diff --git a/iwlwifi-fix-6000-ch-switch.patch b/iwlwifi-fix-6000-ch-switch.patch deleted file mode 100644 index 0fbca2354..000000000 --- a/iwlwifi-fix-6000-ch-switch.patch +++ /dev/null @@ -1,94 +0,0 @@ -commit a7d3a5d97acd4b8db17e1d5c3014357c9b2040f9 -Author: Johannes Berg -Date: Tue Sep 25 16:40:12 2012 +0200 - - iwlwifi: fix 6000 series channel switch command - - The channel switch command for 6000 series devices - is larger than the maximum inline command size of - 320 bytes. The command is therefore refused with a - warning. Fix this by allocating the command and - using the NOCOPY mechanism. - - Cc: stable@kernel.org - Signed-off-by: Johannes Berg - -diff --git a/drivers/net/wireless/iwlwifi/dvm/devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c -index 349c205..da58620 100644 ---- a/drivers/net/wireless/iwlwifi/dvm/devices.c -+++ b/drivers/net/wireless/iwlwifi/dvm/devices.c -@@ -518,7 +518,7 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, - * See iwlagn_mac_channel_switch. - */ - struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS]; -- struct iwl6000_channel_switch_cmd cmd; -+ struct iwl6000_channel_switch_cmd *cmd; - u32 switch_time_in_usec, ucode_switch_time; - u16 ch; - u32 tsf_low; -@@ -527,18 +527,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, - struct ieee80211_vif *vif = ctx->vif; - struct iwl_host_cmd hcmd = { - .id = REPLY_CHANNEL_SWITCH, -- .len = { sizeof(cmd), }, -+ .len = { sizeof(*cmd), }, - .flags = CMD_SYNC, -- .data = { &cmd, }, -+ .dataflags[0] = IWL_HCMD_DFL_NOCOPY, - }; -+ int err; - -- cmd.band = priv->band == IEEE80211_BAND_2GHZ; -+ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); -+ if (!cmd) -+ return -ENOMEM; -+ -+ hcmd.data[0] = cmd; -+ -+ cmd->band = priv->band == IEEE80211_BAND_2GHZ; - ch = ch_switch->channel->hw_value; - IWL_DEBUG_11H(priv, "channel switch from %u to %u\n", - ctx->active.channel, ch); -- cmd.channel = cpu_to_le16(ch); -- cmd.rxon_flags = ctx->staging.flags; -- cmd.rxon_filter_flags = ctx->staging.filter_flags; -+ cmd->channel = cpu_to_le16(ch); -+ cmd->rxon_flags = ctx->staging.flags; -+ cmd->rxon_filter_flags = ctx->staging.filter_flags; - switch_count = ch_switch->count; - tsf_low = ch_switch->timestamp & 0x0ffffffff; - /* -@@ -554,23 +561,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, - switch_count = 0; - } - if (switch_count <= 1) -- cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time); -+ cmd->switch_time = cpu_to_le32(priv->ucode_beacon_time); - else { - switch_time_in_usec = - vif->bss_conf.beacon_int * switch_count * TIME_UNIT; - ucode_switch_time = iwl_usecs_to_beacons(priv, - switch_time_in_usec, - beacon_interval); -- cmd.switch_time = iwl_add_beacon_time(priv, -- priv->ucode_beacon_time, -- ucode_switch_time, -- beacon_interval); -+ cmd->switch_time = iwl_add_beacon_time(priv, -+ priv->ucode_beacon_time, -+ ucode_switch_time, -+ beacon_interval); - } - IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n", -- cmd.switch_time); -- cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR; -+ cmd->switch_time); -+ cmd->expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR; - -- return iwl_dvm_send_cmd(priv, &hcmd); -+ err = iwl_dvm_send_cmd(priv, &hcmd); -+ kfree(cmd); -+ return err; - } - - struct iwl_lib_ops iwl6000_lib = { diff --git a/kernel.spec b/kernel.spec index d35d03682..c28447297 100644 --- a/kernel.spec +++ b/kernel.spec @@ -74,7 +74,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 4 +%define stable_update 5 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -761,15 +761,6 @@ Patch22001: selinux-apply-different-permission-to-ptrace-child.patch #rhbz 846037 Patch22067: selinux-Fix-sel_netnode_insert-suspicious-rcu-dereference.patch -#rhbz 770484 -Patch22071: iwlwifi-fix-6000-ch-switch.patch - -#rhbz 862168 -Patch22073: mac80211_local_deauth_v3.6.patch - -#rhbz 866013 -Patch22074: mac80211-connect-with-HT20-if-HT40-is-not-permitted.patch - #rhbz 867344 Patch22077: dont-call-cifs_lookup-on-hashed-negative-dentry.patch @@ -1503,15 +1494,6 @@ ApplyPatch selinux-apply-different-permission-to-ptrace-child.patch #rhbz 846037 ApplyPatch selinux-Fix-sel_netnode_insert-suspicious-rcu-dereference.patch -#rhbz 770484 -ApplyPatch iwlwifi-fix-6000-ch-switch.patch - -#rhbz 862168 -ApplyPatch mac80211_local_deauth_v3.6.patch - -#rhbz 866013 -ApplyPatch mac80211-connect-with-HT20-if-HT40-is-not-permitted.patch - #rhbz 867344 ApplyPatch dont-call-cifs_lookup-on-hashed-negative-dentry.patch @@ -2386,7 +2368,8 @@ fi # ||----w | # || || %changelog -* Wed Oct 30 2012 Josh Boyer +* Wed Oct 30 2012 Josh Boyer - 3.6.5-1 +- Linux v3.6.5 - CVE-2012-4565 net: divide by zero in tcp algorithm illinois (rhbz 871848 871923) * Tue Oct 30 2012 Josh Boyer diff --git a/mac80211-connect-with-HT20-if-HT40-is-not-permitted.patch b/mac80211-connect-with-HT20-if-HT40-is-not-permitted.patch deleted file mode 100644 index 8c46db671..000000000 --- a/mac80211-connect-with-HT20-if-HT40-is-not-permitted.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 3a40414f826a8f1096d9b94c4a53ef91b25ba28d Mon Sep 17 00:00:00 2001 -From: Johannes Berg -Date: Mon, 1 Oct 2012 15:52:00 +0200 -Subject: [PATCH] mac80211: connect with HT20 if HT40 is not permitted - -Some changes to fix issues with HT40 APs in Korea -and follow-up changes to allow using HT40 even if -the local regulatory database disallows it caused -issues with iwlwifi (and could cause issues with -other devices); iwlwifi firmware would assert if -you tried to connect to an AP that has an invalid -configuration (e.g. using HT40- on channel 140.) - -Fix this, while avoiding the "Korean AP" issue by -disabling HT40 and advertising HT20 to the AP -when connecting. - -Cc: stable@vger.kernel.org [3.6] -Reported-by: Florian Reitmeir -Tested-by: Florian Reitmeir -Signed-off-by: Johannes Berg ---- - net/mac80211/mlme.c | 30 ++++++++++++++++++++---------- - 1 files changed, 20 insertions(+), 10 deletions(-) - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index e510a33..1b7eed2 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -3099,22 +3099,32 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata, - ht_cfreq, ht_oper->primary_chan, - cbss->channel->band); - ht_oper = NULL; -+ } else { -+ channel_type = NL80211_CHAN_HT20; - } - } - -- if (ht_oper) { -- channel_type = NL80211_CHAN_HT20; -+ if (ht_oper && sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) { -+ /* -+ * cfg80211 already verified that the channel itself can -+ * be used, but it didn't check that we can do the right -+ * HT type, so do that here as well. If HT40 isn't allowed -+ * on this channel, disable 40 MHz operation. -+ */ - -- if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) { -- switch (ht_oper->ht_param & -- IEEE80211_HT_PARAM_CHA_SEC_OFFSET) { -- case IEEE80211_HT_PARAM_CHA_SEC_ABOVE: -+ switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) { -+ case IEEE80211_HT_PARAM_CHA_SEC_ABOVE: -+ if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40PLUS) -+ ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ; -+ else - channel_type = NL80211_CHAN_HT40PLUS; -- break; -- case IEEE80211_HT_PARAM_CHA_SEC_BELOW: -+ break; -+ case IEEE80211_HT_PARAM_CHA_SEC_BELOW: -+ if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40MINUS) -+ ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ; -+ else - channel_type = NL80211_CHAN_HT40MINUS; -- break; -- } -+ break; - } - } - --- -1.7.6.5 - diff --git a/mac80211_local_deauth_v3.6.patch b/mac80211_local_deauth_v3.6.patch deleted file mode 100644 index 3b634860f..000000000 --- a/mac80211_local_deauth_v3.6.patch +++ /dev/null @@ -1,66 +0,0 @@ -diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h -index 3d254e1..f10553c 100644 ---- a/include/net/cfg80211.h -+++ b/include/net/cfg80211.h -@@ -1217,6 +1217,7 @@ struct cfg80211_deauth_request { - const u8 *ie; - size_t ie_len; - u16 reason_code; -+ bool local_state_change; - }; - - /** -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index f76b833..08343c2 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -3457,6 +3457,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, - { - struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; - u8 frame_buf[DEAUTH_DISASSOC_LEN]; -+ bool tx = !req->local_state_change; - - mutex_lock(&ifmgd->mtx); - -@@ -3473,12 +3474,11 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, - if (ifmgd->associated && - ether_addr_equal(ifmgd->associated->bssid, req->bssid)) - ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, -- req->reason_code, true, frame_buf); -+ req->reason_code, tx, frame_buf); - else - ieee80211_send_deauth_disassoc(sdata, req->bssid, - IEEE80211_STYPE_DEAUTH, -- req->reason_code, true, -- frame_buf); -+ req->reason_code, tx, frame_buf); - mutex_unlock(&ifmgd->mtx); - - __cfg80211_send_deauth(sdata->dev, frame_buf, DEAUTH_DISASSOC_LEN); -diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c -index 1cdb1d5..0877efb 100644 ---- a/net/wireless/mlme.c -+++ b/net/wireless/mlme.c -@@ -457,21 +457,11 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev, - .reason_code = reason, - .ie = ie, - .ie_len = ie_len, -+ .local_state_change = local_state_change, - }; - - ASSERT_WDEV_LOCK(wdev); - -- if (local_state_change) { -- if (wdev->current_bss && -- ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) { -- cfg80211_unhold_bss(wdev->current_bss); -- cfg80211_put_bss(&wdev->current_bss->pub); -- wdev->current_bss = NULL; -- } -- -- return 0; -- } -- - return rdev->ops->deauth(&rdev->wiphy, dev, &req); - } - diff --git a/sources b/sources index 965397c16..3800ac99f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 1a1760420eac802c541a20ab51a093d1 linux-3.6.tar.xz -d7efab4da2682c44662b684026b059f7 patch-3.6.4.xz +6ad8ceebb9b5c1bf69a0c07ef7cc81f2 patch-3.6.5.xz