--- /dev/null
+From 2d90e63603ac235aecd7d20e234616e0682c8b1f Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Tue, 19 Feb 2013 09:47:09 -0600
+Subject: qcaux: add Franklin U600
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit 2d90e63603ac235aecd7d20e234616e0682c8b1f upstream.
+
+4 ports; AT/PPP is standard CDC-ACM. The other three (added by this
+patch) are QCDM/DIAG, possibly GPS, and unknown.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/qcaux.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/qcaux.c
++++ b/drivers/usb/serial/qcaux.c
+@@ -69,6 +69,7 @@ static struct usb_device_id id_table[] =
+ { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xfd, 0xff) }, /* NMEA */
+ { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xfe, 0xff) }, /* WMC */
+ { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xff, 0xff) }, /* DIAG */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x1fac, 0x0151, 0xff, 0xff, 0xff) },
+ { },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
--- /dev/null
+qcaux-add-franklin-u600.patch
+virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch
+usb-option-add-huawei-e5331.patch
+usb-cdc-wdm-fix-buffer-overflow.patch
--- /dev/null
+From c0f5ecee4e741667b2493c742b60b6218d40b3aa Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.de>
+Date: Tue, 12 Mar 2013 14:52:42 +0100
+Subject: USB: cdc-wdm: fix buffer overflow
+
+From: Oliver Neukum <oneukum@suse.de>
+
+commit c0f5ecee4e741667b2493c742b60b6218d40b3aa upstream.
+
+The buffer for responses must not overflow.
+If this would happen, set a flag, drop the data and return
+an error after user space has read all remaining data.
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-wdm.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -54,6 +54,7 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
+ #define WDM_POLL_RUNNING 6
+ #define WDM_RESPONDING 7
+ #define WDM_SUSPENDING 8
++#define WDM_OVERFLOW 10
+
+ #define WDM_MAX 16
+
+@@ -118,6 +119,7 @@ static void wdm_in_callback(struct urb *
+ {
+ struct wdm_device *desc = urb->context;
+ int status = urb->status;
++ int length = urb->actual_length;
+
+ spin_lock(&desc->iuspin);
+ clear_bit(WDM_RESPONDING, &desc->flags);
+@@ -148,9 +150,17 @@ static void wdm_in_callback(struct urb *
+ }
+
+ desc->rerr = status;
+- desc->reslength = urb->actual_length;
+- memmove(desc->ubuf + desc->length, desc->inbuf, desc->reslength);
+- desc->length += desc->reslength;
++ if (length + desc->length > desc->wMaxCommand) {
++ /* The buffer would overflow */
++ set_bit(WDM_OVERFLOW, &desc->flags);
++ } else {
++ /* we may already be in overflow */
++ if (!test_bit(WDM_OVERFLOW, &desc->flags)) {
++ memmove(desc->ubuf + desc->length, desc->inbuf, length);
++ desc->length += length;
++ desc->reslength = length;
++ }
++ }
+ skip_error:
+ wake_up(&desc->wait);
+
+@@ -417,6 +427,11 @@ retry:
+ rv = -ENODEV;
+ goto err;
+ }
++ if (test_bit(WDM_OVERFLOW, &desc->flags)) {
++ clear_bit(WDM_OVERFLOW, &desc->flags);
++ rv = -ENOBUFS;
++ goto err;
++ }
+ i++;
+ if (file->f_flags & O_NONBLOCK) {
+ if (!test_bit(WDM_READ, &desc->flags)) {
+@@ -456,6 +471,7 @@ retry:
+ spin_unlock_irq(&desc->iuspin);
+ goto retry;
+ }
++
+ if (!desc->reslength) { /* zero length read */
+ dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__);
+ clear_bit(WDM_READ, &desc->flags);
+@@ -901,6 +917,7 @@ static int wdm_post_reset(struct usb_int
+ struct wdm_device *desc = usb_get_intfdata(intf);
+ int rv;
+
++ clear_bit(WDM_OVERFLOW, &desc->flags);
+ rv = recover_from_urb_loss(desc);
+ mutex_unlock(&desc->wlock);
+ mutex_unlock(&desc->rlock);
--- /dev/null
+From daec90e7382cbd0e73eb6861109b3da91e5ab1f3 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Wed, 27 Feb 2013 15:52:56 +0100
+Subject: USB: option: add Huawei E5331
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit daec90e7382cbd0e73eb6861109b3da91e5ab1f3 upstream.
+
+Another device using CDC ACM with vendor specific protocol to mark
+serial functions.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -579,6 +579,7 @@ static const struct usb_device_id option
+ { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c05, USB_CLASS_COMM, 0x02, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c1f, USB_CLASS_COMM, 0x02, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
--- /dev/null
+From e84e7a56a3aa2963db506299e29a5f3f09377f9b Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Fri, 8 Mar 2013 11:30:18 +1100
+Subject: virtio: rng: disallow multiple device registrations, fixes crashes
+
+From: Amit Shah <amit.shah@redhat.com>
+
+commit e84e7a56a3aa2963db506299e29a5f3f09377f9b upstream.
+
+The code currently only supports one virtio-rng device at a time.
+Invoking guests with multiple devices causes the guest to blow up.
+
+Check if we've already registered and initialised the driver. Also
+cleanup in case of registration errors or hot-unplug so that a new
+device can be used.
+
+Reported-by: Peter Krempa <pkrempa@redhat.com>
+Reported-by: <yunzheng@redhat.com>
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/hw_random/virtio-rng.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/hw_random/virtio-rng.c
++++ b/drivers/char/hw_random/virtio-rng.c
+@@ -88,14 +88,22 @@ static int virtrng_probe(struct virtio_d
+ {
+ int err;
+
++ if (vq) {
++ /* We only support one device for now */
++ return -EBUSY;
++ }
+ /* We expect a single virtqueue. */
+ vq = virtio_find_single_vq(vdev, random_recv_done, "input");
+- if (IS_ERR(vq))
+- return PTR_ERR(vq);
++ if (IS_ERR(vq)) {
++ err = PTR_ERR(vq);
++ vq = NULL;
++ return err;
++ }
+
+ err = hwrng_register(&virtio_hwrng);
+ if (err) {
+ vdev->config->del_vqs(vdev);
++ vq = NULL;
+ return err;
+ }
+
+@@ -107,6 +115,7 @@ static void __devexit virtrng_remove(str
+ vdev->config->reset(vdev);
+ hwrng_unregister(&virtio_hwrng);
+ vdev->config->del_vqs(vdev);
++ vq = NULL;
+ }
+
+ static struct virtio_device_id id_table[] = {
projects / thirdparty / kernel / stable-queue.git / commitdiff
