Linux v4.4.8
- Allow antenna selection for rtl8723be (rhbz 1309487)
This commit is contained in:
Laura Abbott
parent
b97d8effe6
commit
334e67b414
|
|
@ -1,46 +0,0 @@
|
|||
From 29c6dd591bbd592472247441de9fa694acdabae8 Mon Sep 17 00:00:00 2001
|
||||
From: Oliver Neukum <oneukum@suse.com>
|
||||
Date: Thu, 7 Jan 2016 11:01:00 +0100
|
||||
Subject: [PATCH] cdc-acm: fix NULL pointer reference
|
||||
|
||||
The union descriptor must be checked. Its usage was conditional
|
||||
before the parser was introduced. This is important, because
|
||||
many RNDIS device, which also use the common parser, have
|
||||
bogus extra descriptors.
|
||||
|
||||
Signed-off-by: Oliver Neukum <oneukum@suse.com>
|
||||
Tested-by: Vasily Galkin <galkin-vv@yandex.ru>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
drivers/net/usb/cdc_ether.c | 8 +++++++-
|
||||
1 file changed, 7 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
|
||||
index 3da70bf..7cba2c3 100644
|
||||
--- a/drivers/net/usb/cdc_ether.c
|
||||
+++ b/drivers/net/usb/cdc_ether.c
|
||||
@@ -160,6 +160,12 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
|
||||
info->u = header.usb_cdc_union_desc;
|
||||
info->header = header.usb_cdc_header_desc;
|
||||
info->ether = header.usb_cdc_ether_desc;
|
||||
+ if (!info->u) {
|
||||
+ if (rndis)
|
||||
+ goto skip;
|
||||
+ else /* in that case a quirk is mandatory */
|
||||
+ goto bad_desc;
|
||||
+ }
|
||||
/* we need a master/control interface (what we're
|
||||
* probed with) and a slave/data interface; union
|
||||
* descriptors sort this all out.
|
||||
@@ -256,7 +262,7 @@ skip:
|
||||
goto bad_desc;
|
||||
}
|
||||
|
||||
- } else if (!info->header || !info->u || (!rndis && !info->ether)) {
|
||||
+ } else if (!info->header || (!rndis && !info->ether)) {
|
||||
dev_dbg(&intf->dev, "missing cdc %s%s%sdescriptor\n",
|
||||
info->header ? "" : "header ",
|
||||
info->u ? "" : "union ",
|
||||
--
|
||||
2.5.0
|
||||
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
From 79abe2bd501d628b165f323098d6972d69bd13d7 Mon Sep 17 00:00:00 2001
|
||||
From: Hans de Goede <hdegoede@redhat.com>
|
||||
Date: Wed, 16 Mar 2016 13:20:51 +0100
|
||||
Subject: [PATCH] uas: Limit qdepth at the scsi-host level
|
||||
|
||||
Commit 64d513ac31bd ("scsi: use host wide tags by default") causes
|
||||
the scsi-core to queue more cmnds then we can handle on devices with
|
||||
multiple LUNs, limit the qdepth at the scsi-host level instead of
|
||||
per slave to fix this.
|
||||
|
||||
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1315013
|
||||
Cc: stable@vger.kernel.org # 4.4.x and 4.5.x
|
||||
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
|
||||
---
|
||||
drivers/usb/storage/uas.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
|
||||
index c90a7e4..b5cb7ab 100644
|
||||
--- a/drivers/usb/storage/uas.c
|
||||
+++ b/drivers/usb/storage/uas.c
|
||||
@@ -800,7 +800,6 @@ static int uas_slave_configure(struct scsi_device *sdev)
|
||||
if (devinfo->flags & US_FL_BROKEN_FUA)
|
||||
sdev->broken_fua = 1;
|
||||
|
||||
- scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -932,6 +931,12 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
|
||||
if (result)
|
||||
goto set_alt0;
|
||||
|
||||
+ /*
|
||||
+ * 1 tag is reserved for untagged commands +
|
||||
+ * 1 tag to avoid of by one errors in some bridge firmwares
|
||||
+ */
|
||||
+ shost->can_queue = devinfo->qdepth - 2;
|
||||
+
|
||||
usb_set_intfdata(intf, shost);
|
||||
result = scsi_add_host(shost, &intf->dev);
|
||||
if (result)
|
||||
--
|
||||
2.7.3
|
||||
|
||||
|
|
@ -1,58 +0,0 @@
|
|||
From patchwork Mon Nov 23 09:32:42 2015
|
||||
Content-Type: text/plain; charset="utf-8"
|
||||
MIME-Version: 1.0
|
||||
Content-Transfer-Encoding: 7bit
|
||||
Subject: [09/29] drm/udl: Use unlocked gem unreferencing
|
||||
From: Daniel Vetter <daniel.vetter@ffwll.ch>
|
||||
X-Patchwork-Id: 65722
|
||||
Message-Id: <1448271183-20523-10-git-send-email-daniel.vetter@ffwll.ch>
|
||||
To: DRI Development <dri-devel@lists.freedesktop.org>
|
||||
Cc: Daniel Vetter <daniel.vetter@intel.com>,
|
||||
Daniel Vetter <daniel.vetter@ffwll.ch>,
|
||||
Intel Graphics Development <intel-gfx@lists.freedesktop.org>,
|
||||
Dave Airlie <airlied@redhat.com>
|
||||
Date: Mon, 23 Nov 2015 10:32:42 +0100
|
||||
|
||||
For drm_gem_object_unreference callers are required to hold
|
||||
dev->struct_mutex, which these paths don't. Enforcing this requirement
|
||||
has become a bit more strict with
|
||||
|
||||
commit ef4c6270bf2867e2f8032e9614d1a8cfc6c71663
|
||||
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
|
||||
Date: Thu Oct 15 09:36:25 2015 +0200
|
||||
|
||||
drm/gem: Check locking in drm_gem_object_unreference
|
||||
|
||||
Cc: Dave Airlie <airlied@redhat.com>
|
||||
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
|
||||
---
|
||||
drivers/gpu/drm/udl/udl_fb.c | 2 +-
|
||||
drivers/gpu/drm/udl/udl_gem.c | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
|
||||
index 200419d4d43c..18a2acbccb7d 100644
|
||||
--- a/drivers/gpu/drm/udl/udl_fb.c
|
||||
+++ b/drivers/gpu/drm/udl/udl_fb.c
|
||||
@@ -538,7 +538,7 @@ static int udlfb_create(struct drm_fb_helper *helper,
|
||||
out_destroy_fbi:
|
||||
drm_fb_helper_release_fbi(helper);
|
||||
out_gfree:
|
||||
- drm_gem_object_unreference(&ufbdev->ufb.obj->base);
|
||||
+ drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base);
|
||||
out:
|
||||
return ret;
|
||||
}
|
||||
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
|
||||
index 2a0a784ab6ee..d7528e0d8442 100644
|
||||
--- a/drivers/gpu/drm/udl/udl_gem.c
|
||||
+++ b/drivers/gpu/drm/udl/udl_gem.c
|
||||
@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file,
|
||||
return ret;
|
||||
}
|
||||
|
||||
- drm_gem_object_unreference(&obj->base);
|
||||
+ drm_gem_object_unreference_unlocked(&obj->base);
|
||||
*handle_p = handle;
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,227 @@
|
|||
From c18d8f5095715c56bb3cd9cba64242542632054b Mon Sep 17 00:00:00 2001
|
||||
From: Larry Finger <Larry.Finger@lwfinger.net>
|
||||
Date: Wed, 16 Mar 2016 13:33:34 -0500
|
||||
Subject: rtlwifi: rtl8723be: Add antenna select module parameter
|
||||
|
||||
A number of new laptops have been delivered with only a single antenna.
|
||||
In principle, this is OK; however, a problem arises when the on-board
|
||||
EEPROM is programmed to use the other antenna connection. The option
|
||||
of opening the computer and moving the connector is not always possible
|
||||
as it will void the warranty in some cases. In addition, this solution
|
||||
breaks the Windows driver when the box dual boots Linux and Windows.
|
||||
|
||||
A fix involving a new module parameter has been developed. This commit
|
||||
adds the new parameter and implements the changes needed for the driver.
|
||||
|
||||
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
|
||||
Cc: Stable <stable@vger.kernel.org> [V4.0+]
|
||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
||||
---
|
||||
drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 5 +++++
|
||||
drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c | 3 +++
|
||||
drivers/net/wireless/realtek/rtlwifi/wifi.h | 3 +++
|
||||
3 files changed, 11 insertions(+)
|
||||
|
||||
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
|
||||
index c983d2f..5a3df91 100644
|
||||
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
|
||||
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
|
||||
@@ -2684,6 +2684,7 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
|
||||
bool auto_load_fail, u8 *hwinfo)
|
||||
{
|
||||
struct rtl_priv *rtlpriv = rtl_priv(hw);
|
||||
+ struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params;
|
||||
u8 value;
|
||||
u32 tmpu_32;
|
||||
|
||||
@@ -2702,6 +2703,10 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
|
||||
rtlpriv->btcoexist.btc_info.ant_num = ANT_X2;
|
||||
}
|
||||
|
||||
+ /* override ant_num / ant_path */
|
||||
+ if (mod_params->ant_sel)
|
||||
+ rtlpriv->btcoexist.btc_info.ant_num =
|
||||
+ (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1);
|
||||
}
|
||||
|
||||
void rtl8723be_bt_reg_init(struct ieee80211_hw *hw)
|
||||
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
|
||||
index a78eaed..2101793 100644
|
||||
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
|
||||
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
|
||||
@@ -273,6 +273,7 @@ static struct rtl_mod_params rtl8723be_mod_params = {
|
||||
.msi_support = false,
|
||||
.disable_watchdog = false,
|
||||
.debug = DBG_EMERG,
|
||||
+ .ant_sel = 0,
|
||||
};
|
||||
|
||||
static struct rtl_hal_cfg rtl8723be_hal_cfg = {
|
||||
@@ -394,6 +395,7 @@ module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
|
||||
module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444);
|
||||
module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog,
|
||||
bool, 0444);
|
||||
+module_param_named(ant_sel, rtl8723be_mod_params.ant_sel, int, 0444);
|
||||
MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
|
||||
MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
|
||||
MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
|
||||
@@ -402,6 +404,7 @@ MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
|
||||
MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
|
||||
MODULE_PARM_DESC(disable_watchdog,
|
||||
"Set to 1 to disable the watchdog (default 0)\n");
|
||||
+MODULE_PARM_DESC(ant_sel, "Set to 1 or 2 to force antenna number (default 0)\n");
|
||||
|
||||
static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
|
||||
|
||||
diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
|
||||
index 554d814..93bd7fc 100644
|
||||
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
|
||||
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
|
||||
@@ -2246,6 +2246,9 @@ struct rtl_mod_params {
|
||||
|
||||
/* default 0: 1 means do not disable interrupts */
|
||||
bool int_clear;
|
||||
+
|
||||
+ /* select antenna */
|
||||
+ int ant_sel;
|
||||
};
|
||||
|
||||
struct rtl_hal_usbint_cfg {
|
||||
--
|
||||
cgit v0.12
|
||||
|
||||
From baa1702290953295e421f0f433e2b1ff4815827c Mon Sep 17 00:00:00 2001
|
||||
From: Larry Finger <Larry.Finger@lwfinger.net>
|
||||
Date: Wed, 16 Mar 2016 13:33:35 -0500
|
||||
Subject: rtlwifi: btcoexist: Implement antenna selection
|
||||
|
||||
The previous patch added an option to rtl8723be to manually select the
|
||||
antenna for those cases when only a single antenna is present, and the
|
||||
on-board EEPROM is incorrectly programmed. This patch implements the
|
||||
necessary changes in the Bluetooth coexistence driver.
|
||||
|
||||
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
|
||||
Cc: Stable <stable@vger.kernel.org> [V4.0+]
|
||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
||||
---
|
||||
.../realtek/rtlwifi/btcoexist/halbtc8723b2ant.c | 9 ++++++--
|
||||
.../realtek/rtlwifi/btcoexist/halbtcoutsrc.c | 27 +++++++++++++++++++++-
|
||||
.../realtek/rtlwifi/btcoexist/halbtcoutsrc.h | 2 +-
|
||||
.../wireless/realtek/rtlwifi/btcoexist/rtl_btc.c | 5 +++-
|
||||
4 files changed, 38 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c
|
||||
index c43ab59..77cbd10 100644
|
||||
--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c
|
||||
+++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c
|
||||
@@ -1203,7 +1203,6 @@ static void btc8723b2ant_set_ant_path(struct btc_coexist *btcoexist,
|
||||
|
||||
/* Force GNT_BT to low */
|
||||
btcoexist->btc_write_1byte_bitmask(btcoexist, 0x765, 0x18, 0x0);
|
||||
- btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0);
|
||||
|
||||
if (board_info->btdm_ant_pos == BTC_ANTENNA_AT_MAIN_PORT) {
|
||||
/* tell firmware "no antenna inverse" */
|
||||
@@ -1211,19 +1210,25 @@ static void btc8723b2ant_set_ant_path(struct btc_coexist *btcoexist,
|
||||
h2c_parameter[1] = 1; /* ext switch type */
|
||||
btcoexist->btc_fill_h2c(btcoexist, 0x65, 2,
|
||||
h2c_parameter);
|
||||
+ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0);
|
||||
} else {
|
||||
/* tell firmware "antenna inverse" */
|
||||
h2c_parameter[0] = 1;
|
||||
h2c_parameter[1] = 1; /* ext switch type */
|
||||
btcoexist->btc_fill_h2c(btcoexist, 0x65, 2,
|
||||
h2c_parameter);
|
||||
+ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x280);
|
||||
}
|
||||
}
|
||||
|
||||
/* ext switch setting */
|
||||
if (use_ext_switch) {
|
||||
/* fixed internal switch S1->WiFi, S0->BT */
|
||||
- btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0);
|
||||
+ if (board_info->btdm_ant_pos == BTC_ANTENNA_AT_MAIN_PORT)
|
||||
+ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0);
|
||||
+ else
|
||||
+ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x280);
|
||||
+
|
||||
switch (antpos_type) {
|
||||
case BTC_ANT_WIFI_AT_MAIN:
|
||||
/* ext switch main at wifi */
|
||||
diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
|
||||
index b2791c8..babd149 100644
|
||||
--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
|
||||
+++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
|
||||
@@ -965,13 +965,38 @@ void exhalbtc_set_chip_type(u8 chip_type)
|
||||
}
|
||||
}
|
||||
|
||||
-void exhalbtc_set_ant_num(u8 type, u8 ant_num)
|
||||
+void exhalbtc_set_ant_num(struct rtl_priv *rtlpriv, u8 type, u8 ant_num)
|
||||
{
|
||||
if (BT_COEX_ANT_TYPE_PG == type) {
|
||||
gl_bt_coexist.board_info.pg_ant_num = ant_num;
|
||||
gl_bt_coexist.board_info.btdm_ant_num = ant_num;
|
||||
+ /* The antenna position:
|
||||
+ * Main (default) or Aux for pgAntNum=2 && btdmAntNum =1.
|
||||
+ * The antenna position should be determined by
|
||||
+ * auto-detect mechanism.
|
||||
+ * The following is assumed to main,
|
||||
+ * and those must be modified
|
||||
+ * if y auto-detect mechanism is ready
|
||||
+ */
|
||||
+ if ((gl_bt_coexist.board_info.pg_ant_num == 2) &&
|
||||
+ (gl_bt_coexist.board_info.btdm_ant_num == 1))
|
||||
+ gl_bt_coexist.board_info.btdm_ant_pos =
|
||||
+ BTC_ANTENNA_AT_MAIN_PORT;
|
||||
+ else
|
||||
+ gl_bt_coexist.board_info.btdm_ant_pos =
|
||||
+ BTC_ANTENNA_AT_MAIN_PORT;
|
||||
} else if (BT_COEX_ANT_TYPE_ANTDIV == type) {
|
||||
gl_bt_coexist.board_info.btdm_ant_num = ant_num;
|
||||
+ gl_bt_coexist.board_info.btdm_ant_pos =
|
||||
+ BTC_ANTENNA_AT_MAIN_PORT;
|
||||
+ } else if (type == BT_COEX_ANT_TYPE_DETECTED) {
|
||||
+ gl_bt_coexist.board_info.btdm_ant_num = ant_num;
|
||||
+ if (rtlpriv->cfg->mod_params->ant_sel == 1)
|
||||
+ gl_bt_coexist.board_info.btdm_ant_pos =
|
||||
+ BTC_ANTENNA_AT_AUX_PORT;
|
||||
+ else
|
||||
+ gl_bt_coexist.board_info.btdm_ant_pos =
|
||||
+ BTC_ANTENNA_AT_MAIN_PORT;
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h
|
||||
index 0a903ea..f41ca57 100644
|
||||
--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h
|
||||
+++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h
|
||||
@@ -535,7 +535,7 @@ void exhalbtc_set_bt_patch_version(u16 bt_hci_version, u16 bt_patch_version);
|
||||
void exhalbtc_update_min_bt_rssi(char bt_rssi);
|
||||
void exhalbtc_set_bt_exist(bool bt_exist);
|
||||
void exhalbtc_set_chip_type(u8 chip_type);
|
||||
-void exhalbtc_set_ant_num(u8 type, u8 ant_num);
|
||||
+void exhalbtc_set_ant_num(struct rtl_priv *rtlpriv, u8 type, u8 ant_num);
|
||||
void exhalbtc_display_bt_coex_info(struct btc_coexist *btcoexist);
|
||||
void exhalbtc_signal_compensation(struct btc_coexist *btcoexist,
|
||||
u8 *rssi_wifi, u8 *rssi_bt);
|
||||
diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c
|
||||
index b9b0cb7..d3fd921 100644
|
||||
--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c
|
||||
+++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c
|
||||
@@ -72,7 +72,10 @@ void rtl_btc_init_hal_vars(struct rtl_priv *rtlpriv)
|
||||
__func__, bt_type);
|
||||
exhalbtc_set_chip_type(bt_type);
|
||||
|
||||
- exhalbtc_set_ant_num(BT_COEX_ANT_TYPE_PG, ant_num);
|
||||
+ if (rtlpriv->cfg->mod_params->ant_sel == 1)
|
||||
+ exhalbtc_set_ant_num(rtlpriv, BT_COEX_ANT_TYPE_DETECTED, 1);
|
||||
+ else
|
||||
+ exhalbtc_set_ant_num(rtlpriv, BT_COEX_ANT_TYPE_PG, ant_num);
|
||||
}
|
||||
|
||||
void rtl_btc_init_hw_config(struct rtl_priv *rtlpriv)
|
||||
--
|
||||
cgit v0.12
|
||||
|
||||
|
|
@ -1,97 +0,0 @@
|
|||
From fbd40ea0180a2d328c5adc61414dc8bab9335ce2 Mon Sep 17 00:00:00 2001
|
||||
From: "David S. Miller" <davem@davemloft.net>
|
||||
Date: Sun, 13 Mar 2016 23:28:00 -0400
|
||||
Subject: ipv4: Don't do expensive useless work during inetdev destroy.
|
||||
|
||||
When an inetdev is destroyed, every address assigned to the interface
|
||||
is removed. And in this scenerio we do two pointless things which can
|
||||
be very expensive if the number of assigned interfaces is large:
|
||||
|
||||
1) Address promotion. We are deleting all addresses, so there is no
|
||||
point in doing this.
|
||||
|
||||
2) A full nf conntrack table purge for every address. We only need to
|
||||
do this once, as is already caught by the existing
|
||||
masq_dev_notifier so masq_inet_event() can skip this.
|
||||
|
||||
Reported-by: Solar Designer <solar@openwall.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
Tested-by: Cyrill Gorcunov <gorcunov@openvz.org>
|
||||
---
|
||||
net/ipv4/devinet.c | 4 ++++
|
||||
net/ipv4/fib_frontend.c | 4 ++++
|
||||
net/ipv4/netfilter/nf_nat_masquerade_ipv4.c | 12 ++++++++++--
|
||||
3 files changed, 18 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
|
||||
index 65e76a4..e333bc8 100644
|
||||
--- a/net/ipv4/devinet.c
|
||||
+++ b/net/ipv4/devinet.c
|
||||
@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
|
||||
|
||||
ASSERT_RTNL();
|
||||
|
||||
+ if (in_dev->dead)
|
||||
+ goto no_promotions;
|
||||
+
|
||||
/* 1. Deleting primary ifaddr forces deletion all secondaries
|
||||
* unless alias promotion is set
|
||||
**/
|
||||
@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
|
||||
fib_del_ifaddr(ifa, ifa1);
|
||||
}
|
||||
|
||||
+no_promotions:
|
||||
/* 2. Unlink it */
|
||||
|
||||
*ifap = ifa1->ifa_next;
|
||||
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
|
||||
index 4734475..21add55 100644
|
||||
--- a/net/ipv4/fib_frontend.c
|
||||
+++ b/net/ipv4/fib_frontend.c
|
||||
@@ -922,6 +922,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
|
||||
subnet = 1;
|
||||
}
|
||||
|
||||
+ if (in_dev->dead)
|
||||
+ goto no_promotions;
|
||||
+
|
||||
/* Deletion is more complicated than add.
|
||||
* We should take care of not to delete too much :-)
|
||||
*
|
||||
@@ -997,6 +1000,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
|
||||
}
|
||||
}
|
||||
|
||||
+no_promotions:
|
||||
if (!(ok & BRD_OK))
|
||||
fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim);
|
||||
if (subnet && ifa->ifa_prefixlen < 31) {
|
||||
diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
|
||||
index c6eb421..ea91058 100644
|
||||
--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
|
||||
+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
|
||||
@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this,
|
||||
unsigned long event,
|
||||
void *ptr)
|
||||
{
|
||||
- struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
|
||||
+ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
|
||||
struct netdev_notifier_info info;
|
||||
|
||||
- netdev_notifier_info_init(&info, dev);
|
||||
+ /* The masq_dev_notifier will catch the case of the device going
|
||||
+ * down. So if the inetdev is dead and being destroyed we have
|
||||
+ * no work to do. Otherwise this is an individual address removal
|
||||
+ * and we have to perform the flush.
|
||||
+ */
|
||||
+ if (idev->dead)
|
||||
+ return NOTIFY_DONE;
|
||||
+
|
||||
+ netdev_notifier_info_init(&info, idev->dev);
|
||||
return masq_device_event(this, event, &info);
|
||||
}
|
||||
|
||||
--
|
||||
cgit v0.12
|
||||
|
||||
49
kernel.spec
49
kernel.spec
|
|
@ -52,7 +52,7 @@ Summary: The Linux kernel
|
|||
%if 0%{?released_kernel}
|
||||
|
||||
# Do we have a -stable update to apply?
|
||||
%define stable_update 7
|
||||
%define stable_update 8
|
||||
# Set rpm version accordingly
|
||||
%if 0%{?stable_update}
|
||||
%define stablerev %{stable_update}
|
||||
|
|
@ -588,9 +588,6 @@ Patch503: drm-i915-turn-off-wc-mmaps.patch
|
|||
|
||||
Patch508: kexec-uefi-copy-secure_boot-flag-in-boot-params.patch
|
||||
|
||||
#CVE-2015-7833 rhbz 1270158 1270160
|
||||
Patch567: usbvision-fix-crash-on-detecting-device-with-invalid.patch
|
||||
|
||||
#rhbz 1287819
|
||||
Patch570: HID-multitouch-enable-palm-rejection-if-device-imple.patch
|
||||
|
||||
|
|
@ -621,27 +618,15 @@ Patch659: pipe-limit-the-per-user-amount-of-pages-allocated-in.patch
|
|||
#rhbz 1310252 1313318
|
||||
Patch660: 0001-drm-i915-Pretend-cursor-is-always-on-for-ILK-style-W.patch
|
||||
|
||||
#rhbz 1316719
|
||||
Patch662: 0001-cdc-acm-fix-NULL-pointer-reference.patch
|
||||
|
||||
#CVE-2016-3135 rhbz 1317386 1317387
|
||||
Patch664: netfilter-x_tables-check-for-size-overflow.patch
|
||||
|
||||
#CVE-2016-3134 rhbz 1317383 1317384
|
||||
Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
|
||||
|
||||
#CVE-2016-3135 rhbz 1318172 1318270
|
||||
Patch666: ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch
|
||||
|
||||
#rhbz 1315013
|
||||
Patch679: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch
|
||||
|
||||
#CVE-2016-2187 rhbz 1317017 1317010
|
||||
Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch
|
||||
|
||||
#rhbz 1295646
|
||||
Patch688: 09-29-drm-udl-Use-unlocked-gem-unreferencing.patch
|
||||
|
||||
# CVE-2016-3672 rhbz 1324749 1324750
|
||||
Patch690: x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch
|
||||
|
||||
|
|
@ -653,10 +638,6 @@ Patch694: ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch
|
|||
|
||||
#CVE-2016-3951 rhbz 1324782 1324815
|
||||
Patch695: cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch
|
||||
Patch696: usbnet-cleanup-after-bind-in-probe.patch
|
||||
|
||||
#rhbz 1317116
|
||||
Patch697: HID-wacom-fix-Bamboo-ONE-oops.patch
|
||||
|
||||
#rhbz 1309980
|
||||
Patch698: 0001-ACPI-processor-Request-native-thermal-interrupt-hand.patch
|
||||
|
|
@ -667,6 +648,9 @@ Patch699: x86-xen-suppress-hugetlbfs-in-PV-guests.patch
|
|||
# CVE-2016-3955 rhbz 1328478 1328479
|
||||
Patch700: USB-usbip-fix-potential-out-of-bounds-write.patch
|
||||
|
||||
#rhbz 1309487
|
||||
Patch701: antenna_select.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
%endif
|
||||
|
||||
|
|
@ -1319,9 +1303,6 @@ ApplyPatch drm-i915-turn-off-wc-mmaps.patch
|
|||
|
||||
ApplyPatch kexec-uefi-copy-secure_boot-flag-in-boot-params.patch
|
||||
|
||||
#CVE-2015-7833 rhbz 1270158 1270160
|
||||
ApplyPatch usbvision-fix-crash-on-detecting-device-with-invalid.patch
|
||||
|
||||
#rhbz 1287819
|
||||
ApplyPatch HID-multitouch-enable-palm-rejection-if-device-imple.patch
|
||||
|
||||
|
|
@ -1352,26 +1333,15 @@ ApplyPatch pipe-limit-the-per-user-amount-of-pages-allocated-in.patch
|
|||
#rhbz 1310252 1313318
|
||||
ApplyPatch 0001-drm-i915-Pretend-cursor-is-always-on-for-ILK-style-W.patch
|
||||
|
||||
ApplyPatch 0001-cdc-acm-fix-NULL-pointer-reference.patch
|
||||
|
||||
#CVE-2016-3135 rhbz 1317386 1317387
|
||||
ApplyPatch netfilter-x_tables-check-for-size-overflow.patch
|
||||
|
||||
#CVE-2016-3134 rhbz 1317383 1317384
|
||||
ApplyPatch netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
|
||||
|
||||
#CVE-2016-3135 rhbz 1318172 1318270
|
||||
ApplyPatch ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch
|
||||
|
||||
#rhbz 1315013
|
||||
ApplyPatch 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch
|
||||
|
||||
#CVE-2016-2187 rhbz 1317017 1317010
|
||||
ApplyPatch input-gtco-fix-crash-on-detecting-device-without-end.patch
|
||||
|
||||
#rhbz 1295646
|
||||
ApplyPatch 09-29-drm-udl-Use-unlocked-gem-unreferencing.patch
|
||||
|
||||
# CVE-2016-3672 rhbz 1324749 1324750
|
||||
ApplyPatch x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch
|
||||
|
||||
|
|
@ -1383,10 +1353,6 @@ ApplyPatch ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch
|
|||
|
||||
#CVE-2016-3951 rhbz 1324782 1324815
|
||||
ApplyPatch cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch
|
||||
ApplyPatch usbnet-cleanup-after-bind-in-probe.patch
|
||||
|
||||
#rhbz 1317116
|
||||
ApplyPatch HID-wacom-fix-Bamboo-ONE-oops.patch
|
||||
|
||||
#rhbz 1309980
|
||||
ApplyPatch 0001-ACPI-processor-Request-native-thermal-interrupt-hand.patch
|
||||
|
|
@ -1397,6 +1363,9 @@ ApplyPatch x86-xen-suppress-hugetlbfs-in-PV-guests.patch
|
|||
# CVE-2016-3955 rhbz 1328478 1328479
|
||||
ApplyPatch USB-usbip-fix-potential-out-of-bounds-write.patch
|
||||
|
||||
#rhbz 1309487
|
||||
ApplyPatch antenna_select.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
|
|
@ -2246,6 +2215,10 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Wed Apr 20 2016 Laura Abbott <labbott@fedoraproject.org> - 4.4.8-200
|
||||
- Linux v4.4.8
|
||||
- Allow antenna selection for rtl8723be (rhbz 1309487)
|
||||
|
||||
* Tue Apr 19 2016 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- CVE-2016-3955 usbip: buffer overflow by trusting length of incoming packets (rhbz 1328478 1328479)
|
||||
|
||||
|
|
|
|||
2
sources
2
sources
|
|
@ -1,3 +1,3 @@
|
|||
9a78fa2eb6c68ca5a40ed5af08142599 linux-4.4.tar.xz
|
||||
dcbc8fe378a676d5d0dd208cf524e144 perf-man-4.4.tar.gz
|
||||
2286314f215706401dd51bf07b179ae4 patch-4.4.7.xz
|
||||
c1d8f46e5b2ee7c925fc38f20a3726d3 patch-4.4.8.xz
|
||||
|
|
|
|||
|
|
@ -1,39 +0,0 @@
|
|||
From 1666984c8625b3db19a9abc298931d35ab7bc64b Mon Sep 17 00:00:00 2001
|
||||
From: Oliver Neukum <oneukum@suse.com>
|
||||
Date: Mon, 7 Mar 2016 11:31:10 +0100
|
||||
Subject: [PATCH] usbnet: cleanup after bind() in probe()
|
||||
|
||||
In case bind() works, but a later error forces bailing
|
||||
in probe() in error cases work and a timer may be scheduled.
|
||||
They must be killed. This fixes an error case related to
|
||||
the double free reported in
|
||||
http://www.spinics.net/lists/netdev/msg367669.html
|
||||
and needs to go on top of Linus' fix to cdc-ncm.
|
||||
|
||||
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
drivers/net/usb/usbnet.c | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
|
||||
index 0b0ba7ef14e4..10798128c03f 100644
|
||||
--- a/drivers/net/usb/usbnet.c
|
||||
+++ b/drivers/net/usb/usbnet.c
|
||||
@@ -1769,6 +1769,13 @@ out3:
|
||||
if (info->unbind)
|
||||
info->unbind (dev, udev);
|
||||
out1:
|
||||
+ /* subdrivers must undo all they did in bind() if they
|
||||
+ * fail it, but we may fail later and a deferred kevent
|
||||
+ * may trigger an error resubmitting itself and, worse,
|
||||
+ * schedule a timer. So we kill it all just in case.
|
||||
+ */
|
||||
+ cancel_work_sync(&dev->kevent);
|
||||
+ del_timer_sync(&dev->delay);
|
||||
free_netdev(net);
|
||||
out:
|
||||
return status;
|
||||
--
|
||||
2.5.5
|
||||
|
||||
|
|
@ -1,49 +0,0 @@
|
|||
From 2ea39fc263c6a7589e15edb7d2d1c89fa569be53 Mon Sep 17 00:00:00 2001
|
||||
From: Vladis Dronov <vdronov@redhat.com>
|
||||
Date: Mon, 16 Nov 2015 15:55:11 -0200
|
||||
Subject: [PATCH] usbvision: fix crash on detecting device with invalid
|
||||
configuration
|
||||
|
||||
The usbvision driver crashes when a specially crafted usb device with invalid
|
||||
number of interfaces or endpoints is detected. This fix adds checks that the
|
||||
device has proper configuration expected by the driver.
|
||||
|
||||
Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
|
||||
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
|
||||
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
||||
---
|
||||
drivers/media/usb/usbvision/usbvision-video.c | 16 +++++++++++++++-
|
||||
1 file changed, 15 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
|
||||
index b693206f66dd..d1dc1a198e3e 100644
|
||||
--- a/drivers/media/usb/usbvision/usbvision-video.c
|
||||
+++ b/drivers/media/usb/usbvision/usbvision-video.c
|
||||
@@ -1463,9 +1463,23 @@ static int usbvision_probe(struct usb_interface *intf,
|
||||
|
||||
if (usbvision_device_data[model].interface >= 0)
|
||||
interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
|
||||
- else
|
||||
+ else if (ifnum < dev->actconfig->desc.bNumInterfaces)
|
||||
interface = &dev->actconfig->interface[ifnum]->altsetting[0];
|
||||
+ else {
|
||||
+ dev_err(&intf->dev, "interface %d is invalid, max is %d\n",
|
||||
+ ifnum, dev->actconfig->desc.bNumInterfaces - 1);
|
||||
+ ret = -ENODEV;
|
||||
+ goto err_usb;
|
||||
+ }
|
||||
+
|
||||
+ if (interface->desc.bNumEndpoints < 2) {
|
||||
+ dev_err(&intf->dev, "interface %d has %d endpoints, but must"
|
||||
+ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints);
|
||||
+ ret = -ENODEV;
|
||||
+ goto err_usb;
|
||||
+ }
|
||||
endpoint = &interface->endpoint[1].desc;
|
||||
+
|
||||
if (!usb_endpoint_xfer_isoc(endpoint)) {
|
||||
dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n",
|
||||
__func__, ifnum);
|
||||
--
|
||||
2.5.0
|
||||
|
||||
Loading…
Reference in New Issue