3.14-stable patches

added patches:
	cfg80211-avoid-mem-leak-on-driver-hint-set.patch
	cfg80211-don-t-warn-about-two-consecutive-country-ie-hint.patch
	cfg80211-fix-160-mhz-channels-with-80-80-and-160-mhz-drivers.patch

diff --git a/queue-3.14/cfg80211-avoid-mem-leak-on-driver-hint-set.patch b/queue-3.14/cfg80211-avoid-mem-leak-on-driver-hint-set.patch
new file mode 100644 (file)
index 0000000..51ee19c
--- /dev/null
+++ b/queue-3.14/cfg80211-avoid-mem-leak-on-driver-hint-set.patch
@@ -0,0 +1,44 @@
+From 34f05f543f02350e920bddb7660ffdd4697aaf60 Mon Sep 17 00:00:00 2001
+From: Arik Nemtsov <arik@wizery.com>
+Date: Thu, 4 Dec 2014 12:22:16 +0200
+Subject: cfg80211: avoid mem leak on driver hint set
+
+From: Arik Nemtsov <arik@wizery.com>
+
+commit 34f05f543f02350e920bddb7660ffdd4697aaf60 upstream.
+
+In the already-set and intersect case of a driver-hint, the previous
+wiphy regdomain was not freed before being reset with a copy of the
+cfg80211 regdomain.
+
+Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
+Acked-by: Luis R. Rodriguez <mcgrof@suse.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/reg.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1547,7 +1547,7 @@ static enum reg_request_treatment
+ reg_process_hint_driver(struct wiphy *wiphy,
+                       struct regulatory_request *driver_request)
+ {
+-      const struct ieee80211_regdomain *regd;
++      const struct ieee80211_regdomain *regd, *tmp;
+       enum reg_request_treatment treatment;
+ 
+       treatment = __reg_process_hint_driver(driver_request);
+@@ -1566,7 +1566,10 @@ reg_process_hint_driver(struct wiphy *wi
+                       kfree(driver_request);
+                       return REG_REQ_IGNORE;
+               }
++
++              tmp = get_wiphy_regdom(wiphy);
+               rcu_assign_pointer(wiphy->regd, regd);
++              rcu_free_regdom(tmp);
+       }
+ 
+ 

diff --git a/queue-3.14/cfg80211-don-t-warn-about-two-consecutive-country-ie-hint.patch b/queue-3.14/cfg80211-don-t-warn-about-two-consecutive-country-ie-hint.patch
new file mode 100644 (file)
index 0000000..18ac345
--- /dev/null
+++ b/queue-3.14/cfg80211-don-t-warn-about-two-consecutive-country-ie-hint.patch
@@ -0,0 +1,42 @@
+From 70dcec5a488a7b81779190ac8089475fe4b8b962 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 2 Dec 2014 09:53:25 +0200
+Subject: cfg80211: don't WARN about two consecutive Country IE hint
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 70dcec5a488a7b81779190ac8089475fe4b8b962 upstream.
+
+This can happen and there is no point in added more
+detection code lower in the stack. Catching these in one
+single point (cfg80211) is enough. Stop WARNING about this
+case.
+
+This fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=89001
+
+Fixes: 2f1c6c572d7b ("cfg80211: process non country IE conflicting first")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/reg.c |    7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1625,11 +1625,8 @@ __reg_process_hint_country_ie(struct wip
+                       return REG_REQ_IGNORE;
+               return REG_REQ_ALREADY_SET;
+       }
+-      /*
+-       * Two consecutive Country IE hints on the same wiphy.
+-       * This should be picked up early by the driver/stack
+-       */
+-      if (WARN_ON(regdom_changes(country_ie_request->alpha2)))
++
++      if (regdom_changes(country_ie_request->alpha2))
+               return REG_REQ_OK;
+       return REG_REQ_ALREADY_SET;
+ }

diff --git a/queue-3.14/cfg80211-fix-160-mhz-channels-with-80-80-and-160-mhz-drivers.patch b/queue-3.14/cfg80211-fix-160-mhz-channels-with-80-80-and-160-mhz-drivers.patch
new file mode 100644 (file)
index 0000000..4f29086
--- /dev/null
+++ b/queue-3.14/cfg80211-fix-160-mhz-channels-with-80-80-and-160-mhz-drivers.patch
@@ -0,0 +1,56 @@
+From 08f6f147773b23b765b94633a8eaa82e7defcf4c Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Thu, 11 Dec 2014 23:48:55 +0200
+Subject: cfg80211: Fix 160 MHz channels with 80+80 and 160 MHz drivers
+
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+
+commit 08f6f147773b23b765b94633a8eaa82e7defcf4c upstream.
+
+The VHT supported channel width field is a two bit integer, not a
+bitfield. cfg80211_chandef_usable() was interpreting it incorrectly and
+ended up rejecting 160 MHz channel width if the driver indicated support
+for both 160 and 80+80 MHz channels.
+
+Fixes: 3d9d1d6656a73 ("nl80211/cfg80211: support VHT channel configuration")
+       (however, no real drivers had 160 MHz support it until 3.16)
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/chan.c |    9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -516,7 +516,7 @@ bool cfg80211_chandef_usable(struct wiph
+ {
+       struct ieee80211_sta_ht_cap *ht_cap;
+       struct ieee80211_sta_vht_cap *vht_cap;
+-      u32 width, control_freq;
++      u32 width, control_freq, cap;
+ 
+       if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+               return false;
+@@ -554,7 +554,8 @@ bool cfg80211_chandef_usable(struct wiph
+                       return false;
+               break;
+       case NL80211_CHAN_WIDTH_80P80:
+-              if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))
++              cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
++              if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
+                       return false;
+       case NL80211_CHAN_WIDTH_80:
+               if (!vht_cap->vht_supported)
+@@ -565,7 +566,9 @@ bool cfg80211_chandef_usable(struct wiph
+       case NL80211_CHAN_WIDTH_160:
+               if (!vht_cap->vht_supported)
+                       return false;
+-              if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
++              cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
++              if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
++                  cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
+                       return false;
+               prohibited_flags |= IEEE80211_CHAN_NO_160MHZ;
+               width = 160;

diff --git a/queue-3.14/series b/queue-3.14/series
index 5c63d00a5d950b97feeecfbf033e28c8cb64096c..e0669eb2785f4759f575e16f20a31d0c2277bc84 100644 (file)
--- a/queue-3.14/series
+++ b/queue-3.14/series
@@ -26,3 +26,6 @@ drm-i915-invalidate-media-caches-on-gen7.patch
 drm-i915-force-the-cs-stall-for-invalidate-flushes.patch
 arc-move-peripherals-to-match-model-to-fpga.patch
 arc-switch-to-generic-entry-end-assembler-annotations.patch
+cfg80211-don-t-warn-about-two-consecutive-country-ie-hint.patch
+cfg80211-avoid-mem-leak-on-driver-hint-set.patch
+cfg80211-fix-160-mhz-channels-with-80-80-and-160-mhz-drivers.patch