Linux v3.10.8

- CVE-2013-4254 ARM: perf: NULL pointer dereference in validate_event (rhbz 998878 998881)

7 files changed, 7 insertions, 302 deletions

diff --git a/ALSA-hda-Add-a-fixup-for-Gateway-LT27.patch b/ALSA-hda-Add-a-fixup-for-Gateway-LT27.patch
deleted file mode 100644
index 9ce3433f..00000000
--- a/ALSA-hda-Add-a-fixup-for-Gateway-LT27.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 1801928e0f99d94c55e33c584c5eb2ff5e246ee6 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Fri, 16 Aug 2013 06:17:05 +0000
-Subject: ALSA: hda - Add a fixup for Gateway LT27
-
-Gateway LT27 needs a fixup for the inverted digital mic.
-
-Reported-by: "Nathanael D. Noblet" <nathanael@gnat.ca>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 5b22bf9..f303cd8 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -4339,6 +4339,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
- 	SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
- 	SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
- 	SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),
-+	SND_PCI_QUIRK(0x1025, 0x034a, "Gateway LT27", ALC662_FIXUP_INV_DMIC),
- 	SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
- 	SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
- 	SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
---
-cgit v0.9.2
diff --git a/iwl4965-reset-firmware-after-rfkill-off.patch b/iwl4965-reset-firmware-after-rfkill-off.patch
deleted file mode 100644
index 08b360d1..00000000
--- a/iwl4965-reset-firmware-after-rfkill-off.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-Using rfkill switch can make firmware unstable, what cause various
-Microcode errors and kernel warnings. Reseting firmware just after
-rfkill off (radio on) helped with that.
-
-Resolve:
-https://bugzilla.redhat.com/show_bug.cgi?id=977053
-
-Reported-and-tested-by: Justin Pearce <whitefox@guardianfox.net>
-Cc: stable@vger.kernel.org
-Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
----
- drivers/net/wireless/iwlegacy/4965-mac.c | 10 +++++-----
- drivers/net/wireless/iwlegacy/common.c   |  1 +
- 2 files changed, 6 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
-index f0b7794..f2ed62e 100644
---- a/drivers/net/wireless/iwlegacy/4965-mac.c
-+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
-@@ -4460,12 +4460,12 @@ il4965_irq_tasklet(struct il_priv *il)
- 		 * is killed. Hence update the killswitch state here. The
- 		 * rfkill handler will care about restarting if needed.
- 		 */
--		if (!test_bit(S_ALIVE, &il->status)) {
--			if (hw_rf_kill)
--				set_bit(S_RFKILL, &il->status);
--			else
--				clear_bit(S_RFKILL, &il->status);
-+		if (hw_rf_kill) {
-+			set_bit(S_RFKILL, &il->status);
-+		} else {
-+			clear_bit(S_RFKILL, &il->status);
- 			wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
-+			il_force_reset(il, true);
- 		}
- 
- 		handled |= CSR_INT_BIT_RF_KILL;
-diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
-index 3195aad..b03e22e 100644
---- a/drivers/net/wireless/iwlegacy/common.c
-+++ b/drivers/net/wireless/iwlegacy/common.c
-@@ -4660,6 +4660,7 @@ il_force_reset(struct il_priv *il, bool external)
- 
- 	return 0;
- }
-+EXPORT_SYMBOL(il_force_reset);
- 
- int
- il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--- 
-1.7.11.7
-
---
-To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at  http://vger.kernel.org/majordomo-info.html
\ No newline at end of file
diff --git a/kernel.spec b/kernel.spec
index 8efe24ca..6447be54 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -74,7 +74,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 7
+%define stable_update 8
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -767,20 +767,9 @@ Patch25070: Input-elantech-fix-for-newer-hardware-versions-v7.patch
 #rhbz 989138
 Patch25072: HID-Revert-Revert-HID-Fix-logitech-dj-missing-Unifying-device-issue.patch
 
-#rhbz 977053
-Patch25073: iwl4965-reset-firmware-after-rfkill-off.patch
-
-#rhbz 981445
-Patch25074: mac80211-fix-infinite-loop-in-ieee80211_determine_chantype.patch
-Patch25075: mac80211-ignore-HT-primary-channel-while-connected.patch
-Patch25076: mac80211-continue-using-disabled-channels-while-connected.patch
-
 #rhbz 963715
 Patch25077: media-cx23885-Fix-TeVii-S471-regression-since-introduction-of-ts2020.patch
 
-#rhbz 845699
-Patch25078: ALSA-hda-Add-a-fixup-for-Gateway-LT27.patch
-
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1496,20 +1485,9 @@ ApplyPatch Input-elantech-fix-for-newer-hardware-versions-v7.patch
 #rhbz 989138
 ApplyPatch HID-Revert-Revert-HID-Fix-logitech-dj-missing-Unifying-device-issue.patch
 
-#rhbz 977053
-ApplyPatch iwl4965-reset-firmware-after-rfkill-off.patch
-
-#rhbz 981445
-ApplyPatch mac80211-fix-infinite-loop-in-ieee80211_determine_chantype.patch
-ApplyPatch mac80211-ignore-HT-primary-channel-while-connected.patch
-ApplyPatch mac80211-continue-using-disabled-channels-while-connected.patch
-
 #rhbz 963715
 ApplyPatch media-cx23885-Fix-TeVii-S471-regression-since-introduction-of-ts2020.patch
 
-#rhbz 845699
-ApplyPatch ALSA-hda-Add-a-fixup-for-Gateway-LT27.patch
-
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2322,10 +2300,14 @@ fi
 # and build.
 
 %changelog
+* Tue Aug 20 2013 Josh Boyer <jwboyer@fedoraproject.org> - 3.10.8-200
+- Linux v3.10.8
+- CVE-2013-4254 ARM: perf: NULL pointer dereference in validate_event (rhbz 998878 998881)
+
 * Fri Aug 16 2013 Josh Boyer <jwboyer@fedoraproject.org>
 - Add patch from Nathanael Noblet to fix mic on Gateway LT27 (rhbz 845699)
 
-* Thu Aug 15 2013 Josh Boyer <jwboyer@redhat.com> - 3.6.10.7-200
+* Thu Aug 15 2013 Josh Boyer <jwboyer@redhat.com> - 3.10.7-200
 - Enable memory cgroup swap accounting (rhbz 982808)
 - Add patch to fix regression on TeVII S471 devices (rhbz 963715)
 - Linux v3.10.7
diff --git a/mac80211-continue-using-disabled-channels-while-connected.patch b/mac80211-continue-using-disabled-channels-while-connected.patch
deleted file mode 100644
index 91dd1d7d..00000000
--- a/mac80211-continue-using-disabled-channels-while-connected.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From ddfe49b42d8ad4bfdf92d63d4a74f162660d878d Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Wed, 31 Jul 2013 18:52:03 +0000
-Subject: mac80211: continue using disabled channels while connected
-
-In case the AP has different regulatory information than we do,
-it can happen that we connect to an AP based on e.g. the world
-roaming regulatory data, and then update our database with the
-AP's country information disables the channel the AP is using.
-If this happens on an HT AP, the bandwidth tracking code will
-hit the WARN_ON() and disconnect. Since that's not very useful,
-ignore the channel-disable flag in bandwidth tracking.
-
-Cc: stable@vger.kernel.org
-Reported-by: Chris Wright <chrisw@sous-sol.org>
-Tested-by: Chris Wright <chrisw@sous-sol.org>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index 077a953..cc9e02d 100644
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -335,8 +335,17 @@ out:
- 	if (ret & IEEE80211_STA_DISABLE_VHT)
- 		vht_chandef = *chandef;
- 
-+	/*
-+	 * Ignore the DISABLED flag when we're already connected and only
-+	 * tracking the APs beacon for bandwidth changes - otherwise we
-+	 * might get disconnected here if we connect to an AP, update our
-+	 * regulatory information based on the AP's country IE and the
-+	 * information we have is wrong/outdated and disables the channel
-+	 * that we're actually using for the connection to the AP.
-+	 */
- 	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
--					IEEE80211_CHAN_DISABLED)) {
-+					tracking ? 0 :
-+						   IEEE80211_CHAN_DISABLED)) {
- 		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
- 			ret = IEEE80211_STA_DISABLE_HT |
- 			      IEEE80211_STA_DISABLE_VHT;
---
-cgit v0.9.2
diff --git a/mac80211-fix-infinite-loop-in-ieee80211_determine_chantype.patch b/mac80211-fix-infinite-loop-in-ieee80211_determine_chantype.patch
deleted file mode 100644
index 49115f96..00000000
--- a/mac80211-fix-infinite-loop-in-ieee80211_determine_chantype.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From b56e4b857c5210e848bfb80e074e5756a36cd523 Mon Sep 17 00:00:00 2001
-From: Chris Wright <chrisw@sous-sol.org>
-Date: Wed, 31 Jul 2013 19:12:24 +0000
-Subject: mac80211: fix infinite loop in ieee80211_determine_chantype
-
-Commit "3d9646d mac80211: fix channel selection bug" introduced a possible
-infinite loop by moving the out target above the chandef_downgrade
-while loop.  When we downgrade to NL80211_CHAN_WIDTH_20_NOHT, we jump
-back up to re-run the while loop...indefinitely.  Replace goto with
-break and carry on.  This may not be sufficient to connect to the AP,
-but will at least keep the cpu from livelocking.  Thanks to Derek Atkins
-as an extra pair of debugging eyes.
-
-Cc: stable@kernel.org
-Signed-off-by: Chris Wright <chrisw@sous-sol.org>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index ae31968..e3e7d2b 100644
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -338,7 +338,7 @@ out:
- 		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
- 			ret = IEEE80211_STA_DISABLE_HT |
- 			      IEEE80211_STA_DISABLE_VHT;
--			goto out;
-+			break;
- 		}
- 
- 		ret |= chandef_downgrade(chandef);
---
-cgit v0.9.2
diff --git a/mac80211-ignore-HT-primary-channel-while-connected.patch b/mac80211-ignore-HT-primary-channel-while-connected.patch
deleted file mode 100644
index ba5d2a47..00000000
--- a/mac80211-ignore-HT-primary-channel-while-connected.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-From 5cdaed1e878d723d56d04ae0be1738124acf9f46 Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Wed, 31 Jul 2013 09:23:06 +0000
-Subject: mac80211: ignore HT primary channel while connected
-
-While we're connected, the AP shouldn't change the primary channel
-in the HT information. We checked this, and dropped the connection
-if it did change it.
-
-Unfortunately, this is causing problems on some APs, e.g. on the
-Netgear WRT610NL: the beacons seem to always contain a bad channel
-and if we made a connection using a probe response (correct data)
-we drop the connection immediately and can basically not connect
-properly at all.
-
-Work around this by ignoring the HT primary channel information in
-beacons if we're already connected.
-
-Also print out more verbose messages in the other situations to
-help diagnose similar bugs quicker in the future.
-
-Cc: stable@vger.kernel.org [3.10]
-Acked-by: Andy Isaacson <adi@hexapodia.org>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index e5c3cf4..077a953 100644
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -211,8 +211,9 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
- 			     struct ieee80211_channel *channel,
- 			     const struct ieee80211_ht_operation *ht_oper,
- 			     const struct ieee80211_vht_operation *vht_oper,
--			     struct cfg80211_chan_def *chandef, bool verbose)
-+			     struct cfg80211_chan_def *chandef, bool tracking)
- {
-+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
- 	struct cfg80211_chan_def vht_chandef;
- 	u32 ht_cfreq, ret;
- 
-@@ -231,7 +232,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
- 	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
- 						  channel->band);
- 	/* check that channel matches the right operating channel */
--	if (channel->center_freq != ht_cfreq) {
-+	if (!tracking && channel->center_freq != ht_cfreq) {
- 		/*
- 		 * It's possible that some APs are confused here;
- 		 * Netgear WNDR3700 sometimes reports 4 higher than
-@@ -239,11 +240,10 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
- 		 * since we look at probe response/beacon data here
- 		 * it should be OK.
- 		 */
--		if (verbose)
--			sdata_info(sdata,
--				   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
--				   channel->center_freq, ht_cfreq,
--				   ht_oper->primary_chan, channel->band);
-+		sdata_info(sdata,
-+			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
-+			   channel->center_freq, ht_cfreq,
-+			   ht_oper->primary_chan, channel->band);
- 		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
- 		goto out;
- 	}
-@@ -297,7 +297,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
- 				channel->band);
- 		break;
- 	default:
--		if (verbose)
-+		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
- 			sdata_info(sdata,
- 				   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
- 				   vht_oper->chan_width);
-@@ -306,7 +306,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
- 	}
- 
- 	if (!cfg80211_chandef_valid(&vht_chandef)) {
--		if (verbose)
-+		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
- 			sdata_info(sdata,
- 				   "AP VHT information is invalid, disable VHT\n");
- 		ret = IEEE80211_STA_DISABLE_VHT;
-@@ -319,7 +319,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
- 	}
- 
- 	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
--		if (verbose)
-+		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
- 			sdata_info(sdata,
- 				   "AP VHT information doesn't match HT, disable VHT\n");
- 		ret = IEEE80211_STA_DISABLE_VHT;
-@@ -346,7 +346,7 @@ out:
- 		ret |= chandef_downgrade(chandef);
- 	}
- 
--	if (chandef->width != vht_chandef.width && verbose)
-+	if (chandef->width != vht_chandef.width && !tracking)
- 		sdata_info(sdata,
- 			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
- 
-@@ -386,7 +386,7 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
- 
- 	/* calculate new channel (type) based on HT/VHT operation IEs */
- 	flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
--					     vht_oper, &chandef, false);
-+					     vht_oper, &chandef, true);
- 
- 	/*
- 	 * Downgrade the new channel if we associated with restricted
-@@ -3838,7 +3838,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
- 	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
- 						     cbss->channel,
- 						     ht_oper, vht_oper,
--						     &chandef, true);
-+						     &chandef, false);
- 
- 	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
- 				      local->rx_chains);
---
-cgit v0.9.2
diff --git a/sources b/sources
index cc0f0411..f1361d48 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 4f25cd5bec5f8d5a7d935b3f2ccb8481  linux-3.10.tar.xz
-6b1b6b62044fcf3624f067154d5c1666  patch-3.10.7.xz
+f62214b2847eef5fc22cfc9f1e2d28a3  patch-3.10.8.xz