3.4-stable patches

added patches:
	hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch
	xfs-underflow-bug-in-xfs_attrlist_by_handle.patch

diff --git a/queue-3.4/hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch b/queue-3.4/hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch
new file mode 100644 (file)
index 0000000..ec6fde3
--- /dev/null
+++ b/queue-3.4/hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch
@@ -0,0 +1,43 @@
+From cf7559bc053471f32373d71d04a9aa19e0b48d59 Mon Sep 17 00:00:00 2001
+From: Brian Carnes <bmcarnes@gmail.com>
+Date: Thu, 12 Dec 2013 08:05:32 +0100
+Subject: hwmon: (w83l786ng) Fix fan speed control mode setting and reporting
+
+From: Brian Carnes <bmcarnes@gmail.com>
+
+commit cf7559bc053471f32373d71d04a9aa19e0b48d59 upstream.
+
+The wrong mask is used, which causes some fan speed control modes
+(pwmX_enable) to be incorrectly reported, and some modes to be
+impossible to set.
+
+[JD: add subject and description.]
+
+Signed-off-by: Brian Carnes <bmcarnes@gmail.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/w83l786ng.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/w83l786ng.c
++++ b/drivers/hwmon/w83l786ng.c
+@@ -510,7 +510,7 @@ store_pwm_enable(struct device *dev, str
+       mutex_lock(&data->update_lock);
+       reg = w83l786ng_read_value(client, W83L786NG_REG_FAN_CFG);
+       data->pwm_enable[nr] = val;
+-      reg &= ~(0x02 << W83L786NG_PWM_ENABLE_SHIFT[nr]);
++      reg &= ~(0x03 << W83L786NG_PWM_ENABLE_SHIFT[nr]);
+       reg |= (val - 1) << W83L786NG_PWM_ENABLE_SHIFT[nr];
+       w83l786ng_write_value(client, W83L786NG_REG_FAN_CFG, reg);
+       mutex_unlock(&data->update_lock);
+@@ -781,7 +781,7 @@ static struct w83l786ng_data *w83l786ng_
+                           ((pwmcfg >> W83L786NG_PWM_MODE_SHIFT[i]) & 1)
+                           ? 0 : 1;
+                       data->pwm_enable[i] =
+-                          ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 2) + 1;
++                          ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 3) + 1;
+                       data->pwm[i] = w83l786ng_read_value(client,
+                           W83L786NG_REG_PWM[i]);
+               }

diff --git a/queue-3.4/series b/queue-3.4/series
index af1ea55c25cd876c540dd8ce1accc1745904cea7..8ec1f3f90fefbd8e9867eecffc7c0ac8d4aba7a3 100644 (file)
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -5,3 +5,5 @@ arm-omap3-hwmod-data-don-t-prevent-reset-of-usb-host-module.patch
 arm-7912-1-check-stack-pointer-in-get_wchan.patch
 arm-7913-1-fix-framepointer-check-in-unwind_frame.patch
 kvm-improve-create-vcpu-parameter-cve-2013-4587.patch
+hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch
+xfs-underflow-bug-in-xfs_attrlist_by_handle.patch

diff --git a/queue-3.4/xfs-underflow-bug-in-xfs_attrlist_by_handle.patch b/queue-3.4/xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
new file mode 100644 (file)
index 0000000..4acbe0c
--- /dev/null
+++ b/queue-3.4/xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
@@ -0,0 +1,50 @@
+From 31978b5cc66b8ba8a7e8eef60b12395d41b7b890 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 31 Oct 2013 21:00:10 +0300
+Subject: xfs: underflow bug in xfs_attrlist_by_handle()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 31978b5cc66b8ba8a7e8eef60b12395d41b7b890 upstream.
+
+If we allocate less than sizeof(struct attrlist) then we end up
+corrupting memory or doing a ZERO_PTR_SIZE dereference.
+
+This can only be triggered with CAP_SYS_ADMIN.
+
+Reported-by: Nico Golde <nico@ngolde.de>
+Reported-by: Fabian Yamaguchi <fabs@goesec.de>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_ioctl.c   |    3 ++-
+ fs/xfs/xfs_ioctl32.c |    3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/xfs/xfs_ioctl.c
++++ b/fs/xfs/xfs_ioctl.c
+@@ -400,7 +400,8 @@ xfs_attrlist_by_handle(
+               return -XFS_ERROR(EPERM);
+       if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t)))
+               return -XFS_ERROR(EFAULT);
+-      if (al_hreq.buflen > XATTR_LIST_MAX)
++      if (al_hreq.buflen < sizeof(struct attrlist) ||
++          al_hreq.buflen > XATTR_LIST_MAX)
+               return -XFS_ERROR(EINVAL);
+ 
+       /*
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -361,7 +361,8 @@ xfs_compat_attrlist_by_handle(
+       if (copy_from_user(&al_hreq, arg,
+                          sizeof(compat_xfs_fsop_attrlist_handlereq_t)))
+               return -XFS_ERROR(EFAULT);
+-      if (al_hreq.buflen > XATTR_LIST_MAX)
++      if (al_hreq.buflen < sizeof(struct attrlist) ||
++          al_hreq.buflen > XATTR_LIST_MAX)
+               return -XFS_ERROR(EINVAL);
+ 
+       /*