From: Greg Kroah-Hartman Date: Wed, 18 Dec 2013 17:59:28 +0000 (-0800) Subject: 3.4-stable patches X-Git-Tag: v3.4.75~39 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=101e3a3b806c6be939163e3dea72f3ea633ac5a4;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch xfs-underflow-bug-in-xfs_attrlist_by_handle.patch --- diff --git a/queue-3.4/hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch b/queue-3.4/hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch new file mode 100644 index 00000000000..ec6fde3d602 --- /dev/null +++ b/queue-3.4/hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch @@ -0,0 +1,43 @@ +From cf7559bc053471f32373d71d04a9aa19e0b48d59 Mon Sep 17 00:00:00 2001 +From: Brian Carnes +Date: Thu, 12 Dec 2013 08:05:32 +0100 +Subject: hwmon: (w83l786ng) Fix fan speed control mode setting and reporting + +From: Brian Carnes + +commit cf7559bc053471f32373d71d04a9aa19e0b48d59 upstream. + +The wrong mask is used, which causes some fan speed control modes +(pwmX_enable) to be incorrectly reported, and some modes to be +impossible to set. + +[JD: add subject and description.] + +Signed-off-by: Brian Carnes +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/w83l786ng.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/w83l786ng.c ++++ b/drivers/hwmon/w83l786ng.c +@@ -510,7 +510,7 @@ store_pwm_enable(struct device *dev, str + mutex_lock(&data->update_lock); + reg = w83l786ng_read_value(client, W83L786NG_REG_FAN_CFG); + data->pwm_enable[nr] = val; +- reg &= ~(0x02 << W83L786NG_PWM_ENABLE_SHIFT[nr]); ++ reg &= ~(0x03 << W83L786NG_PWM_ENABLE_SHIFT[nr]); + reg |= (val - 1) << W83L786NG_PWM_ENABLE_SHIFT[nr]; + w83l786ng_write_value(client, W83L786NG_REG_FAN_CFG, reg); + mutex_unlock(&data->update_lock); +@@ -781,7 +781,7 @@ static struct w83l786ng_data *w83l786ng_ + ((pwmcfg >> W83L786NG_PWM_MODE_SHIFT[i]) & 1) + ? 0 : 1; + data->pwm_enable[i] = +- ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 2) + 1; ++ ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 3) + 1; + data->pwm[i] = w83l786ng_read_value(client, + W83L786NG_REG_PWM[i]); + } diff --git a/queue-3.4/series b/queue-3.4/series index af1ea55c25c..8ec1f3f90fe 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -5,3 +5,5 @@ arm-omap3-hwmod-data-don-t-prevent-reset-of-usb-host-module.patch arm-7912-1-check-stack-pointer-in-get_wchan.patch arm-7913-1-fix-framepointer-check-in-unwind_frame.patch kvm-improve-create-vcpu-parameter-cve-2013-4587.patch +hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch +xfs-underflow-bug-in-xfs_attrlist_by_handle.patch diff --git a/queue-3.4/xfs-underflow-bug-in-xfs_attrlist_by_handle.patch b/queue-3.4/xfs-underflow-bug-in-xfs_attrlist_by_handle.patch new file mode 100644 index 00000000000..4acbe0cdcdb --- /dev/null +++ b/queue-3.4/xfs-underflow-bug-in-xfs_attrlist_by_handle.patch @@ -0,0 +1,50 @@ +From 31978b5cc66b8ba8a7e8eef60b12395d41b7b890 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 31 Oct 2013 21:00:10 +0300 +Subject: xfs: underflow bug in xfs_attrlist_by_handle() + +From: Dan Carpenter + +commit 31978b5cc66b8ba8a7e8eef60b12395d41b7b890 upstream. + +If we allocate less than sizeof(struct attrlist) then we end up +corrupting memory or doing a ZERO_PTR_SIZE dereference. + +This can only be triggered with CAP_SYS_ADMIN. + +Reported-by: Nico Golde +Reported-by: Fabian Yamaguchi +Signed-off-by: Dan Carpenter +Reviewed-by: Dave Chinner +Signed-off-by: Ben Myers +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_ioctl.c | 3 ++- + fs/xfs/xfs_ioctl32.c | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/xfs/xfs_ioctl.c ++++ b/fs/xfs/xfs_ioctl.c +@@ -400,7 +400,8 @@ xfs_attrlist_by_handle( + return -XFS_ERROR(EPERM); + if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t))) + return -XFS_ERROR(EFAULT); +- if (al_hreq.buflen > XATTR_LIST_MAX) ++ if (al_hreq.buflen < sizeof(struct attrlist) || ++ al_hreq.buflen > XATTR_LIST_MAX) + return -XFS_ERROR(EINVAL); + + /* +--- a/fs/xfs/xfs_ioctl32.c ++++ b/fs/xfs/xfs_ioctl32.c +@@ -361,7 +361,8 @@ xfs_compat_attrlist_by_handle( + if (copy_from_user(&al_hreq, arg, + sizeof(compat_xfs_fsop_attrlist_handlereq_t))) + return -XFS_ERROR(EFAULT); +- if (al_hreq.buflen > XATTR_LIST_MAX) ++ if (al_hreq.buflen < sizeof(struct attrlist) || ++ al_hreq.buflen > XATTR_LIST_MAX) + return -XFS_ERROR(EINVAL); + + /*