From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Tue, 3 Aug 2010 23:32:34 +0000 (-0700)
Subject: .35 patches
X-Git-Tag: v2.6.27.50~23
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=29227917e62b557fb48fd2cb9b149ed6316b591c;p=thirdparty%2Fkernel%2Fstable-queue.git

.35 patches
---

diff --git a/queue-2.6.35/arm-imx-gpio-add-spinlock-protection.patch b/queue-2.6.35/arm-imx-gpio-add-spinlock-protection.patch
new file mode 100644
index 00000000000..06a7d478941
--- /dev/null
+++ b/queue-2.6.35/arm-imx-gpio-add-spinlock-protection.patch
@@ -0,0 +1,75 @@
+From 14cb0deb66fcfca8fdbef75da8c84b5405a8c767 Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Tue, 6 Jul 2010 14:03:22 +0300
+Subject: arm/imx/gpio: add spinlock protection
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+commit 14cb0deb66fcfca8fdbef75da8c84b5405a8c767 upstream.
+
+The GPIO registers need protection from concurrent access for operations that
+are not atomic.
+
+Cc: Juergen Beisert <j.beisert@pengutronix.de>
+Cc: Daniel Mack <daniel@caiaq.de>
+Reported-by: rpkamiak@rockwellcollins.com
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/plat-mxc/gpio.c              |    8 ++++++++
+ arch/arm/plat-mxc/include/mach/gpio.h |    1 +
+ 2 files changed, 9 insertions(+)
+
+--- a/arch/arm/plat-mxc/gpio.c
++++ b/arch/arm/plat-mxc/gpio.c
+@@ -214,13 +214,16 @@ static void _set_gpio_direction(struct g
+ 	struct mxc_gpio_port *port =
+ 		container_of(chip, struct mxc_gpio_port, chip);
+ 	u32 l;
++	unsigned long flags;
+ 
++	spin_lock_irqsave(&port->lock, flags);
+ 	l = __raw_readl(port->base + GPIO_GDIR);
+ 	if (dir)
+ 		l |= 1 << offset;
+ 	else
+ 		l &= ~(1 << offset);
+ 	__raw_writel(l, port->base + GPIO_GDIR);
++	spin_unlock_irqrestore(&port->lock, flags);
+ }
+ 
+ static void mxc_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
+@@ -229,9 +232,12 @@ static void mxc_gpio_set(struct gpio_chi
+ 		container_of(chip, struct mxc_gpio_port, chip);
+ 	void __iomem *reg = port->base + GPIO_DR;
+ 	u32 l;
++	unsigned long flags;
+ 
++	spin_lock_irqsave(&port->lock, flags);
+ 	l = (__raw_readl(reg) & (~(1 << offset))) | (value << offset);
+ 	__raw_writel(l, reg);
++	spin_unlock_irqrestore(&port->lock, flags);
+ }
+ 
+ static int mxc_gpio_get(struct gpio_chip *chip, unsigned offset)
+@@ -285,6 +291,8 @@ int __init mxc_gpio_init(struct mxc_gpio
+ 		port[i].chip.base = i * 32;
+ 		port[i].chip.ngpio = 32;
+ 
++		spin_lock_init(&port[i].lock);
++
+ 		/* its a serious configuration bug when it fails */
+ 		BUG_ON( gpiochip_add(&port[i].chip) < 0 );
+ 
+--- a/arch/arm/plat-mxc/include/mach/gpio.h
++++ b/arch/arm/plat-mxc/include/mach/gpio.h
+@@ -36,6 +36,7 @@ struct mxc_gpio_port {
+ 	int virtual_irq_start;
+ 	struct gpio_chip chip;
+ 	u32 both_edges;
++	spinlock_t lock;
+ };
+ 
+ int mxc_gpio_init(struct mxc_gpio_port*, int);
diff --git a/queue-2.6.35/parisc-led.c-fix-potential-stack-overflow-in-led_proc_write.patch b/queue-2.6.35/parisc-led.c-fix-potential-stack-overflow-in-led_proc_write.patch
new file mode 100644
index 00000000000..0ded5b20123
--- /dev/null
+++ b/queue-2.6.35/parisc-led.c-fix-potential-stack-overflow-in-led_proc_write.patch
@@ -0,0 +1,45 @@
+From 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Mon, 2 Aug 2010 22:46:41 +0200
+Subject: PARISC: led.c - fix potential stack overflow in led_proc_write()
+
+From: Helge Deller <deller@gmx.de>
+
+commit 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 upstream.
+
+avoid potential stack overflow by correctly checking count parameter
+
+Reported-by: Ilja <ilja@netric.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Acked-by: Kyle McMartin <kyle@mcmartin.ca>
+Cc: James E.J. Bottomley <jejb@parisc-linux.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/parisc/led.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -176,16 +176,18 @@ static ssize_t led_proc_write(struct fil
+ 	size_t count, loff_t *pos)
+ {
+ 	void *data = PDE(file->f_path.dentry->d_inode)->data;
+-	char *cur, lbuf[count + 1];
++	char *cur, lbuf[32];
+ 	int d;
+ 
+ 	if (!capable(CAP_SYS_ADMIN))
+ 		return -EACCES;
+ 
+-	memset(lbuf, 0, count + 1);
++	if (count >= sizeof(lbuf))
++		count = sizeof(lbuf)-1;
+ 
+ 	if (copy_from_user(lbuf, buf, count))
+ 		return -EFAULT;
++	lbuf[count] = 0;
+ 
+ 	cur = lbuf;
+