3.4-stable patches

added patches:
	usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch

diff --git a/queue-3.4/series b/queue-3.4/series
index 5636cedf57676acba5edd0faebab76581263b496..5f973eaba45dff545c943287436c36c34415c8e2 100644 (file)
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -28,3 +28,4 @@ usb-xhci-fix-trb-transfer-length-macro-used-for-event-trb.patch
 btrfs-fix-race-between-mmap-writes-and-compression.patch
 btrfs-limit-the-global-reserve-to-512mb.patch
 btrfs-don-t-drop-path-when-printing-out-tree-errors-in-scrub.patch
+usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch

diff --git a/queue-3.4/usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch b/queue-3.4/usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch
new file mode 100644 (file)
index 0000000..5e49fb7
--- /dev/null
+++ b/queue-3.4/usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch
@@ -0,0 +1,40 @@
+From 511f3c5326eabe1ece35202a404c24c0aeacc246 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 15 Mar 2013 14:02:14 -0400
+Subject: usb: gadget: udc-core: fix a regression during gadget driver unbinding
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 511f3c5326eabe1ece35202a404c24c0aeacc246 upstream.
+
+This patch (as1666) fixes a regression in the UDC core.  The core
+takes care of unbinding gadget drivers, and it does the unbinding
+before telling the UDC driver to turn off the controller hardware.
+When the call to the udc_stop callback is made, the gadget no longer
+has a driver.  The callback routine should not be invoked with a
+pointer to the old driver; doing so can cause problems (such as
+use-after-free accesses in net2280).
+
+This patch should be applied, with appropriate context changes, to all
+the stable kernels going back to 3.1.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/usb/gadget/udc-core.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc-core.c
++++ b/drivers/usb/gadget/udc-core.c
+@@ -265,7 +265,7 @@ static void usb_gadget_remove_driver(str
+               udc->driver->disconnect(udc->gadget);
+               usb_gadget_disconnect(udc->gadget);
+               udc->driver->unbind(udc->gadget);
+-              usb_gadget_udc_stop(udc->gadget, udc->driver);
++              usb_gadget_udc_stop(udc->gadget, NULL);
+       } else {
+               usb_gadget_stop(udc->gadget, udc->driver);
+       }