]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 18 Jun 2012 16:57:04 +0000 (09:57 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 18 Jun 2012 16:57:04 +0000 (09:57 -0700)
added patches:
rpc_pipefs-allow-rpc_purge_list-to-take-a-null-waitq-pointer.patch
scsi-mpt2sas-fix-unsafe-using-smp_processor_id-in-preemptible.patch
swap-fix-shmem-swapping-when-more-than-8-areas.patch
tracing-have-tracing_off-actually-turn-tracing-off.patch
usb-option-add-more-yuga-device-ids.patch
usb-option-add-vodafone-huawei-k5005-support.patch
usb-option-fix-memory-leak.patch
usb-option-fix-port-data-abuse.patch
usb-option-updated-huawei-k4605-has-better-id.patch

queue-3.4/rpc_pipefs-allow-rpc_purge_list-to-take-a-null-waitq-pointer.patch [new file with mode: 0644]
queue-3.4/scsi-mpt2sas-fix-unsafe-using-smp_processor_id-in-preemptible.patch [new file with mode: 0644]
queue-3.4/series
queue-3.4/swap-fix-shmem-swapping-when-more-than-8-areas.patch [new file with mode: 0644]
queue-3.4/tracing-have-tracing_off-actually-turn-tracing-off.patch [new file with mode: 0644]
queue-3.4/usb-option-add-more-yuga-device-ids.patch [new file with mode: 0644]
queue-3.4/usb-option-add-vodafone-huawei-k5005-support.patch [new file with mode: 0644]
queue-3.4/usb-option-fix-memory-leak.patch [new file with mode: 0644]
queue-3.4/usb-option-fix-port-data-abuse.patch [new file with mode: 0644]
queue-3.4/usb-option-updated-huawei-k4605-has-better-id.patch [new file with mode: 0644]

diff --git a/queue-3.4/rpc_pipefs-allow-rpc_purge_list-to-take-a-null-waitq-pointer.patch b/queue-3.4/rpc_pipefs-allow-rpc_purge_list-to-take-a-null-waitq-pointer.patch
new file mode 100644 (file)
index 0000000..8a4c9a8
--- /dev/null
@@ -0,0 +1,51 @@
+From 92123e068efa310b09e9943ac1cfd10ff6b6d2e4 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Mon, 11 Jun 2012 10:03:42 -0400
+Subject: rpc_pipefs: allow rpc_purge_list to take a NULL waitq pointer
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 92123e068efa310b09e9943ac1cfd10ff6b6d2e4 upstream.
+
+In the event that we don't have a dentry for a rpc_pipefs pipe, we still
+need to allow the queue_timeout job to clean out the queue. There's just
+no waitq to wake up in that event.
+
+Reported-by: Hans de Bruin <jmdebruin@xmsnet.nl>
+Reported-by: Joerg Platte <jplatte@naasa.net>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/rpc_pipe.c |   12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -71,7 +71,9 @@ static void rpc_purge_list(wait_queue_he
+               msg->errno = err;
+               destroy_msg(msg);
+       } while (!list_empty(head));
+-      wake_up(waitq);
++
++      if (waitq)
++              wake_up(waitq);
+ }
+ static void
+@@ -91,11 +93,9 @@ rpc_timeout_upcall_queue(struct work_str
+       }
+       dentry = dget(pipe->dentry);
+       spin_unlock(&pipe->lock);
+-      if (dentry) {
+-              rpc_purge_list(&RPC_I(dentry->d_inode)->waitq,
+-                             &free_list, destroy_msg, -ETIMEDOUT);
+-              dput(dentry);
+-      }
++      rpc_purge_list(dentry ? &RPC_I(dentry->d_inode)->waitq : NULL,
++                      &free_list, destroy_msg, -ETIMEDOUT);
++      dput(dentry);
+ }
+ ssize_t rpc_pipe_generic_upcall(struct file *filp, struct rpc_pipe_msg *msg,
diff --git a/queue-3.4/scsi-mpt2sas-fix-unsafe-using-smp_processor_id-in-preemptible.patch b/queue-3.4/scsi-mpt2sas-fix-unsafe-using-smp_processor_id-in-preemptible.patch
new file mode 100644 (file)
index 0000000..9e9e792
--- /dev/null
@@ -0,0 +1,33 @@
+From a2c658505bf5c75516ee0a79287223e86a2474af Mon Sep 17 00:00:00 2001
+From: "nagalakshmi.nandigama@lsi.com" <nagalakshmi.nandigama@lsi.com>
+Date: Tue, 17 Apr 2012 11:25:04 +0530
+Subject: SCSI: mpt2sas: Fix unsafe using smp_processor_id() in preemptible
+
+From: "nagalakshmi.nandigama@lsi.com" <nagalakshmi.nandigama@lsi.com>
+
+commit a2c658505bf5c75516ee0a79287223e86a2474af upstream.
+
+When CONFIG_DEBUG_PREEMPT is enabled, bug is observed in the smp_processor_id().
+This is because smp_processor_id() is not called in preempt safe condition.
+
+To fix this issue, use raw_smp_processor_id instead of smp_processor_id.
+
+Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -1785,7 +1785,7 @@ static inline void _base_writeq(__u64 b,
+ static inline u8
+ _base_get_msix_index(struct MPT2SAS_ADAPTER *ioc)
+ {
+-      return ioc->cpu_msix_table[smp_processor_id()];
++      return ioc->cpu_msix_table[raw_smp_processor_id()];
+ }
+ /**
index a16e0a4a8f090428888254a50e3f288d62b3a7dc..0f160c3b096df7e0a9ae7d0fea7c22d7e22af178 100644 (file)
@@ -13,3 +13,12 @@ xen-setup-filter-aperfmperf-cpuid-feature-out.patch
 nfsv4.1-fix-a-request-leak-on-the-back-channel.patch
 nfsv4-fix-unnecessary-delegation-returns-in-nfs4_do_open.patch
 nfsd4-bug_on-is_spin_locked-no-good-on-up-kernels.patch
+tracing-have-tracing_off-actually-turn-tracing-off.patch
+rpc_pipefs-allow-rpc_purge_list-to-take-a-null-waitq-pointer.patch
+scsi-mpt2sas-fix-unsafe-using-smp_processor_id-in-preemptible.patch
+swap-fix-shmem-swapping-when-more-than-8-areas.patch
+usb-option-add-vodafone-huawei-k5005-support.patch
+usb-option-updated-huawei-k4605-has-better-id.patch
+usb-option-add-more-yuga-device-ids.patch
+usb-option-fix-memory-leak.patch
+usb-option-fix-port-data-abuse.patch
diff --git a/queue-3.4/swap-fix-shmem-swapping-when-more-than-8-areas.patch b/queue-3.4/swap-fix-shmem-swapping-when-more-than-8-areas.patch
new file mode 100644 (file)
index 0000000..4ff7c82
--- /dev/null
@@ -0,0 +1,98 @@
+From 9b15b817f3d62409290fd56fe3cbb076a931bb0a Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Fri, 15 Jun 2012 17:55:50 -0700
+Subject: swap: fix shmem swapping when more than 8 areas
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 9b15b817f3d62409290fd56fe3cbb076a931bb0a upstream.
+
+Minchan Kim reports that when a system has many swap areas, and tmpfs
+swaps out to the ninth or more, shmem_getpage_gfp()'s attempts to read
+back the page cannot locate it, and the read fails with -ENOMEM.
+
+Whoops.  Yes, I blindly followed read_swap_header()'s pte_to_swp_entry(
+swp_entry_to_pte()) technique for determining maximum usable swap
+offset, without stopping to realize that that actually depends upon the
+pte swap encoding shifting swap offset to the higher bits and truncating
+it there.  Whereas our radix_tree swap encoding leaves offset in the
+lower bits: it's swap "type" (that is, index of swap area) that was
+truncated.
+
+Fix it by reducing the SWP_TYPE_SHIFT() in swapops.h, and removing the
+broken radix_to_swp_entry(swp_to_radix_entry()) from read_swap_header().
+
+This does not reduce the usable size of a swap area any further, it
+leaves it as claimed when making the original commit: no change from 3.0
+on x86_64, nor on i386 without PAE; but 3.0's 512GB is reduced to 128GB
+per swapfile on i386 with PAE.  It's not a change I would have risked
+five years ago, but with x86_64 supported for ten years, I believe it's
+appropriate now.
+
+Hmm, and what if some architecture implements its swap pte with offset
+encoded below type? That would equally break the maximum usable swap
+offset check.  Happily, they all follow the same tradition of encoding
+offset above type, but I'll prepare a check on that for next.
+
+Reported-and-Reviewed-and-Tested-by: Minchan Kim <minchan@kernel.org>
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/swapops.h |    8 +++++---
+ mm/swapfile.c           |   12 ++++--------
+ 2 files changed, 9 insertions(+), 11 deletions(-)
+
+--- a/include/linux/swapops.h
++++ b/include/linux/swapops.h
+@@ -9,13 +9,15 @@
+  * get good packing density in that tree, so the index should be dense in
+  * the low-order bits.
+  *
+- * We arrange the `type' and `offset' fields so that `type' is at the five
++ * We arrange the `type' and `offset' fields so that `type' is at the seven
+  * high-order bits of the swp_entry_t and `offset' is right-aligned in the
+- * remaining bits.
++ * remaining bits.  Although `type' itself needs only five bits, we allow for
++ * shmem/tmpfs to shift it all up a further two bits: see swp_to_radix_entry().
+  *
+  * swp_entry_t's are *never* stored anywhere in their arch-dependent format.
+  */
+-#define SWP_TYPE_SHIFT(e)     (sizeof(e.val) * 8 - MAX_SWAPFILES_SHIFT)
++#define SWP_TYPE_SHIFT(e)     ((sizeof(e.val) * 8) - \
++                      (MAX_SWAPFILES_SHIFT + RADIX_TREE_EXCEPTIONAL_SHIFT))
+ #define SWP_OFFSET_MASK(e)    ((1UL << SWP_TYPE_SHIFT(e)) - 1)
+ /*
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -1924,24 +1924,20 @@ static unsigned long read_swap_header(st
+       /*
+        * Find out how many pages are allowed for a single swap
+-       * device. There are three limiting factors: 1) the number
++       * device. There are two limiting factors: 1) the number
+        * of bits for the swap offset in the swp_entry_t type, and
+        * 2) the number of bits in the swap pte as defined by the
+-       * the different architectures, and 3) the number of free bits
+-       * in an exceptional radix_tree entry. In order to find the
++       * different architectures. In order to find the
+        * largest possible bit mask, a swap entry with swap type 0
+        * and swap offset ~0UL is created, encoded to a swap pte,
+        * decoded to a swp_entry_t again, and finally the swap
+        * offset is extracted. This will mask all the bits from
+        * the initial ~0UL mask that can't be encoded in either
+        * the swp_entry_t or the architecture definition of a
+-       * swap pte.  Then the same is done for a radix_tree entry.
++       * swap pte.
+        */
+       maxpages = swp_offset(pte_to_swp_entry(
+-                      swp_entry_to_pte(swp_entry(0, ~0UL))));
+-      maxpages = swp_offset(radix_to_swp_entry(
+-                      swp_to_radix_entry(swp_entry(0, maxpages)))) + 1;
+-
++                      swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1;
+       if (maxpages > swap_header->info.last_page) {
+               maxpages = swap_header->info.last_page + 1;
+               /* p->max is an unsigned int: don't overflow it */
diff --git a/queue-3.4/tracing-have-tracing_off-actually-turn-tracing-off.patch b/queue-3.4/tracing-have-tracing_off-actually-turn-tracing-off.patch
new file mode 100644 (file)
index 0000000..6d24957
--- /dev/null
@@ -0,0 +1,37 @@
+From f2bf1f6f5f89d031245067512449fc889b2f4bb2 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt@redhat.com>
+Date: Wed, 6 Jun 2012 19:50:40 -0400
+Subject: tracing: Have tracing_off() actually turn tracing off
+
+From: Steven Rostedt <srostedt@redhat.com>
+
+commit f2bf1f6f5f89d031245067512449fc889b2f4bb2 upstream.
+
+A recent update to have tracing_on/off() only affect the ftrace ring
+buffers instead of all ring buffers had a cut and paste error.
+The tracing_off() did the exact same thing as tracing_on() and
+would not actually turn off tracing. Unfortunately, tracing_off()
+is more important to be working than tracing_on() as this is a key
+development tool, as it lets the developer turn off tracing as soon
+as a problem is discovered. It is also used by panic and oops code.
+
+This bug also breaks the 'echo func:traceoff > set_ftrace_filter'
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -383,7 +383,7 @@ EXPORT_SYMBOL_GPL(tracing_on);
+ void tracing_off(void)
+ {
+       if (global_trace.buffer)
+-              ring_buffer_record_on(global_trace.buffer);
++              ring_buffer_record_off(global_trace.buffer);
+       /*
+        * This flag is only looked at when buffers haven't been
+        * allocated yet. We don't really care about the race
diff --git a/queue-3.4/usb-option-add-more-yuga-device-ids.patch b/queue-3.4/usb-option-add-more-yuga-device-ids.patch
new file mode 100644 (file)
index 0000000..03ecb40
--- /dev/null
@@ -0,0 +1,90 @@
+From 0ef0be15fd2564767f114c249fc4af704d8e16f4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=E8=AF=B4=E4=B8=8D=E5=BE=97?= <gavin.kx@qq.com>
+Date: Mon, 28 May 2012 21:31:29 +0800
+Subject: USB: option: add more YUGA device ids
+
+From: =?UTF-8?q?=E8=AF=B4=E4=B8=8D=E5=BE=97?= <gavin.kx@qq.com>
+
+commit 0ef0be15fd2564767f114c249fc4af704d8e16f4 upstream.
+
+Signed-off-by: gavin zhu <gavin.zhu@qq.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |   42 ++++++++++++++++++++++++++----------------
+ 1 file changed, 26 insertions(+), 16 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -426,7 +426,7 @@ static void option_instat_callback(struc
+ #define SAMSUNG_VENDOR_ID                       0x04e8
+ #define SAMSUNG_PRODUCT_GT_B3730                0x6889
+-/* YUGA products  www.yuga-info.com*/
++/* YUGA products  www.yuga-info.com gavin.kx@qq.com */
+ #define YUGA_VENDOR_ID                                0x257A
+ #define YUGA_PRODUCT_CEM600                   0x1601
+ #define YUGA_PRODUCT_CEM610                   0x1602
+@@ -443,6 +443,8 @@ static void option_instat_callback(struc
+ #define YUGA_PRODUCT_CEU516                   0x160C
+ #define YUGA_PRODUCT_CEU528                   0x160D
+ #define YUGA_PRODUCT_CEU526                   0x160F
++#define YUGA_PRODUCT_CEU881                   0x161F
++#define YUGA_PRODUCT_CEU882                   0x162F
+ #define YUGA_PRODUCT_CWM600                   0x2601
+ #define YUGA_PRODUCT_CWM610                   0x2602
+@@ -458,23 +460,26 @@ static void option_instat_callback(struc
+ #define YUGA_PRODUCT_CWU518                   0x260B
+ #define YUGA_PRODUCT_CWU516                   0x260C
+ #define YUGA_PRODUCT_CWU528                   0x260D
++#define YUGA_PRODUCT_CWU581                   0x260E
+ #define YUGA_PRODUCT_CWU526                   0x260F
++#define YUGA_PRODUCT_CWU582                   0x261F
++#define YUGA_PRODUCT_CWU583                   0x262F
+-#define YUGA_PRODUCT_CLM600                   0x2601
+-#define YUGA_PRODUCT_CLM610                   0x2602
+-#define YUGA_PRODUCT_CLM500                   0x2603
+-#define YUGA_PRODUCT_CLM510                   0x2604
+-#define YUGA_PRODUCT_CLM800                   0x2605
+-#define YUGA_PRODUCT_CLM900                   0x2606
+-
+-#define YUGA_PRODUCT_CLU718                   0x2607
+-#define YUGA_PRODUCT_CLU716                   0x2608
+-#define YUGA_PRODUCT_CLU728                   0x2609
+-#define YUGA_PRODUCT_CLU726                   0x260A
+-#define YUGA_PRODUCT_CLU518                   0x260B
+-#define YUGA_PRODUCT_CLU516                   0x260C
+-#define YUGA_PRODUCT_CLU528                   0x260D
+-#define YUGA_PRODUCT_CLU526                   0x260F
++#define YUGA_PRODUCT_CLM600                   0x3601
++#define YUGA_PRODUCT_CLM610                   0x3602
++#define YUGA_PRODUCT_CLM500                   0x3603
++#define YUGA_PRODUCT_CLM510                   0x3604
++#define YUGA_PRODUCT_CLM800                   0x3605
++#define YUGA_PRODUCT_CLM900                   0x3606
++
++#define YUGA_PRODUCT_CLU718                   0x3607
++#define YUGA_PRODUCT_CLU716                   0x3608
++#define YUGA_PRODUCT_CLU728                   0x3609
++#define YUGA_PRODUCT_CLU726                   0x360A
++#define YUGA_PRODUCT_CLU518                   0x360B
++#define YUGA_PRODUCT_CLU516                   0x360C
++#define YUGA_PRODUCT_CLU528                   0x360D
++#define YUGA_PRODUCT_CLU526                   0x360F
+ /* Viettel products */
+ #define VIETTEL_VENDOR_ID                     0x2262
+@@ -1215,6 +1220,11 @@ static const struct usb_device_id option
+       { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU516) },
+       { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) },
+       { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
++      { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU881) },
++      { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU882) },
++      { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU581) },
++      { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU582) },
++      { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU583) },
+       { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
+       { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
+       { USB_DEVICE(LG_VENDOR_ID, LG_PRODUCT_L02C) }, /* docomo L-02C modem */
diff --git a/queue-3.4/usb-option-add-vodafone-huawei-k5005-support.patch b/queue-3.4/usb-option-add-vodafone-huawei-k5005-support.patch
new file mode 100644 (file)
index 0000000..37eb7ec
--- /dev/null
@@ -0,0 +1,40 @@
+From 4cbbb039a9719fb3bba73d255c6a95bc6dc6428b Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Sat, 19 May 2012 19:20:50 +0200
+Subject: USB: option: Add Vodafone/Huawei K5005 support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit 4cbbb039a9719fb3bba73d255c6a95bc6dc6428b upstream.
+
+Tested-by: Thomas Schäfer <tschaefer@t-online.de>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -150,6 +150,7 @@ static void option_instat_callback(struc
+ #define HUAWEI_PRODUCT_E14AC                  0x14AC
+ #define HUAWEI_PRODUCT_K3806                  0x14AE
+ #define HUAWEI_PRODUCT_K4605                  0x14C6
++#define HUAWEI_PRODUCT_K5005                  0x14C8
+ #define HUAWEI_PRODUCT_K3770                  0x14C9
+ #define HUAWEI_PRODUCT_K3771                  0x14CA
+ #define HUAWEI_PRODUCT_K4510                  0x14CB
+@@ -666,6 +667,9 @@ static const struct usb_device_id option
+       { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) },
+       { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff),
+               .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist },
++      { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x31) },
++      { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x32) },
++      { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x33) },
+       { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) },
+       { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) },
+       { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
diff --git a/queue-3.4/usb-option-fix-memory-leak.patch b/queue-3.4/usb-option-fix-memory-leak.patch
new file mode 100644 (file)
index 0000000..c974119
--- /dev/null
@@ -0,0 +1,55 @@
+From b9c3aab315b51f81649a0d737c4c73783fbd8de0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 29 May 2012 18:22:48 +0200
+Subject: USB: option: fix memory leak
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit b9c3aab315b51f81649a0d737c4c73783fbd8de0 upstream.
+
+Fix memory leak introduced by commit 383cedc3bb435de7a2 ("USB: serial:
+full autosuspend support for the option driver") which allocates
+usb-serial data but never frees it.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |   12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -47,6 +47,7 @@
+ /* Function prototypes */
+ static int  option_probe(struct usb_serial *serial,
+                       const struct usb_device_id *id);
++static void option_release(struct usb_serial *serial);
+ static int option_send_setup(struct usb_serial_port *port);
+ static void option_instat_callback(struct urb *urb);
+@@ -1273,7 +1274,7 @@ static struct usb_serial_driver option_1
+       .ioctl             = usb_wwan_ioctl,
+       .attach            = usb_wwan_startup,
+       .disconnect        = usb_wwan_disconnect,
+-      .release           = usb_wwan_release,
++      .release           = option_release,
+       .read_int_callback = option_instat_callback,
+ #ifdef CONFIG_PM
+       .suspend           = usb_wwan_suspend,
+@@ -1384,6 +1385,15 @@ static int option_probe(struct usb_seria
+       return 0;
+ }
++static void option_release(struct usb_serial *serial)
++{
++      struct usb_wwan_intf_private *priv = usb_get_serial_data(serial);
++
++      usb_wwan_release(serial);
++
++      kfree(priv);
++}
++
+ static void option_instat_callback(struct urb *urb)
+ {
+       int err;
diff --git a/queue-3.4/usb-option-fix-port-data-abuse.patch b/queue-3.4/usb-option-fix-port-data-abuse.patch
new file mode 100644 (file)
index 0000000..bc12d30
--- /dev/null
@@ -0,0 +1,77 @@
+From 4273f9878b0a8271df055e3c8f2e7f08c6a4a2f4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 29 May 2012 17:57:52 +0200
+Subject: USB: option: fix port-data abuse
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 4273f9878b0a8271df055e3c8f2e7f08c6a4a2f4 upstream.
+
+Commit 8b4c6a3ab596961b78465 ("USB: option: Use generic USB wwan code")
+moved option port-data allocation to usb_wwan_startup but still cast the
+port data to the old struct...
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |   34 +++-------------------------------
+ 1 file changed, 3 insertions(+), 31 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1288,35 +1288,6 @@ static struct usb_serial_driver * const
+ static bool debug;
+-/* per port private data */
+-
+-#define N_IN_URB 4
+-#define N_OUT_URB 4
+-#define IN_BUFLEN 4096
+-#define OUT_BUFLEN 4096
+-
+-struct option_port_private {
+-      /* Input endpoints and buffer for this port */
+-      struct urb *in_urbs[N_IN_URB];
+-      u8 *in_buffer[N_IN_URB];
+-      /* Output endpoints and buffer for this port */
+-      struct urb *out_urbs[N_OUT_URB];
+-      u8 *out_buffer[N_OUT_URB];
+-      unsigned long out_busy;         /* Bit vector of URBs in use */
+-      int opened;
+-      struct usb_anchor delayed;
+-
+-      /* Settings for the port */
+-      int rts_state;  /* Handshaking pins (outputs) */
+-      int dtr_state;
+-      int cts_state;  /* Handshaking pins (inputs) */
+-      int dsr_state;
+-      int dcd_state;
+-      int ri_state;
+-
+-      unsigned long tx_start_time[N_OUT_URB];
+-};
+-
+ module_usb_serial_driver(option_driver, serial_drivers);
+ static bool is_blacklisted(const u8 ifnum, enum option_blacklist_reason reason,
+@@ -1399,7 +1370,8 @@ static void option_instat_callback(struc
+       int err;
+       int status = urb->status;
+       struct usb_serial_port *port =  urb->context;
+-      struct option_port_private *portdata = usb_get_serial_port_data(port);
++      struct usb_wwan_port_private *portdata =
++                                      usb_get_serial_port_data(port);
+       dbg("%s", __func__);
+       dbg("%s: urb %p port %p has data %p", __func__, urb, port, portdata);
+@@ -1460,7 +1432,7 @@ static int option_send_setup(struct usb_
+       struct usb_serial *serial = port->serial;
+       struct usb_wwan_intf_private *intfdata =
+               (struct usb_wwan_intf_private *) serial->private;
+-      struct option_port_private *portdata;
++      struct usb_wwan_port_private *portdata;
+       int ifNum = serial->interface->cur_altsetting->desc.bInterfaceNumber;
+       int val = 0;
+       dbg("%s", __func__);
diff --git a/queue-3.4/usb-option-updated-huawei-k4605-has-better-id.patch b/queue-3.4/usb-option-updated-huawei-k4605-has-better-id.patch
new file mode 100644 (file)
index 0000000..8d747f6
--- /dev/null
@@ -0,0 +1,32 @@
+From 42ca7da1c2363dbef4ba1b6917c4c02274b6a5e2 Mon Sep 17 00:00:00 2001
+From: Andrew Bird <ajb@spheresystems.co.uk>
+Date: Mon, 28 May 2012 12:43:06 +0100
+Subject: USB: option: Updated Huawei K4605 has better id
+
+From: Andrew Bird <ajb@spheresystems.co.uk>
+
+commit 42ca7da1c2363dbef4ba1b6917c4c02274b6a5e2 upstream.
+
+Later firmwares for this device now have proper subclass and
+protocol info so we can identify it nicely without needing to use
+the blacklist. I'm not removing the old 0xff matching as there
+may be devices in the field that still need that.
+
+Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -667,6 +667,8 @@ static const struct usb_device_id option
+       { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) },
+       { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff),
+               .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist },
++      { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0x01, 0x31) },
++      { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0x01, 0x32) },
+       { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x31) },
+       { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x32) },
+       { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x33) },