From: Greg Kroah-Hartman Date: Wed, 24 Oct 2012 16:59:36 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.49~47 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1e580c4e7798ed7f11e838c195fefbc9c4e9f93a;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: usb-acm-fix-the-computation-of-the-number-of-data-bits.patch usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch --- diff --git a/queue-3.0/series b/queue-3.0/series index d16e23a9d10..00b2af2e392 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -7,3 +7,6 @@ pcmcia-sharpsl-don-t-discard-sharpsl_pcmcia_ops.patch kernel-sys.c-fix-stack-memory-content-leak-via-uname26.patch use-clamp_t-in-uname26-fix.patch x86-exclude-e820_reserved-regions-and-memory-holes-above-4-gb-from-direct-mapping.patch +xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch +usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch +usb-acm-fix-the-computation-of-the-number-of-data-bits.patch diff --git a/queue-3.0/usb-acm-fix-the-computation-of-the-number-of-data-bits.patch b/queue-3.0/usb-acm-fix-the-computation-of-the-number-of-data-bits.patch new file mode 100644 index 00000000000..39f30ab37a1 --- /dev/null +++ b/queue-3.0/usb-acm-fix-the-computation-of-the-number-of-data-bits.patch @@ -0,0 +1,56 @@ +From 301a29da6e891e7eb95c843af0ecdbe86d01f723 Mon Sep 17 00:00:00 2001 +From: Nicolas Boullis +Date: Tue, 16 Oct 2012 00:06:23 +0200 +Subject: usb: acm: fix the computation of the number of data bits + +From: Nicolas Boullis + +commit 301a29da6e891e7eb95c843af0ecdbe86d01f723 upstream. + +The current code assumes that CSIZE is 0000060, which appears to be +wrong on some arches (such as powerpc). + +Signed-off-by: Nicolas Boullis +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -760,10 +760,6 @@ static const __u32 acm_tty_speed[] = { + 2500000, 3000000, 3500000, 4000000 + }; + +-static const __u8 acm_tty_size[] = { +- 5, 6, 7, 8 +-}; +- + static void acm_tty_set_termios(struct tty_struct *tty, + struct ktermios *termios_old) + { +@@ -780,7 +776,21 @@ static void acm_tty_set_termios(struct t + newline.bParityType = termios->c_cflag & PARENB ? + (termios->c_cflag & PARODD ? 1 : 2) + + (termios->c_cflag & CMSPAR ? 2 : 0) : 0; +- newline.bDataBits = acm_tty_size[(termios->c_cflag & CSIZE) >> 4]; ++ switch (termios->c_cflag & CSIZE) { ++ case CS5: ++ newline.bDataBits = 5; ++ break; ++ case CS6: ++ newline.bDataBits = 6; ++ break; ++ case CS7: ++ newline.bDataBits = 7; ++ break; ++ case CS8: ++ default: ++ newline.bDataBits = 8; ++ break; ++ } + /* FIXME: Needs to clear unsupported bits in the termios */ + acm->clocal = ((termios->c_cflag & CLOCAL) != 0); + diff --git a/queue-3.0/usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch b/queue-3.0/usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch new file mode 100644 index 00000000000..c3758967a4c --- /dev/null +++ b/queue-3.0/usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch @@ -0,0 +1,31 @@ +From c5211187f7ff8e8dbff4ebf7c011ac4c0ffe319c Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Tue, 16 Oct 2012 21:21:21 +0800 +Subject: USB: cdc-acm: fix pipe type of write endpoint + +From: Ming Lei + +commit c5211187f7ff8e8dbff4ebf7c011ac4c0ffe319c upstream. + +If the write endpoint is interrupt type, usb_sndintpipe() should +be passed to usb_fill_int_urb() instead of usb_sndbulkpipe(). + +Signed-off-by: Ming Lei +Cc: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1172,7 +1172,7 @@ made_compressed_probe: + + if (usb_endpoint_xfer_int(epwrite)) + usb_fill_int_urb(snd->urb, usb_dev, +- usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress), ++ usb_sndintpipe(usb_dev, epwrite->bEndpointAddress), + NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval); + else + usb_fill_bulk_urb(snd->urb, usb_dev, diff --git a/queue-3.0/xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch b/queue-3.0/xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch new file mode 100644 index 00000000000..eb616ee3d97 --- /dev/null +++ b/queue-3.0/xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch @@ -0,0 +1,97 @@ +From a349e23d1cf746f8bdc603dcc61fae9ee4a695f6 Mon Sep 17 00:00:00 2001 +From: David Vrabel +Date: Fri, 19 Oct 2012 17:29:07 +0100 +Subject: xen/x86: don't corrupt %eip when returning from a signal handler + +From: David Vrabel + +commit a349e23d1cf746f8bdc603dcc61fae9ee4a695f6 upstream. + +In 32 bit guests, if a userspace process has %eax == -ERESTARTSYS +(-512) or -ERESTARTNOINTR (-513) when it is interrupted by an event +/and/ the process has a pending signal then %eip (and %eax) are +corrupted when returning to the main process after handling the +signal. The application may then crash with SIGSEGV or a SIGILL or it +may have subtly incorrect behaviour (depending on what instruction it +returned to). + +The occurs because handle_signal() is incorrectly thinking that there +is a system call that needs to restarted so it adjusts %eip and %eax +to re-execute the system call instruction (even though user space had +not done a system call). + +If %eax == -514 (-ERESTARTNOHAND (-514) or -ERESTART_RESTARTBLOCK +(-516) then handle_signal() only corrupted %eax (by setting it to +-EINTR). This may cause the application to crash or have incorrect +behaviour. + +handle_signal() assumes that regs->orig_ax >= 0 means a system call so +any kernel entry point that is not for a system call must push a +negative value for orig_ax. For example, for physical interrupts on +bare metal the inverse of the vector is pushed and page_fault() sets +regs->orig_ax to -1, overwriting the hardware provided error code. + +xen_hypervisor_callback() was incorrectly pushing 0 for orig_ax +instead of -1. + +Classic Xen kernels pushed %eax which works as %eax cannot be both +non-negative and -RESTARTSYS (etc.), but using -1 is consistent with +other non-system call entry points and avoids some of the tests in +handle_signal(). + +There were similar bugs in xen_failsafe_callback() of both 32 and +64-bit guests. If the fault was corrected and the normal return path +was used then 0 was incorrectly pushed as the value for orig_ax. + +Signed-off-by: David Vrabel +Acked-by: Jan Beulich +Acked-by: Ian Campbell +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/entry_32.S | 8 +++++--- + arch/x86/kernel/entry_64.S | 2 +- + 2 files changed, 6 insertions(+), 4 deletions(-) + +--- a/arch/x86/kernel/entry_32.S ++++ b/arch/x86/kernel/entry_32.S +@@ -1029,7 +1029,7 @@ ENTRY(xen_sysenter_target) + + ENTRY(xen_hypervisor_callback) + CFI_STARTPROC +- pushl_cfi $0 ++ pushl_cfi $-1 /* orig_ax = -1 => not a system call */ + SAVE_ALL + TRACE_IRQS_OFF + +@@ -1071,14 +1071,16 @@ ENTRY(xen_failsafe_callback) + 2: mov 8(%esp),%es + 3: mov 12(%esp),%fs + 4: mov 16(%esp),%gs ++ /* EAX == 0 => Category 1 (Bad segment) ++ EAX != 0 => Category 2 (Bad IRET) */ + testl %eax,%eax + popl_cfi %eax + lea 16(%esp),%esp + CFI_ADJUST_CFA_OFFSET -16 + jz 5f + addl $16,%esp +- jmp iret_exc # EAX != 0 => Category 2 (Bad IRET) +-5: pushl_cfi $0 # EAX == 0 => Category 1 (Bad segment) ++ jmp iret_exc ++5: pushl_cfi $-1 /* orig_ax = -1 => not a system call */ + SAVE_ALL + jmp ret_from_exception + CFI_ENDPROC +--- a/arch/x86/kernel/entry_64.S ++++ b/arch/x86/kernel/entry_64.S +@@ -1308,7 +1308,7 @@ ENTRY(xen_failsafe_callback) + CFI_RESTORE r11 + addq $0x30,%rsp + CFI_ADJUST_CFA_OFFSET -0x30 +- pushq_cfi $0 ++ pushq_cfi $-1 /* orig_ax = -1 => not a system call */ + SAVE_ALL + jmp error_exit + CFI_ENDPROC