From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 1 Apr 2013 23:44:44 +0000 (-0700)
Subject: 3.4-stable patches
X-Git-Tag: v3.8.6~33
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=77a410811afd1df903801c7a69f896331245c8e0;p=thirdparty%2Fkernel%2Fstable-queue.git

3.4-stable patches

added patches:
	usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch
---

diff --git a/queue-3.4/series b/queue-3.4/series
index 5636cedf576..5f973eaba45 100644
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -28,3 +28,4 @@ usb-xhci-fix-trb-transfer-length-macro-used-for-event-trb.patch
 btrfs-fix-race-between-mmap-writes-and-compression.patch
 btrfs-limit-the-global-reserve-to-512mb.patch
 btrfs-don-t-drop-path-when-printing-out-tree-errors-in-scrub.patch
+usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch
diff --git a/queue-3.4/usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch b/queue-3.4/usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch
new file mode 100644
index 00000000000..5e49fb71904
--- /dev/null
+++ b/queue-3.4/usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch
@@ -0,0 +1,40 @@
+From 511f3c5326eabe1ece35202a404c24c0aeacc246 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 15 Mar 2013 14:02:14 -0400
+Subject: usb: gadget: udc-core: fix a regression during gadget driver unbinding
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 511f3c5326eabe1ece35202a404c24c0aeacc246 upstream.
+
+This patch (as1666) fixes a regression in the UDC core.  The core
+takes care of unbinding gadget drivers, and it does the unbinding
+before telling the UDC driver to turn off the controller hardware.
+When the call to the udc_stop callback is made, the gadget no longer
+has a driver.  The callback routine should not be invoked with a
+pointer to the old driver; doing so can cause problems (such as
+use-after-free accesses in net2280).
+
+This patch should be applied, with appropriate context changes, to all
+the stable kernels going back to 3.1.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/usb/gadget/udc-core.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc-core.c
++++ b/drivers/usb/gadget/udc-core.c
+@@ -265,7 +265,7 @@ static void usb_gadget_remove_driver(str
+ 		udc->driver->disconnect(udc->gadget);
+ 		usb_gadget_disconnect(udc->gadget);
+ 		udc->driver->unbind(udc->gadget);
+-		usb_gadget_udc_stop(udc->gadget, udc->driver);
++		usb_gadget_udc_stop(udc->gadget, NULL);
+ 	} else {
+ 		usb_gadget_stop(udc->gadget, udc->driver);
+ 	}