From: Greg Kroah-Hartman Date: Tue, 7 Jul 2015 17:33:51 +0000 (-0700) Subject: 4.0-stable patches X-Git-Tag: v4.0.8~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2f82f9a7e812cd3b921474ec009876f8ba1339c8;p=thirdparty%2Fkernel%2Fstable-queue.git 4.0-stable patches added patches: usb-gadget-f_fs-add-extra-check-before-unregister_gadget_item.patch usb-gadget-f_fs-fix-check-in-read-operation.patch --- diff --git a/queue-4.0/series b/queue-4.0/series index 1fe20cf7713..d5f3cc1064b 100644 --- a/queue-4.0/series +++ b/queue-4.0/series @@ -24,3 +24,5 @@ amd-xgbe-add-the-__gfp_nowarn-flag-to-rx-buffer-allocation.patch net-mvneta-introduce-compatible-string-marvell-armada-xp-neta.patch arm-mvebu-update-ethernet-compatible-string-for-armada-xp.patch net-mvneta-disable-ip-checksum-with-jumbo-frames-for-armada-370.patch +usb-gadget-f_fs-fix-check-in-read-operation.patch +usb-gadget-f_fs-add-extra-check-before-unregister_gadget_item.patch diff --git a/queue-4.0/usb-gadget-f_fs-add-extra-check-before-unregister_gadget_item.patch b/queue-4.0/usb-gadget-f_fs-add-extra-check-before-unregister_gadget_item.patch new file mode 100644 index 00000000000..6f51268583b --- /dev/null +++ b/queue-4.0/usb-gadget-f_fs-add-extra-check-before-unregister_gadget_item.patch @@ -0,0 +1,47 @@ +From f14e9ad17f46051b02bffffac2036486097de19e Mon Sep 17 00:00:00 2001 +From: Rui Miguel Silva +Date: Wed, 20 May 2015 14:52:40 +0100 +Subject: usb: gadget: f_fs: add extra check before unregister_gadget_item + +From: Rui Miguel Silva + +commit f14e9ad17f46051b02bffffac2036486097de19e upstream. + +ffs_closed can race with configfs_rmdir which will call config_item_release, so +add an extra check to avoid calling the unregister_gadget_item with an null +gadget item. + +Signed-off-by: Rui Miguel Silva +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -3433,6 +3433,7 @@ done: + static void ffs_closed(struct ffs_data *ffs) + { + struct ffs_dev *ffs_obj; ++ struct f_fs_opts *opts; + + ENTER(); + ffs_dev_lock(); +@@ -3446,8 +3447,13 @@ static void ffs_closed(struct ffs_data * + if (ffs_obj->ffs_closed_callback) + ffs_obj->ffs_closed_callback(ffs); + +- if (!ffs_obj->opts || ffs_obj->opts->no_configfs +- || !ffs_obj->opts->func_inst.group.cg_item.ci_parent) ++ if (ffs_obj->opts) ++ opts = ffs_obj->opts; ++ else ++ goto done; ++ ++ if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent ++ || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount)) + goto done; + + unregister_gadget_item(ffs_obj->opts-> diff --git a/queue-4.0/usb-gadget-f_fs-fix-check-in-read-operation.patch b/queue-4.0/usb-gadget-f_fs-fix-check-in-read-operation.patch new file mode 100644 index 00000000000..5a78f92c629 --- /dev/null +++ b/queue-4.0/usb-gadget-f_fs-fix-check-in-read-operation.patch @@ -0,0 +1,34 @@ +From 342f39a6c8d34d638a87b7d5f2156adc4db2585c Mon Sep 17 00:00:00 2001 +From: Rui Miguel Silva +Date: Wed, 20 May 2015 14:53:33 +0100 +Subject: usb: gadget: f_fs: fix check in read operation + +From: Rui Miguel Silva + +commit 342f39a6c8d34d638a87b7d5f2156adc4db2585c upstream. + +when copying to iter the size can be different then the iov count, +the check for full iov is wrong and make any read on request which +is not the exactly size of iov to return -EFAULT. + +So, just check the success of the copy. + +Signed-off-by: Rui Miguel Silva +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -845,7 +845,7 @@ static ssize_t ffs_epfile_io(struct file + ret = ep->status; + if (io_data->read && ret > 0) { + ret = copy_to_iter(data, ret, &io_data->data); +- if (unlikely(iov_iter_count(&io_data->data))) ++ if (!ret) + ret = -EFAULT; + } + }