3.17-stable patches

added patches:
	cxgb4-handle-dcb-enable-correctly.patch
	media-ttusb-dec-buffer-overflow-in-ioctl.patch

diff --git a/queue-3.17/cxgb4-handle-dcb-enable-correctly.patch b/queue-3.17/cxgb4-handle-dcb-enable-correctly.patch
new file mode 100644 (file)
index 0000000..dac2d5a
--- /dev/null
+++ b/queue-3.17/cxgb4-handle-dcb-enable-correctly.patch
@@ -0,0 +1,62 @@
+From 3bb062613b1ecbd0c388106f61344d699f7859ec Mon Sep 17 00:00:00 2001
+From: Anish Bhatt <anish@chelsio.com>
+Date: Thu, 23 Oct 2014 14:37:31 -0700
+Subject: cxgb4 : Handle dcb enable correctly
+
+From: Anish Bhatt <anish@chelsio.com>
+
+commit 3bb062613b1ecbd0c388106f61344d699f7859ec upstream.
+
+Disabling DCBx in firmware automatically enables DCBx for control via host
+lldp agents. Wait for an explicit setstate call from an lldp agents to enable
+ DCBx instead.
+
+Fixes: 76bcb31efc06 ("cxgb4 : Add DCBx support codebase and dcbnl_ops")
+
+Signed-off-by: Anish Bhatt <anish@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c  |    7 ++++++-
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c |    6 +++++-
+ 2 files changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+@@ -80,7 +80,6 @@ void cxgb4_dcb_state_fsm(struct net_devi
+                       /* we're going to use Host DCB */
+                       dcb->state = CXGB4_DCB_STATE_HOST;
+                       dcb->supported = CXGB4_DCBX_HOST_SUPPORT;
+-                      dcb->enabled = 1;
+                       break;
+               }
+ 
+@@ -349,6 +348,12 @@ static u8 cxgb4_setstate(struct net_devi
+ {
+       struct port_info *pi = netdev2pinfo(dev);
+ 
++      /* If DCBx is host-managed, dcb is enabled by outside lldp agents */
++      if (pi->dcb.state == CXGB4_DCB_STATE_HOST) {
++              pi->dcb.enabled = enabled;
++              return 0;
++      }
++
+       /* Firmware doesn't provide any mechanism to control the DCB state.
+        */
+       if (enabled != (pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED))
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -688,7 +688,11 @@ int cxgb4_dcb_enabled(const struct net_d
+ #ifdef CONFIG_CHELSIO_T4_DCB
+       struct port_info *pi = netdev_priv(dev);
+ 
+-      return pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED;
++      if (!pi->dcb.enabled)
++              return 0;
++
++      return ((pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED) ||
++              (pi->dcb.state == CXGB4_DCB_STATE_HOST));
+ #else
+       return 0;
+ #endif

diff --git a/queue-3.17/media-ttusb-dec-buffer-overflow-in-ioctl.patch b/queue-3.17/media-ttusb-dec-buffer-overflow-in-ioctl.patch
new file mode 100644 (file)
index 0000000..b8586c3
--- /dev/null
+++ b/queue-3.17/media-ttusb-dec-buffer-overflow-in-ioctl.patch
@@ -0,0 +1,31 @@
+From f2e323ec96077642d397bb1c355def536d489d16 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 5 Sep 2014 09:09:28 -0300
+Subject: media: ttusb-dec: buffer overflow in ioctl
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit f2e323ec96077642d397bb1c355def536d489d16 upstream.
+
+We need to add a limit check here so we don't overflow the buffer.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/ttusb-dec/ttusbdecfe.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/media/usb/ttusb-dec/ttusbdecfe.c
++++ b/drivers/media/usb/ttusb-dec/ttusbdecfe.c
+@@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_m
+                  0x00, 0x00, 0x00, 0x00,
+                  0x00, 0x00 };
+ 
++      if (cmd->msg_len > sizeof(b) - 4)
++              return -EINVAL;
++
+       memcpy(&b[4], cmd->msg, cmd->msg_len);
+ 
+       state->config->send_command(fe, 0x72,

diff --git a/queue-3.17/series b/queue-3.17/series
index 8f5ae0a584404f973cf65dfe235c843a1414ba8f..bb90cd002d1cd8a4b678b9f859b2c4dcad1b1de5 100644 (file)
--- a/queue-3.17/series
+++ b/queue-3.17/series
@@ -107,3 +107,5 @@ nfs-don-t-try-to-reclaim-delegation-open-state-if-recovery-failed.patch
 nfs-fix-use-of-uninitialized-variable-in-nfs_getattr.patch
 nfsv4-fix-races-between-nfs_remove_bad_delegation-and-delegation-return.patch
 nfsv4.1-nfs41_clear_delegation_stateid-shouldn-t-trust-nfs_delegated_state.patch
+media-ttusb-dec-buffer-overflow-in-ioctl.patch
+cxgb4-handle-dcb-enable-correctly.patch