From: Greg Kroah-Hartman Date: Wed, 24 Oct 2012 16:31:19 +0000 (-0700) Subject: 3.6-stable patches X-Git-Tag: v3.0.49~49 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cb42685fbbd8d8c4ad0e6b537563614d0059348b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.6-stable patches added patches: usb-acm-fix-the-computation-of-the-number-of-data-bits.patch usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch usb-io_ti-fix-port-data-memory-leak.patch xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch --- diff --git a/queue-3.6/series b/queue-3.6/series index 396d0ae7402..8d5fd263070 100644 --- a/queue-3.6/series +++ b/queue-3.6/series @@ -16,3 +16,7 @@ kernel-sys.c-fix-stack-memory-content-leak-via-uname26.patch use-clamp_t-in-uname26-fix.patch x86-amd-mce-avoid-null-pointer-reference-on-cpu-northbridge-lookup.patch x86-exclude-e820_reserved-regions-and-memory-holes-above-4-gb-from-direct-mapping.patch +xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch +usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch +usb-acm-fix-the-computation-of-the-number-of-data-bits.patch +usb-io_ti-fix-port-data-memory-leak.patch diff --git a/queue-3.6/usb-acm-fix-the-computation-of-the-number-of-data-bits.patch b/queue-3.6/usb-acm-fix-the-computation-of-the-number-of-data-bits.patch new file mode 100644 index 00000000000..e304d96952d --- /dev/null +++ b/queue-3.6/usb-acm-fix-the-computation-of-the-number-of-data-bits.patch @@ -0,0 +1,56 @@ +From 301a29da6e891e7eb95c843af0ecdbe86d01f723 Mon Sep 17 00:00:00 2001 +From: Nicolas Boullis +Date: Tue, 16 Oct 2012 00:06:23 +0200 +Subject: usb: acm: fix the computation of the number of data bits + +From: Nicolas Boullis + +commit 301a29da6e891e7eb95c843af0ecdbe86d01f723 upstream. + +The current code assumes that CSIZE is 0000060, which appears to be +wrong on some arches (such as powerpc). + +Signed-off-by: Nicolas Boullis +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -818,10 +818,6 @@ static const __u32 acm_tty_speed[] = { + 2500000, 3000000, 3500000, 4000000 + }; + +-static const __u8 acm_tty_size[] = { +- 5, 6, 7, 8 +-}; +- + static void acm_tty_set_termios(struct tty_struct *tty, + struct ktermios *termios_old) + { +@@ -835,7 +831,21 @@ static void acm_tty_set_termios(struct t + newline.bParityType = termios->c_cflag & PARENB ? + (termios->c_cflag & PARODD ? 1 : 2) + + (termios->c_cflag & CMSPAR ? 2 : 0) : 0; +- newline.bDataBits = acm_tty_size[(termios->c_cflag & CSIZE) >> 4]; ++ switch (termios->c_cflag & CSIZE) { ++ case CS5: ++ newline.bDataBits = 5; ++ break; ++ case CS6: ++ newline.bDataBits = 6; ++ break; ++ case CS7: ++ newline.bDataBits = 7; ++ break; ++ case CS8: ++ default: ++ newline.bDataBits = 8; ++ break; ++ } + /* FIXME: Needs to clear unsupported bits in the termios */ + acm->clocal = ((termios->c_cflag & CLOCAL) != 0); + diff --git a/queue-3.6/usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch b/queue-3.6/usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch new file mode 100644 index 00000000000..af25682ae0d --- /dev/null +++ b/queue-3.6/usb-cdc-acm-fix-pipe-type-of-write-endpoint.patch @@ -0,0 +1,31 @@ +From c5211187f7ff8e8dbff4ebf7c011ac4c0ffe319c Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Tue, 16 Oct 2012 21:21:21 +0800 +Subject: USB: cdc-acm: fix pipe type of write endpoint + +From: Ming Lei + +commit c5211187f7ff8e8dbff4ebf7c011ac4c0ffe319c upstream. + +If the write endpoint is interrupt type, usb_sndintpipe() should +be passed to usb_fill_int_urb() instead of usb_sndbulkpipe(). + +Signed-off-by: Ming Lei +Cc: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1234,7 +1234,7 @@ made_compressed_probe: + + if (usb_endpoint_xfer_int(epwrite)) + usb_fill_int_urb(snd->urb, usb_dev, +- usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress), ++ usb_sndintpipe(usb_dev, epwrite->bEndpointAddress), + NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval); + else + usb_fill_bulk_urb(snd->urb, usb_dev, diff --git a/queue-3.6/usb-io_ti-fix-port-data-memory-leak.patch b/queue-3.6/usb-io_ti-fix-port-data-memory-leak.patch new file mode 100644 index 00000000000..4b48031cdd5 --- /dev/null +++ b/queue-3.6/usb-io_ti-fix-port-data-memory-leak.patch @@ -0,0 +1,163 @@ +From 003615302a16579531932576bcd9582ddeba9018 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 17 Oct 2012 13:34:58 +0200 +Subject: USB: io_ti: fix port-data memory leak + +From: Johan Hovold + +commit 003615302a16579531932576bcd9582ddeba9018 upstream. + +Fix port-data memory leak by moving port data allocation and +deallocation to port_probe and port_remove. + +Since commit 0998d0631001288 (device-core: Ensure drvdata = NULL when no +driver is bound) the port private data is no longer freed at release as +it is no longer accessible. + +Compile-only tested. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/io_ti.c | 91 +++++++++++++++++++++------------------------ + 1 file changed, 44 insertions(+), 47 deletions(-) + +--- a/drivers/usb/serial/io_ti.c ++++ b/drivers/usb/serial/io_ti.c +@@ -2594,12 +2594,7 @@ static void edge_break(struct tty_struct + static int edge_startup(struct usb_serial *serial) + { + struct edgeport_serial *edge_serial; +- struct edgeport_port *edge_port; +- struct usb_device *dev; + int status; +- int i; +- +- dev = serial->dev; + + /* create our private serial structure */ + edge_serial = kzalloc(sizeof(struct edgeport_serial), GFP_KERNEL); +@@ -2617,40 +2612,7 @@ static int edge_startup(struct usb_seria + return status; + } + +- /* set up our port private structures */ +- for (i = 0; i < serial->num_ports; ++i) { +- edge_port = kzalloc(sizeof(struct edgeport_port), GFP_KERNEL); +- if (edge_port == NULL) { +- dev_err(&serial->dev->dev, "%s - Out of memory\n", +- __func__); +- goto cleanup; +- } +- spin_lock_init(&edge_port->ep_lock); +- if (kfifo_alloc(&edge_port->write_fifo, EDGE_OUT_BUF_SIZE, +- GFP_KERNEL)) { +- dev_err(&serial->dev->dev, "%s - Out of memory\n", +- __func__); +- kfree(edge_port); +- goto cleanup; +- } +- edge_port->port = serial->port[i]; +- edge_port->edge_serial = edge_serial; +- usb_set_serial_port_data(serial->port[i], edge_port); +- edge_port->bUartMode = default_uart_mode; +- } +- + return 0; +- +-cleanup: +- for (--i; i >= 0; --i) { +- edge_port = usb_get_serial_port_data(serial->port[i]); +- kfifo_free(&edge_port->write_fifo); +- kfree(edge_port); +- usb_set_serial_port_data(serial->port[i], NULL); +- } +- kfree(edge_serial); +- usb_set_serial_data(serial, NULL); +- return -ENOMEM; + } + + static void edge_disconnect(struct usb_serial *serial) +@@ -2660,19 +2622,54 @@ static void edge_disconnect(struct usb_s + + static void edge_release(struct usb_serial *serial) + { +- int i; ++ kfree(usb_get_serial_data(serial)); ++} ++ ++static int edge_port_probe(struct usb_serial_port *port) ++{ + struct edgeport_port *edge_port; ++ int ret; + +- dbg("%s", __func__); ++ edge_port = kzalloc(sizeof(*edge_port), GFP_KERNEL); ++ if (!edge_port) ++ return -ENOMEM; ++ ++ ret = kfifo_alloc(&edge_port->write_fifo, EDGE_OUT_BUF_SIZE, ++ GFP_KERNEL); ++ if (ret) { ++ kfree(edge_port); ++ return -ENOMEM; ++ } + +- for (i = 0; i < serial->num_ports; ++i) { +- edge_port = usb_get_serial_port_data(serial->port[i]); ++ ret = edge_create_sysfs_attrs(port); ++ if (ret) { + kfifo_free(&edge_port->write_fifo); + kfree(edge_port); ++ return ret; + } +- kfree(usb_get_serial_data(serial)); ++ ++ spin_lock_init(&edge_port->ep_lock); ++ edge_port->port = port; ++ edge_port->edge_serial = usb_get_serial_data(port->serial); ++ edge_port->bUartMode = default_uart_mode; ++ ++ usb_set_serial_port_data(port, edge_port); ++ ++ return 0; + } + ++static int edge_port_remove(struct usb_serial_port *port) ++{ ++ struct edgeport_port *edge_port; ++ ++ edge_port = usb_get_serial_port_data(port); ++ ++ edge_remove_sysfs_attrs(port); ++ kfifo_free(&edge_port->write_fifo); ++ kfree(edge_port); ++ ++ return 0; ++} + + /* Sysfs Attributes */ + +@@ -2732,8 +2729,8 @@ static struct usb_serial_driver edgeport + .attach = edge_startup, + .disconnect = edge_disconnect, + .release = edge_release, +- .port_probe = edge_create_sysfs_attrs, +- .port_remove = edge_remove_sysfs_attrs, ++ .port_probe = edge_port_probe, ++ .port_remove = edge_port_remove, + .ioctl = edge_ioctl, + .set_termios = edge_set_termios, + .tiocmget = edge_tiocmget, +@@ -2763,8 +2760,8 @@ static struct usb_serial_driver edgeport + .attach = edge_startup, + .disconnect = edge_disconnect, + .release = edge_release, +- .port_probe = edge_create_sysfs_attrs, +- .port_remove = edge_remove_sysfs_attrs, ++ .port_probe = edge_port_probe, ++ .port_remove = edge_port_remove, + .ioctl = edge_ioctl, + .set_termios = edge_set_termios, + .tiocmget = edge_tiocmget, diff --git a/queue-3.6/xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch b/queue-3.6/xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch new file mode 100644 index 00000000000..309e4fd735d --- /dev/null +++ b/queue-3.6/xen-x86-don-t-corrupt-eip-when-returning-from-a-signal-handler.patch @@ -0,0 +1,97 @@ +From a349e23d1cf746f8bdc603dcc61fae9ee4a695f6 Mon Sep 17 00:00:00 2001 +From: David Vrabel +Date: Fri, 19 Oct 2012 17:29:07 +0100 +Subject: xen/x86: don't corrupt %eip when returning from a signal handler + +From: David Vrabel + +commit a349e23d1cf746f8bdc603dcc61fae9ee4a695f6 upstream. + +In 32 bit guests, if a userspace process has %eax == -ERESTARTSYS +(-512) or -ERESTARTNOINTR (-513) when it is interrupted by an event +/and/ the process has a pending signal then %eip (and %eax) are +corrupted when returning to the main process after handling the +signal. The application may then crash with SIGSEGV or a SIGILL or it +may have subtly incorrect behaviour (depending on what instruction it +returned to). + +The occurs because handle_signal() is incorrectly thinking that there +is a system call that needs to restarted so it adjusts %eip and %eax +to re-execute the system call instruction (even though user space had +not done a system call). + +If %eax == -514 (-ERESTARTNOHAND (-514) or -ERESTART_RESTARTBLOCK +(-516) then handle_signal() only corrupted %eax (by setting it to +-EINTR). This may cause the application to crash or have incorrect +behaviour. + +handle_signal() assumes that regs->orig_ax >= 0 means a system call so +any kernel entry point that is not for a system call must push a +negative value for orig_ax. For example, for physical interrupts on +bare metal the inverse of the vector is pushed and page_fault() sets +regs->orig_ax to -1, overwriting the hardware provided error code. + +xen_hypervisor_callback() was incorrectly pushing 0 for orig_ax +instead of -1. + +Classic Xen kernels pushed %eax which works as %eax cannot be both +non-negative and -RESTARTSYS (etc.), but using -1 is consistent with +other non-system call entry points and avoids some of the tests in +handle_signal(). + +There were similar bugs in xen_failsafe_callback() of both 32 and +64-bit guests. If the fault was corrected and the normal return path +was used then 0 was incorrectly pushed as the value for orig_ax. + +Signed-off-by: David Vrabel +Acked-by: Jan Beulich +Acked-by: Ian Campbell +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/entry_32.S | 8 +++++--- + arch/x86/kernel/entry_64.S | 2 +- + 2 files changed, 6 insertions(+), 4 deletions(-) + +--- a/arch/x86/kernel/entry_32.S ++++ b/arch/x86/kernel/entry_32.S +@@ -1016,7 +1016,7 @@ ENTRY(xen_sysenter_target) + + ENTRY(xen_hypervisor_callback) + CFI_STARTPROC +- pushl_cfi $0 ++ pushl_cfi $-1 /* orig_ax = -1 => not a system call */ + SAVE_ALL + TRACE_IRQS_OFF + +@@ -1058,14 +1058,16 @@ ENTRY(xen_failsafe_callback) + 2: mov 8(%esp),%es + 3: mov 12(%esp),%fs + 4: mov 16(%esp),%gs ++ /* EAX == 0 => Category 1 (Bad segment) ++ EAX != 0 => Category 2 (Bad IRET) */ + testl %eax,%eax + popl_cfi %eax + lea 16(%esp),%esp + CFI_ADJUST_CFA_OFFSET -16 + jz 5f + addl $16,%esp +- jmp iret_exc # EAX != 0 => Category 2 (Bad IRET) +-5: pushl_cfi $0 # EAX == 0 => Category 1 (Bad segment) ++ jmp iret_exc ++5: pushl_cfi $-1 /* orig_ax = -1 => not a system call */ + SAVE_ALL + jmp ret_from_exception + CFI_ENDPROC +--- a/arch/x86/kernel/entry_64.S ++++ b/arch/x86/kernel/entry_64.S +@@ -1363,7 +1363,7 @@ ENTRY(xen_failsafe_callback) + CFI_RESTORE r11 + addq $0x30,%rsp + CFI_ADJUST_CFA_OFFSET -0x30 +- pushq_cfi $0 ++ pushq_cfi $-1 /* orig_ax = -1 => not a system call */ + SAVE_ALL + jmp error_exit + CFI_ENDPROC