.35 patches

diff --git a/queue-2.6.35/arm-imx-gpio-add-spinlock-protection.patch b/queue-2.6.35/arm-imx-gpio-add-spinlock-protection.patch
new file mode 100644 (file)
index 0000000..06a7d47
--- /dev/null
+++ b/queue-2.6.35/arm-imx-gpio-add-spinlock-protection.patch
@@ -0,0 +1,75 @@
+From 14cb0deb66fcfca8fdbef75da8c84b5405a8c767 Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Tue, 6 Jul 2010 14:03:22 +0300
+Subject: arm/imx/gpio: add spinlock protection
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+commit 14cb0deb66fcfca8fdbef75da8c84b5405a8c767 upstream.
+
+The GPIO registers need protection from concurrent access for operations that
+are not atomic.
+
+Cc: Juergen Beisert <j.beisert@pengutronix.de>
+Cc: Daniel Mack <daniel@caiaq.de>
+Reported-by: rpkamiak@rockwellcollins.com
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/plat-mxc/gpio.c              |    8 ++++++++
+ arch/arm/plat-mxc/include/mach/gpio.h |    1 +
+ 2 files changed, 9 insertions(+)
+
+--- a/arch/arm/plat-mxc/gpio.c
++++ b/arch/arm/plat-mxc/gpio.c
+@@ -214,13 +214,16 @@ static void _set_gpio_direction(struct g
+       struct mxc_gpio_port *port =
+               container_of(chip, struct mxc_gpio_port, chip);
+       u32 l;
++      unsigned long flags;
+ 
++      spin_lock_irqsave(&port->lock, flags);
+       l = __raw_readl(port->base + GPIO_GDIR);
+       if (dir)
+               l |= 1 << offset;
+       else
+               l &= ~(1 << offset);
+       __raw_writel(l, port->base + GPIO_GDIR);
++      spin_unlock_irqrestore(&port->lock, flags);
+ }
+ 
+ static void mxc_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
+@@ -229,9 +232,12 @@ static void mxc_gpio_set(struct gpio_chi
+               container_of(chip, struct mxc_gpio_port, chip);
+       void __iomem *reg = port->base + GPIO_DR;
+       u32 l;
++      unsigned long flags;
+ 
++      spin_lock_irqsave(&port->lock, flags);
+       l = (__raw_readl(reg) & (~(1 << offset))) | (value << offset);
+       __raw_writel(l, reg);
++      spin_unlock_irqrestore(&port->lock, flags);
+ }
+ 
+ static int mxc_gpio_get(struct gpio_chip *chip, unsigned offset)
+@@ -285,6 +291,8 @@ int __init mxc_gpio_init(struct mxc_gpio
+               port[i].chip.base = i * 32;
+               port[i].chip.ngpio = 32;
+ 
++              spin_lock_init(&port[i].lock);
++
+               /* its a serious configuration bug when it fails */
+               BUG_ON( gpiochip_add(&port[i].chip) < 0 );
+ 
+--- a/arch/arm/plat-mxc/include/mach/gpio.h
++++ b/arch/arm/plat-mxc/include/mach/gpio.h
+@@ -36,6 +36,7 @@ struct mxc_gpio_port {
+       int virtual_irq_start;
+       struct gpio_chip chip;
+       u32 both_edges;
++      spinlock_t lock;
+ };
+ 
+ int mxc_gpio_init(struct mxc_gpio_port*, int);

diff --git a/queue-2.6.35/parisc-led.c-fix-potential-stack-overflow-in-led_proc_write.patch b/queue-2.6.35/parisc-led.c-fix-potential-stack-overflow-in-led_proc_write.patch
new file mode 100644 (file)
index 0000000..0ded5b2
--- /dev/null
+++ b/queue-2.6.35/parisc-led.c-fix-potential-stack-overflow-in-led_proc_write.patch
@@ -0,0 +1,45 @@
+From 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Mon, 2 Aug 2010 22:46:41 +0200
+Subject: PARISC: led.c - fix potential stack overflow in led_proc_write()
+
+From: Helge Deller <deller@gmx.de>
+
+commit 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 upstream.
+
+avoid potential stack overflow by correctly checking count parameter
+
+Reported-by: Ilja <ilja@netric.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Acked-by: Kyle McMartin <kyle@mcmartin.ca>
+Cc: James E.J. Bottomley <jejb@parisc-linux.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/parisc/led.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -176,16 +176,18 @@ static ssize_t led_proc_write(struct fil
+       size_t count, loff_t *pos)
+ {
+       void *data = PDE(file->f_path.dentry->d_inode)->data;
+-      char *cur, lbuf[count + 1];
++      char *cur, lbuf[32];
+       int d;
+ 
+       if (!capable(CAP_SYS_ADMIN))
+               return -EACCES;
+ 
+-      memset(lbuf, 0, count + 1);
++      if (count >= sizeof(lbuf))
++              count = sizeof(lbuf)-1;
+ 
+       if (copy_from_user(lbuf, buf, count))
+               return -EFAULT;
++      lbuf[count] = 0;
+ 
+       cur = lbuf;
+