From 1be72d94006db82fa89e2efaab27521a47da4cad Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 26 Nov 2013 09:23:28 -0800 Subject: [PATCH] 3.10-stable patches added patches: revert-ima-policy-for-ramfs.patch rt2x00-check-if-device-is-still-available-on-rt2x00mac_flush.patch rt2x00-fix-a-crash-bug-in-the-ht-descriptor-handling-fix.patch rt2x00-fix-ht-tx-descriptor-settings-regression.patch rt2x00-rt2800lib-fix-vgc-adjustment-for-rt5592.patch --- queue-3.10/revert-ima-policy-for-ramfs.patch | 32 ++++++ ...s-still-available-on-rt2x00mac_flush.patch | 104 ++++++++++++++++++ ...ug-in-the-ht-descriptor-handling-fix.patch | 43 ++++++++ ...ht-tx-descriptor-settings-regression.patch | 82 ++++++++++++++ ...800lib-fix-vgc-adjustment-for-rt5592.patch | 52 +++++++++ queue-3.10/series | 5 + 6 files changed, 318 insertions(+) create mode 100644 queue-3.10/revert-ima-policy-for-ramfs.patch create mode 100644 queue-3.10/rt2x00-check-if-device-is-still-available-on-rt2x00mac_flush.patch create mode 100644 queue-3.10/rt2x00-fix-a-crash-bug-in-the-ht-descriptor-handling-fix.patch create mode 100644 queue-3.10/rt2x00-fix-ht-tx-descriptor-settings-regression.patch create mode 100644 queue-3.10/rt2x00-rt2800lib-fix-vgc-adjustment-for-rt5592.patch diff --git a/queue-3.10/revert-ima-policy-for-ramfs.patch b/queue-3.10/revert-ima-policy-for-ramfs.patch new file mode 100644 index 00000000000..109e93c5478 --- /dev/null +++ b/queue-3.10/revert-ima-policy-for-ramfs.patch @@ -0,0 +1,32 @@ +From 08de59eb144d7c41351a467442f898d720f0f15f Mon Sep 17 00:00:00 2001 +From: Mimi Zohar +Date: Thu, 17 Oct 2013 07:34:02 -0400 +Subject: Revert "ima: policy for RAMFS" + +From: Mimi Zohar + +commit 08de59eb144d7c41351a467442f898d720f0f15f upstream. + +This reverts commit 4c2c392763a682354fac65b6a569adec4e4b5387. + +Everything in the initramfs should be measured and appraised, +but until the initramfs has extended attribute support, at +least measured. + +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_policy.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -73,7 +73,6 @@ static struct ima_rule_entry default_rul + {.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC}, + {.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC}, + {.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC}, +- {.action = DONT_MEASURE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC}, + {.action = DONT_MEASURE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC}, + {.action = DONT_MEASURE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC}, + {.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC}, diff --git a/queue-3.10/rt2x00-check-if-device-is-still-available-on-rt2x00mac_flush.patch b/queue-3.10/rt2x00-check-if-device-is-still-available-on-rt2x00mac_flush.patch new file mode 100644 index 00000000000..d65e1d4f551 --- /dev/null +++ b/queue-3.10/rt2x00-check-if-device-is-still-available-on-rt2x00mac_flush.patch @@ -0,0 +1,104 @@ +From 5671ab05cf2a579218985ef56595387932d78ee4 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Tue, 15 Oct 2013 14:31:12 +0200 +Subject: rt2x00: check if device is still available on rt2x00mac_flush() + +From: Stanislaw Gruszka + +commit 5671ab05cf2a579218985ef56595387932d78ee4 upstream. + +Fix random kernel panic with below messages when remove dongle. + +[ 2212.355447] BUG: unable to handle kernel NULL pointer dereference at 0000000000000250 +[ 2212.355527] IP: [] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb] +[ 2212.355599] PGD 0 +[ 2212.355626] Oops: 0000 [#1] SMP +[ 2212.355664] Modules linked in: rt2800usb rt2x00usb rt2800lib crc_ccitt rt2x00lib mac80211 cfg80211 tun arc4 fuse rfcomm bnep snd_hda_codec_realtek snd_hda_intel snd_hda_codec btusb uvcvideo bluetooth snd_hwdep x86_pkg_temp_thermal snd_seq coretemp aesni_intel aes_x86_64 snd_seq_device glue_helper snd_pcm ablk_helper videobuf2_vmalloc sdhci_pci videobuf2_memops videobuf2_core sdhci videodev mmc_core serio_raw snd_page_alloc microcode i2c_i801 snd_timer hid_multitouch thinkpad_acpi lpc_ich mfd_core snd tpm_tis wmi tpm tpm_bios soundcore acpi_cpufreq i915 i2c_algo_bit drm_kms_helper drm i2c_core video [last unloaded: cfg80211] +[ 2212.356224] CPU: 0 PID: 34 Comm: khubd Not tainted 3.12.0-rc3-wl+ #3 +[ 2212.356268] Hardware name: LENOVO 3444CUU/3444CUU, BIOS G6ET93WW (2.53 ) 02/04/2013 +[ 2212.356319] task: ffff880212f687c0 ti: ffff880212f66000 task.ti: ffff880212f66000 +[ 2212.356392] RIP: 0010:[] [] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb] +[ 2212.356481] RSP: 0018:ffff880212f67750 EFLAGS: 00010202 +[ 2212.356519] RAX: 000000000000000c RBX: 000000000000000c RCX: 0000000000000293 +[ 2212.356568] RDX: ffff8801f4dc219a RSI: 0000000000000000 RDI: 0000000000000240 +[ 2212.356617] RBP: ffff880212f67778 R08: ffffffffa02667e0 R09: 0000000000000002 +[ 2212.356665] R10: 0001f95254ab4b40 R11: ffff880212f675be R12: ffff8801f4dc2150 +[ 2212.356712] R13: 0000000000000000 R14: ffffffffa02667e0 R15: 000000000000000d +[ 2212.356761] FS: 0000000000000000(0000) GS:ffff88021e200000(0000) knlGS:0000000000000000 +[ 2212.356813] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 2212.356852] CR2: 0000000000000250 CR3: 0000000001a0c000 CR4: 00000000001407f0 +[ 2212.356899] Stack: +[ 2212.356917] 000000000000000c ffff8801f4dc2150 0000000000000000 ffffffffa02667e0 +[ 2212.356980] 000000000000000d ffff880212f677b8 ffffffffa03a31ad ffff8801f4dc219a +[ 2212.357038] ffff8801f4dc2150 0000000000000000 ffff8800b93217a0 ffff8801f49bc800 +[ 2212.357099] Call Trace: +[ 2212.357122] [] ? rt2x00usb_interrupt_txdone+0x90/0x90 [rt2x00usb] +[ 2212.357174] [] rt2x00queue_for_each_entry+0xed/0x170 [rt2x00lib] +[ 2212.357244] [] rt2x00usb_kick_queue+0x5c/0x60 [rt2x00usb] +[ 2212.357314] [] rt2x00queue_flush_queue+0x62/0xa0 [rt2x00lib] +[ 2212.357386] [] rt2x00mac_flush+0x30/0x70 [rt2x00lib] +[ 2212.357470] [] ieee80211_flush_queues+0xbd/0x140 [mac80211] +[ 2212.357555] [] ieee80211_set_disassoc+0x2d2/0x3d0 [mac80211] +[ 2212.357645] [] ieee80211_mgd_deauth+0x1d3/0x240 [mac80211] +[ 2212.357718] [] ? try_to_wake_up+0xec/0x290 +[ 2212.357788] [] ieee80211_deauth+0x18/0x20 [mac80211] +[ 2212.357872] [] cfg80211_mlme_deauth+0x9c/0x140 [cfg80211] +[ 2212.357913] [] cfg80211_mlme_down+0x5c/0x60 [cfg80211] +[ 2212.357962] [] cfg80211_disconnect+0x188/0x1a0 [cfg80211] +[ 2212.358014] [] ? __cfg80211_stop_sched_scan+0x1c/0x130 [cfg80211] +[ 2212.358067] [] cfg80211_leave+0xc4/0xe0 [cfg80211] +[ 2212.358124] [] cfg80211_netdev_notifier_call+0x3ab/0x5e0 [cfg80211] +[ 2212.358177] [] ? inetdev_event+0x38/0x510 +[ 2212.358217] [] ? __wake_up+0x44/0x50 +[ 2212.358254] [] notifier_call_chain+0x4c/0x70 +[ 2212.358293] [] raw_notifier_call_chain+0x16/0x20 +[ 2212.358361] [] call_netdevice_notifiers_info+0x35/0x60 +[ 2212.358429] [] __dev_close_many+0x49/0xd0 +[ 2212.358487] [] dev_close_many+0x88/0x100 +[ 2212.358546] [] rollback_registered_many+0xb0/0x220 +[ 2212.358612] [] unregister_netdevice_many+0x19/0x60 +[ 2212.358694] [] ieee80211_remove_interfaces+0x112/0x190 [mac80211] +[ 2212.358791] [] ieee80211_unregister_hw+0x4f/0x100 [mac80211] +[ 2212.361994] [] rt2x00lib_remove_dev+0x161/0x1a0 [rt2x00lib] +[ 2212.365240] [] rt2x00usb_disconnect+0x2e/0x70 [rt2x00usb] +[ 2212.368470] [] usb_unbind_interface+0x64/0x1c0 +[ 2212.371734] [] __device_release_driver+0x7f/0xf0 +[ 2212.374999] [] device_release_driver+0x23/0x30 +[ 2212.378131] [] bus_remove_device+0x108/0x180 +[ 2212.381358] [] device_del+0x135/0x1d0 +[ 2212.384454] [] usb_disable_device+0xb0/0x270 +[ 2212.387451] [] usb_disconnect+0xad/0x1d0 +[ 2212.390294] [] hub_thread+0x63d/0x1660 +[ 2212.393034] [] ? wake_up_atomic_t+0x30/0x30 +[ 2212.395728] [] ? hub_port_debounce+0x130/0x130 +[ 2212.398412] [] kthread+0xc0/0xd0 +[ 2212.401058] [] ? insert_kthread_work+0x40/0x40 +[ 2212.403639] [] ret_from_fork+0x7c/0xb0 +[ 2212.406193] [] ? insert_kthread_work+0x40/0x40 +[ 2212.408732] Code: 24 58 08 00 00 bf 80 00 00 00 e8 3a c3 e0 e0 5b 41 5c 5d c3 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 <48> 8b 47 10 48 89 fb 4c 8b 6f 28 4c 8b 20 49 8b 04 24 4c 8b 30 +[ 2212.414671] RIP [] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb] +[ 2212.417646] RSP +[ 2212.420547] CR2: 0000000000000250 +[ 2212.441024] ---[ end trace 5442918f33832bce ]--- + +Signed-off-by: Stanislaw Gruszka +Acked-by: Helmut Schaa +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2x00mac.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/wireless/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c +@@ -754,6 +754,9 @@ void rt2x00mac_flush(struct ieee80211_hw + struct rt2x00_dev *rt2x00dev = hw->priv; + struct data_queue *queue; + ++ if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags)) ++ return; ++ + tx_queue_for_each(rt2x00dev, queue) + rt2x00queue_flush_queue(queue, drop); + } diff --git a/queue-3.10/rt2x00-fix-a-crash-bug-in-the-ht-descriptor-handling-fix.patch b/queue-3.10/rt2x00-fix-a-crash-bug-in-the-ht-descriptor-handling-fix.patch new file mode 100644 index 00000000000..9dccbf77bf5 --- /dev/null +++ b/queue-3.10/rt2x00-fix-a-crash-bug-in-the-ht-descriptor-handling-fix.patch @@ -0,0 +1,43 @@ +From b4089d6d8e71a7293e2192025dfa507a04f661c4 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Thu, 14 Nov 2013 21:33:15 +0100 +Subject: rt2x00: fix a crash bug in the HT descriptor handling fix + +From: Felix Fietkau + +commit b4089d6d8e71a7293e2192025dfa507a04f661c4 upstream. + +Commit "rt2x00: fix HT TX descriptor settings regression" +assumes that the control parameter to rt2x00mac_tx is always non-NULL. +There is an internal call in rt2x00lib_bc_buffer_iter where NULL is +passed. Fix the resulting crash by adding an initialized dummy on-stack +ieee80211_tx_control struct. + +Signed-off-by: Felix Fietkau +Acked-by: Gertjan van Wingerde +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2x00dev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c +@@ -181,6 +181,7 @@ static void rt2x00lib_autowakeup(struct + static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac, + struct ieee80211_vif *vif) + { ++ struct ieee80211_tx_control control = {}; + struct rt2x00_dev *rt2x00dev = data; + struct sk_buff *skb; + +@@ -195,7 +196,7 @@ static void rt2x00lib_bc_buffer_iter(voi + */ + skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif); + while (skb) { +- rt2x00mac_tx(rt2x00dev->hw, NULL, skb); ++ rt2x00mac_tx(rt2x00dev->hw, &control, skb); + skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif); + } + } diff --git a/queue-3.10/rt2x00-fix-ht-tx-descriptor-settings-regression.patch b/queue-3.10/rt2x00-fix-ht-tx-descriptor-settings-regression.patch new file mode 100644 index 00000000000..2a17876fc9d --- /dev/null +++ b/queue-3.10/rt2x00-fix-ht-tx-descriptor-settings-regression.patch @@ -0,0 +1,82 @@ +From 3d8bfe141be8e5c21261fc63da8e7964d44f2645 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Thu, 31 Oct 2013 11:23:57 +0100 +Subject: rt2x00: fix HT TX descriptor settings regression + +From: Stanislaw Gruszka + +commit 3d8bfe141be8e5c21261fc63da8e7964d44f2645 upstream. + +Since: + +commit 36323f817af0376c78612cfdab714b0feb05fea5 +Author: Thomas Huehn +Date: Mon Jul 23 21:33:42 2012 +0200 + + mac80211: move TX station pointer and restructure TX + +we do not pass sta pointer to rt2x00queue_create_tx_descriptor_ht(), +hence we do not correctly set station WCID and AMPDU density parameters. + +Signed-off-by: Stanislaw Gruszka +Acked-by: Gertjan van Wingerde +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2x00lib.h | 2 +- + drivers/net/wireless/rt2x00/rt2x00mac.c | 4 ++-- + drivers/net/wireless/rt2x00/rt2x00queue.c | 4 ++-- + 3 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/rt2x00/rt2x00lib.h ++++ b/drivers/net/wireless/rt2x00/rt2x00lib.h +@@ -146,7 +146,7 @@ void rt2x00queue_remove_l2pad(struct sk_ + * @local: frame is not from mac80211 + */ + int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb, +- bool local); ++ struct ieee80211_sta *sta, bool local); + + /** + * rt2x00queue_update_beacon - Send new beacon from mac80211 +--- a/drivers/net/wireless/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c +@@ -90,7 +90,7 @@ static int rt2x00mac_tx_rts_cts(struct r + frag_skb->data, data_length, tx_info, + (struct ieee80211_rts *)(skb->data)); + +- retval = rt2x00queue_write_tx_frame(queue, skb, true); ++ retval = rt2x00queue_write_tx_frame(queue, skb, NULL, true); + if (retval) { + dev_kfree_skb_any(skb); + rt2x00_warn(rt2x00dev, "Failed to send RTS/CTS frame\n"); +@@ -151,7 +151,7 @@ void rt2x00mac_tx(struct ieee80211_hw *h + goto exit_fail; + } + +- if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false))) ++ if (unlikely(rt2x00queue_write_tx_frame(queue, skb, control->sta, false))) + goto exit_fail; + + /* +--- a/drivers/net/wireless/rt2x00/rt2x00queue.c ++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c +@@ -635,7 +635,7 @@ static void rt2x00queue_bar_check(struct + } + + int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb, +- bool local) ++ struct ieee80211_sta *sta, bool local) + { + struct ieee80211_tx_info *tx_info; + struct queue_entry *entry; +@@ -649,7 +649,7 @@ int rt2x00queue_write_tx_frame(struct da + * after that we are free to use the skb->cb array + * for our information. + */ +- rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, NULL); ++ rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, sta); + + /* + * All information is retrieved from the skb->cb array, diff --git a/queue-3.10/rt2x00-rt2800lib-fix-vgc-adjustment-for-rt5592.patch b/queue-3.10/rt2x00-rt2800lib-fix-vgc-adjustment-for-rt5592.patch new file mode 100644 index 00000000000..51c777d06cd --- /dev/null +++ b/queue-3.10/rt2x00-rt2800lib-fix-vgc-adjustment-for-rt5592.patch @@ -0,0 +1,52 @@ +From 0beb1bbf19c72f17809e42b8f33522a55c2cc18c Mon Sep 17 00:00:00 2001 +From: Gabor Juhos +Date: Thu, 3 Oct 2013 20:00:40 +0200 +Subject: rt2x00: rt2800lib: fix VGC adjustment for RT5592 + +From: Gabor Juhos + +commit 0beb1bbf19c72f17809e42b8f33522a55c2cc18c upstream. + +In commit 3d81535ea5940446510a8a5cee1c6ad23c90c753 +(rt2800: 5592: add chip specific vgc calculations) +the rt2800_link_tuner function has been modified to +adjust VGC level for the RT5592 chipset. + +On the RT5592 chipset, the VGC level must be adjusted +only if rssi is greater than -65. However the current +code adjusts the VGC value by 0x10 regardless of the +actual chipset if the rssi value is between -80 and +-65. + +Fix the broken behaviour by reordering the if-else +statements. + +Signed-off-by: Gabor Juhos +Acked-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2800lib.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/rt2x00/rt2800lib.c ++++ b/drivers/net/wireless/rt2x00/rt2800lib.c +@@ -3400,10 +3400,13 @@ void rt2800_link_tuner(struct rt2x00_dev + + vgc = rt2800_get_default_vgc(rt2x00dev); + +- if (rt2x00_rt(rt2x00dev, RT5592) && qual->rssi > -65) +- vgc += 0x20; +- else if (qual->rssi > -80) +- vgc += 0x10; ++ if (rt2x00_rt(rt2x00dev, RT5592)) { ++ if (qual->rssi > -65) ++ vgc += 0x20; ++ } else { ++ if (qual->rssi > -80) ++ vgc += 0x10; ++ } + + rt2800_set_vgc(rt2x00dev, qual, vgc); + } diff --git a/queue-3.10/series b/queue-3.10/series index 3a23b65421f..98ae85eb93a 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -22,3 +22,8 @@ acpi-ec-ensure-lock-is-acquired-before-accessing-ec-struct-members.patch acpi-video-quirk-initial-backlight-level-0.patch acpi-hotplug-fix-handle_root_bridge_removal.patch acpi-hotplug-do-not-execute-insert-in-progress-_ost.patch +rt2x00-fix-a-crash-bug-in-the-ht-descriptor-handling-fix.patch +rt2x00-check-if-device-is-still-available-on-rt2x00mac_flush.patch +rt2x00-rt2800lib-fix-vgc-adjustment-for-rt5592.patch +rt2x00-fix-ht-tx-descriptor-settings-regression.patch +revert-ima-policy-for-ramfs.patch -- 2.47.3