--- /dev/null
+From 5b917a1420d3d1a9c8da49fb0090692dc9aaee86 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segooon@gmail.com>
+Date: Sun, 17 Oct 2010 18:41:24 +0400
+Subject: pcmcia: synclink_cs: fix information leak to userland
+
+From: Vasiliy Kulikov <segooon@gmail.com>
+
+commit 5b917a1420d3d1a9c8da49fb0090692dc9aaee86 upstream.
+
+Structure new_line is copied to userland with some padding fields unitialized.
+It leads to leaking of stack memory.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/pcmcia/synclink_cs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/char/pcmcia/synclink_cs.c
++++ b/drivers/char/pcmcia/synclink_cs.c
+@@ -4164,6 +4164,8 @@ static int hdlcdev_ioctl(struct net_devi
+ if (cmd != SIOCWANDEV)
+ return hdlc_ioctl(dev, ifr, cmd);
+
++ memset(&new_line, 0, size);
++
+ switch(ifr->ifr_settings.type) {
+ case IF_GET_IFACE: /* return current sync_serial_settings */
+
--- /dev/null
+From 9f5f9ffe50e90ed73040d2100db8bfc341cee352 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@samba.org>
+Date: Thu, 9 Sep 2010 19:02:40 +0000
+Subject: powerpc/perf: Fix sampling enable for PPC970
+
+From: Paul Mackerras <paulus@samba.org>
+
+commit 9f5f9ffe50e90ed73040d2100db8bfc341cee352 upstream.
+
+The logic to distinguish marked instruction events from ordinary events
+on PPC970 and derivatives was flawed. The result is that instruction
+sampling didn't get enabled in the PMU for some marked instruction
+events, so they would never trigger. This fixes it by adding the
+appropriate break statements in the switch statement.
+
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/ppc970-pmu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/powerpc/kernel/ppc970-pmu.c
++++ b/arch/powerpc/kernel/ppc970-pmu.c
+@@ -173,9 +173,11 @@ static int p970_marked_instr_event(u64 e
+ switch (unit) {
+ case PM_VPU:
+ mask = 0x4c; /* byte 0 bits 2,3,6 */
++ break;
+ case PM_LSU0:
+ /* byte 2 bits 0,2,3,4,6; all of byte 1 */
+ mask = 0x085dff00;
++ break;
+ case PM_LSU1L:
+ mask = 0x50 << 24; /* byte 3 bits 4,6 */
+ break;
--- /dev/null
+From 7740191cd909b75d75685fb08a5d1f54b8a9d28b Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Date: Mon, 13 Sep 2010 17:47:00 -0400
+Subject: sched: Fix string comparison in /proc/sched_features
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+commit 7740191cd909b75d75685fb08a5d1f54b8a9d28b upstream.
+
+Fix incorrect handling of the following case:
+
+ INTERACTIVE
+ INTERACTIVE_SOMETHING_ELSE
+
+The comparison only checks up to each element's length.
+
+Changelog since v1:
+ - Embellish using some Rostedtisms.
+ [ mingo: ^^ == smaller and cleaner ]
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Tony Lindgren <tony@atomide.com>
+LKML-Reference: <20100913214700.GB16118@Krystal>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -741,7 +741,7 @@ sched_feat_write(struct file *filp, cons
+ size_t cnt, loff_t *ppos)
+ {
+ char buf[64];
+- char *cmp = buf;
++ char *cmp;
+ int neg = 0;
+ int i;
+
+@@ -752,6 +752,7 @@ sched_feat_write(struct file *filp, cons
+ return -EFAULT;
+
+ buf[cnt] = 0;
++ cmp = strstrip(buf);
+
+ if (strncmp(buf, "NO_", 3) == 0) {
+ neg = 1;
+@@ -759,9 +760,7 @@ sched_feat_write(struct file *filp, cons
+ }
+
+ for (i = 0; sched_feat_names[i]; i++) {
+- int len = strlen(sched_feat_names[i]);
+-
+- if (strncmp(cmp, sched_feat_names[i], len) == 0) {
++ if (strcmp(cmp, sched_feat_names[i]) == 0) {
+ if (neg)
+ sysctl_sched_features &= ~(1UL << i);
+ else
--- /dev/null
+From 0c9a32f0192e656daa2ff3c9149f6d71b4a1b873 Mon Sep 17 00:00:00 2001
+From: Max Vozeler <mvz@vozeler.com>
+Date: Tue, 21 Sep 2010 17:31:40 +0200
+Subject: staging: usbip: Notify usb core of port status changes
+
+From: Max Vozeler <mvz@vozeler.com>
+
+commit 0c9a32f0192e656daa2ff3c9149f6d71b4a1b873 upstream.
+
+This patch changes vhci to behave like dummy and
+other hcds when disconnecting a device.
+
+Previously detaching a device from the root hub
+did not notify the usb core of the disconnect and
+left the device visible.
+
+Signed-off-by: Max Vozeler <mvz@vozeler.com>
+Reported-by: Marco Lancione <marco@optikam.com>
+Tested-by: Luc Jalbert <ljalbert@optikam.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/usbip/vhci_hcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/usbip/vhci_hcd.c
++++ b/drivers/staging/usbip/vhci_hcd.c
+@@ -163,6 +163,8 @@ void rh_port_disconnect(int rhport)
+ * spin_unlock(&vdev->ud.lock); */
+
+ spin_unlock_irqrestore(&the_controller->lock, flags);
++
++ usb_hcd_poll_rh_status(vhci_to_hcd(the_controller));
+ }
+
+
--- /dev/null
+From 584c5b7cf06194464240280483ee0376cdddbbae Mon Sep 17 00:00:00 2001
+From: Max Vozeler <mvz@vozeler.com>
+Date: Tue, 21 Sep 2010 17:43:30 +0200
+Subject: staging: usbip: Process event flags without delay
+
+From: Max Vozeler <mvz@vozeler.com>
+
+commit 584c5b7cf06194464240280483ee0376cdddbbae upstream.
+
+The way the event handler works can cause it to delay
+events until eventual wakeup for another event.
+
+For example, on device detach (vhci):
+
+ - Write to sysfs detach file
+ -> usbip_event_add(VDEV_EVENT_DOWN)
+ -> wakeup()
+
+#define VDEV_EVENT_DOWN (USBIP_EH_SHUTDOWN | USBIP_EH_RESET).
+
+ - Event thread wakes up and passes the event to
+ event_handler() to process.
+
+ - It processes and clears the USBIP_EH_SHUTDOWN
+ flag then returns.
+
+ - The outer event loop (event_handler_loop()) calls
+ wait_event_interruptible().
+
+The processing of the second flag which is part of
+VDEV_EVENT_DOWN (USBIP_EH_RESET) did not happen yet.
+It is delayed until the next event.
+
+This means the ->reset callback may not happen for
+a long time (if ever), leaving the usbip port in a
+weird state which prevents its reuse.
+
+This patch changes the handler to process all flags
+before waiting for another wakeup.
+
+I have verified this change to fix a problem which
+prevented reattach of a usbip device. It also helps
+for socket errors which missed the RESET as well.
+
+The delayed event processing also affects the stub
+side of usbip and the error handling there.
+
+Signed-off-by: Max Vozeler <mvz@vozeler.com>
+Reported-by: Marco Lancione <marco@optikam.com>
+Tested-by: Luc Jalbert <ljalbert@optikam.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/usbip/usbip_event.c | 16 +++-------------
+ 1 file changed, 3 insertions(+), 13 deletions(-)
+
+--- a/drivers/staging/usbip/usbip_event.c
++++ b/drivers/staging/usbip/usbip_event.c
+@@ -38,21 +38,13 @@ static int event_handler(struct usbip_de
+ ud->eh_ops.shutdown(ud);
+
+ ud->event &= ~USBIP_EH_SHUTDOWN;
+-
+- break;
+ }
+
+- /* Stop the error handler. */
+- if (ud->event & USBIP_EH_BYE)
+- return -1;
+-
+ /* Reset the device. */
+ if (ud->event & USBIP_EH_RESET) {
+ ud->eh_ops.reset(ud);
+
+ ud->event &= ~USBIP_EH_RESET;
+-
+- break;
+ }
+
+ /* Mark the device as unusable. */
+@@ -60,13 +52,11 @@ static int event_handler(struct usbip_de
+ ud->eh_ops.unusable(ud);
+
+ ud->event &= ~USBIP_EH_UNUSABLE;
+-
+- break;
+ }
+
+- /* NOTREACHED */
+- printk(KERN_ERR "%s: unknown event\n", __func__);
+- return -1;
++ /* Stop the error handler. */
++ if (ud->event & USBIP_EH_BYE)
++ return -1;
+ }
+
+ return 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
