From: Greg Kroah-Hartman Date: Tue, 26 Feb 2013 18:53:58 +0000 (-0800) Subject: 3.0-stable patches X-Git-Tag: v3.7.10~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6ae74d5915e3037ab15d0115e759826ce7ee3b97;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: staging-comedi-disallow-comedi_devconfig-on-non-board-minors.patch staging-vt6656-fix-urb-submitted-while-active-warning.patch --- diff --git a/queue-3.0/series b/queue-3.0/series index c679f7abb74..27edb64e846 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -30,3 +30,5 @@ sunvdc-fix-off-by-one-in-generic_request.patch drm-usb-bind-driver-to-correct-device.patch nls-improve-utf8-utf16-string-conversion-routine.patch drm-i915-disable-shared-panel-fitter-for-pipe.patch +staging-comedi-disallow-comedi_devconfig-on-non-board-minors.patch +staging-vt6656-fix-urb-submitted-while-active-warning.patch diff --git a/queue-3.0/staging-comedi-disallow-comedi_devconfig-on-non-board-minors.patch b/queue-3.0/staging-comedi-disallow-comedi_devconfig-on-non-board-minors.patch new file mode 100644 index 00000000000..85539b8fa62 --- /dev/null +++ b/queue-3.0/staging-comedi-disallow-comedi_devconfig-on-non-board-minors.patch @@ -0,0 +1,51 @@ +From 754ab5c0e55dd118273ca2c217c4d95e9fbc8259 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Mon, 28 Jan 2013 16:14:31 +0000 +Subject: staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors + +From: Ian Abbott + +commit 754ab5c0e55dd118273ca2c217c4d95e9fbc8259 upstream. + +Comedi has two sorts of minor devices: +(a) normal board minor devices in the range 0 to +COMEDI_NUM_BOARD_MINORS-1 inclusive; and +(b) special subdevice minor devices in the range COMEDI_NUM_BOARD_MINORS +upwards that are used to open the same underlying comedi device as the +normal board minor devices, but with non-default read and write +subdevices for asynchronous commands. + +The special subdevice minor devices get created when a board supporting +asynchronous commands is attached to a normal board minor device, and +destroyed when the board is detached from the normal board minor device. +One way to attach or detach a board is by using the COMEDI_DEVCONFIG +ioctl. This should only be used on normal board minors as the special +subdevice minors are too ephemeral. In particular, the change +introduced in commit 7d3135af399e92cf4c9bbc5f86b6c140aab3b88c ("staging: +comedi: prevent auto-unconfig of manually configured devices") breaks +horribly for special subdevice minor devices. + +Since there's no legitimate use for the COMEDI_DEVCONFIG ioctl on a +special subdevice minor device node, disallow it and return -ENOTTY. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -136,6 +136,11 @@ static long comedi_unlocked_ioctl(struct + /* Device config is special, because it must work on + * an unconfigured device. */ + if (cmd == COMEDI_DEVCONFIG) { ++ if (minor >= COMEDI_NUM_BOARD_MINORS) { ++ /* Device config not appropriate on non-board minors. */ ++ rc = -ENOTTY; ++ goto done; ++ } + rc = do_devconfig_ioctl(dev, + (struct comedi_devconfig __user *)arg); + if (rc == 0) diff --git a/queue-3.0/staging-vt6656-fix-urb-submitted-while-active-warning.patch b/queue-3.0/staging-vt6656-fix-urb-submitted-while-active-warning.patch new file mode 100644 index 00000000000..eab42c98177 --- /dev/null +++ b/queue-3.0/staging-vt6656-fix-urb-submitted-while-active-warning.patch @@ -0,0 +1,85 @@ +From ae5943de8c8c4438cbac5cda599ff0b88c224468 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Wed, 30 Jan 2013 20:07:29 +0000 +Subject: staging: vt6656: Fix URB submitted while active warning. + +From: Malcolm Priestley + +commit ae5943de8c8c4438cbac5cda599ff0b88c224468 upstream. + +This error happens because PIPEnsControlOut and PIPEnsControlIn unlock the +spin lock for delay, letting in another thread. + +The patch moves the current MP_SET_FLAG to before filling +of sUsbCtlRequest for pControlURB and clears it in event of failing. + +Any thread calling either function while fMP_CONTROL_READS or fMP_CONTROL_WRITES +flags set will return STATUS_FAILURE. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/usbpipe.c | 28 ++++++++++++++++++++-------- + 1 file changed, 20 insertions(+), 8 deletions(-) + +--- a/drivers/staging/vt6656/usbpipe.c ++++ b/drivers/staging/vt6656/usbpipe.c +@@ -168,6 +168,11 @@ int PIPEnsControlOut( + if (pDevice->Flags & fMP_CONTROL_WRITES) + return STATUS_FAILURE; + ++ if (pDevice->Flags & fMP_CONTROL_READS) ++ return STATUS_FAILURE; ++ ++ MP_SET_FLAG(pDevice, fMP_CONTROL_WRITES); ++ + pDevice->sUsbCtlRequest.bRequestType = 0x40; + pDevice->sUsbCtlRequest.bRequest = byRequest; + pDevice->sUsbCtlRequest.wValue = cpu_to_le16p(&wValue); +@@ -182,12 +187,13 @@ int PIPEnsControlOut( + + ntStatus = usb_submit_urb(pDevice->pControlURB, GFP_ATOMIC); + if (ntStatus != 0) { +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"control send request submission failed: %d\n", ntStatus); ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO ++ "control send request submission failed: %d\n", ++ ntStatus); ++ MP_CLEAR_FLAG(pDevice, fMP_CONTROL_WRITES); + return STATUS_FAILURE; + } +- else { +- MP_SET_FLAG(pDevice, fMP_CONTROL_WRITES); +- } ++ + spin_unlock_irq(&pDevice->lock); + for (ii = 0; ii <= USB_CTL_WAIT; ii ++) { + +@@ -227,6 +233,11 @@ int PIPEnsControlIn( + if (pDevice->Flags & fMP_CONTROL_READS) + return STATUS_FAILURE; + ++ if (pDevice->Flags & fMP_CONTROL_WRITES) ++ return STATUS_FAILURE; ++ ++ MP_SET_FLAG(pDevice, fMP_CONTROL_READS); ++ + pDevice->sUsbCtlRequest.bRequestType = 0xC0; + pDevice->sUsbCtlRequest.bRequest = byRequest; + pDevice->sUsbCtlRequest.wValue = cpu_to_le16p(&wValue); +@@ -240,10 +251,11 @@ int PIPEnsControlIn( + + ntStatus = usb_submit_urb(pDevice->pControlURB, GFP_ATOMIC); + if (ntStatus != 0) { +- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"control request submission failed: %d\n", ntStatus); +- }else { +- MP_SET_FLAG(pDevice, fMP_CONTROL_READS); +- } ++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO ++ "control request submission failed: %d\n", ntStatus); ++ MP_CLEAR_FLAG(pDevice, fMP_CONTROL_READS); ++ return STATUS_FAILURE; ++ } + + spin_unlock_irq(&pDevice->lock); + for (ii = 0; ii <= USB_CTL_WAIT; ii ++) {