--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jan 25 03:23:38 2008
+From: Michael Buesch <mb@bu3sch.de>
+Date: Fri, 25 Jan 2008 12:15:07 +0100
+Subject: b43: Drop packets we are not able to encrypt
+To: stable@kernel.org
+Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de
+Message-ID: <200801251215.08164.mb@bu3sch.de>
+Content-Disposition: inline
+
+From: Michael Buesch <mb@bu3sch.de>
+
+patch 09552ccd8277e6382097e93a40f7311a09449367 in mainline
+
+We must drop any packets we are not able to encrypt.
+We must not send them unencrypted or with an all-zero-key (which
+basically is the same as unencrypted, from a security point of view).
+
+This might only trigger shortly after resume before mac80211 reassociated
+and reconfigured the keys.
+
+It is safe to drop these packets, as the association they belong to
+is not guaranteed anymore anyway.
+This is a security fix in the sense that it prevents information leakage.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/dma.c | 11 ++++++++++-
+ drivers/net/wireless/b43/xmit.c | 20 +++++++++++++++-----
+ drivers/net/wireless/b43/xmit.h | 2 +-
+ 3 files changed, 26 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -1122,9 +1122,11 @@ static int dma_tx_fragment(struct b43_dm
+ memset(meta_hdr, 0, sizeof(*meta_hdr));
+
+ header = &(ring->txhdr_cache[slot * sizeof(struct b43_txhdr_fw4)]);
+- b43_generate_txhdr(ring->dev, header,
++ err = b43_generate_txhdr(ring->dev, header,
+ skb->data, skb->len, ctl,
+ generate_cookie(ring, slot));
++ if (unlikely(err))
++ return err;
+
+ meta_hdr->dmaaddr = map_descbuffer(ring, (unsigned char *)header,
+ sizeof(struct b43_txhdr_fw4), 1);
+@@ -1219,6 +1221,13 @@ int b43_dma_tx(struct b43_wldev *dev,
+ B43_WARN_ON(ring->stopped);
+
+ err = dma_tx_fragment(ring, skb, ctl);
++ if (unlikely(err == -ENOKEY)) {
++ /* Drop this packet, as we don't have the encryption key
++ * anymore and must not transmit it unencrypted. */
++ dev_kfree_skb_any(skb);
++ err = 0;
++ goto out_unlock;
++ }
+ if (unlikely(err)) {
+ b43err(dev->wl, "DMA tx mapping failure\n");
+ goto out_unlock;
+--- a/drivers/net/wireless/b43/xmit.c
++++ b/drivers/net/wireless/b43/xmit.c
+@@ -177,7 +177,7 @@ static u8 b43_calc_fallback_rate(u8 bitr
+ return 0;
+ }
+
+-static void generate_txhdr_fw4(struct b43_wldev *dev,
++static int generate_txhdr_fw4(struct b43_wldev *dev,
+ struct b43_txhdr_fw4 *txhdr,
+ const unsigned char *fragment_data,
+ unsigned int fragment_len,
+@@ -235,7 +235,15 @@ static void generate_txhdr_fw4(struct b4
+
+ B43_WARN_ON(key_idx >= dev->max_nr_keys);
+ key = &(dev->key[key_idx]);
+- B43_WARN_ON(!key->keyconf);
++
++ if (unlikely(!key->keyconf)) {
++ /* This key is invalid. This might only happen
++ * in a short timeframe after machine resume before
++ * we were able to reconfigure keys.
++ * Drop this packet completely. Do not transmit it
++ * unencrypted to avoid leaking information. */
++ return -ENOKEY;
++ }
+
+ /* Hardware appends ICV. */
+ plcp_fragment_len += txctl->icv_len;
+@@ -352,16 +360,18 @@ static void generate_txhdr_fw4(struct b4
+ txhdr->mac_ctl = cpu_to_le32(mac_ctl);
+ txhdr->phy_ctl = cpu_to_le16(phy_ctl);
+ txhdr->extra_ft = extra_ft;
++
++ return 0;
+ }
+
+-void b43_generate_txhdr(struct b43_wldev *dev,
++int b43_generate_txhdr(struct b43_wldev *dev,
+ u8 * txhdr,
+ const unsigned char *fragment_data,
+ unsigned int fragment_len,
+ const struct ieee80211_tx_control *txctl, u16 cookie)
+ {
+- generate_txhdr_fw4(dev, (struct b43_txhdr_fw4 *)txhdr,
+- fragment_data, fragment_len, txctl, cookie);
++ return generate_txhdr_fw4(dev, (struct b43_txhdr_fw4 *)txhdr,
++ fragment_data, fragment_len, txctl, cookie);
+ }
+
+ static s8 b43_rssi_postprocess(struct b43_wldev *dev,
+--- a/drivers/net/wireless/b43/xmit.h
++++ b/drivers/net/wireless/b43/xmit.h
+@@ -82,7 +82,7 @@ struct b43_txhdr_fw4 {
+ #define B43_TX4_PHY_ANT1 0x0100 /* Use antenna 1 */
+ #define B43_TX4_PHY_ANTLAST 0x0300 /* Use last used antenna */
+
+-void b43_generate_txhdr(struct b43_wldev *dev,
++int b43_generate_txhdr(struct b43_wldev *dev,
+ u8 * txhdr,
+ const unsigned char *fragment_data,
+ unsigned int fragment_len,
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jan 25 03:23:28 2008
+From: Michael Buesch <mb@bu3sch.de>
+Date: Fri, 25 Jan 2008 12:20:20 +0100
+Subject: b43: Fix dma-slot resource leakage
+To: stable@kernel.org
+Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de
+Message-ID: <200801251220.20332.mb@bu3sch.de>
+Content-Disposition: inline
+
+From: Michael Buesch <mb@bu3sch.de>
+
+patch 8dd0100ce9511e52614ecd0a6587c13ce5769c8b in mainline.
+
+This fixes four resource leakages.
+In any error path we must deallocate the DMA frame slots we
+previously allocated by request_slot().
+This is done by storing the ring pointers before doing any ring
+allocation and restoring the old pointers in case of an error.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: Stefano Brivio <stefano.brivio@polimi.it>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+---
+ drivers/net/wireless/b43/dma.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -1106,7 +1106,7 @@ static int dma_tx_fragment(struct b43_dm
+ {
+ const struct b43_dma_ops *ops = ring->ops;
+ u8 *header;
+- int slot;
++ int slot, old_top_slot, old_used_slots;
+ int err;
+ struct b43_dmadesc_generic *desc;
+ struct b43_dmadesc_meta *meta;
+@@ -1116,6 +1116,9 @@ static int dma_tx_fragment(struct b43_dm
+ #define SLOTS_PER_PACKET 2
+ B43_WARN_ON(skb_shinfo(skb)->nr_frags);
+
++ old_top_slot = ring->current_slot;
++ old_used_slots = ring->used_slots;
++
+ /* Get a slot for the header. */
+ slot = request_slot(ring);
+ desc = ops->idx2desc(ring, slot, &meta_hdr);
+@@ -1125,13 +1128,19 @@ static int dma_tx_fragment(struct b43_dm
+ err = b43_generate_txhdr(ring->dev, header,
+ skb->data, skb->len, ctl,
+ generate_cookie(ring, slot));
+- if (unlikely(err))
++ if (unlikely(err)) {
++ ring->current_slot = old_top_slot;
++ ring->used_slots = old_used_slots;
+ return err;
++ }
+
+ meta_hdr->dmaaddr = map_descbuffer(ring, (unsigned char *)header,
+ sizeof(struct b43_txhdr_fw4), 1);
+- if (dma_mapping_error(meta_hdr->dmaaddr))
++ if (dma_mapping_error(meta_hdr->dmaaddr)) {
++ ring->current_slot = old_top_slot;
++ ring->used_slots = old_used_slots;
+ return -EIO;
++ }
+ ops->fill_descriptor(ring, desc, meta_hdr->dmaaddr,
+ sizeof(struct b43_txhdr_fw4), 1, 0, 0);
+
+@@ -1149,6 +1158,8 @@ static int dma_tx_fragment(struct b43_dm
+ if (dma_mapping_error(meta->dmaaddr)) {
+ bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
+ if (!bounce_skb) {
++ ring->current_slot = old_top_slot;
++ ring->used_slots = old_used_slots;
+ err = -ENOMEM;
+ goto out_unmap_hdr;
+ }
+@@ -1159,6 +1170,8 @@ static int dma_tx_fragment(struct b43_dm
+ meta->skb = skb;
+ meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
+ if (dma_mapping_error(meta->dmaaddr)) {
++ ring->current_slot = old_top_slot;
++ ring->used_slots = old_used_slots;
+ err = -EIO;
+ goto out_free_bounce;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jan 25 03:23:28 2008
+From: Michael Buesch <mb@bu3sch.de>
+Date: Fri, 25 Jan 2008 12:11:45 +0100
+Subject: b43: Fix suspend/resume
+To: stable@kernel.org
+Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de
+Message-ID: <200801251211.45980.mb@bu3sch.de>
+Content-Disposition: inline
+
+From: Michael Buesch <mb@bu3sch.de>
+
+patch 7be1bb6b798d506693d2d8668e801951996b5a4a in mainline.
+
+This patch makes suspend/resume work with the b43 driver.
+We must not overwrite the MAC addresses in the init function, as this
+would also overwrite the MAC on resume. With an all-zero MAC the device
+firmware is not able to ACK any received packets anymore.
+Fix this by moving the initializion stuff that must be done on init but
+not on resume to the start function.
+Also zero out filter_flags to make sure we don't have some flags
+from a previous instance for a tiny timeframe until mac80211 reconfigures
+them.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/main.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -3395,8 +3395,6 @@ static int b43_wireless_core_init(struct
+ b43_bluetooth_coext_enable(dev);
+
+ ssb_bus_powerup(bus, 1); /* Enable dynamic PCTL */
+- memset(wl->bssid, 0, ETH_ALEN);
+- memset(wl->mac_addr, 0, ETH_ALEN);
+ b43_upload_card_macaddress(dev);
+ b43_security_init(dev);
+ b43_rng_init(wl);
+@@ -3493,6 +3491,13 @@ static int b43_start(struct ieee80211_hw
+ int did_init = 0;
+ int err = 0;
+
++ /* Kill all old instance specific information to make sure
++ * the card won't use it in the short timeframe between start
++ * and mac80211 reconfiguring it. */
++ memset(wl->bssid, 0, ETH_ALEN);
++ memset(wl->mac_addr, 0, ETH_ALEN);
++ wl->filter_flags = 0;
++
+ /* First register RFkill.
+ * LEDs that are registered later depend on it. */
+ b43_rfkill_init(dev);
pci-fix-fakephp-deadlock.patch
acpi-update-acpi-blacklist.patch
x86-restore-correct-module-name-for-apm.patch
+sky2-restore-multicast-addresses-after-recovery.patch
+sky2-fix-for-wol-on-some-devices.patch
+b43-fix-suspend-resume.patch
+b43-drop-packets-we-are-not-able-to-encrypt.patch
+b43-fix-dma-slot-resource-leakage.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jan 24 19:46:45 2008
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+Date: Thu, 24 Jan 2008 19:46:10 -0800
+Subject: sky2: fix for WOL on some devices
+To: stable@kernel.org
+Message-ID: <20080124194610.68c3b009@deepthought>
+
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+patch 82637e808478087ce861129745fa60cc37e7929d in mainline
+
+This patch disables config mode access after clearing PCI settings.
+Without this change WOL won't work on some BIOS's
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -621,6 +621,7 @@ static void sky2_phy_power(struct sky2_h
+ static const u32 phy_power[] = { PCI_Y2_PHY1_POWD, PCI_Y2_PHY2_POWD };
+ static const u32 coma_mode[] = { PCI_Y2_PHY1_COMA, PCI_Y2_PHY2_COMA };
+
++ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
+ reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
+ /* Turn on/off phy power saving */
+ if (onoff)
+@@ -632,7 +633,8 @@ static void sky2_phy_power(struct sky2_h
+ reg1 |= coma_mode[port];
+
+ sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
+- reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
++ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
++ sky2_pci_read32(hw, PCI_DEV_REG1);
+
+ udelay(100);
+ }
+@@ -2427,6 +2429,7 @@ static void sky2_hw_intr(struct sky2_hw
+ if (status & (Y2_IS_MST_ERR | Y2_IS_IRQ_STAT)) {
+ u16 pci_err;
+
++ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
+ pci_err = sky2_pci_read16(hw, PCI_STATUS);
+ if (net_ratelimit())
+ dev_err(&pdev->dev, "PCI hardware error (0x%x)\n",
+@@ -2434,12 +2437,14 @@ static void sky2_hw_intr(struct sky2_hw
+
+ sky2_pci_write16(hw, PCI_STATUS,
+ pci_err | PCI_STATUS_ERROR_BITS);
++ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
+ }
+
+ if (status & Y2_IS_PCI_EXP) {
+ /* PCI-Express uncorrectable Error occurred */
+ u32 err;
+
++ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
+ err = sky2_read32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS);
+ sky2_write32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS,
+ 0xfffffffful);
+@@ -2447,6 +2452,7 @@ static void sky2_hw_intr(struct sky2_hw
+ dev_err(&pdev->dev, "PCI Express error (0x%x)\n", err);
+
+ sky2_read32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS);
++ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
+ }
+
+ if (status & Y2_HWE_L1_MASK)
+@@ -2812,6 +2818,7 @@ static void sky2_reset(struct sky2_hw *h
+ }
+
+ sky2_power_on(hw);
++ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
+
+ for (i = 0; i < hw->ports; i++) {
+ sky2_write8(hw, SK_REG(i, GMAC_LINK_CTRL), GMLC_RST_SET);
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jan 24 19:45:27 2008
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+Date: Thu, 24 Jan 2008 19:44:50 -0800
+Subject: sky2: restore multicast addresses after recovery
+To: stable@kernel.org
+Message-ID: <20080124194450.6ab264ea@deepthought>
+
+From: Stephen Hemminger <shemminger@linux-foundation.org>
+
+patch a7bffe722c996679b4fb2103ecaf673ec2b9b4a7 in mainline.
+
+If the sky2 deadman timer forces a recovery, the multicast hash
+list is lost. Move the call to sky2_set_multicast to the end
+of sky2_up() so all paths that bring device up will restore multicast.
+
+Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -1412,6 +1412,7 @@ static int sky2_up(struct net_device *de
+ imask |= portirq_msk[port];
+ sky2_write32(hw, B0_IMSK, imask);
+
++ sky2_set_multicast(dev);
+ return 0;
+
+ err_out:
+@@ -3533,8 +3534,6 @@ static int sky2_set_ringparam(struct net
+ err = sky2_up(dev);
+ if (err)
+ dev_close(dev);
+- else
+- sky2_set_multicast(dev);
+ }
+
+ return err;
+@@ -4368,8 +4367,6 @@ static int sky2_resume(struct pci_dev *p
+ dev_close(dev);
+ goto out;
+ }
+-
+- sky2_set_multicast(dev);
+ }
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
