From: Greg Kroah-Hartman Date: Thu, 18 May 2017 11:22:36 +0000 (+0200) Subject: usb-legotower patch should be delayed for a release X-Git-Tag: v3.18.54~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6687d8edd967951ad8e78ef21cf65cd99287f731;p=thirdparty%2Fkernel%2Fstable-queue.git usb-legotower patch should be delayed for a release so the fix for this one can land in Linus's tree. --- diff --git a/queue-4.10/usb-misc-legousbtower-fix-buffers-on-stack.patch b/next/usb-misc-legousbtower-fix-buffers-on-stack.patch similarity index 100% rename from queue-4.10/usb-misc-legousbtower-fix-buffers-on-stack.patch rename to next/usb-misc-legousbtower-fix-buffers-on-stack.patch diff --git a/queue-4.10/series b/queue-4.10/series index 1634167072a..26962fdf8b1 100644 --- a/queue-4.10/series +++ b/queue-4.10/series @@ -18,7 +18,6 @@ usb-gadget-legacy-gadgets-are-optional.patch usb-make-sure-usb-phy-of-gets-built-in.patch usb-hub-fix-error-loop-seen-after-hub-communication-errors.patch usb-hub-do-not-attempt-to-autosuspend-disconnected-devices.patch -usb-misc-legousbtower-fix-buffers-on-stack.patch x86-boot-fix-bss-corruption-overwrite-bug-in-early-x86-kernel-startup.patch selftests-x86-ldt_gdt_32-work-around-a-glibc-sigaction-bug.patch x86-pmem-fix-cache-flushing-for-iovec-write-8-bytes.patch diff --git a/queue-4.11/series b/queue-4.11/series index 226158c5ff3..b7f3f712cc4 100644 --- a/queue-4.11/series +++ b/queue-4.11/series @@ -19,7 +19,6 @@ usb-gadget-legacy-gadgets-are-optional.patch usb-make-sure-usb-phy-of-gets-built-in.patch usb-hub-fix-error-loop-seen-after-hub-communication-errors.patch usb-hub-do-not-attempt-to-autosuspend-disconnected-devices.patch -usb-misc-legousbtower-fix-buffers-on-stack.patch x86-boot-fix-bss-corruption-overwrite-bug-in-early-x86-kernel-startup.patch selftests-x86-ldt_gdt_32-work-around-a-glibc-sigaction-bug.patch x86-pmem-fix-cache-flushing-for-iovec-write-8-bytes.patch diff --git a/queue-4.11/usb-misc-legousbtower-fix-buffers-on-stack.patch b/queue-4.11/usb-misc-legousbtower-fix-buffers-on-stack.patch deleted file mode 100644 index d2ab86715e4..00000000000 --- a/queue-4.11/usb-misc-legousbtower-fix-buffers-on-stack.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 942a48730faf149ccbf3e12ac718aee120bb3529 Mon Sep 17 00:00:00 2001 -From: Maksim Salau -Date: Tue, 25 Apr 2017 22:49:21 +0300 -Subject: usb: misc: legousbtower: Fix buffers on stack - -From: Maksim Salau - -commit 942a48730faf149ccbf3e12ac718aee120bb3529 upstream. - -Allocate buffers on HEAP instead of STACK for local structures -that are to be received using usb_control_msg(). - -Signed-off-by: Maksim Salau -Tested-by: Alfredo Rafael Vicente Boix ; -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/usb/misc/legousbtower.c | 37 +++++++++++++++++++++++++++---------- - 1 file changed, 27 insertions(+), 10 deletions(-) - ---- a/drivers/usb/misc/legousbtower.c -+++ b/drivers/usb/misc/legousbtower.c -@@ -317,9 +317,16 @@ static int tower_open (struct inode *ino - int subminor; - int retval = 0; - struct usb_interface *interface; -- struct tower_reset_reply reset_reply; -+ struct tower_reset_reply *reset_reply; - int result; - -+ reset_reply = kmalloc(sizeof(*reset_reply), GFP_KERNEL); -+ -+ if (!reset_reply) { -+ retval = -ENOMEM; -+ goto exit; -+ } -+ - nonseekable_open(inode, file); - subminor = iminor(inode); - -@@ -364,8 +371,8 @@ static int tower_open (struct inode *ino - USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE, - 0, - 0, -- &reset_reply, -- sizeof(reset_reply), -+ reset_reply, -+ sizeof(*reset_reply), - 1000); - if (result < 0) { - dev_err(&dev->udev->dev, -@@ -406,6 +413,7 @@ unlock_exit: - mutex_unlock(&dev->lock); - - exit: -+ kfree(reset_reply); - return retval; - } - -@@ -808,7 +816,7 @@ static int tower_probe (struct usb_inter - struct lego_usb_tower *dev = NULL; - struct usb_host_interface *iface_desc; - struct usb_endpoint_descriptor* endpoint; -- struct tower_get_version_reply get_version_reply; -+ struct tower_get_version_reply *get_version_reply = NULL; - int i; - int retval = -ENOMEM; - int result; -@@ -886,6 +894,13 @@ static int tower_probe (struct usb_inter - dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; - dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; - -+ get_version_reply = kmalloc(sizeof(*get_version_reply), GFP_KERNEL); -+ -+ if (!get_version_reply) { -+ retval = -ENOMEM; -+ goto error; -+ } -+ - /* get the firmware version and log it */ - result = usb_control_msg (udev, - usb_rcvctrlpipe(udev, 0), -@@ -893,18 +908,19 @@ static int tower_probe (struct usb_inter - USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE, - 0, - 0, -- &get_version_reply, -- sizeof(get_version_reply), -+ get_version_reply, -+ sizeof(*get_version_reply), - 1000); - if (result < 0) { - dev_err(idev, "LEGO USB Tower get version control request failed\n"); - retval = result; - goto error; - } -- dev_info(&interface->dev, "LEGO USB Tower firmware version is %d.%d " -- "build %d\n", get_version_reply.major, -- get_version_reply.minor, -- le16_to_cpu(get_version_reply.build_no)); -+ dev_info(&interface->dev, -+ "LEGO USB Tower firmware version is %d.%d build %d\n", -+ get_version_reply->major, -+ get_version_reply->minor, -+ le16_to_cpu(get_version_reply->build_no)); - - /* we can register the device now, as it is ready */ - usb_set_intfdata (interface, dev); -@@ -928,6 +944,7 @@ exit: - return retval; - - error: -+ kfree(get_version_reply); - tower_delete(dev); - return retval; - } diff --git a/queue-4.4/series b/queue-4.4/series index e55738fbc47..fcbcae81722 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -15,7 +15,6 @@ usb-misc-add-missing-continue-in-switch.patch usb-make-sure-usb-phy-of-gets-built-in.patch usb-hub-fix-error-loop-seen-after-hub-communication-errors.patch usb-hub-do-not-attempt-to-autosuspend-disconnected-devices.patch -usb-misc-legousbtower-fix-buffers-on-stack.patch x86-boot-fix-bss-corruption-overwrite-bug-in-early-x86-kernel-startup.patch selftests-x86-ldt_gdt_32-work-around-a-glibc-sigaction-bug.patch x86-pmem-fix-cache-flushing-for-iovec-write-8-bytes.patch diff --git a/queue-4.4/usb-misc-legousbtower-fix-buffers-on-stack.patch b/queue-4.4/usb-misc-legousbtower-fix-buffers-on-stack.patch deleted file mode 100644 index 7c2402c93ce..00000000000 --- a/queue-4.4/usb-misc-legousbtower-fix-buffers-on-stack.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 942a48730faf149ccbf3e12ac718aee120bb3529 Mon Sep 17 00:00:00 2001 -From: Maksim Salau -Date: Tue, 25 Apr 2017 22:49:21 +0300 -Subject: usb: misc: legousbtower: Fix buffers on stack - -From: Maksim Salau - -commit 942a48730faf149ccbf3e12ac718aee120bb3529 upstream. - -Allocate buffers on HEAP instead of STACK for local structures -that are to be received using usb_control_msg(). - -Signed-off-by: Maksim Salau -Tested-by: Alfredo Rafael Vicente Boix ; -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/usb/misc/legousbtower.c | 37 +++++++++++++++++++++++++++---------- - 1 file changed, 27 insertions(+), 10 deletions(-) - ---- a/drivers/usb/misc/legousbtower.c -+++ b/drivers/usb/misc/legousbtower.c -@@ -317,9 +317,16 @@ static int tower_open (struct inode *ino - int subminor; - int retval = 0; - struct usb_interface *interface; -- struct tower_reset_reply reset_reply; -+ struct tower_reset_reply *reset_reply; - int result; - -+ reset_reply = kmalloc(sizeof(*reset_reply), GFP_KERNEL); -+ -+ if (!reset_reply) { -+ retval = -ENOMEM; -+ goto exit; -+ } -+ - nonseekable_open(inode, file); - subminor = iminor(inode); - -@@ -364,8 +371,8 @@ static int tower_open (struct inode *ino - USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE, - 0, - 0, -- &reset_reply, -- sizeof(reset_reply), -+ reset_reply, -+ sizeof(*reset_reply), - 1000); - if (result < 0) { - dev_err(&dev->udev->dev, -@@ -406,6 +413,7 @@ unlock_exit: - mutex_unlock(&dev->lock); - - exit: -+ kfree(reset_reply); - return retval; - } - -@@ -808,7 +816,7 @@ static int tower_probe (struct usb_inter - struct lego_usb_tower *dev = NULL; - struct usb_host_interface *iface_desc; - struct usb_endpoint_descriptor* endpoint; -- struct tower_get_version_reply get_version_reply; -+ struct tower_get_version_reply *get_version_reply = NULL; - int i; - int retval = -ENOMEM; - int result; -@@ -898,6 +906,13 @@ static int tower_probe (struct usb_inter - dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; - dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; - -+ get_version_reply = kmalloc(sizeof(*get_version_reply), GFP_KERNEL); -+ -+ if (!get_version_reply) { -+ retval = -ENOMEM; -+ goto error; -+ } -+ - /* get the firmware version and log it */ - result = usb_control_msg (udev, - usb_rcvctrlpipe(udev, 0), -@@ -905,18 +920,19 @@ static int tower_probe (struct usb_inter - USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE, - 0, - 0, -- &get_version_reply, -- sizeof(get_version_reply), -+ get_version_reply, -+ sizeof(*get_version_reply), - 1000); - if (result < 0) { - dev_err(idev, "LEGO USB Tower get version control request failed\n"); - retval = result; - goto error; - } -- dev_info(&interface->dev, "LEGO USB Tower firmware version is %d.%d " -- "build %d\n", get_version_reply.major, -- get_version_reply.minor, -- le16_to_cpu(get_version_reply.build_no)); -+ dev_info(&interface->dev, -+ "LEGO USB Tower firmware version is %d.%d build %d\n", -+ get_version_reply->major, -+ get_version_reply->minor, -+ le16_to_cpu(get_version_reply->build_no)); - - /* we can register the device now, as it is ready */ - usb_set_intfdata (interface, dev); -@@ -940,6 +956,7 @@ exit: - return retval; - - error: -+ kfree(get_version_reply); - tower_delete(dev); - return retval; - } diff --git a/queue-4.9/series b/queue-4.9/series index 707c7ad7422..d05d08501a3 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -17,7 +17,6 @@ usb-gadget-legacy-gadgets-are-optional.patch usb-make-sure-usb-phy-of-gets-built-in.patch usb-hub-fix-error-loop-seen-after-hub-communication-errors.patch usb-hub-do-not-attempt-to-autosuspend-disconnected-devices.patch -usb-misc-legousbtower-fix-buffers-on-stack.patch x86-boot-fix-bss-corruption-overwrite-bug-in-early-x86-kernel-startup.patch selftests-x86-ldt_gdt_32-work-around-a-glibc-sigaction-bug.patch x86-pmem-fix-cache-flushing-for-iovec-write-8-bytes.patch diff --git a/queue-4.9/usb-misc-legousbtower-fix-buffers-on-stack.patch b/queue-4.9/usb-misc-legousbtower-fix-buffers-on-stack.patch deleted file mode 100644 index d2ab86715e4..00000000000 --- a/queue-4.9/usb-misc-legousbtower-fix-buffers-on-stack.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 942a48730faf149ccbf3e12ac718aee120bb3529 Mon Sep 17 00:00:00 2001 -From: Maksim Salau -Date: Tue, 25 Apr 2017 22:49:21 +0300 -Subject: usb: misc: legousbtower: Fix buffers on stack - -From: Maksim Salau - -commit 942a48730faf149ccbf3e12ac718aee120bb3529 upstream. - -Allocate buffers on HEAP instead of STACK for local structures -that are to be received using usb_control_msg(). - -Signed-off-by: Maksim Salau -Tested-by: Alfredo Rafael Vicente Boix ; -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/usb/misc/legousbtower.c | 37 +++++++++++++++++++++++++++---------- - 1 file changed, 27 insertions(+), 10 deletions(-) - ---- a/drivers/usb/misc/legousbtower.c -+++ b/drivers/usb/misc/legousbtower.c -@@ -317,9 +317,16 @@ static int tower_open (struct inode *ino - int subminor; - int retval = 0; - struct usb_interface *interface; -- struct tower_reset_reply reset_reply; -+ struct tower_reset_reply *reset_reply; - int result; - -+ reset_reply = kmalloc(sizeof(*reset_reply), GFP_KERNEL); -+ -+ if (!reset_reply) { -+ retval = -ENOMEM; -+ goto exit; -+ } -+ - nonseekable_open(inode, file); - subminor = iminor(inode); - -@@ -364,8 +371,8 @@ static int tower_open (struct inode *ino - USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE, - 0, - 0, -- &reset_reply, -- sizeof(reset_reply), -+ reset_reply, -+ sizeof(*reset_reply), - 1000); - if (result < 0) { - dev_err(&dev->udev->dev, -@@ -406,6 +413,7 @@ unlock_exit: - mutex_unlock(&dev->lock); - - exit: -+ kfree(reset_reply); - return retval; - } - -@@ -808,7 +816,7 @@ static int tower_probe (struct usb_inter - struct lego_usb_tower *dev = NULL; - struct usb_host_interface *iface_desc; - struct usb_endpoint_descriptor* endpoint; -- struct tower_get_version_reply get_version_reply; -+ struct tower_get_version_reply *get_version_reply = NULL; - int i; - int retval = -ENOMEM; - int result; -@@ -886,6 +894,13 @@ static int tower_probe (struct usb_inter - dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; - dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; - -+ get_version_reply = kmalloc(sizeof(*get_version_reply), GFP_KERNEL); -+ -+ if (!get_version_reply) { -+ retval = -ENOMEM; -+ goto error; -+ } -+ - /* get the firmware version and log it */ - result = usb_control_msg (udev, - usb_rcvctrlpipe(udev, 0), -@@ -893,18 +908,19 @@ static int tower_probe (struct usb_inter - USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE, - 0, - 0, -- &get_version_reply, -- sizeof(get_version_reply), -+ get_version_reply, -+ sizeof(*get_version_reply), - 1000); - if (result < 0) { - dev_err(idev, "LEGO USB Tower get version control request failed\n"); - retval = result; - goto error; - } -- dev_info(&interface->dev, "LEGO USB Tower firmware version is %d.%d " -- "build %d\n", get_version_reply.major, -- get_version_reply.minor, -- le16_to_cpu(get_version_reply.build_no)); -+ dev_info(&interface->dev, -+ "LEGO USB Tower firmware version is %d.%d build %d\n", -+ get_version_reply->major, -+ get_version_reply->minor, -+ le16_to_cpu(get_version_reply->build_no)); - - /* we can register the device now, as it is ready */ - usb_set_intfdata (interface, dev); -@@ -928,6 +944,7 @@ exit: - return retval; - - error: -+ kfree(get_version_reply); - tower_delete(dev); - return retval; - }