iwlwifi: dvm: fix D3 firmware PN programming
authorJohannes Berg <johannes.berg@intel.com>
Tue, 15 Sep 2015 12:36:09 +0000 (14:36 +0200)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 17 Nov 2015 15:54:42 +0000 (15:54 +0000)
commit45a7943d9fed337807ce04654d1a6bbf3ae746e0
tree5a7bdafb59f35a43a2b52ef467d3a3c43749889c
parenta2a46f5816a863b33e79e1fecb74e06422350cfd
iwlwifi: dvm: fix D3 firmware PN programming

commit 5bd166872d8f99f156fac191299d24f828bb2348 upstream.

The code to send the RX PN data (for each TID) to the firmware
has a devastating bug: it overwrites the data for TID 0 with
all the TID data, leaving the remaining TIDs zeroed. This will
allow replays to actually be accepted by the firmware, which
could allow waking up the system.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/net/wireless/iwlwifi/iwl-agn.c