3.3.7-1.fc16.gnu

7 files changed, 114 insertions, 153 deletions

diff --git a/freed-ora/current/f16/dl2k-Clean-up-rio_ioctl.patch b/freed-ora/current/f16/dl2k-Clean-up-rio_ioctl.patch
deleted file mode 100644
index 2ef4eed6d..000000000
--- a/freed-ora/current/f16/dl2k-Clean-up-rio_ioctl.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From 1bb57e940e1958e40d51f2078f50c3a96a9b2d75 Mon Sep 17 00:00:00 2001
-From: Jeff Mahoney <jeffm@suse.com>
-Date: Wed, 25 Apr 2012 14:32:09 +0000
-Subject: [PATCH] dl2k: Clean up rio_ioctl
-
-The dl2k driver's rio_ioctl call has a few issues:
-- No permissions checking
-- Implements SIOCGMIIREG and SIOCGMIIREG using the SIOCDEVPRIVATE numbers
-- Has a few ioctls that may have been used for debugging at one point
-  but have no place in the kernel proper.
-
-This patch removes all but the MII ioctls, renumbers them to use the
-standard ones, and adds the proper permission check for SIOCSMIIREG.
-
-We can also get rid of the dl2k-specific struct mii_data in favor of
-the generic struct mii_ioctl_data.
-
-Since we have the phyid on hand, we can add the SIOCGMIIPHY ioctl too.
-
-Most of the MII code for the driver could probably be converted to use
-the generic MII library but I don't have a device to test the results.
-
-Reported-by: Stephan Mueller <stephan.mueller@atsec.com>
-Signed-off-by: Jeff Mahoney <jeffm@suse.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/ethernet/dlink/dl2k.c |   52 ++++++------------------------------
- drivers/net/ethernet/dlink/dl2k.h |    7 -----
- 2 files changed, 9 insertions(+), 50 deletions(-)
-
-diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
-index b2dc2c8..2e09edb 100644
---- a/drivers/net/ethernet/dlink/dl2k.c
-+++ b/drivers/net/ethernet/dlink/dl2k.c
-@@ -1259,55 +1259,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
- {
- 	int phy_addr;
- 	struct netdev_private *np = netdev_priv(dev);
--	struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
--
--	struct netdev_desc *desc;
--	int i;
-+	struct mii_ioctl_data *miidata = if_mii(rq);
- 
- 	phy_addr = np->phy_addr;
- 	switch (cmd) {
--	case SIOCDEVPRIVATE:
--		break;
--
--	case SIOCDEVPRIVATE + 1:
--		miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
-+	case SIOCGMIIPHY:
-+		miidata->phy_id = phy_addr;
- 		break;
--	case SIOCDEVPRIVATE + 2:
--		mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
-+	case SIOCGMIIREG:
-+		miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
- 		break;
--	case SIOCDEVPRIVATE + 3:
--		break;
--	case SIOCDEVPRIVATE + 4:
--		break;
--	case SIOCDEVPRIVATE + 5:
--		netif_stop_queue (dev);
-+	case SIOCSMIIREG:
-+		if (!capable(CAP_NET_ADMIN))
-+			return -EPERM;
-+		mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
- 		break;
--	case SIOCDEVPRIVATE + 6:
--		netif_wake_queue (dev);
--		break;
--	case SIOCDEVPRIVATE + 7:
--		printk
--		    ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
--		     netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
--		     np->old_rx);
--		break;
--	case SIOCDEVPRIVATE + 8:
--		printk("TX ring:\n");
--		for (i = 0; i < TX_RING_SIZE; i++) {
--			desc = &np->tx_ring[i];
--			printk
--			    ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
--			     i,
--			     (u32) (np->tx_ring_dma + i * sizeof (*desc)),
--			     (u32)le64_to_cpu(desc->next_desc),
--			     (u32)le64_to_cpu(desc->status),
--			     (u32)(le64_to_cpu(desc->fraginfo) >> 32),
--			     (u32)le64_to_cpu(desc->fraginfo));
--			printk ("\n");
--		}
--		printk ("\n");
--		break;
--
- 	default:
- 		return -EOPNOTSUPP;
- 	}
-diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
-index ba0adca..30c2da3 100644
---- a/drivers/net/ethernet/dlink/dl2k.h
-+++ b/drivers/net/ethernet/dlink/dl2k.h
-@@ -365,13 +365,6 @@ struct ioctl_data {
- 	char *data;
- };
- 
--struct mii_data {
--	__u16 reserved;
--	__u16 reg_num;
--	__u16 in_value;
--	__u16 out_value;
--};
--
- /* The Rx and Tx buffer descriptors. */
- struct netdev_desc {
- 	__le64 next_desc;
--- 
-1.7.7.6
-
diff --git a/freed-ora/current/f16/dvbs-fix-zigzag.patch b/freed-ora/current/f16/dvbs-fix-zigzag.patch
deleted file mode 100644
index 4bc9daaf4..000000000
--- a/freed-ora/current/f16/dvbs-fix-zigzag.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
-index 39696c6..de7dc29 100644
---- a/drivers/media/dvb/dvb-core/dvb_frontend.c
-+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
-@@ -1898,6 +1898,10 @@ static int dtv_set_frontend(struct dvb_frontend *fe)
- 	} else {
- 		/* default values */
- 		switch (c->delivery_system) {
-+		case SYS_DVBS:
-+		case SYS_DVBS2:
-+		case SYS_ISDBS:
-+		case SYS_TURBO:
- 		case SYS_DVBC_ANNEX_A:
- 		case SYS_DVBC_ANNEX_C:
- 			fepriv->min_delay = HZ / 20;
diff --git a/freed-ora/current/f16/kernel.spec b/freed-ora/current/f16/kernel.spec
index cc4656bf9..e8e5d3796 100644
--- a/freed-ora/current/f16/kernel.spec
+++ b/freed-ora/current/f16/kernel.spec
@@ -54,7 +54,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 3
+%global baserelease 1
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -104,7 +104,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 6
+%define stable_update 7
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -760,7 +760,6 @@ Patch2802: linux-2.6-silence-acpi-blacklist.patch
 #   add-poll-requested-events.patch was added for 3.4
 Patch2900: add-poll-requested-events.patch
 Patch2901: drivers-media-update.patch
-Patch2902: dvbs-fix-zigzag.patch
 
 # fs fixes
 
@@ -842,15 +841,15 @@ Patch22007: macvtap-zerocopy-validate-vector-length.patch
 #rhbz 817298
 Patch22013: ipw2x00-add-supported-cipher-suites-to-wiphy-initialization.patch
 
-#rhbz 818820
-Patch22016: dl2k-Clean-up-rio_ioctl.patch
-
 #rhbz 749276
 Patch22018: atl1c_net_next_update-3.3.patch
 
 #rhbz 795176
 Patch22019: rtl818x-fix-sleeping-function-called-from-invalid-context.patch
 
+#rhbz 822120
+Patch22020: rtlwifi-fix-for-race-condition-when-firmware-is-cach.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1508,7 +1507,6 @@ ApplyPatch quite-apm.patch
 # Media (V4L/DVB/IR) updates/fixes/experimental drivers
 #  apply if non-empty
 ApplyPatch add-poll-requested-events.patch
-ApplyPatch dvbs-fix-zigzag.patch
 ApplyOptionalPatch drivers-media-update.patch
 
 # Patches headed upstream
@@ -1568,15 +1566,15 @@ ApplyPatch macvtap-zerocopy-validate-vector-length.patch
 #rhbz 817298
 ApplyPatch ipw2x00-add-supported-cipher-suites-to-wiphy-initialization.patch
 
-#rhbz 818820
-ApplyPatch dl2k-Clean-up-rio_ioctl.patch
-
 #rhbz 749276
 ApplyPatch atl1c_net_next_update-3.3.patch
 
 #rhbz 795176
 ApplyPatch rtl818x-fix-sleeping-function-called-from-invalid-context.patch
 
+#rhbz 822120
+ApplyPatch rtlwifi-fix-for-race-condition-when-firmware-is-cach.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2315,6 +2313,18 @@ fi
 # and build.
 
 %changelog
+* Tue May 22 2012 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 3.3.7-gnu.
+
+* Mon May 21 2012 Justin M. Forbes <jforbes@redhat.com> 3.3.7-1
+- Linux 3.3.7
+
+* Fri May 18 2012 Josh Boyer <jwboyer@redhat.com>
+- Additional fixes for CVE-2011-4131 (rhbz 822874 822869)
+
+* Thu May 17 2012 Josh Boyer <jwboyer@redhat.com>
+- Fix rtlwifi async firmware load race condition (rhbz 822120)
+
 * Wed May 16 2012 Justin M. Forbes <jforbes@redhat.com> 3.3.6-3
 - fix rtl8187: ->brightness_set can not sleep (rhbz 795176)
 
diff --git a/freed-ora/current/f16/patch-3.3-gnu-3.3.6-gnu.xz.sign b/freed-ora/current/f16/patch-3.3-gnu-3.3.6-gnu.xz.sign
deleted file mode 100644
index d0c573ca4..000000000
--- a/freed-ora/current/f16/patch-3.3-gnu-3.3.6-gnu.xz.sign
+++ /dev/null
@@ -1,7 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.18 (GNU/Linux)
-
-iEYEABECAAYFAk+warwACgkQvLfPh359R6d9+QCglEj0bmJRls2lR1R728kCGbP0
-qHUAn079mlbL8uVupU95vJaV1L6j9p2O
-=f175
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f16/patch-3.3-gnu-3.3.7-gnu.xz.sign b/freed-ora/current/f16/patch-3.3-gnu-3.3.7-gnu.xz.sign
new file mode 100644
index 000000000..f0247d217
--- /dev/null
+++ b/freed-ora/current/f16/patch-3.3-gnu-3.3.7-gnu.xz.sign
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.18 (GNU/Linux)
+
+iEYEABECAAYFAk+660IACgkQvLfPh359R6dVLgCgk9jXp1ZBBaCxHwgdQ/UW5TeQ
+N78AnjDEKsumNm57jF+KS9aeuAPSomB8
+=vs8N
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f16/rtlwifi-fix-for-race-condition-when-firmware-is-cach.patch b/freed-ora/current/f16/rtlwifi-fix-for-race-condition-when-firmware-is-cach.patch
new file mode 100644
index 000000000..431ec00b6
--- /dev/null
+++ b/freed-ora/current/f16/rtlwifi-fix-for-race-condition-when-firmware-is-cach.patch
@@ -0,0 +1,86 @@
+From 574e02abaf816b582685805f0c1150ca9f1f18ee Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Fri, 4 May 2012 08:27:43 -0500
+Subject: [PATCH] rtlwifi: fix for race condition when firmware is cached
+
+In commit b0302ab, the rtlwifi family of drivers was converted to use
+asynchronous firmware loading. Unfortumately, the implementation was
+racy, and the ieee80211 routines could be started before rtl_init_core()
+was called to setup the data.
+
+This patch fixes the bug noted in https://bugzilla.kernel.org/show_bug.cgi?id=43187.
+
+Reported-by: Joshua Roys <Joshua.Roys@gtri.gatech.edu>
+Tested-by: Neptune Ning <frostyplanet@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Stable <stable@vger.kernel.org>    [3.3]
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+---
+ drivers/net/wireless/rtlwifi/pci.c |   16 ++++++++--------
+ drivers/net/wireless/rtlwifi/usb.c |   10 +++++-----
+ 2 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index b588ca8..03c400e 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -1865,14 +1865,6 @@ int __devinit rtl_pci_probe(struct pci_dev *pdev,
+ 	/*like read eeprom and so on */
+ 	rtlpriv->cfg->ops->read_eeprom_info(hw);
+ 
+-	if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+-		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+-			 ("Can't init_sw_vars.\n"));
+-		goto fail3;
+-	}
+-
+-	rtlpriv->cfg->ops->init_sw_leds(hw);
+-
+ 	/*aspm */
+ 	rtl_pci_init_aspm(hw);
+ 
+@@ -1892,6 +1884,14 @@ int __devinit rtl_pci_probe(struct pci_dev *pdev,
+ 		goto fail3;
+ 	}
+ 
++	if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
++		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
++			 ("Can't init_sw_vars.\n"));
++		goto fail3;
++	}
++
++	rtlpriv->cfg->ops->init_sw_leds(hw);
++
+ 	err = sysfs_create_group(&pdev->dev.kobj, &rtl_attribute_group);
+ 	if (err) {
+ 		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index 049e207..20b53ae 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -970,12 +970,6 @@ int __devinit rtl_usb_probe(struct usb_interface *intf,
+ 	rtlpriv->cfg->ops->read_chip_version(hw);
+ 	/*like read eeprom and so on */
+ 	rtlpriv->cfg->ops->read_eeprom_info(hw);
+-	if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+-		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+-			 ("Can't init_sw_vars.\n"));
+-		goto error_out;
+-	}
+-	rtlpriv->cfg->ops->init_sw_leds(hw);
+ 	err = _rtl_usb_init(hw);
+ 	err = _rtl_usb_init_sw(hw);
+ 	/* Init mac80211 sw */
+@@ -985,6 +979,12 @@ int __devinit rtl_usb_probe(struct usb_interface *intf,
+ 			 ("Can't allocate sw for mac80211.\n"));
+ 		goto error_out;
+ 	}
++	if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
++		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
++			 ("Can't init_sw_vars.\n"));
++		goto error_out;
++	}
++	rtlpriv->cfg->ops->init_sw_leds(hw);
+ 
+ 	return 0;
+ error_out:
diff --git a/freed-ora/current/f16/sources b/freed-ora/current/f16/sources
index 647ca16a8..746743e75 100644
--- a/freed-ora/current/f16/sources
+++ b/freed-ora/current/f16/sources
@@ -1,2 +1,2 @@
 5487da14ca81715a469c7594d39722fa  linux-libre-3.3-gnu.tar.xz
-6d9d139e4b53802615833372728cc0e4  patch-3.3-gnu-3.3.6-gnu.xz
+7c6765b6223ad361c1c49310679ac1d0  patch-3.3-gnu-3.3.7-gnu.xz