From: Greg Kroah-Hartman Date: Mon, 18 Jun 2012 16:57:04 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.36~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a9f2c3515d194114b89883f1e59e22a531d6bc88;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: rpc_pipefs-allow-rpc_purge_list-to-take-a-null-waitq-pointer.patch scsi-mpt2sas-fix-unsafe-using-smp_processor_id-in-preemptible.patch swap-fix-shmem-swapping-when-more-than-8-areas.patch tracing-have-tracing_off-actually-turn-tracing-off.patch usb-option-add-more-yuga-device-ids.patch usb-option-add-vodafone-huawei-k5005-support.patch usb-option-fix-memory-leak.patch usb-option-fix-port-data-abuse.patch usb-option-updated-huawei-k4605-has-better-id.patch --- diff --git a/queue-3.4/rpc_pipefs-allow-rpc_purge_list-to-take-a-null-waitq-pointer.patch b/queue-3.4/rpc_pipefs-allow-rpc_purge_list-to-take-a-null-waitq-pointer.patch new file mode 100644 index 00000000000..8a4c9a82d95 --- /dev/null +++ b/queue-3.4/rpc_pipefs-allow-rpc_purge_list-to-take-a-null-waitq-pointer.patch @@ -0,0 +1,51 @@ +From 92123e068efa310b09e9943ac1cfd10ff6b6d2e4 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Mon, 11 Jun 2012 10:03:42 -0400 +Subject: rpc_pipefs: allow rpc_purge_list to take a NULL waitq pointer + +From: Jeff Layton + +commit 92123e068efa310b09e9943ac1cfd10ff6b6d2e4 upstream. + +In the event that we don't have a dentry for a rpc_pipefs pipe, we still +need to allow the queue_timeout job to clean out the queue. There's just +no waitq to wake up in that event. + +Reported-by: Hans de Bruin +Reported-by: Joerg Platte +Signed-off-by: Jeff Layton +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/rpc_pipe.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/net/sunrpc/rpc_pipe.c ++++ b/net/sunrpc/rpc_pipe.c +@@ -71,7 +71,9 @@ static void rpc_purge_list(wait_queue_he + msg->errno = err; + destroy_msg(msg); + } while (!list_empty(head)); +- wake_up(waitq); ++ ++ if (waitq) ++ wake_up(waitq); + } + + static void +@@ -91,11 +93,9 @@ rpc_timeout_upcall_queue(struct work_str + } + dentry = dget(pipe->dentry); + spin_unlock(&pipe->lock); +- if (dentry) { +- rpc_purge_list(&RPC_I(dentry->d_inode)->waitq, +- &free_list, destroy_msg, -ETIMEDOUT); +- dput(dentry); +- } ++ rpc_purge_list(dentry ? &RPC_I(dentry->d_inode)->waitq : NULL, ++ &free_list, destroy_msg, -ETIMEDOUT); ++ dput(dentry); + } + + ssize_t rpc_pipe_generic_upcall(struct file *filp, struct rpc_pipe_msg *msg, diff --git a/queue-3.4/scsi-mpt2sas-fix-unsafe-using-smp_processor_id-in-preemptible.patch b/queue-3.4/scsi-mpt2sas-fix-unsafe-using-smp_processor_id-in-preemptible.patch new file mode 100644 index 00000000000..9e9e79284df --- /dev/null +++ b/queue-3.4/scsi-mpt2sas-fix-unsafe-using-smp_processor_id-in-preemptible.patch @@ -0,0 +1,33 @@ +From a2c658505bf5c75516ee0a79287223e86a2474af Mon Sep 17 00:00:00 2001 +From: "nagalakshmi.nandigama@lsi.com" +Date: Tue, 17 Apr 2012 11:25:04 +0530 +Subject: SCSI: mpt2sas: Fix unsafe using smp_processor_id() in preemptible + +From: "nagalakshmi.nandigama@lsi.com" + +commit a2c658505bf5c75516ee0a79287223e86a2474af upstream. + +When CONFIG_DEBUG_PREEMPT is enabled, bug is observed in the smp_processor_id(). +This is because smp_processor_id() is not called in preempt safe condition. + +To fix this issue, use raw_smp_processor_id instead of smp_processor_id. + +Signed-off-by: Nagalakshmi Nandigama +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt2sas/mpt2sas_base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/mpt2sas/mpt2sas_base.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c +@@ -1785,7 +1785,7 @@ static inline void _base_writeq(__u64 b, + static inline u8 + _base_get_msix_index(struct MPT2SAS_ADAPTER *ioc) + { +- return ioc->cpu_msix_table[smp_processor_id()]; ++ return ioc->cpu_msix_table[raw_smp_processor_id()]; + } + + /** diff --git a/queue-3.4/series b/queue-3.4/series index a16e0a4a8f0..0f160c3b096 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -13,3 +13,12 @@ xen-setup-filter-aperfmperf-cpuid-feature-out.patch nfsv4.1-fix-a-request-leak-on-the-back-channel.patch nfsv4-fix-unnecessary-delegation-returns-in-nfs4_do_open.patch nfsd4-bug_on-is_spin_locked-no-good-on-up-kernels.patch +tracing-have-tracing_off-actually-turn-tracing-off.patch +rpc_pipefs-allow-rpc_purge_list-to-take-a-null-waitq-pointer.patch +scsi-mpt2sas-fix-unsafe-using-smp_processor_id-in-preemptible.patch +swap-fix-shmem-swapping-when-more-than-8-areas.patch +usb-option-add-vodafone-huawei-k5005-support.patch +usb-option-updated-huawei-k4605-has-better-id.patch +usb-option-add-more-yuga-device-ids.patch +usb-option-fix-memory-leak.patch +usb-option-fix-port-data-abuse.patch diff --git a/queue-3.4/swap-fix-shmem-swapping-when-more-than-8-areas.patch b/queue-3.4/swap-fix-shmem-swapping-when-more-than-8-areas.patch new file mode 100644 index 00000000000..4ff7c82133e --- /dev/null +++ b/queue-3.4/swap-fix-shmem-swapping-when-more-than-8-areas.patch @@ -0,0 +1,98 @@ +From 9b15b817f3d62409290fd56fe3cbb076a931bb0a Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Fri, 15 Jun 2012 17:55:50 -0700 +Subject: swap: fix shmem swapping when more than 8 areas + +From: Hugh Dickins + +commit 9b15b817f3d62409290fd56fe3cbb076a931bb0a upstream. + +Minchan Kim reports that when a system has many swap areas, and tmpfs +swaps out to the ninth or more, shmem_getpage_gfp()'s attempts to read +back the page cannot locate it, and the read fails with -ENOMEM. + +Whoops. Yes, I blindly followed read_swap_header()'s pte_to_swp_entry( +swp_entry_to_pte()) technique for determining maximum usable swap +offset, without stopping to realize that that actually depends upon the +pte swap encoding shifting swap offset to the higher bits and truncating +it there. Whereas our radix_tree swap encoding leaves offset in the +lower bits: it's swap "type" (that is, index of swap area) that was +truncated. + +Fix it by reducing the SWP_TYPE_SHIFT() in swapops.h, and removing the +broken radix_to_swp_entry(swp_to_radix_entry()) from read_swap_header(). + +This does not reduce the usable size of a swap area any further, it +leaves it as claimed when making the original commit: no change from 3.0 +on x86_64, nor on i386 without PAE; but 3.0's 512GB is reduced to 128GB +per swapfile on i386 with PAE. It's not a change I would have risked +five years ago, but with x86_64 supported for ten years, I believe it's +appropriate now. + +Hmm, and what if some architecture implements its swap pte with offset +encoded below type? That would equally break the maximum usable swap +offset check. Happily, they all follow the same tradition of encoding +offset above type, but I'll prepare a check on that for next. + +Reported-and-Reviewed-and-Tested-by: Minchan Kim +Signed-off-by: Hugh Dickins +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/swapops.h | 8 +++++--- + mm/swapfile.c | 12 ++++-------- + 2 files changed, 9 insertions(+), 11 deletions(-) + +--- a/include/linux/swapops.h ++++ b/include/linux/swapops.h +@@ -9,13 +9,15 @@ + * get good packing density in that tree, so the index should be dense in + * the low-order bits. + * +- * We arrange the `type' and `offset' fields so that `type' is at the five ++ * We arrange the `type' and `offset' fields so that `type' is at the seven + * high-order bits of the swp_entry_t and `offset' is right-aligned in the +- * remaining bits. ++ * remaining bits. Although `type' itself needs only five bits, we allow for ++ * shmem/tmpfs to shift it all up a further two bits: see swp_to_radix_entry(). + * + * swp_entry_t's are *never* stored anywhere in their arch-dependent format. + */ +-#define SWP_TYPE_SHIFT(e) (sizeof(e.val) * 8 - MAX_SWAPFILES_SHIFT) ++#define SWP_TYPE_SHIFT(e) ((sizeof(e.val) * 8) - \ ++ (MAX_SWAPFILES_SHIFT + RADIX_TREE_EXCEPTIONAL_SHIFT)) + #define SWP_OFFSET_MASK(e) ((1UL << SWP_TYPE_SHIFT(e)) - 1) + + /* +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -1924,24 +1924,20 @@ static unsigned long read_swap_header(st + + /* + * Find out how many pages are allowed for a single swap +- * device. There are three limiting factors: 1) the number ++ * device. There are two limiting factors: 1) the number + * of bits for the swap offset in the swp_entry_t type, and + * 2) the number of bits in the swap pte as defined by the +- * the different architectures, and 3) the number of free bits +- * in an exceptional radix_tree entry. In order to find the ++ * different architectures. In order to find the + * largest possible bit mask, a swap entry with swap type 0 + * and swap offset ~0UL is created, encoded to a swap pte, + * decoded to a swp_entry_t again, and finally the swap + * offset is extracted. This will mask all the bits from + * the initial ~0UL mask that can't be encoded in either + * the swp_entry_t or the architecture definition of a +- * swap pte. Then the same is done for a radix_tree entry. ++ * swap pte. + */ + maxpages = swp_offset(pte_to_swp_entry( +- swp_entry_to_pte(swp_entry(0, ~0UL)))); +- maxpages = swp_offset(radix_to_swp_entry( +- swp_to_radix_entry(swp_entry(0, maxpages)))) + 1; +- ++ swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1; + if (maxpages > swap_header->info.last_page) { + maxpages = swap_header->info.last_page + 1; + /* p->max is an unsigned int: don't overflow it */ diff --git a/queue-3.4/tracing-have-tracing_off-actually-turn-tracing-off.patch b/queue-3.4/tracing-have-tracing_off-actually-turn-tracing-off.patch new file mode 100644 index 00000000000..6d24957c293 --- /dev/null +++ b/queue-3.4/tracing-have-tracing_off-actually-turn-tracing-off.patch @@ -0,0 +1,37 @@ +From f2bf1f6f5f89d031245067512449fc889b2f4bb2 Mon Sep 17 00:00:00 2001 +From: Steven Rostedt +Date: Wed, 6 Jun 2012 19:50:40 -0400 +Subject: tracing: Have tracing_off() actually turn tracing off + +From: Steven Rostedt + +commit f2bf1f6f5f89d031245067512449fc889b2f4bb2 upstream. + +A recent update to have tracing_on/off() only affect the ftrace ring +buffers instead of all ring buffers had a cut and paste error. +The tracing_off() did the exact same thing as tracing_on() and +would not actually turn off tracing. Unfortunately, tracing_off() +is more important to be working than tracing_on() as this is a key +development tool, as it lets the developer turn off tracing as soon +as a problem is discovered. It is also used by panic and oops code. + +This bug also breaks the 'echo func:traceoff > set_ftrace_filter' + +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -383,7 +383,7 @@ EXPORT_SYMBOL_GPL(tracing_on); + void tracing_off(void) + { + if (global_trace.buffer) +- ring_buffer_record_on(global_trace.buffer); ++ ring_buffer_record_off(global_trace.buffer); + /* + * This flag is only looked at when buffers haven't been + * allocated yet. We don't really care about the race diff --git a/queue-3.4/usb-option-add-more-yuga-device-ids.patch b/queue-3.4/usb-option-add-more-yuga-device-ids.patch new file mode 100644 index 00000000000..03ecb402a98 --- /dev/null +++ b/queue-3.4/usb-option-add-more-yuga-device-ids.patch @@ -0,0 +1,90 @@ +From 0ef0be15fd2564767f114c249fc4af704d8e16f4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=E8=AF=B4=E4=B8=8D=E5=BE=97?= +Date: Mon, 28 May 2012 21:31:29 +0800 +Subject: USB: option: add more YUGA device ids + +From: =?UTF-8?q?=E8=AF=B4=E4=B8=8D=E5=BE=97?= + +commit 0ef0be15fd2564767f114c249fc4af704d8e16f4 upstream. + +Signed-off-by: gavin zhu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 42 ++++++++++++++++++++++++++---------------- + 1 file changed, 26 insertions(+), 16 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -426,7 +426,7 @@ static void option_instat_callback(struc + #define SAMSUNG_VENDOR_ID 0x04e8 + #define SAMSUNG_PRODUCT_GT_B3730 0x6889 + +-/* YUGA products www.yuga-info.com*/ ++/* YUGA products www.yuga-info.com gavin.kx@qq.com */ + #define YUGA_VENDOR_ID 0x257A + #define YUGA_PRODUCT_CEM600 0x1601 + #define YUGA_PRODUCT_CEM610 0x1602 +@@ -443,6 +443,8 @@ static void option_instat_callback(struc + #define YUGA_PRODUCT_CEU516 0x160C + #define YUGA_PRODUCT_CEU528 0x160D + #define YUGA_PRODUCT_CEU526 0x160F ++#define YUGA_PRODUCT_CEU881 0x161F ++#define YUGA_PRODUCT_CEU882 0x162F + + #define YUGA_PRODUCT_CWM600 0x2601 + #define YUGA_PRODUCT_CWM610 0x2602 +@@ -458,23 +460,26 @@ static void option_instat_callback(struc + #define YUGA_PRODUCT_CWU518 0x260B + #define YUGA_PRODUCT_CWU516 0x260C + #define YUGA_PRODUCT_CWU528 0x260D ++#define YUGA_PRODUCT_CWU581 0x260E + #define YUGA_PRODUCT_CWU526 0x260F ++#define YUGA_PRODUCT_CWU582 0x261F ++#define YUGA_PRODUCT_CWU583 0x262F + +-#define YUGA_PRODUCT_CLM600 0x2601 +-#define YUGA_PRODUCT_CLM610 0x2602 +-#define YUGA_PRODUCT_CLM500 0x2603 +-#define YUGA_PRODUCT_CLM510 0x2604 +-#define YUGA_PRODUCT_CLM800 0x2605 +-#define YUGA_PRODUCT_CLM900 0x2606 +- +-#define YUGA_PRODUCT_CLU718 0x2607 +-#define YUGA_PRODUCT_CLU716 0x2608 +-#define YUGA_PRODUCT_CLU728 0x2609 +-#define YUGA_PRODUCT_CLU726 0x260A +-#define YUGA_PRODUCT_CLU518 0x260B +-#define YUGA_PRODUCT_CLU516 0x260C +-#define YUGA_PRODUCT_CLU528 0x260D +-#define YUGA_PRODUCT_CLU526 0x260F ++#define YUGA_PRODUCT_CLM600 0x3601 ++#define YUGA_PRODUCT_CLM610 0x3602 ++#define YUGA_PRODUCT_CLM500 0x3603 ++#define YUGA_PRODUCT_CLM510 0x3604 ++#define YUGA_PRODUCT_CLM800 0x3605 ++#define YUGA_PRODUCT_CLM900 0x3606 ++ ++#define YUGA_PRODUCT_CLU718 0x3607 ++#define YUGA_PRODUCT_CLU716 0x3608 ++#define YUGA_PRODUCT_CLU728 0x3609 ++#define YUGA_PRODUCT_CLU726 0x360A ++#define YUGA_PRODUCT_CLU518 0x360B ++#define YUGA_PRODUCT_CLU516 0x360C ++#define YUGA_PRODUCT_CLU528 0x360D ++#define YUGA_PRODUCT_CLU526 0x360F + + /* Viettel products */ + #define VIETTEL_VENDOR_ID 0x2262 +@@ -1215,6 +1220,11 @@ static const struct usb_device_id option + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU516) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) }, + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) }, ++ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU881) }, ++ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU882) }, ++ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU581) }, ++ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU582) }, ++ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU583) }, + { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) }, + { USB_DEVICE(LG_VENDOR_ID, LG_PRODUCT_L02C) }, /* docomo L-02C modem */ diff --git a/queue-3.4/usb-option-add-vodafone-huawei-k5005-support.patch b/queue-3.4/usb-option-add-vodafone-huawei-k5005-support.patch new file mode 100644 index 00000000000..37eb7ec2ba4 --- /dev/null +++ b/queue-3.4/usb-option-add-vodafone-huawei-k5005-support.patch @@ -0,0 +1,40 @@ +From 4cbbb039a9719fb3bba73d255c6a95bc6dc6428b Mon Sep 17 00:00:00 2001 +From: Bjørn Mork +Date: Sat, 19 May 2012 19:20:50 +0200 +Subject: USB: option: Add Vodafone/Huawei K5005 support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +commit 4cbbb039a9719fb3bba73d255c6a95bc6dc6428b upstream. + +Tested-by: Thomas Schäfer +Signed-off-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -150,6 +150,7 @@ static void option_instat_callback(struc + #define HUAWEI_PRODUCT_E14AC 0x14AC + #define HUAWEI_PRODUCT_K3806 0x14AE + #define HUAWEI_PRODUCT_K4605 0x14C6 ++#define HUAWEI_PRODUCT_K5005 0x14C8 + #define HUAWEI_PRODUCT_K3770 0x14C9 + #define HUAWEI_PRODUCT_K3771 0x14CA + #define HUAWEI_PRODUCT_K4510 0x14CB +@@ -666,6 +667,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x31) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x32) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x33) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) }, diff --git a/queue-3.4/usb-option-fix-memory-leak.patch b/queue-3.4/usb-option-fix-memory-leak.patch new file mode 100644 index 00000000000..c974119033a --- /dev/null +++ b/queue-3.4/usb-option-fix-memory-leak.patch @@ -0,0 +1,55 @@ +From b9c3aab315b51f81649a0d737c4c73783fbd8de0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 29 May 2012 18:22:48 +0200 +Subject: USB: option: fix memory leak + +From: Johan Hovold + +commit b9c3aab315b51f81649a0d737c4c73783fbd8de0 upstream. + +Fix memory leak introduced by commit 383cedc3bb435de7a2 ("USB: serial: +full autosuspend support for the option driver") which allocates +usb-serial data but never frees it. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -47,6 +47,7 @@ + /* Function prototypes */ + static int option_probe(struct usb_serial *serial, + const struct usb_device_id *id); ++static void option_release(struct usb_serial *serial); + static int option_send_setup(struct usb_serial_port *port); + static void option_instat_callback(struct urb *urb); + +@@ -1273,7 +1274,7 @@ static struct usb_serial_driver option_1 + .ioctl = usb_wwan_ioctl, + .attach = usb_wwan_startup, + .disconnect = usb_wwan_disconnect, +- .release = usb_wwan_release, ++ .release = option_release, + .read_int_callback = option_instat_callback, + #ifdef CONFIG_PM + .suspend = usb_wwan_suspend, +@@ -1384,6 +1385,15 @@ static int option_probe(struct usb_seria + return 0; + } + ++static void option_release(struct usb_serial *serial) ++{ ++ struct usb_wwan_intf_private *priv = usb_get_serial_data(serial); ++ ++ usb_wwan_release(serial); ++ ++ kfree(priv); ++} ++ + static void option_instat_callback(struct urb *urb) + { + int err; diff --git a/queue-3.4/usb-option-fix-port-data-abuse.patch b/queue-3.4/usb-option-fix-port-data-abuse.patch new file mode 100644 index 00000000000..bc12d30335b --- /dev/null +++ b/queue-3.4/usb-option-fix-port-data-abuse.patch @@ -0,0 +1,77 @@ +From 4273f9878b0a8271df055e3c8f2e7f08c6a4a2f4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 29 May 2012 17:57:52 +0200 +Subject: USB: option: fix port-data abuse + +From: Johan Hovold + +commit 4273f9878b0a8271df055e3c8f2e7f08c6a4a2f4 upstream. + +Commit 8b4c6a3ab596961b78465 ("USB: option: Use generic USB wwan code") +moved option port-data allocation to usb_wwan_startup but still cast the +port data to the old struct... + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 34 +++------------------------------- + 1 file changed, 3 insertions(+), 31 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1288,35 +1288,6 @@ static struct usb_serial_driver * const + + static bool debug; + +-/* per port private data */ +- +-#define N_IN_URB 4 +-#define N_OUT_URB 4 +-#define IN_BUFLEN 4096 +-#define OUT_BUFLEN 4096 +- +-struct option_port_private { +- /* Input endpoints and buffer for this port */ +- struct urb *in_urbs[N_IN_URB]; +- u8 *in_buffer[N_IN_URB]; +- /* Output endpoints and buffer for this port */ +- struct urb *out_urbs[N_OUT_URB]; +- u8 *out_buffer[N_OUT_URB]; +- unsigned long out_busy; /* Bit vector of URBs in use */ +- int opened; +- struct usb_anchor delayed; +- +- /* Settings for the port */ +- int rts_state; /* Handshaking pins (outputs) */ +- int dtr_state; +- int cts_state; /* Handshaking pins (inputs) */ +- int dsr_state; +- int dcd_state; +- int ri_state; +- +- unsigned long tx_start_time[N_OUT_URB]; +-}; +- + module_usb_serial_driver(option_driver, serial_drivers); + + static bool is_blacklisted(const u8 ifnum, enum option_blacklist_reason reason, +@@ -1399,7 +1370,8 @@ static void option_instat_callback(struc + int err; + int status = urb->status; + struct usb_serial_port *port = urb->context; +- struct option_port_private *portdata = usb_get_serial_port_data(port); ++ struct usb_wwan_port_private *portdata = ++ usb_get_serial_port_data(port); + + dbg("%s", __func__); + dbg("%s: urb %p port %p has data %p", __func__, urb, port, portdata); +@@ -1460,7 +1432,7 @@ static int option_send_setup(struct usb_ + struct usb_serial *serial = port->serial; + struct usb_wwan_intf_private *intfdata = + (struct usb_wwan_intf_private *) serial->private; +- struct option_port_private *portdata; ++ struct usb_wwan_port_private *portdata; + int ifNum = serial->interface->cur_altsetting->desc.bInterfaceNumber; + int val = 0; + dbg("%s", __func__); diff --git a/queue-3.4/usb-option-updated-huawei-k4605-has-better-id.patch b/queue-3.4/usb-option-updated-huawei-k4605-has-better-id.patch new file mode 100644 index 00000000000..8d747f624d8 --- /dev/null +++ b/queue-3.4/usb-option-updated-huawei-k4605-has-better-id.patch @@ -0,0 +1,32 @@ +From 42ca7da1c2363dbef4ba1b6917c4c02274b6a5e2 Mon Sep 17 00:00:00 2001 +From: Andrew Bird +Date: Mon, 28 May 2012 12:43:06 +0100 +Subject: USB: option: Updated Huawei K4605 has better id + +From: Andrew Bird + +commit 42ca7da1c2363dbef4ba1b6917c4c02274b6a5e2 upstream. + +Later firmwares for this device now have proper subclass and +protocol info so we can identify it nicely without needing to use +the blacklist. I'm not removing the old 0xff matching as there +may be devices in the field that still need that. + +Signed-off-by: Andrew Bird +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -667,6 +667,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0x01, 0x31) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0x01, 0x32) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x31) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x32) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x33) },