diff --git a/0001-cdc-acm-fix-NULL-pointer-reference.patch b/0001-cdc-acm-fix-NULL-pointer-reference.patch deleted file mode 100644 index 3d63411..0000000 --- a/0001-cdc-acm-fix-NULL-pointer-reference.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 29c6dd591bbd592472247441de9fa694acdabae8 Mon Sep 17 00:00:00 2001 -From: Oliver Neukum -Date: Thu, 7 Jan 2016 11:01:00 +0100 -Subject: [PATCH] cdc-acm: fix NULL pointer reference - -The union descriptor must be checked. Its usage was conditional -before the parser was introduced. This is important, because -many RNDIS device, which also use the common parser, have -bogus extra descriptors. - -Signed-off-by: Oliver Neukum -Tested-by: Vasily Galkin -Signed-off-by: David S. Miller ---- - drivers/net/usb/cdc_ether.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c -index 3da70bf..7cba2c3 100644 ---- a/drivers/net/usb/cdc_ether.c -+++ b/drivers/net/usb/cdc_ether.c -@@ -160,6 +160,12 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf) - info->u = header.usb_cdc_union_desc; - info->header = header.usb_cdc_header_desc; - info->ether = header.usb_cdc_ether_desc; -+ if (!info->u) { -+ if (rndis) -+ goto skip; -+ else /* in that case a quirk is mandatory */ -+ goto bad_desc; -+ } - /* we need a master/control interface (what we're - * probed with) and a slave/data interface; union - * descriptors sort this all out. -@@ -256,7 +262,7 @@ skip: - goto bad_desc; - } - -- } else if (!info->header || !info->u || (!rndis && !info->ether)) { -+ } else if (!info->header || (!rndis && !info->ether)) { - dev_dbg(&intf->dev, "missing cdc %s%s%sdescriptor\n", - info->header ? "" : "header ", - info->u ? "" : "union ", --- -2.5.0 - diff --git a/0001-uas-Limit-qdepth-at-the-scsi-host-level.patch b/0001-uas-Limit-qdepth-at-the-scsi-host-level.patch deleted file mode 100644 index b6c4468..0000000 --- a/0001-uas-Limit-qdepth-at-the-scsi-host-level.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 79abe2bd501d628b165f323098d6972d69bd13d7 Mon Sep 17 00:00:00 2001 -From: Hans de Goede -Date: Wed, 16 Mar 2016 13:20:51 +0100 -Subject: [PATCH] uas: Limit qdepth at the scsi-host level - -Commit 64d513ac31bd ("scsi: use host wide tags by default") causes -the scsi-core to queue more cmnds then we can handle on devices with -multiple LUNs, limit the qdepth at the scsi-host level instead of -per slave to fix this. - -BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1315013 -Cc: stable@vger.kernel.org # 4.4.x and 4.5.x -Signed-off-by: Hans de Goede ---- - drivers/usb/storage/uas.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index c90a7e4..b5cb7ab 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -800,7 +800,6 @@ static int uas_slave_configure(struct scsi_device *sdev) - if (devinfo->flags & US_FL_BROKEN_FUA) - sdev->broken_fua = 1; - -- scsi_change_queue_depth(sdev, devinfo->qdepth - 2); - return 0; - } - -@@ -932,6 +931,12 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id) - if (result) - goto set_alt0; - -+ /* -+ * 1 tag is reserved for untagged commands + -+ * 1 tag to avoid of by one errors in some bridge firmwares -+ */ -+ shost->can_queue = devinfo->qdepth - 2; -+ - usb_set_intfdata(intf, shost); - result = scsi_add_host(shost, &intf->dev); - if (result) --- -2.7.3 - diff --git a/09-29-drm-udl-Use-unlocked-gem-unreferencing.patch b/09-29-drm-udl-Use-unlocked-gem-unreferencing.patch deleted file mode 100644 index e2dbabe..0000000 --- a/09-29-drm-udl-Use-unlocked-gem-unreferencing.patch +++ /dev/null @@ -1,58 +0,0 @@ -From patchwork Mon Nov 23 09:32:42 2015 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -Subject: [09/29] drm/udl: Use unlocked gem unreferencing -From: Daniel Vetter -X-Patchwork-Id: 65722 -Message-Id: <1448271183-20523-10-git-send-email-daniel.vetter@ffwll.ch> -To: DRI Development -Cc: Daniel Vetter , - Daniel Vetter , - Intel Graphics Development , - Dave Airlie -Date: Mon, 23 Nov 2015 10:32:42 +0100 - -For drm_gem_object_unreference callers are required to hold -dev->struct_mutex, which these paths don't. Enforcing this requirement -has become a bit more strict with - -commit ef4c6270bf2867e2f8032e9614d1a8cfc6c71663 -Author: Daniel Vetter -Date: Thu Oct 15 09:36:25 2015 +0200 - - drm/gem: Check locking in drm_gem_object_unreference - -Cc: Dave Airlie -Signed-off-by: Daniel Vetter ---- - drivers/gpu/drm/udl/udl_fb.c | 2 +- - drivers/gpu/drm/udl/udl_gem.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c -index 200419d4d43c..18a2acbccb7d 100644 ---- a/drivers/gpu/drm/udl/udl_fb.c -+++ b/drivers/gpu/drm/udl/udl_fb.c -@@ -538,7 +538,7 @@ static int udlfb_create(struct drm_fb_helper *helper, - out_destroy_fbi: - drm_fb_helper_release_fbi(helper); - out_gfree: -- drm_gem_object_unreference(&ufbdev->ufb.obj->base); -+ drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base); - out: - return ret; - } -diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c -index 2a0a784ab6ee..d7528e0d8442 100644 ---- a/drivers/gpu/drm/udl/udl_gem.c -+++ b/drivers/gpu/drm/udl/udl_gem.c -@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file, - return ret; - } - -- drm_gem_object_unreference(&obj->base); -+ drm_gem_object_unreference_unlocked(&obj->base); - *handle_p = handle; - return 0; - } diff --git a/antenna_select.patch b/antenna_select.patch new file mode 100644 index 0000000..15763e9 --- /dev/null +++ b/antenna_select.patch @@ -0,0 +1,227 @@ +From c18d8f5095715c56bb3cd9cba64242542632054b Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Wed, 16 Mar 2016 13:33:34 -0500 +Subject: rtlwifi: rtl8723be: Add antenna select module parameter + +A number of new laptops have been delivered with only a single antenna. +In principle, this is OK; however, a problem arises when the on-board +EEPROM is programmed to use the other antenna connection. The option +of opening the computer and moving the connector is not always possible +as it will void the warranty in some cases. In addition, this solution +breaks the Windows driver when the box dual boots Linux and Windows. + +A fix involving a new module parameter has been developed. This commit +adds the new parameter and implements the changes needed for the driver. + +Signed-off-by: Larry Finger +Cc: Stable [V4.0+] +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 5 +++++ + drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c | 3 +++ + drivers/net/wireless/realtek/rtlwifi/wifi.h | 3 +++ + 3 files changed, 11 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +index c983d2f..5a3df91 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +@@ -2684,6 +2684,7 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw, + bool auto_load_fail, u8 *hwinfo) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); ++ struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params; + u8 value; + u32 tmpu_32; + +@@ -2702,6 +2703,10 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw, + rtlpriv->btcoexist.btc_info.ant_num = ANT_X2; + } + ++ /* override ant_num / ant_path */ ++ if (mod_params->ant_sel) ++ rtlpriv->btcoexist.btc_info.ant_num = ++ (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1); + } + + void rtl8723be_bt_reg_init(struct ieee80211_hw *hw) +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c +index a78eaed..2101793 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c +@@ -273,6 +273,7 @@ static struct rtl_mod_params rtl8723be_mod_params = { + .msi_support = false, + .disable_watchdog = false, + .debug = DBG_EMERG, ++ .ant_sel = 0, + }; + + static struct rtl_hal_cfg rtl8723be_hal_cfg = { +@@ -394,6 +395,7 @@ module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444); + module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444); + module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog, + bool, 0444); ++module_param_named(ant_sel, rtl8723be_mod_params.ant_sel, int, 0444); + MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n"); + MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n"); + MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n"); +@@ -402,6 +404,7 @@ MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n"); + MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)"); + MODULE_PARM_DESC(disable_watchdog, + "Set to 1 to disable the watchdog (default 0)\n"); ++MODULE_PARM_DESC(ant_sel, "Set to 1 or 2 to force antenna number (default 0)\n"); + + static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume); + +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index 554d814..93bd7fc 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2246,6 +2246,9 @@ struct rtl_mod_params { + + /* default 0: 1 means do not disable interrupts */ + bool int_clear; ++ ++ /* select antenna */ ++ int ant_sel; + }; + + struct rtl_hal_usbint_cfg { +-- +cgit v0.12 + +From baa1702290953295e421f0f433e2b1ff4815827c Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Wed, 16 Mar 2016 13:33:35 -0500 +Subject: rtlwifi: btcoexist: Implement antenna selection + +The previous patch added an option to rtl8723be to manually select the +antenna for those cases when only a single antenna is present, and the +on-board EEPROM is incorrectly programmed. This patch implements the +necessary changes in the Bluetooth coexistence driver. + +Signed-off-by: Larry Finger +Cc: Stable [V4.0+] +Signed-off-by: Kalle Valo +--- + .../realtek/rtlwifi/btcoexist/halbtc8723b2ant.c | 9 ++++++-- + .../realtek/rtlwifi/btcoexist/halbtcoutsrc.c | 27 +++++++++++++++++++++- + .../realtek/rtlwifi/btcoexist/halbtcoutsrc.h | 2 +- + .../wireless/realtek/rtlwifi/btcoexist/rtl_btc.c | 5 +++- + 4 files changed, 38 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c +index c43ab59..77cbd10 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtc8723b2ant.c +@@ -1203,7 +1203,6 @@ static void btc8723b2ant_set_ant_path(struct btc_coexist *btcoexist, + + /* Force GNT_BT to low */ + btcoexist->btc_write_1byte_bitmask(btcoexist, 0x765, 0x18, 0x0); +- btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0); + + if (board_info->btdm_ant_pos == BTC_ANTENNA_AT_MAIN_PORT) { + /* tell firmware "no antenna inverse" */ +@@ -1211,19 +1210,25 @@ static void btc8723b2ant_set_ant_path(struct btc_coexist *btcoexist, + h2c_parameter[1] = 1; /* ext switch type */ + btcoexist->btc_fill_h2c(btcoexist, 0x65, 2, + h2c_parameter); ++ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0); + } else { + /* tell firmware "antenna inverse" */ + h2c_parameter[0] = 1; + h2c_parameter[1] = 1; /* ext switch type */ + btcoexist->btc_fill_h2c(btcoexist, 0x65, 2, + h2c_parameter); ++ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x280); + } + } + + /* ext switch setting */ + if (use_ext_switch) { + /* fixed internal switch S1->WiFi, S0->BT */ +- btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0); ++ if (board_info->btdm_ant_pos == BTC_ANTENNA_AT_MAIN_PORT) ++ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x0); ++ else ++ btcoexist->btc_write_2byte(btcoexist, 0x948, 0x280); ++ + switch (antpos_type) { + case BTC_ANT_WIFI_AT_MAIN: + /* ext switch main at wifi */ +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c +index b2791c8..babd149 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c +@@ -965,13 +965,38 @@ void exhalbtc_set_chip_type(u8 chip_type) + } + } + +-void exhalbtc_set_ant_num(u8 type, u8 ant_num) ++void exhalbtc_set_ant_num(struct rtl_priv *rtlpriv, u8 type, u8 ant_num) + { + if (BT_COEX_ANT_TYPE_PG == type) { + gl_bt_coexist.board_info.pg_ant_num = ant_num; + gl_bt_coexist.board_info.btdm_ant_num = ant_num; ++ /* The antenna position: ++ * Main (default) or Aux for pgAntNum=2 && btdmAntNum =1. ++ * The antenna position should be determined by ++ * auto-detect mechanism. ++ * The following is assumed to main, ++ * and those must be modified ++ * if y auto-detect mechanism is ready ++ */ ++ if ((gl_bt_coexist.board_info.pg_ant_num == 2) && ++ (gl_bt_coexist.board_info.btdm_ant_num == 1)) ++ gl_bt_coexist.board_info.btdm_ant_pos = ++ BTC_ANTENNA_AT_MAIN_PORT; ++ else ++ gl_bt_coexist.board_info.btdm_ant_pos = ++ BTC_ANTENNA_AT_MAIN_PORT; + } else if (BT_COEX_ANT_TYPE_ANTDIV == type) { + gl_bt_coexist.board_info.btdm_ant_num = ant_num; ++ gl_bt_coexist.board_info.btdm_ant_pos = ++ BTC_ANTENNA_AT_MAIN_PORT; ++ } else if (type == BT_COEX_ANT_TYPE_DETECTED) { ++ gl_bt_coexist.board_info.btdm_ant_num = ant_num; ++ if (rtlpriv->cfg->mod_params->ant_sel == 1) ++ gl_bt_coexist.board_info.btdm_ant_pos = ++ BTC_ANTENNA_AT_AUX_PORT; ++ else ++ gl_bt_coexist.board_info.btdm_ant_pos = ++ BTC_ANTENNA_AT_MAIN_PORT; + } + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h +index 0a903ea..f41ca57 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h +@@ -535,7 +535,7 @@ void exhalbtc_set_bt_patch_version(u16 bt_hci_version, u16 bt_patch_version); + void exhalbtc_update_min_bt_rssi(char bt_rssi); + void exhalbtc_set_bt_exist(bool bt_exist); + void exhalbtc_set_chip_type(u8 chip_type); +-void exhalbtc_set_ant_num(u8 type, u8 ant_num); ++void exhalbtc_set_ant_num(struct rtl_priv *rtlpriv, u8 type, u8 ant_num); + void exhalbtc_display_bt_coex_info(struct btc_coexist *btcoexist); + void exhalbtc_signal_compensation(struct btc_coexist *btcoexist, + u8 *rssi_wifi, u8 *rssi_bt); +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c +index b9b0cb7..d3fd921 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c +@@ -72,7 +72,10 @@ void rtl_btc_init_hal_vars(struct rtl_priv *rtlpriv) + __func__, bt_type); + exhalbtc_set_chip_type(bt_type); + +- exhalbtc_set_ant_num(BT_COEX_ANT_TYPE_PG, ant_num); ++ if (rtlpriv->cfg->mod_params->ant_sel == 1) ++ exhalbtc_set_ant_num(rtlpriv, BT_COEX_ANT_TYPE_DETECTED, 1); ++ else ++ exhalbtc_set_ant_num(rtlpriv, BT_COEX_ANT_TYPE_PG, ant_num); + } + + void rtl_btc_init_hw_config(struct rtl_priv *rtlpriv) +-- +cgit v0.12 + diff --git a/ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch b/ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch deleted file mode 100644 index 48e4762..0000000 --- a/ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch +++ /dev/null @@ -1,97 +0,0 @@ -From fbd40ea0180a2d328c5adc61414dc8bab9335ce2 Mon Sep 17 00:00:00 2001 -From: "David S. Miller" -Date: Sun, 13 Mar 2016 23:28:00 -0400 -Subject: ipv4: Don't do expensive useless work during inetdev destroy. - -When an inetdev is destroyed, every address assigned to the interface -is removed. And in this scenerio we do two pointless things which can -be very expensive if the number of assigned interfaces is large: - -1) Address promotion. We are deleting all addresses, so there is no - point in doing this. - -2) A full nf conntrack table purge for every address. We only need to - do this once, as is already caught by the existing - masq_dev_notifier so masq_inet_event() can skip this. - -Reported-by: Solar Designer -Signed-off-by: David S. Miller -Tested-by: Cyrill Gorcunov ---- - net/ipv4/devinet.c | 4 ++++ - net/ipv4/fib_frontend.c | 4 ++++ - net/ipv4/netfilter/nf_nat_masquerade_ipv4.c | 12 ++++++++++-- - 3 files changed, 18 insertions(+), 2 deletions(-) - -diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c -index 65e76a4..e333bc8 100644 ---- a/net/ipv4/devinet.c -+++ b/net/ipv4/devinet.c -@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, - - ASSERT_RTNL(); - -+ if (in_dev->dead) -+ goto no_promotions; -+ - /* 1. Deleting primary ifaddr forces deletion all secondaries - * unless alias promotion is set - **/ -@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, - fib_del_ifaddr(ifa, ifa1); - } - -+no_promotions: - /* 2. Unlink it */ - - *ifap = ifa1->ifa_next; -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 4734475..21add55 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -922,6 +922,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) - subnet = 1; - } - -+ if (in_dev->dead) -+ goto no_promotions; -+ - /* Deletion is more complicated than add. - * We should take care of not to delete too much :-) - * -@@ -997,6 +1000,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) - } - } - -+no_promotions: - if (!(ok & BRD_OK)) - fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim); - if (subnet && ifa->ifa_prefixlen < 31) { -diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -index c6eb421..ea91058 100644 ---- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this, - unsigned long event, - void *ptr) - { -- struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev; -+ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev; - struct netdev_notifier_info info; - -- netdev_notifier_info_init(&info, dev); -+ /* The masq_dev_notifier will catch the case of the device going -+ * down. So if the inetdev is dead and being destroyed we have -+ * no work to do. Otherwise this is an individual address removal -+ * and we have to perform the flush. -+ */ -+ if (idev->dead) -+ return NOTIFY_DONE; -+ -+ netdev_notifier_info_init(&info, idev->dev); - return masq_device_event(this, event, &info); - } - --- -cgit v0.12 - diff --git a/kernel.spec b/kernel.spec index bae7064..b9a045c 100644 --- a/kernel.spec +++ b/kernel.spec @@ -52,7 +52,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 7 +%define stable_update 8 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -582,9 +582,6 @@ Patch503: drm-i915-turn-off-wc-mmaps.patch Patch508: kexec-uefi-copy-secure_boot-flag-in-boot-params.patch -#CVE-2015-7833 rhbz 1270158 1270160 -Patch567: usbvision-fix-crash-on-detecting-device-with-invalid.patch - #rhbz 1287819 Patch570: HID-multitouch-enable-palm-rejection-if-device-imple.patch @@ -615,27 +612,15 @@ Patch659: pipe-limit-the-per-user-amount-of-pages-allocated-in.patch #rhbz 1310252 1313318 Patch660: 0001-drm-i915-Pretend-cursor-is-always-on-for-ILK-style-W.patch -#rhbz 1316719 -Patch662: 0001-cdc-acm-fix-NULL-pointer-reference.patch - #CVE-2016-3135 rhbz 1317386 1317387 Patch664: netfilter-x_tables-check-for-size-overflow.patch #CVE-2016-3134 rhbz 1317383 1317384 Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch -#CVE-2016-3135 rhbz 1318172 1318270 -Patch666: ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch - -#rhbz 1315013 -Patch679: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch - #CVE-2016-2187 rhbz 1317017 1317010 Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch -#rhbz 1295646 -Patch688: 09-29-drm-udl-Use-unlocked-gem-unreferencing.patch - # CVE-2016-3672 rhbz 1324749 1324750 Patch690: x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch @@ -647,10 +632,6 @@ Patch694: ext4-fix-races-of-writeback-with-punch-hole-and-zero.patch #CVE-2016-3951 rhbz 1324782 1324815 Patch695: cdc_ncm-do-not-call-usbnet_link_change-from-cdc_ncm_.patch -Patch696: usbnet-cleanup-after-bind-in-probe.patch - -#rhbz 1317116 -Patch697: HID-wacom-fix-Bamboo-ONE-oops.patch #rhbz 1309980 Patch698: 0001-ACPI-processor-Request-native-thermal-interrupt-hand.patch @@ -661,6 +642,9 @@ Patch699: x86-xen-suppress-hugetlbfs-in-PV-guests.patch # CVE-2016-3955 rhbz 1328478 1328479 Patch700: USB-usbip-fix-potential-out-of-bounds-write.patch +#rhbz 1309487 +Patch701: antenna_select.patch + # END OF PATCH DEFINITIONS %endif @@ -2104,6 +2088,10 @@ fi # # %changelog +* Wed Apr 20 2016 Laura Abbott - 4.4.8-300 +- Linux v4.4.8 +- Allow antenna selection for rtl8723be (rhbz 1309487) + * Tue Apr 19 2016 Josh Boyer - CVE-2016-3955 usbip: buffer overflow by trusting length of incoming packets (rhbz 1328478 1328479) diff --git a/sources b/sources index a07545f..4514230 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ 9a78fa2eb6c68ca5a40ed5af08142599 linux-4.4.tar.xz dcbc8fe378a676d5d0dd208cf524e144 perf-man-4.4.tar.gz -2286314f215706401dd51bf07b179ae4 patch-4.4.7.xz +c1d8f46e5b2ee7c925fc38f20a3726d3 patch-4.4.8.xz diff --git a/usbnet-cleanup-after-bind-in-probe.patch b/usbnet-cleanup-after-bind-in-probe.patch deleted file mode 100644 index dc231a9..0000000 --- a/usbnet-cleanup-after-bind-in-probe.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 1666984c8625b3db19a9abc298931d35ab7bc64b Mon Sep 17 00:00:00 2001 -From: Oliver Neukum -Date: Mon, 7 Mar 2016 11:31:10 +0100 -Subject: [PATCH] usbnet: cleanup after bind() in probe() - -In case bind() works, but a later error forces bailing -in probe() in error cases work and a timer may be scheduled. -They must be killed. This fixes an error case related to -the double free reported in -http://www.spinics.net/lists/netdev/msg367669.html -and needs to go on top of Linus' fix to cdc-ncm. - -Signed-off-by: Oliver Neukum -Signed-off-by: David S. Miller ---- - drivers/net/usb/usbnet.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index 0b0ba7ef14e4..10798128c03f 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -1769,6 +1769,13 @@ out3: - if (info->unbind) - info->unbind (dev, udev); - out1: -+ /* subdrivers must undo all they did in bind() if they -+ * fail it, but we may fail later and a deferred kevent -+ * may trigger an error resubmitting itself and, worse, -+ * schedule a timer. So we kill it all just in case. -+ */ -+ cancel_work_sync(&dev->kevent); -+ del_timer_sync(&dev->delay); - free_netdev(net); - out: - return status; --- -2.5.5 - diff --git a/usbvision-fix-crash-on-detecting-device-with-invalid.patch b/usbvision-fix-crash-on-detecting-device-with-invalid.patch deleted file mode 100644 index a03e379..0000000 --- a/usbvision-fix-crash-on-detecting-device-with-invalid.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 2ea39fc263c6a7589e15edb7d2d1c89fa569be53 Mon Sep 17 00:00:00 2001 -From: Vladis Dronov -Date: Mon, 16 Nov 2015 15:55:11 -0200 -Subject: [PATCH] usbvision: fix crash on detecting device with invalid - configuration - -The usbvision driver crashes when a specially crafted usb device with invalid -number of interfaces or endpoints is detected. This fix adds checks that the -device has proper configuration expected by the driver. - -Reported-by: Ralf Spenneberg -Signed-off-by: Vladis Dronov -Signed-off-by: Mauro Carvalho Chehab ---- - drivers/media/usb/usbvision/usbvision-video.c | 16 +++++++++++++++- - 1 file changed, 15 insertions(+), 1 deletion(-) - -diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c -index b693206f66dd..d1dc1a198e3e 100644 ---- a/drivers/media/usb/usbvision/usbvision-video.c -+++ b/drivers/media/usb/usbvision/usbvision-video.c -@@ -1463,9 +1463,23 @@ static int usbvision_probe(struct usb_interface *intf, - - if (usbvision_device_data[model].interface >= 0) - interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; -- else -+ else if (ifnum < dev->actconfig->desc.bNumInterfaces) - interface = &dev->actconfig->interface[ifnum]->altsetting[0]; -+ else { -+ dev_err(&intf->dev, "interface %d is invalid, max is %d\n", -+ ifnum, dev->actconfig->desc.bNumInterfaces - 1); -+ ret = -ENODEV; -+ goto err_usb; -+ } -+ -+ if (interface->desc.bNumEndpoints < 2) { -+ dev_err(&intf->dev, "interface %d has %d endpoints, but must" -+ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints); -+ ret = -ENODEV; -+ goto err_usb; -+ } - endpoint = &interface->endpoint[1].desc; -+ - if (!usb_endpoint_xfer_isoc(endpoint)) { - dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n", - __func__, ifnum); --- -2.5.0 -