From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Tue, 15 Dec 2009 18:14:24 +0000 (-0800)
Subject: start the 2.6.32 patch series
X-Git-Tag: v2.6.27.42~26
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5ebc794faad1f2ff0cdc3799d2c9d21306746079;p=thirdparty%2Fkernel%2Fstable-queue.git

start the 2.6.32 patch series
---

diff --git a/queue-2.6.32/series b/queue-2.6.32/series
new file mode 100644
index 00000000000..f0db9038038
--- /dev/null
+++ b/queue-2.6.32/series
@@ -0,0 +1 @@
+usb-usb-storage-fix-bug-in-fill_inquiry.patch
diff --git a/queue-2.6.32/usb-usb-storage-fix-bug-in-fill_inquiry.patch b/queue-2.6.32/usb-usb-storage-fix-bug-in-fill_inquiry.patch
new file mode 100644
index 00000000000..4f5366f0d6e
--- /dev/null
+++ b/queue-2.6.32/usb-usb-storage-fix-bug-in-fill_inquiry.patch
@@ -0,0 +1,57 @@
+From f3f6faa9edf67c1018270793e0547b0f81abb47e Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 7 Dec 2009 16:47:43 -0500
+Subject: USB: usb-storage: fix bug in fill_inquiry
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit f3f6faa9edf67c1018270793e0547b0f81abb47e upstream.
+
+This patch (as1312) fixes a minor bug in usb-storage.  The
+fill_inquiry() routine neglects to pre-load the inquiry data buffer
+with spaces.  As a result, if the vendor name is shorter than 8
+characters or the product name is shorter than 16, the remainder will
+be filled with garbage.
+
+The patch also removes some unnecessary calls to strlen().
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/usb.c |   15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -228,6 +228,7 @@ void fill_inquiry_response(struct us_dat
+ 	if (data_len<36) // You lose.
+ 		return;
+ 
++	memset(data+8, ' ', 28);
+ 	if(data[0]&0x20) { /* USB device currently not connected. Return
+ 			      peripheral qualifier 001b ("...however, the
+ 			      physical device is not currently connected
+@@ -237,15 +238,15 @@ void fill_inquiry_response(struct us_dat
+ 			      device, it may return zeros or ASCII spaces 
+ 			      (20h) in those fields until the data is
+ 			      available from the device."). */
+-		memset(data+8,0,28);
+ 	} else {
+ 		u16 bcdDevice = le16_to_cpu(us->pusb_dev->descriptor.bcdDevice);
+-		memcpy(data+8, us->unusual_dev->vendorName, 
+-			strlen(us->unusual_dev->vendorName) > 8 ? 8 :
+-			strlen(us->unusual_dev->vendorName));
+-		memcpy(data+16, us->unusual_dev->productName, 
+-			strlen(us->unusual_dev->productName) > 16 ? 16 :
+-			strlen(us->unusual_dev->productName));
++		int n;
++
++		n = strlen(us->unusual_dev->vendorName);
++		memcpy(data+8, us->unusual_dev->vendorName, min(8, n));
++		n = strlen(us->unusual_dev->productName);
++		memcpy(data+16, us->unusual_dev->productName, min(16, n));
++
+ 		data[32] = 0x30 + ((bcdDevice>>12) & 0x0F);
+ 		data[33] = 0x30 + ((bcdDevice>>8) & 0x0F);
+ 		data[34] = 0x30 + ((bcdDevice>>4) & 0x0F);