From: Greg Kroah-Hartman Date: Wed, 2 Oct 2013 16:55:19 +0000 (-0700) Subject: 3.11-stable patches X-Git-Tag: v3.0.99~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1e49e7f5b350e1570d895f4fd86ebcbb88673fd3;p=thirdparty%2Fkernel%2Fstable-queue.git 3.11-stable patches added patches: staging-vt6656-iwctl_siwencodeext-return-if-device-not-open.patch staging-vt6656-main_usb.c-oops-on-device_close-move-flag-earlier.patch --- diff --git a/queue-3.11/series b/queue-3.11/series index 1947cf996e0..048f88cf01f 100644 --- a/queue-3.11/series +++ b/queue-3.11/series @@ -21,3 +21,5 @@ serial-tegra-fix-tty-kref-leak.patch serial-pch_uart-fix-tty-kref-leak-in-rx-error-path.patch serial-pch_uart-fix-tty-kref-leak-in-dma-rx-path.patch arm-7837-3-fix-thumb-2-bug-in-aes-assembler-code.patch +staging-vt6656-main_usb.c-oops-on-device_close-move-flag-earlier.patch +staging-vt6656-iwctl_siwencodeext-return-if-device-not-open.patch diff --git a/queue-3.11/staging-vt6656-iwctl_siwencodeext-return-if-device-not-open.patch b/queue-3.11/staging-vt6656-iwctl_siwencodeext-return-if-device-not-open.patch new file mode 100644 index 00000000000..9452391ee6b --- /dev/null +++ b/queue-3.11/staging-vt6656-iwctl_siwencodeext-return-if-device-not-open.patch @@ -0,0 +1,33 @@ +From 5e8c3d3e41b0bf241e830a1ee0752405adecc050 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Mon, 23 Sep 2013 20:30:42 +0100 +Subject: staging: vt6656: [BUG] iwctl_siwencodeext return if device not open + +From: Malcolm Priestley + +commit 5e8c3d3e41b0bf241e830a1ee0752405adecc050 upstream. + +Don't allow entry to iwctl_siwencodeext if device not open. + +This fixes a race condition where wpa supplicant/network manager +enters the function when the device is already closed. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/iwctl.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/vt6656/iwctl.c ++++ b/drivers/staging/vt6656/iwctl.c +@@ -1634,6 +1634,9 @@ int iwctl_siwencodeext(struct net_device + if (pMgmt == NULL) + return -EFAULT; + ++ if (!(pDevice->flags & DEVICE_FLAGS_OPENED)) ++ return -ENODEV; ++ + buf = kzalloc(sizeof(struct viawget_wpa_param), GFP_KERNEL); + if (buf == NULL) + return -ENOMEM; diff --git a/queue-3.11/staging-vt6656-main_usb.c-oops-on-device_close-move-flag-earlier.patch b/queue-3.11/staging-vt6656-main_usb.c-oops-on-device_close-move-flag-earlier.patch new file mode 100644 index 00000000000..4da97d85d0b --- /dev/null +++ b/queue-3.11/staging-vt6656-main_usb.c-oops-on-device_close-move-flag-earlier.patch @@ -0,0 +1,45 @@ +From e3eb270fab7734427dd8171a93e4946fe28674bc Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 22 Sep 2013 19:48:54 +0100 +Subject: staging: vt6656: [BUG] main_usb.c oops on device_close move flag earlier. + +From: Malcolm Priestley + +commit e3eb270fab7734427dd8171a93e4946fe28674bc upstream. + +The vt6656 is prone to resetting on the usb bus. + +It seems there is a race condition and wpa supplicant is +trying to open the device via iw_handlers before its actually +closed at a stage that the buffers are being removed. + +The device is longer considered open when the +buffers are being removed. So move ~DEVICE_FLAGS_OPENED +flag to before freeing the device buffers. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/main_usb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -1099,6 +1099,8 @@ static int device_close(struct net_devic + memset(pMgmt->abyCurrBSSID, 0, 6); + pMgmt->eCurrState = WMAC_STATE_IDLE; + ++ pDevice->flags &= ~DEVICE_FLAGS_OPENED; ++ + device_free_tx_bufs(pDevice); + device_free_rx_bufs(pDevice); + device_free_int_bufs(pDevice); +@@ -1110,7 +1112,6 @@ static int device_close(struct net_devic + usb_free_urb(pDevice->pInterruptURB); + + BSSvClearNodeDBTable(pDevice, 0); +- pDevice->flags &=(~DEVICE_FLAGS_OPENED); + + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "device_close2 \n"); +