From f7a628a12c718ea9fb9112135308c5888c3c60d4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 5 Nov 2015 16:14:14 -0800 Subject: [PATCH] 3.10-stable patches added patches: iwlwifi-dvm-fix-d3-firmware-pn-programming.patch iwlwifi-fix-firmware-filename-for-3160.patch --- ...i-dvm-fix-d3-firmware-pn-programming.patch | 34 +++++++++++++++++++ ...lwifi-fix-firmware-filename-for-3160.patch | 30 ++++++++++++++++ queue-3.10/series | 2 ++ 3 files changed, 66 insertions(+) create mode 100644 queue-3.10/iwlwifi-dvm-fix-d3-firmware-pn-programming.patch create mode 100644 queue-3.10/iwlwifi-fix-firmware-filename-for-3160.patch diff --git a/queue-3.10/iwlwifi-dvm-fix-d3-firmware-pn-programming.patch b/queue-3.10/iwlwifi-dvm-fix-d3-firmware-pn-programming.patch new file mode 100644 index 00000000000..6d60e2cb6e8 --- /dev/null +++ b/queue-3.10/iwlwifi-dvm-fix-d3-firmware-pn-programming.patch @@ -0,0 +1,34 @@ +From 5bd166872d8f99f156fac191299d24f828bb2348 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Tue, 15 Sep 2015 14:36:09 +0200 +Subject: iwlwifi: dvm: fix D3 firmware PN programming + +From: Johannes Berg + +commit 5bd166872d8f99f156fac191299d24f828bb2348 upstream. + +The code to send the RX PN data (for each TID) to the firmware +has a devastating bug: it overwrites the data for TID 0 with +all the TID data, leaving the remaining TIDs zeroed. This will +allow replays to actually be accepted by the firmware, which +could allow waking up the system. + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/dvm/lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/dvm/lib.c ++++ b/drivers/net/wireless/iwlwifi/dvm/lib.c +@@ -1023,7 +1023,7 @@ static void iwlagn_wowlan_program_keys(s + u8 *pn = seq.ccmp.pn; + + ieee80211_get_key_rx_seq(key, i, &seq); +- aes_sc->pn = cpu_to_le64( ++ aes_sc[i].pn = cpu_to_le64( + (u64)pn[5] | + ((u64)pn[4] << 8) | + ((u64)pn[3] << 16) | diff --git a/queue-3.10/iwlwifi-fix-firmware-filename-for-3160.patch b/queue-3.10/iwlwifi-fix-firmware-filename-for-3160.patch new file mode 100644 index 00000000000..67ef3414557 --- /dev/null +++ b/queue-3.10/iwlwifi-fix-firmware-filename-for-3160.patch @@ -0,0 +1,30 @@ +From b5a48134f8af08f5243328f8a0b05fc5ae7cf343 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Tue, 22 Sep 2015 10:47:27 +0200 +Subject: iwlwifi: fix firmware filename for 3160 + +From: Johannes Berg + +commit b5a48134f8af08f5243328f8a0b05fc5ae7cf343 upstream. + +The MODULE_FIRMWARE() for 3160 should be using the 7260 version as +it's done in the device configuration struct instead of referencing +IWL3160_UCODE_API_OK which doesn't even exist. + +Reported-by: Hauke Mehrtens +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-7000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c +@@ -185,4 +185,4 @@ const struct iwl_cfg iwl3160_n_cfg = { + }; + + MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); +-MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK)); ++MODULE_FIRMWARE(IWL3162_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); diff --git a/queue-3.10/series b/queue-3.10/series index 75484e3e9b5..a53ec4ba942 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -1 +1,3 @@ ath9k-declare-required-extra-tx-headroom.patch +iwlwifi-dvm-fix-d3-firmware-pn-programming.patch +iwlwifi-fix-firmware-filename-for-3160.patch -- 2.47.2