use-clamp_t-in-uname26-fix.patch
x86-amd-mce-avoid-null-pointer-reference-on-cpu-northbridge-lookup.patch
x86-exclude-e820_reserved-regions-and-memory-holes-above-4-gb-from-direct-mapping.patch
+xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch
+usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch
+usb-acm-fix-the-computation-of-the-number-of-data-bits.patch
+usb-io_ti-fix-port-data-memory-leak.patch
--- /dev/null
+From 301a29da6e891e7eb95c843af0ecdbe86d01f723 Mon Sep 17 00:00:00 2001
+From: Nicolas Boullis <nboullis@debian.org>
+Date: Tue, 16 Oct 2012 00:06:23 +0200
+Subject: usb: acm: fix the computation of the number of data bits
+
+From: Nicolas Boullis <nboullis@debian.org>
+
+commit 301a29da6e891e7eb95c843af0ecdbe86d01f723 upstream.
+
+The current code assumes that CSIZE is 0000060, which appears to be
+wrong on some arches (such as powerpc).
+
+Signed-off-by: Nicolas Boullis <nboullis@debian.org>
+Acked-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -818,10 +818,6 @@ static const __u32 acm_tty_speed[] = {
+ 2500000, 3000000, 3500000, 4000000
+ };
+
+-static const __u8 acm_tty_size[] = {
+- 5, 6, 7, 8
+-};
+-
+ static void acm_tty_set_termios(struct tty_struct *tty,
+ struct ktermios *termios_old)
+ {
+@@ -835,7 +831,21 @@ static void acm_tty_set_termios(struct t
+ newline.bParityType = termios->c_cflag & PARENB ?
+ (termios->c_cflag & PARODD ? 1 : 2) +
+ (termios->c_cflag & CMSPAR ? 2 : 0) : 0;
+- newline.bDataBits = acm_tty_size[(termios->c_cflag & CSIZE) >> 4];
++ switch (termios->c_cflag & CSIZE) {
++ case CS5:
++ newline.bDataBits = 5;
++ break;
++ case CS6:
++ newline.bDataBits = 6;
++ break;
++ case CS7:
++ newline.bDataBits = 7;
++ break;
++ case CS8:
++ default:
++ newline.bDataBits = 8;
++ break;
++ }
+ /* FIXME: Needs to clear unsupported bits in the termios */
+ acm->clocal = ((termios->c_cflag & CLOCAL) != 0);
+
--- /dev/null
+From c5211187f7ff8e8dbff4ebf7c011ac4c0ffe319c Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@canonical.com>
+Date: Tue, 16 Oct 2012 21:21:21 +0800
+Subject: USB: cdc-acm: fix pipe type of write endpoint
+
+From: Ming Lei <ming.lei@canonical.com>
+
+commit c5211187f7ff8e8dbff4ebf7c011ac4c0ffe319c upstream.
+
+If the write endpoint is interrupt type, usb_sndintpipe() should
+be passed to usb_fill_int_urb() instead of usb_sndbulkpipe().
+
+Signed-off-by: Ming Lei <ming.lei@canonical.com>
+Cc: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1234,7 +1234,7 @@ made_compressed_probe:
+
+ if (usb_endpoint_xfer_int(epwrite))
+ usb_fill_int_urb(snd->urb, usb_dev,
+- usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
++ usb_sndintpipe(usb_dev, epwrite->bEndpointAddress),
+ NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval);
+ else
+ usb_fill_bulk_urb(snd->urb, usb_dev,
--- /dev/null
+From 003615302a16579531932576bcd9582ddeba9018 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Wed, 17 Oct 2012 13:34:58 +0200
+Subject: USB: io_ti: fix port-data memory leak
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 003615302a16579531932576bcd9582ddeba9018 upstream.
+
+Fix port-data memory leak by moving port data allocation and
+deallocation to port_probe and port_remove.
+
+Since commit 0998d0631001288 (device-core: Ensure drvdata = NULL when no
+driver is bound) the port private data is no longer freed at release as
+it is no longer accessible.
+
+Compile-only tested.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/io_ti.c | 91 +++++++++++++++++++++------------------------
+ 1 file changed, 44 insertions(+), 47 deletions(-)
+
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -2594,12 +2594,7 @@ static void edge_break(struct tty_struct
+ static int edge_startup(struct usb_serial *serial)
+ {
+ struct edgeport_serial *edge_serial;
+- struct edgeport_port *edge_port;
+- struct usb_device *dev;
+ int status;
+- int i;
+-
+- dev = serial->dev;
+
+ /* create our private serial structure */
+ edge_serial = kzalloc(sizeof(struct edgeport_serial), GFP_KERNEL);
+@@ -2617,40 +2612,7 @@ static int edge_startup(struct usb_seria
+ return status;
+ }
+
+- /* set up our port private structures */
+- for (i = 0; i < serial->num_ports; ++i) {
+- edge_port = kzalloc(sizeof(struct edgeport_port), GFP_KERNEL);
+- if (edge_port == NULL) {
+- dev_err(&serial->dev->dev, "%s - Out of memory\n",
+- __func__);
+- goto cleanup;
+- }
+- spin_lock_init(&edge_port->ep_lock);
+- if (kfifo_alloc(&edge_port->write_fifo, EDGE_OUT_BUF_SIZE,
+- GFP_KERNEL)) {
+- dev_err(&serial->dev->dev, "%s - Out of memory\n",
+- __func__);
+- kfree(edge_port);
+- goto cleanup;
+- }
+- edge_port->port = serial->port[i];
+- edge_port->edge_serial = edge_serial;
+- usb_set_serial_port_data(serial->port[i], edge_port);
+- edge_port->bUartMode = default_uart_mode;
+- }
+-
+ return 0;
+-
+-cleanup:
+- for (--i; i >= 0; --i) {
+- edge_port = usb_get_serial_port_data(serial->port[i]);
+- kfifo_free(&edge_port->write_fifo);
+- kfree(edge_port);
+- usb_set_serial_port_data(serial->port[i], NULL);
+- }
+- kfree(edge_serial);
+- usb_set_serial_data(serial, NULL);
+- return -ENOMEM;
+ }
+
+ static void edge_disconnect(struct usb_serial *serial)
+@@ -2660,19 +2622,54 @@ static void edge_disconnect(struct usb_s
+
+ static void edge_release(struct usb_serial *serial)
+ {
+- int i;
++ kfree(usb_get_serial_data(serial));
++}
++
++static int edge_port_probe(struct usb_serial_port *port)
++{
+ struct edgeport_port *edge_port;
++ int ret;
+
+- dbg("%s", __func__);
++ edge_port = kzalloc(sizeof(*edge_port), GFP_KERNEL);
++ if (!edge_port)
++ return -ENOMEM;
++
++ ret = kfifo_alloc(&edge_port->write_fifo, EDGE_OUT_BUF_SIZE,
++ GFP_KERNEL);
++ if (ret) {
++ kfree(edge_port);
++ return -ENOMEM;
++ }
+
+- for (i = 0; i < serial->num_ports; ++i) {
+- edge_port = usb_get_serial_port_data(serial->port[i]);
++ ret = edge_create_sysfs_attrs(port);
++ if (ret) {
+ kfifo_free(&edge_port->write_fifo);
+ kfree(edge_port);
++ return ret;
+ }
+- kfree(usb_get_serial_data(serial));
++
++ spin_lock_init(&edge_port->ep_lock);
++ edge_port->port = port;
++ edge_port->edge_serial = usb_get_serial_data(port->serial);
++ edge_port->bUartMode = default_uart_mode;
++
++ usb_set_serial_port_data(port, edge_port);
++
++ return 0;
+ }
+
++static int edge_port_remove(struct usb_serial_port *port)
++{
++ struct edgeport_port *edge_port;
++
++ edge_port = usb_get_serial_port_data(port);
++
++ edge_remove_sysfs_attrs(port);
++ kfifo_free(&edge_port->write_fifo);
++ kfree(edge_port);
++
++ return 0;
++}
+
+ /* Sysfs Attributes */
+
+@@ -2732,8 +2729,8 @@ static struct usb_serial_driver edgeport
+ .attach = edge_startup,
+ .disconnect = edge_disconnect,
+ .release = edge_release,
+- .port_probe = edge_create_sysfs_attrs,
+- .port_remove = edge_remove_sysfs_attrs,
++ .port_probe = edge_port_probe,
++ .port_remove = edge_port_remove,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+ .tiocmget = edge_tiocmget,
+@@ -2763,8 +2760,8 @@ static struct usb_serial_driver edgeport
+ .attach = edge_startup,
+ .disconnect = edge_disconnect,
+ .release = edge_release,
+- .port_probe = edge_create_sysfs_attrs,
+- .port_remove = edge_remove_sysfs_attrs,
++ .port_probe = edge_port_probe,
++ .port_remove = edge_port_remove,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+ .tiocmget = edge_tiocmget,
--- /dev/null
+From a349e23d1cf746f8bdc603dcc61fae9ee4a695f6 Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Fri, 19 Oct 2012 17:29:07 +0100
+Subject: xen/x86: don't corrupt %eip when returning from a signal handler
+
+From: David Vrabel <david.vrabel@citrix.com>
+
+commit a349e23d1cf746f8bdc603dcc61fae9ee4a695f6 upstream.
+
+In 32 bit guests, if a userspace process has %eax == -ERESTARTSYS
+(-512) or -ERESTARTNOINTR (-513) when it is interrupted by an event
+/and/ the process has a pending signal then %eip (and %eax) are
+corrupted when returning to the main process after handling the
+signal. The application may then crash with SIGSEGV or a SIGILL or it
+may have subtly incorrect behaviour (depending on what instruction it
+returned to).
+
+The occurs because handle_signal() is incorrectly thinking that there
+is a system call that needs to restarted so it adjusts %eip and %eax
+to re-execute the system call instruction (even though user space had
+not done a system call).
+
+If %eax == -514 (-ERESTARTNOHAND (-514) or -ERESTART_RESTARTBLOCK
+(-516) then handle_signal() only corrupted %eax (by setting it to
+-EINTR). This may cause the application to crash or have incorrect
+behaviour.
+
+handle_signal() assumes that regs->orig_ax >= 0 means a system call so
+any kernel entry point that is not for a system call must push a
+negative value for orig_ax. For example, for physical interrupts on
+bare metal the inverse of the vector is pushed and page_fault() sets
+regs->orig_ax to -1, overwriting the hardware provided error code.
+
+xen_hypervisor_callback() was incorrectly pushing 0 for orig_ax
+instead of -1.
+
+Classic Xen kernels pushed %eax which works as %eax cannot be both
+non-negative and -RESTARTSYS (etc.), but using -1 is consistent with
+other non-system call entry points and avoids some of the tests in
+handle_signal().
+
+There were similar bugs in xen_failsafe_callback() of both 32 and
+64-bit guests. If the fault was corrected and the normal return path
+was used then 0 was incorrectly pushed as the value for orig_ax.
+
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Acked-by: Jan Beulich <JBeulich@suse.com>
+Acked-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/entry_32.S | 8 +++++---
+ arch/x86/kernel/entry_64.S | 2 +-
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -1016,7 +1016,7 @@ ENTRY(xen_sysenter_target)
+
+ ENTRY(xen_hypervisor_callback)
+ CFI_STARTPROC
+- pushl_cfi $0
++ pushl_cfi $-1 /* orig_ax = -1 => not a system call */
+ SAVE_ALL
+ TRACE_IRQS_OFF
+
+@@ -1058,14 +1058,16 @@ ENTRY(xen_failsafe_callback)
+ 2: mov 8(%esp),%es
+ 3: mov 12(%esp),%fs
+ 4: mov 16(%esp),%gs
++ /* EAX == 0 => Category 1 (Bad segment)
++ EAX != 0 => Category 2 (Bad IRET) */
+ testl %eax,%eax
+ popl_cfi %eax
+ lea 16(%esp),%esp
+ CFI_ADJUST_CFA_OFFSET -16
+ jz 5f
+ addl $16,%esp
+- jmp iret_exc # EAX != 0 => Category 2 (Bad IRET)
+-5: pushl_cfi $0 # EAX == 0 => Category 1 (Bad segment)
++ jmp iret_exc
++5: pushl_cfi $-1 /* orig_ax = -1 => not a system call */
+ SAVE_ALL
+ jmp ret_from_exception
+ CFI_ENDPROC
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -1363,7 +1363,7 @@ ENTRY(xen_failsafe_callback)
+ CFI_RESTORE r11
+ addq $0x30,%rsp
+ CFI_ADJUST_CFA_OFFSET -0x30
+- pushq_cfi $0
++ pushq_cfi $-1 /* orig_ax = -1 => not a system call */
+ SAVE_ALL
+ jmp error_exit
+ CFI_ENDPROC
projects / thirdparty / kernel / stable-queue.git / commitdiff
