Linux v3.10.8
- CVE-2013-4254 ARM: perf: NULL pointer dereference in validate_event (rhbz 998878 998881)
This commit is contained in:
Josh Boyer
parent
9238c21bb1
commit
5bf1cd40d3
|
|
@ -1,25 +0,0 @@
|
|||
From 1801928e0f99d94c55e33c584c5eb2ff5e246ee6 Mon Sep 17 00:00:00 2001
|
||||
From: Takashi Iwai <tiwai@suse.de>
|
||||
Date: Fri, 16 Aug 2013 06:17:05 +0000
|
||||
Subject: ALSA: hda - Add a fixup for Gateway LT27
|
||||
|
||||
Gateway LT27 needs a fixup for the inverted digital mic.
|
||||
|
||||
Reported-by: "Nathanael D. Noblet" <nathanael@gnat.ca>
|
||||
Cc: <stable@vger.kernel.org>
|
||||
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||||
---
|
||||
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
|
||||
index 5b22bf9..f303cd8 100644
|
||||
--- a/sound/pci/hda/patch_realtek.c
|
||||
+++ b/sound/pci/hda/patch_realtek.c
|
||||
@@ -4339,6 +4339,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
|
||||
SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
|
||||
SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
|
||||
SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),
|
||||
+ SND_PCI_QUIRK(0x1025, 0x034a, "Gateway LT27", ALC662_FIXUP_INV_DMIC),
|
||||
SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
|
||||
SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
|
||||
SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
|
||||
--
|
||||
cgit v0.9.2
|
||||
|
|
@ -1,56 +0,0 @@
|
|||
Using rfkill switch can make firmware unstable, what cause various
|
||||
Microcode errors and kernel warnings. Reseting firmware just after
|
||||
rfkill off (radio on) helped with that.
|
||||
|
||||
Resolve:
|
||||
https://bugzilla.redhat.com/show_bug.cgi?id=977053
|
||||
|
||||
Reported-and-tested-by: Justin Pearce <whitefox@guardianfox.net>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
|
||||
---
|
||||
drivers/net/wireless/iwlegacy/4965-mac.c | 10 +++++-----
|
||||
drivers/net/wireless/iwlegacy/common.c | 1 +
|
||||
2 files changed, 6 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
|
||||
index f0b7794..f2ed62e 100644
|
||||
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
|
||||
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
|
||||
@@ -4460,12 +4460,12 @@ il4965_irq_tasklet(struct il_priv *il)
|
||||
* is killed. Hence update the killswitch state here. The
|
||||
* rfkill handler will care about restarting if needed.
|
||||
*/
|
||||
- if (!test_bit(S_ALIVE, &il->status)) {
|
||||
- if (hw_rf_kill)
|
||||
- set_bit(S_RFKILL, &il->status);
|
||||
- else
|
||||
- clear_bit(S_RFKILL, &il->status);
|
||||
+ if (hw_rf_kill) {
|
||||
+ set_bit(S_RFKILL, &il->status);
|
||||
+ } else {
|
||||
+ clear_bit(S_RFKILL, &il->status);
|
||||
wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
|
||||
+ il_force_reset(il, true);
|
||||
}
|
||||
|
||||
handled |= CSR_INT_BIT_RF_KILL;
|
||||
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
|
||||
index 3195aad..b03e22e 100644
|
||||
--- a/drivers/net/wireless/iwlegacy/common.c
|
||||
+++ b/drivers/net/wireless/iwlegacy/common.c
|
||||
@@ -4660,6 +4660,7 @@ il_force_reset(struct il_priv *il, bool external)
|
||||
|
||||
return 0;
|
||||
}
|
||||
+EXPORT_SYMBOL(il_force_reset);
|
||||
|
||||
int
|
||||
il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
|
||||
--
|
||||
1.7.11.7
|
||||
|
||||
--
|
||||
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
|
||||
the body of a message to majordomo@vger.kernel.org
|
||||
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
||||
28
kernel.spec
28
kernel.spec
|
|
@ -74,7 +74,7 @@ Summary: The Linux kernel
|
|||
%if 0%{?released_kernel}
|
||||
|
||||
# Do we have a -stable update to apply?
|
||||
%define stable_update 7
|
||||
%define stable_update 8
|
||||
# Is it a -stable RC?
|
||||
%define stable_rc 0
|
||||
# Set rpm version accordingly
|
||||
|
|
@ -766,20 +766,9 @@ Patch25069: iwlwifi-dvm-fix-calling-ieee80211_chswitch_done-with-NULL.patch
|
|||
#rhbz 969473
|
||||
Patch25070: Input-elantech-fix-for-newer-hardware-versions-v7.patch
|
||||
|
||||
#rhbz 977053
|
||||
Patch25073: iwl4965-reset-firmware-after-rfkill-off.patch
|
||||
|
||||
#rhbz 981445
|
||||
Patch25074: mac80211-fix-infinite-loop-in-ieee80211_determine_chantype.patch
|
||||
Patch25075: mac80211-ignore-HT-primary-channel-while-connected.patch
|
||||
Patch25076: mac80211-continue-using-disabled-channels-while-connected.patch
|
||||
|
||||
#rhbz 963715
|
||||
Patch25077: media-cx23885-Fix-TeVii-S471-regression-since-introduction-of-ts2020.patch
|
||||
|
||||
#rhbz 845699
|
||||
Patch25078: ALSA-hda-Add-a-fixup-for-Gateway-LT27.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
|
@ -1481,20 +1470,9 @@ ApplyPatch iwlwifi-dvm-fix-calling-ieee80211_chswitch_done-with-NULL.patch
|
|||
#rhbz 969473
|
||||
ApplyPatch Input-elantech-fix-for-newer-hardware-versions-v7.patch
|
||||
|
||||
#rhbz 977053
|
||||
ApplyPatch iwl4965-reset-firmware-after-rfkill-off.patch
|
||||
|
||||
#rhbz 981445
|
||||
ApplyPatch mac80211-fix-infinite-loop-in-ieee80211_determine_chantype.patch
|
||||
ApplyPatch mac80211-ignore-HT-primary-channel-while-connected.patch
|
||||
ApplyPatch mac80211-continue-using-disabled-channels-while-connected.patch
|
||||
|
||||
#rhbz 963715
|
||||
ApplyPatch media-cx23885-Fix-TeVii-S471-regression-since-introduction-of-ts2020.patch
|
||||
|
||||
#rhbz 845699
|
||||
ApplyPatch ALSA-hda-Add-a-fixup-for-Gateway-LT27.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
|
|
@ -2336,6 +2314,10 @@ fi
|
|||
# ||----w |
|
||||
# || ||
|
||||
%changelog
|
||||
* Tue Aug 20 2013 Josh Boyer <jwboyer@fedoraproject.org> - 3.10.8-10
|
||||
- Linux v3.10.8
|
||||
- CVE-2013-4254 ARM: perf: NULL pointer dereference in validate_event (rhbz 998878 998881)
|
||||
|
||||
* Fri Aug 16 2013 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- Add patch from Nathanael Noblet to fix mic on Gateway LT27 (rhbz 845699)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,43 +0,0 @@
|
|||
From ddfe49b42d8ad4bfdf92d63d4a74f162660d878d Mon Sep 17 00:00:00 2001
|
||||
From: Johannes Berg <johannes.berg@intel.com>
|
||||
Date: Wed, 31 Jul 2013 18:52:03 +0000
|
||||
Subject: mac80211: continue using disabled channels while connected
|
||||
|
||||
In case the AP has different regulatory information than we do,
|
||||
it can happen that we connect to an AP based on e.g. the world
|
||||
roaming regulatory data, and then update our database with the
|
||||
AP's country information disables the channel the AP is using.
|
||||
If this happens on an HT AP, the bandwidth tracking code will
|
||||
hit the WARN_ON() and disconnect. Since that's not very useful,
|
||||
ignore the channel-disable flag in bandwidth tracking.
|
||||
|
||||
Cc: stable@vger.kernel.org
|
||||
Reported-by: Chris Wright <chrisw@sous-sol.org>
|
||||
Tested-by: Chris Wright <chrisw@sous-sol.org>
|
||||
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
||||
---
|
||||
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
|
||||
index 077a953..cc9e02d 100644
|
||||
--- a/net/mac80211/mlme.c
|
||||
+++ b/net/mac80211/mlme.c
|
||||
@@ -335,8 +335,17 @@ out:
|
||||
if (ret & IEEE80211_STA_DISABLE_VHT)
|
||||
vht_chandef = *chandef;
|
||||
|
||||
+ /*
|
||||
+ * Ignore the DISABLED flag when we're already connected and only
|
||||
+ * tracking the APs beacon for bandwidth changes - otherwise we
|
||||
+ * might get disconnected here if we connect to an AP, update our
|
||||
+ * regulatory information based on the AP's country IE and the
|
||||
+ * information we have is wrong/outdated and disables the channel
|
||||
+ * that we're actually using for the connection to the AP.
|
||||
+ */
|
||||
while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
|
||||
- IEEE80211_CHAN_DISABLED)) {
|
||||
+ tracking ? 0 :
|
||||
+ IEEE80211_CHAN_DISABLED)) {
|
||||
if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
|
||||
ret = IEEE80211_STA_DISABLE_HT |
|
||||
IEEE80211_STA_DISABLE_VHT;
|
||||
--
|
||||
cgit v0.9.2
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
From b56e4b857c5210e848bfb80e074e5756a36cd523 Mon Sep 17 00:00:00 2001
|
||||
From: Chris Wright <chrisw@sous-sol.org>
|
||||
Date: Wed, 31 Jul 2013 19:12:24 +0000
|
||||
Subject: mac80211: fix infinite loop in ieee80211_determine_chantype
|
||||
|
||||
Commit "3d9646d mac80211: fix channel selection bug" introduced a possible
|
||||
infinite loop by moving the out target above the chandef_downgrade
|
||||
while loop. When we downgrade to NL80211_CHAN_WIDTH_20_NOHT, we jump
|
||||
back up to re-run the while loop...indefinitely. Replace goto with
|
||||
break and carry on. This may not be sufficient to connect to the AP,
|
||||
but will at least keep the cpu from livelocking. Thanks to Derek Atkins
|
||||
as an extra pair of debugging eyes.
|
||||
|
||||
Cc: stable@kernel.org
|
||||
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
|
||||
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
||||
---
|
||||
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
|
||||
index ae31968..e3e7d2b 100644
|
||||
--- a/net/mac80211/mlme.c
|
||||
+++ b/net/mac80211/mlme.c
|
||||
@@ -338,7 +338,7 @@ out:
|
||||
if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
|
||||
ret = IEEE80211_STA_DISABLE_HT |
|
||||
IEEE80211_STA_DISABLE_VHT;
|
||||
- goto out;
|
||||
+ break;
|
||||
}
|
||||
|
||||
ret |= chandef_downgrade(chandef);
|
||||
--
|
||||
cgit v0.9.2
|
||||
|
|
@ -1,121 +0,0 @@
|
|||
From 5cdaed1e878d723d56d04ae0be1738124acf9f46 Mon Sep 17 00:00:00 2001
|
||||
From: Johannes Berg <johannes.berg@intel.com>
|
||||
Date: Wed, 31 Jul 2013 09:23:06 +0000
|
||||
Subject: mac80211: ignore HT primary channel while connected
|
||||
|
||||
While we're connected, the AP shouldn't change the primary channel
|
||||
in the HT information. We checked this, and dropped the connection
|
||||
if it did change it.
|
||||
|
||||
Unfortunately, this is causing problems on some APs, e.g. on the
|
||||
Netgear WRT610NL: the beacons seem to always contain a bad channel
|
||||
and if we made a connection using a probe response (correct data)
|
||||
we drop the connection immediately and can basically not connect
|
||||
properly at all.
|
||||
|
||||
Work around this by ignoring the HT primary channel information in
|
||||
beacons if we're already connected.
|
||||
|
||||
Also print out more verbose messages in the other situations to
|
||||
help diagnose similar bugs quicker in the future.
|
||||
|
||||
Cc: stable@vger.kernel.org [3.10]
|
||||
Acked-by: Andy Isaacson <adi@hexapodia.org>
|
||||
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
||||
---
|
||||
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
|
||||
index e5c3cf4..077a953 100644
|
||||
--- a/net/mac80211/mlme.c
|
||||
+++ b/net/mac80211/mlme.c
|
||||
@@ -211,8 +211,9 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
|
||||
struct ieee80211_channel *channel,
|
||||
const struct ieee80211_ht_operation *ht_oper,
|
||||
const struct ieee80211_vht_operation *vht_oper,
|
||||
- struct cfg80211_chan_def *chandef, bool verbose)
|
||||
+ struct cfg80211_chan_def *chandef, bool tracking)
|
||||
{
|
||||
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
|
||||
struct cfg80211_chan_def vht_chandef;
|
||||
u32 ht_cfreq, ret;
|
||||
|
||||
@@ -231,7 +232,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
|
||||
ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
|
||||
channel->band);
|
||||
/* check that channel matches the right operating channel */
|
||||
- if (channel->center_freq != ht_cfreq) {
|
||||
+ if (!tracking && channel->center_freq != ht_cfreq) {
|
||||
/*
|
||||
* It's possible that some APs are confused here;
|
||||
* Netgear WNDR3700 sometimes reports 4 higher than
|
||||
@@ -239,11 +240,10 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
|
||||
* since we look at probe response/beacon data here
|
||||
* it should be OK.
|
||||
*/
|
||||
- if (verbose)
|
||||
- sdata_info(sdata,
|
||||
- "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
|
||||
- channel->center_freq, ht_cfreq,
|
||||
- ht_oper->primary_chan, channel->band);
|
||||
+ sdata_info(sdata,
|
||||
+ "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
|
||||
+ channel->center_freq, ht_cfreq,
|
||||
+ ht_oper->primary_chan, channel->band);
|
||||
ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
|
||||
goto out;
|
||||
}
|
||||
@@ -297,7 +297,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
|
||||
channel->band);
|
||||
break;
|
||||
default:
|
||||
- if (verbose)
|
||||
+ if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
|
||||
sdata_info(sdata,
|
||||
"AP VHT operation IE has invalid channel width (%d), disable VHT\n",
|
||||
vht_oper->chan_width);
|
||||
@@ -306,7 +306,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
|
||||
}
|
||||
|
||||
if (!cfg80211_chandef_valid(&vht_chandef)) {
|
||||
- if (verbose)
|
||||
+ if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
|
||||
sdata_info(sdata,
|
||||
"AP VHT information is invalid, disable VHT\n");
|
||||
ret = IEEE80211_STA_DISABLE_VHT;
|
||||
@@ -319,7 +319,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
|
||||
}
|
||||
|
||||
if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
|
||||
- if (verbose)
|
||||
+ if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
|
||||
sdata_info(sdata,
|
||||
"AP VHT information doesn't match HT, disable VHT\n");
|
||||
ret = IEEE80211_STA_DISABLE_VHT;
|
||||
@@ -346,7 +346,7 @@ out:
|
||||
ret |= chandef_downgrade(chandef);
|
||||
}
|
||||
|
||||
- if (chandef->width != vht_chandef.width && verbose)
|
||||
+ if (chandef->width != vht_chandef.width && !tracking)
|
||||
sdata_info(sdata,
|
||||
"capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
|
||||
|
||||
@@ -386,7 +386,7 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
|
||||
|
||||
/* calculate new channel (type) based on HT/VHT operation IEs */
|
||||
flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
|
||||
- vht_oper, &chandef, false);
|
||||
+ vht_oper, &chandef, true);
|
||||
|
||||
/*
|
||||
* Downgrade the new channel if we associated with restricted
|
||||
@@ -3838,7 +3838,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
|
||||
ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
|
||||
cbss->channel,
|
||||
ht_oper, vht_oper,
|
||||
- &chandef, true);
|
||||
+ &chandef, false);
|
||||
|
||||
sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
|
||||
local->rx_chains);
|
||||
--
|
||||
cgit v0.9.2
|
||||
Loading…
Reference in New Issue