3.0-stable patches

added patches:
	staging-comedi-disallow-comedi_devconfig-on-non-board-minors.patch
	staging-vt6656-fix-urb-submitted-while-active-warning.patch

diff --git a/queue-3.0/series b/queue-3.0/series
index c679f7abb743bfe106890e5a3be3b6f77eff9c24..27edb64e84698eb24e3258bfdb5e8251525b51d4 100644 (file)
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -30,3 +30,5 @@ sunvdc-fix-off-by-one-in-generic_request.patch
 drm-usb-bind-driver-to-correct-device.patch
 nls-improve-utf8-utf16-string-conversion-routine.patch
 drm-i915-disable-shared-panel-fitter-for-pipe.patch
+staging-comedi-disallow-comedi_devconfig-on-non-board-minors.patch
+staging-vt6656-fix-urb-submitted-while-active-warning.patch

diff --git a/queue-3.0/staging-comedi-disallow-comedi_devconfig-on-non-board-minors.patch b/queue-3.0/staging-comedi-disallow-comedi_devconfig-on-non-board-minors.patch
new file mode 100644 (file)
index 0000000..85539b8
--- /dev/null
+++ b/queue-3.0/staging-comedi-disallow-comedi_devconfig-on-non-board-minors.patch
@@ -0,0 +1,51 @@
+From 754ab5c0e55dd118273ca2c217c4d95e9fbc8259 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Mon, 28 Jan 2013 16:14:31 +0000
+Subject: staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 754ab5c0e55dd118273ca2c217c4d95e9fbc8259 upstream.
+
+Comedi has two sorts of minor devices:
+(a) normal board minor devices in the range 0 to
+COMEDI_NUM_BOARD_MINORS-1 inclusive; and
+(b) special subdevice minor devices in the range COMEDI_NUM_BOARD_MINORS
+upwards that are used to open the same underlying comedi device as the
+normal board minor devices, but with non-default read and write
+subdevices for asynchronous commands.
+
+The special subdevice minor devices get created when a board supporting
+asynchronous commands is attached to a normal board minor device, and
+destroyed when the board is detached from the normal board minor device.
+One way to attach or detach a board is by using the COMEDI_DEVCONFIG
+ioctl.  This should only be used on normal board minors as the special
+subdevice minors are too ephemeral.  In particular, the change
+introduced in commit 7d3135af399e92cf4c9bbc5f86b6c140aab3b88c ("staging:
+comedi: prevent auto-unconfig of manually configured devices") breaks
+horribly for special subdevice minor devices.
+
+Since there's no legitimate use for the COMEDI_DEVCONFIG ioctl on a
+special subdevice minor device node, disallow it and return -ENOTTY.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/comedi_fops.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -136,6 +136,11 @@ static long comedi_unlocked_ioctl(struct
+       /* Device config is special, because it must work on
+        * an unconfigured device. */
+       if (cmd == COMEDI_DEVCONFIG) {
++              if (minor >= COMEDI_NUM_BOARD_MINORS) {
++                      /* Device config not appropriate on non-board minors. */
++                      rc = -ENOTTY;
++                      goto done;
++              }
+               rc = do_devconfig_ioctl(dev,
+                                       (struct comedi_devconfig __user *)arg);
+               if (rc == 0)

diff --git a/queue-3.0/staging-vt6656-fix-urb-submitted-while-active-warning.patch b/queue-3.0/staging-vt6656-fix-urb-submitted-while-active-warning.patch
new file mode 100644 (file)
index 0000000..eab42c9
--- /dev/null
+++ b/queue-3.0/staging-vt6656-fix-urb-submitted-while-active-warning.patch
@@ -0,0 +1,85 @@
+From ae5943de8c8c4438cbac5cda599ff0b88c224468 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Wed, 30 Jan 2013 20:07:29 +0000
+Subject: staging: vt6656: Fix URB submitted while active warning.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit ae5943de8c8c4438cbac5cda599ff0b88c224468 upstream.
+
+This error happens because PIPEnsControlOut and PIPEnsControlIn unlock the
+spin lock for delay, letting in another thread.
+
+The patch moves the current MP_SET_FLAG to before filling
+of sUsbCtlRequest for pControlURB and clears it in event of failing.
+
+Any thread calling either function while fMP_CONTROL_READS or fMP_CONTROL_WRITES
+flags set will return STATUS_FAILURE.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/usbpipe.c |   28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/staging/vt6656/usbpipe.c
++++ b/drivers/staging/vt6656/usbpipe.c
+@@ -168,6 +168,11 @@ int PIPEnsControlOut(
+     if (pDevice->Flags & fMP_CONTROL_WRITES)
+         return STATUS_FAILURE;
+ 
++      if (pDevice->Flags & fMP_CONTROL_READS)
++              return STATUS_FAILURE;
++
++      MP_SET_FLAG(pDevice, fMP_CONTROL_WRITES);
++
+       pDevice->sUsbCtlRequest.bRequestType = 0x40;
+       pDevice->sUsbCtlRequest.bRequest = byRequest;
+       pDevice->sUsbCtlRequest.wValue = cpu_to_le16p(&wValue);
+@@ -182,12 +187,13 @@ int PIPEnsControlOut(
+ 
+       ntStatus = usb_submit_urb(pDevice->pControlURB, GFP_ATOMIC);
+       if (ntStatus != 0) {
+-              DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"control send request submission failed: %d\n", ntStatus);
++              DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
++                      "control send request submission failed: %d\n",
++                              ntStatus);
++              MP_CLEAR_FLAG(pDevice, fMP_CONTROL_WRITES);
+               return STATUS_FAILURE;
+       }
+-      else {
+-          MP_SET_FLAG(pDevice, fMP_CONTROL_WRITES);
+-      }
++
+       spin_unlock_irq(&pDevice->lock);
+     for (ii = 0; ii <= USB_CTL_WAIT; ii ++) {
+ 
+@@ -227,6 +233,11 @@ int PIPEnsControlIn(
+     if (pDevice->Flags & fMP_CONTROL_READS)
+       return STATUS_FAILURE;
+ 
++      if (pDevice->Flags & fMP_CONTROL_WRITES)
++              return STATUS_FAILURE;
++
++      MP_SET_FLAG(pDevice, fMP_CONTROL_READS);
++
+       pDevice->sUsbCtlRequest.bRequestType = 0xC0;
+       pDevice->sUsbCtlRequest.bRequest = byRequest;
+       pDevice->sUsbCtlRequest.wValue = cpu_to_le16p(&wValue);
+@@ -240,10 +251,11 @@ int PIPEnsControlIn(
+ 
+       ntStatus = usb_submit_urb(pDevice->pControlURB, GFP_ATOMIC);
+       if (ntStatus != 0) {
+-              DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"control request submission failed: %d\n", ntStatus);
+-      }else {
+-              MP_SET_FLAG(pDevice, fMP_CONTROL_READS);
+-    }
++              DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
++                      "control request submission failed: %d\n", ntStatus);
++              MP_CLEAR_FLAG(pDevice, fMP_CONTROL_READS);
++              return STATUS_FAILURE;
++      }
+ 
+       spin_unlock_irq(&pDevice->lock);
+     for (ii = 0; ii <= USB_CTL_WAIT; ii ++) {