From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Thu, 15 Oct 2009 18:52:58 +0000 (-0700)
Subject: .27 patches
X-Git-Tag: v2.6.27.38~7
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=65c0db12c436219d78cb0e76339eb26c94802e9c;p=thirdparty%2Fkernel%2Fstable-queue.git

.27 patches
---

diff --git a/queue-2.6.27/scsi-fix-protection-scsi_data_buffer-leak.patch b/queue-2.6.27/scsi-fix-protection-scsi_data_buffer-leak.patch
new file mode 100644
index 00000000000..8663a81debe
--- /dev/null
+++ b/queue-2.6.27/scsi-fix-protection-scsi_data_buffer-leak.patch
@@ -0,0 +1,51 @@
+From b4c2554d40ceac130a8d062eaa8838ed22158c45 Mon Sep 17 00:00:00 2001
+From: Martin K. Petersen <martin.petersen@oracle.com>
+Date: Fri, 18 Sep 2009 17:33:01 -0400
+Subject: SCSI: Fix protection scsi_data_buffer leak
+
+From: Martin K. Petersen <martin.petersen@oracle.com>
+
+commit b4c2554d40ceac130a8d062eaa8838ed22158c45 upstream.
+
+We would leak a scsi_data_buffer if the free_list command was of the
+protected variety.
+
+Reported-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi.c |   11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -243,10 +243,7 @@ scsi_host_alloc_command(struct Scsi_Host
+  */
+ struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask)
+ {
+-	struct scsi_cmnd *cmd;
+-	unsigned char *buf;
+-
+-	cmd = scsi_host_alloc_command(shost, gfp_mask);
++	struct scsi_cmnd *cmd = scsi_host_alloc_command(shost, gfp_mask);
+ 
+ 	if (unlikely(!cmd)) {
+ 		unsigned long flags;
+@@ -260,9 +257,15 @@ struct scsi_cmnd *__scsi_get_command(str
+ 		spin_unlock_irqrestore(&shost->free_list_lock, flags);
+ 
+ 		if (cmd) {
++			void *buf, *prot;
++
+ 			buf = cmd->sense_buffer;
++			prot = cmd->prot_sdb;
++
+ 			memset(cmd, 0, sizeof(*cmd));
++
+ 			cmd->sense_buffer = buf;
++			cmd->prot_sdb = prot;
+ 		}
+ 	}
+ 
diff --git a/queue-2.6.27/series b/queue-2.6.27/series
index 8cab8179853..dbea213068f 100644
--- a/queue-2.6.27/series
+++ b/queue-2.6.27/series
@@ -1 +1,3 @@
 usb-serial-fix-crash-when-sub-driver-updates-firmware.patch
+scsi-fix-protection-scsi_data_buffer-leak.patch
+usb-digi_acceleport-fix-broken-unthrottle.patch
diff --git a/queue-2.6.27/usb-digi_acceleport-fix-broken-unthrottle.patch b/queue-2.6.27/usb-digi_acceleport-fix-broken-unthrottle.patch
new file mode 100644
index 00000000000..b234ba9e6a5
--- /dev/null
+++ b/queue-2.6.27/usb-digi_acceleport-fix-broken-unthrottle.patch
@@ -0,0 +1,43 @@
+From ba6b702f85a61561d329c4c11d3ed95604924f9a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 29 Sep 2009 12:39:23 +0200
+Subject: USB: digi_acceleport: Fix broken unthrottle.
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit ba6b702f85a61561d329c4c11d3ed95604924f9a upstream.
+
+This patch fixes a regression introduced in
+39892da44b21b5362eb848ca424d73a25ccc488f.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Acked-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/digi_acceleport.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/serial/digi_acceleport.c
++++ b/drivers/usb/serial/digi_acceleport.c
+@@ -892,16 +892,16 @@ static void digi_rx_unthrottle(struct tt
+ 
+ 	spin_lock_irqsave(&priv->dp_port_lock, flags);
+ 
+-	/* turn throttle off */
+-	priv->dp_throttled = 0;
+-	priv->dp_throttle_restart = 0;
+-
+ 	/* restart read chain */
+ 	if (priv->dp_throttle_restart) {
+ 		port->read_urb->dev = port->serial->dev;
+ 		ret = usb_submit_urb(port->read_urb, GFP_ATOMIC);
+ 	}
+ 
++	/* turn throttle off */
++	priv->dp_throttled = 0;
++	priv->dp_throttle_restart = 0;
++
+ 	spin_unlock_irqrestore(&priv->dp_port_lock, flags);
+ 
+ 	if (ret)