.27 patches

diff --git a/queue-2.6.27/scsi-fix-protection-scsi_data_buffer-leak.patch b/queue-2.6.27/scsi-fix-protection-scsi_data_buffer-leak.patch
new file mode 100644 (file)
index 0000000..8663a81
--- /dev/null
+++ b/queue-2.6.27/scsi-fix-protection-scsi_data_buffer-leak.patch
@@ -0,0 +1,51 @@
+From b4c2554d40ceac130a8d062eaa8838ed22158c45 Mon Sep 17 00:00:00 2001
+From: Martin K. Petersen <martin.petersen@oracle.com>
+Date: Fri, 18 Sep 2009 17:33:01 -0400
+Subject: SCSI: Fix protection scsi_data_buffer leak
+
+From: Martin K. Petersen <martin.petersen@oracle.com>
+
+commit b4c2554d40ceac130a8d062eaa8838ed22158c45 upstream.
+
+We would leak a scsi_data_buffer if the free_list command was of the
+protected variety.
+
+Reported-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi.c |   11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -243,10 +243,7 @@ scsi_host_alloc_command(struct Scsi_Host
+  */
+ struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask)
+ {
+-      struct scsi_cmnd *cmd;
+-      unsigned char *buf;
+-
+-      cmd = scsi_host_alloc_command(shost, gfp_mask);
++      struct scsi_cmnd *cmd = scsi_host_alloc_command(shost, gfp_mask);
+ 
+       if (unlikely(!cmd)) {
+               unsigned long flags;
+@@ -260,9 +257,15 @@ struct scsi_cmnd *__scsi_get_command(str
+               spin_unlock_irqrestore(&shost->free_list_lock, flags);
+ 
+               if (cmd) {
++                      void *buf, *prot;
++
+                       buf = cmd->sense_buffer;
++                      prot = cmd->prot_sdb;
++
+                       memset(cmd, 0, sizeof(*cmd));
++
+                       cmd->sense_buffer = buf;
++                      cmd->prot_sdb = prot;
+               }
+       }
+ 

diff --git a/queue-2.6.27/series b/queue-2.6.27/series
index 8cab81798531a7341f0908ac7a095be289c65659..dbea213068f91b59ccdb26cc68545c0f5f9fa383 100644 (file)
--- a/queue-2.6.27/series
+++ b/queue-2.6.27/series
@@ -1 +1,3 @@
 usb-serial-fix-crash-when-sub-driver-updates-firmware.patch
+scsi-fix-protection-scsi_data_buffer-leak.patch
+usb-digi_acceleport-fix-broken-unthrottle.patch

diff --git a/queue-2.6.27/usb-digi_acceleport-fix-broken-unthrottle.patch b/queue-2.6.27/usb-digi_acceleport-fix-broken-unthrottle.patch
new file mode 100644 (file)
index 0000000..b234ba9
--- /dev/null
+++ b/queue-2.6.27/usb-digi_acceleport-fix-broken-unthrottle.patch
@@ -0,0 +1,43 @@
+From ba6b702f85a61561d329c4c11d3ed95604924f9a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 29 Sep 2009 12:39:23 +0200
+Subject: USB: digi_acceleport: Fix broken unthrottle.
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit ba6b702f85a61561d329c4c11d3ed95604924f9a upstream.
+
+This patch fixes a regression introduced in
+39892da44b21b5362eb848ca424d73a25ccc488f.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Acked-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/digi_acceleport.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/serial/digi_acceleport.c
++++ b/drivers/usb/serial/digi_acceleport.c
+@@ -892,16 +892,16 @@ static void digi_rx_unthrottle(struct tt
+ 
+       spin_lock_irqsave(&priv->dp_port_lock, flags);
+ 
+-      /* turn throttle off */
+-      priv->dp_throttled = 0;
+-      priv->dp_throttle_restart = 0;
+-
+       /* restart read chain */
+       if (priv->dp_throttle_restart) {
+               port->read_urb->dev = port->serial->dev;
+               ret = usb_submit_urb(port->read_urb, GFP_ATOMIC);
+       }
+ 
++      /* turn throttle off */
++      priv->dp_throttled = 0;
++      priv->dp_throttle_restart = 0;
++
+       spin_unlock_irqrestore(&priv->dp_port_lock, flags);
+ 
+       if (ret)