From: Greg Kroah-Hartman Date: Wed, 9 Oct 2013 15:54:42 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.100~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0468349a7d10526281dcc7e3b0cc85b9c727aea4;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: kernel-kmod.c-check-for-null-in-call_usermodehelper_exec.patch usb-serial-option-ignore-card-reader-interface-on-huawei-e1750.patch --- diff --git a/queue-3.0/kernel-kmod.c-check-for-null-in-call_usermodehelper_exec.patch b/queue-3.0/kernel-kmod.c-check-for-null-in-call_usermodehelper_exec.patch new file mode 100644 index 00000000000..756c4a65761 --- /dev/null +++ b/queue-3.0/kernel-kmod.c-check-for-null-in-call_usermodehelper_exec.patch @@ -0,0 +1,45 @@ +From 4c1c7be95c345cf2ad537a0c48e9aeadc7304527 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Mon, 30 Sep 2013 13:45:08 -0700 +Subject: kernel/kmod.c: check for NULL in call_usermodehelper_exec() + +From: Tetsuo Handa + +commit 4c1c7be95c345cf2ad537a0c48e9aeadc7304527 upstream. + +If /proc/sys/kernel/core_pattern contains only "|", a NULL pointer +dereference happens upon core dump because argv_split("") returns +argv[0] == NULL. + +This bug was once fixed by commit 264b83c07a84 ("usermodehelper: check +subprocess_info->path != NULL") but was by error reintroduced by commit +7f57cfa4e2aa ("usermodehelper: kill the sub_info->path[0] check"). + +This bug seems to exist since 2.6.19 (the version which core dump to +pipe was added). Depending on kernel version and config, some side +effect might happen immediately after this oops (e.g. kernel panic with +2.6.32-358.18.1.el6). + +Signed-off-by: Tetsuo Handa +Acked-by: Oleg Nesterov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/kmod.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/kernel/kmod.c ++++ b/kernel/kmod.c +@@ -420,6 +420,10 @@ int call_usermodehelper_exec(struct subp + DECLARE_COMPLETION_ONSTACK(done); + int retval = 0; + ++ if (!sub_info->path) { ++ call_usermodehelper_freeinfo(sub_info); ++ return -EINVAL; ++ } + helper_lock(); + if (!sub_info->path) { + retval = -EINVAL; diff --git a/queue-3.0/series b/queue-3.0/series index ca8634d4832..fbf85964bde 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -26,3 +26,5 @@ sparc64-remove-rwsem-export-leftovers.patch sparc64-fix-off-by-one-in-trampoline-tlb-mapping-installation-loop.patch sparc64-fix-not-sra-ed-o5-in-32-bit-traced-syscall.patch sparc32-fix-exit-flag-passed-from-traced-sys_sigreturn.patch +kernel-kmod.c-check-for-null-in-call_usermodehelper_exec.patch +usb-serial-option-ignore-card-reader-interface-on-huawei-e1750.patch diff --git a/queue-3.0/usb-serial-option-ignore-card-reader-interface-on-huawei-e1750.patch b/queue-3.0/usb-serial-option-ignore-card-reader-interface-on-huawei-e1750.patch new file mode 100644 index 00000000000..5bcf24f33c2 --- /dev/null +++ b/queue-3.0/usb-serial-option-ignore-card-reader-interface-on-huawei-e1750.patch @@ -0,0 +1,45 @@ +From eb2addd4044b4b2ce77693bde5bc810536dd96ee Mon Sep 17 00:00:00 2001 +From: Michal Malý +Date: Sat, 28 Sep 2013 19:50:27 +0200 +Subject: USB: serial: option: Ignore card reader interface on Huawei E1750 + +From: Michal Malý + +commit eb2addd4044b4b2ce77693bde5bc810536dd96ee upstream. + +Hi, + +my Huawei 3G modem has an embedded Smart Card reader which causes +trouble when the modem is being detected (a bunch of " (ttyUSBx): +open blocked by driver for more than 7 seconds!" in messages.log). This +trivial patch corrects the problem for me. The modem identifies itself +as "12d1:1406 Huawei Technologies Co., Ltd. E1750" in lsusb although the +description on the body says "Model E173u-1" + +Signed-off-by: Michal Malý +Cc: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -81,6 +81,7 @@ static void option_instat_callback(struc + + #define HUAWEI_VENDOR_ID 0x12D1 + #define HUAWEI_PRODUCT_E173 0x140C ++#define HUAWEI_PRODUCT_E1750 0x1406 + #define HUAWEI_PRODUCT_K4505 0x1464 + #define HUAWEI_PRODUCT_K3765 0x1465 + #define HUAWEI_PRODUCT_K4605 0x14C6 +@@ -581,6 +582,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t) &net_intf2_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff),