; + case CRYPTO_ALG_TYPE_AHASH: + err = crypto_register_ahash( +@@ -2851,25 +2842,8 @@ authencesn: + dev_err(dev, "%s alg registration failed\n", + name); + kfree(t_alg); +- } else { ++ } else + list_add_tail(&t_alg->entry, &priv->alg_list); +- if (authenc) { +- struct crypto_alg *alg = +- &driver_algs[i].alg.crypto; +- +- name = alg->cra_name; +- memmove(name + 10, name + 7, +- strlen(name) - 7); +- memcpy(name + 7, "esn", 3); +- +- name = alg->cra_driver_name; +- memmove(name + 10, name + 7, +- strlen(name) - 7); +- memcpy(name + 7, "esn", 3); +- +- goto authencesn; +- } +- } + } + } + if (!list_empty(&priv->alg_list)) diff --git a/queue-3.8/rtlwifi-usb-add-missing-freeing-of-skbuff.patch b/queue-3.8/rtlwifi-usb-add-missing-freeing-of-skbuff.patch new file mode 100644 index 00000000000..2b267a6f0f3 --- /dev/null +++ b/queue-3.8/rtlwifi-usb-add-missing-freeing-of-skbuff.patch @@ -0,0 +1,28 @@ +From 36ef0b473fbf43d5db23eea4616cc1d18cec245f Mon Sep 17 00:00:00 2001 +From: Jussi Kivilinna +Date: Sun, 17 Mar 2013 11:54:04 +0200 +Subject: rtlwifi: usb: add missing freeing of skbuff + +From: Jussi Kivilinna + +commit 36ef0b473fbf43d5db23eea4616cc1d18cec245f upstream. + +Signed-off-by: Jussi Kivilinna +Acked-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/usb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -854,6 +854,7 @@ static void _rtl_usb_transmit(struct iee + if (unlikely(!_urb)) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, + "Can't allocate urb. Drop skb!\n"); ++ kfree_skb(skb); + return; + } + urb_list = &rtlusb->tx_pending[ep_num]; diff --git a/queue-3.8/series b/queue-3.8/series index 93f2022e65d..0d0e5f5ae7c 100644 --- a/queue-3.8/series +++ b/queue-3.8/series @@ -3,3 +3,16 @@ tile-expect-new-initramfs-name-from-hypervisor-file-system.patch bluetooth-fix-not-closing-sco-sockets-in-the-bt_connect2-state.patch bluetooth-add-support-for-dell.patch bluetooth-add-support-for-dell_2.patch +staging-comedi-s626-fix-continuous-acquisition.patch +revert-crypto-talitos-add-ipsec-esn-support.patch +revert-crypto-caam-add-ipsec-esn-support.patch +sysfs-fix-race-between-readdir-and-lseek.patch +sysfs-handle-failure-path-correctly-for-readdir.patch +can-sja1000-fix-define-conflict-on-sh.patch +ath9k_hw-revert-chainmask-to-user-configuration-after-calibration.patch +ath9k-limit-tx-path-hang-check-to-normal-data-queues.patch +ath9k-avoid-queueing-hw-check-work-when-suspended.patch +hid-usbhid-quirk-for-realtek-multi-card-reader.patch +hid-usbhid-quirk-for-msi-gx680r-led-panel.patch +hid-usbhid-fix-build-problem.patch +rtlwifi-usb-add-missing-freeing-of-skbuff.patch diff --git a/queue-3.8/staging-comedi-s626-fix-continuous-acquisition.patch b/queue-3.8/staging-comedi-s626-fix-continuous-acquisition.patch new file mode 100644 index 00000000000..9bb593b36fa --- /dev/null +++ b/queue-3.8/staging-comedi-s626-fix-continuous-acquisition.patch @@ -0,0 +1,65 @@ +From e4317ce877a31dbb9d96375391c1c4ad2210d637 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 22 Mar 2013 15:16:29 +0000 +Subject: staging: comedi: s626: fix continuous acquisition + +From: Ian Abbott + +commit e4317ce877a31dbb9d96375391c1c4ad2210d637 upstream. + +For the s626 driver, there is a bug in the handling of asynchronous +commands on the AI subdevice when the stop source is `TRIG_NONE`. The +command should run continuously until cancelled, but the interrupt +handler stops the command running after the first scan. + +The command set-up function `s626_ai_cmd()` contains this code: + + switch (cmd->stop_src) { + case TRIG_COUNT: + /* data arrives as one packet */ + devpriv->ai_sample_count = cmd->stop_arg; + devpriv->ai_continous = 0; + break; + case TRIG_NONE: + /* continous acquisition */ + devpriv->ai_continous = 1; + devpriv->ai_sample_count = 0; + break; + } + +The interrupt handler `s626_irq_handler()` contains this code: + + if (!(devpriv->ai_continous)) + devpriv->ai_sample_count--; + if (devpriv->ai_sample_count <= 0) { + devpriv->ai_cmd_running = 0; + /* ... */ + } + +So `devpriv->ai_sample_count` is only decremented for the `TRIG_COUNT` +case, but `devpriv->ai_cmd_running` is set to 0 (and the command +stopped) regardless. + +Fix this in `s626_ai_cmd()` by setting `devpriv->ai_sample_count = 1` +for the `TRIG_NONE` case. The interrupt handler will not decrement it +so it will remain greater than 0 and the check for stopping the +acquisition will fail. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/s626.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/s626.c ++++ b/drivers/staging/comedi/drivers/s626.c +@@ -1482,7 +1482,7 @@ static int s626_ai_cmd(struct comedi_dev + case TRIG_NONE: + /* continous acquisition */ + devpriv->ai_continous = 1; +- devpriv->ai_sample_count = 0; ++ devpriv->ai_sample_count = 1; + break; + } + diff --git a/queue-3.8/sysfs-fix-race-between-readdir-and-lseek.patch b/queue-3.8/sysfs-fix-race-between-readdir-and-lseek.patch new file mode 100644 index 00000000000..94abef9d9f9 --- /dev/null +++ b/queue-3.8/sysfs-fix-race-between-readdir-and-lseek.patch @@ -0,0 +1,51 @@ +From 991f76f837bf22c5bb07261cfd86525a0a96650c Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Wed, 20 Mar 2013 23:25:24 +0800 +Subject: sysfs: fix race between readdir and lseek + +From: Ming Lei + +commit 991f76f837bf22c5bb07261cfd86525a0a96650c upstream. + +While readdir() is running, lseek() may set filp->f_pos as zero, +then may leave filp->private_data pointing to one sysfs_dirent +object without holding its reference counter, so the sysfs_dirent +object may be used after free in next readdir(). + +This patch holds inode->i_mutex to avoid the problem since +the lock is always held in readdir path. + +Reported-by: Dave Jones +Tested-by: Sasha Levin +Signed-off-by: Ming Lei +Signed-off-by: Greg Kroah-Hartman + +--- + fs/sysfs/dir.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/fs/sysfs/dir.c ++++ b/fs/sysfs/dir.c +@@ -1058,10 +1058,21 @@ static int sysfs_readdir(struct file * f + return 0; + } + ++static loff_t sysfs_dir_llseek(struct file *file, loff_t offset, int whence) ++{ ++ struct inode *inode = file->f_path.dentry->d_inode; ++ loff_t ret; ++ ++ mutex_lock(&inode->i_mutex); ++ ret = generic_file_llseek(file, offset, whence); ++ mutex_unlock(&inode->i_mutex); ++ ++ return ret; ++} + + const struct file_operations sysfs_dir_operations = { + .read = generic_read_dir, + .readdir = sysfs_readdir, + .release = sysfs_dir_release, +- .llseek = generic_file_llseek, ++ .llseek = sysfs_dir_llseek, + }; diff --git a/queue-3.8/sysfs-handle-failure-path-correctly-for-readdir.patch b/queue-3.8/sysfs-handle-failure-path-correctly-for-readdir.patch new file mode 100644 index 00000000000..2af5b72d47b --- /dev/null +++ b/queue-3.8/sysfs-handle-failure-path-correctly-for-readdir.patch @@ -0,0 +1,47 @@ +From e5110f411d2ee35bf8d202ccca2e89c633060dca Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Wed, 20 Mar 2013 23:25:25 +0800 +Subject: sysfs: handle failure path correctly for readdir() + +From: Ming Lei + +commit e5110f411d2ee35bf8d202ccca2e89c633060dca upstream. + +In case of 'if (filp->f_pos == 0 or 1)' of sysfs_readdir(), +the failure from filldir() isn't handled, and the reference counter +of the sysfs_dirent object pointed by filp->private_data will be +released without clearing filp->private_data, so use after free +bug will be triggered later. + +This patch returns immeadiately under the situation for fixing the bug, +and it is reasonable to return from readdir() when filldir() fails. + +Reported-by: Dave Jones +Tested-by: Sasha Levin +Signed-off-by: Ming Lei +Signed-off-by: Greg Kroah-Hartman + +--- + fs/sysfs/dir.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/sysfs/dir.c ++++ b/fs/sysfs/dir.c +@@ -1020,6 +1020,8 @@ static int sysfs_readdir(struct file * f + ino = parent_sd->s_ino; + if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0) + filp->f_pos++; ++ else ++ return 0; + } + if (filp->f_pos == 1) { + if (parent_sd->s_parent) +@@ -1028,6 +1030,8 @@ static int sysfs_readdir(struct file * f + ino = parent_sd->s_ino; + if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0) + filp->f_pos++; ++ else ++ return 0; + } + mutex_lock(&sysfs_mutex); + for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);