start the 2.6.32 patch series

diff --git a/queue-2.6.32/series b/queue-2.6.32/series
new file mode 100644 (file)
index 0000000..f0db903
--- /dev/null
+++ b/queue-2.6.32/series
@@ -0,0 +1 @@
+usb-usb-storage-fix-bug-in-fill_inquiry.patch

diff --git a/queue-2.6.32/usb-usb-storage-fix-bug-in-fill_inquiry.patch b/queue-2.6.32/usb-usb-storage-fix-bug-in-fill_inquiry.patch
new file mode 100644 (file)
index 0000000..4f5366f
--- /dev/null
+++ b/queue-2.6.32/usb-usb-storage-fix-bug-in-fill_inquiry.patch
@@ -0,0 +1,57 @@
+From f3f6faa9edf67c1018270793e0547b0f81abb47e Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 7 Dec 2009 16:47:43 -0500
+Subject: USB: usb-storage: fix bug in fill_inquiry
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit f3f6faa9edf67c1018270793e0547b0f81abb47e upstream.
+
+This patch (as1312) fixes a minor bug in usb-storage.  The
+fill_inquiry() routine neglects to pre-load the inquiry data buffer
+with spaces.  As a result, if the vendor name is shorter than 8
+characters or the product name is shorter than 16, the remainder will
+be filled with garbage.
+
+The patch also removes some unnecessary calls to strlen().
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/usb.c |   15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -228,6 +228,7 @@ void fill_inquiry_response(struct us_dat
+       if (data_len<36) // You lose.
+               return;
+ 
++      memset(data+8, ' ', 28);
+       if(data[0]&0x20) { /* USB device currently not connected. Return
+                             peripheral qualifier 001b ("...however, the
+                             physical device is not currently connected
+@@ -237,15 +238,15 @@ void fill_inquiry_response(struct us_dat
+                             device, it may return zeros or ASCII spaces 
+                             (20h) in those fields until the data is
+                             available from the device."). */
+-              memset(data+8,0,28);
+       } else {
+               u16 bcdDevice = le16_to_cpu(us->pusb_dev->descriptor.bcdDevice);
+-              memcpy(data+8, us->unusual_dev->vendorName, 
+-                      strlen(us->unusual_dev->vendorName) > 8 ? 8 :
+-                      strlen(us->unusual_dev->vendorName));
+-              memcpy(data+16, us->unusual_dev->productName, 
+-                      strlen(us->unusual_dev->productName) > 16 ? 16 :
+-                      strlen(us->unusual_dev->productName));
++              int n;
++
++              n = strlen(us->unusual_dev->vendorName);
++              memcpy(data+8, us->unusual_dev->vendorName, min(8, n));
++              n = strlen(us->unusual_dev->productName);
++              memcpy(data+16, us->unusual_dev->productName, min(16, n));
++
+               data[32] = 0x30 + ((bcdDevice>>12) & 0x0F);
+               data[33] = 0x30 + ((bcdDevice>>8) & 0x0F);
+               data[34] = 0x30 + ((bcdDevice>>4) & 0x0F);