3.11-stable patches

added patches:
	staging-vt6656-iwctl_siwencodeext-return-if-device-not-open.patch
	staging-vt6656-main_usb.c-oops-on-device_close-move-flag-earlier.patch

diff --git a/queue-3.11/series b/queue-3.11/series
index 1947cf996e0a087d5a50e903cff313edfdeb509f..048f88cf01f7548f3be998a8d50f117805c02d53 100644 (file)
--- a/queue-3.11/series
+++ b/queue-3.11/series
@@ -21,3 +21,5 @@ serial-tegra-fix-tty-kref-leak.patch
 serial-pch_uart-fix-tty-kref-leak-in-rx-error-path.patch
 serial-pch_uart-fix-tty-kref-leak-in-dma-rx-path.patch
 arm-7837-3-fix-thumb-2-bug-in-aes-assembler-code.patch
+staging-vt6656-main_usb.c-oops-on-device_close-move-flag-earlier.patch
+staging-vt6656-iwctl_siwencodeext-return-if-device-not-open.patch

diff --git a/queue-3.11/staging-vt6656-iwctl_siwencodeext-return-if-device-not-open.patch b/queue-3.11/staging-vt6656-iwctl_siwencodeext-return-if-device-not-open.patch
new file mode 100644 (file)
index 0000000..9452391
--- /dev/null
+++ b/queue-3.11/staging-vt6656-iwctl_siwencodeext-return-if-device-not-open.patch
@@ -0,0 +1,33 @@
+From 5e8c3d3e41b0bf241e830a1ee0752405adecc050 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Mon, 23 Sep 2013 20:30:42 +0100
+Subject: staging: vt6656: [BUG] iwctl_siwencodeext return if device not open
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 5e8c3d3e41b0bf241e830a1ee0752405adecc050 upstream.
+
+Don't allow entry to iwctl_siwencodeext if device not open.
+
+This fixes a race condition where wpa supplicant/network manager
+enters the function when the device is already closed.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/iwctl.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/vt6656/iwctl.c
++++ b/drivers/staging/vt6656/iwctl.c
+@@ -1634,6 +1634,9 @@ int iwctl_siwencodeext(struct net_device
+       if (pMgmt == NULL)
+               return -EFAULT;
+ 
++      if (!(pDevice->flags & DEVICE_FLAGS_OPENED))
++              return -ENODEV;
++
+       buf = kzalloc(sizeof(struct viawget_wpa_param), GFP_KERNEL);
+       if (buf == NULL)
+               return -ENOMEM;

diff --git a/queue-3.11/staging-vt6656-main_usb.c-oops-on-device_close-move-flag-earlier.patch b/queue-3.11/staging-vt6656-main_usb.c-oops-on-device_close-move-flag-earlier.patch
new file mode 100644 (file)
index 0000000..4da97d8
--- /dev/null
+++ b/queue-3.11/staging-vt6656-main_usb.c-oops-on-device_close-move-flag-earlier.patch
@@ -0,0 +1,45 @@
+From e3eb270fab7734427dd8171a93e4946fe28674bc Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 22 Sep 2013 19:48:54 +0100
+Subject: staging: vt6656: [BUG] main_usb.c oops on device_close move flag earlier.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit e3eb270fab7734427dd8171a93e4946fe28674bc upstream.
+
+The vt6656 is prone to resetting on the usb bus.
+
+It seems there is a race condition and wpa supplicant is
+trying to open the device via iw_handlers before its actually
+closed at a stage that the buffers are being removed.
+
+The device is longer considered open when the
+buffers are being removed. So move ~DEVICE_FLAGS_OPENED
+flag to before freeing the device buffers.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/main_usb.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -1099,6 +1099,8 @@ static int device_close(struct net_devic
+     memset(pMgmt->abyCurrBSSID, 0, 6);
+     pMgmt->eCurrState = WMAC_STATE_IDLE;
+ 
++      pDevice->flags &= ~DEVICE_FLAGS_OPENED;
++
+     device_free_tx_bufs(pDevice);
+     device_free_rx_bufs(pDevice);
+     device_free_int_bufs(pDevice);
+@@ -1110,7 +1112,6 @@ static int device_close(struct net_devic
+     usb_free_urb(pDevice->pInterruptURB);
+ 
+     BSSvClearNodeDBTable(pDevice, 0);
+-    pDevice->flags &=(~DEVICE_FLAGS_OPENED);
+ 
+     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "device_close2 \n");
+