From: Greg Kroah-Hartman Date: Tue, 11 Sep 2012 17:11:25 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.5.4~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d0853df3eeb4f260c8b76f64f6403d44795ab18b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: dccp-check-ccid-before-dereferencing.patch drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch --- diff --git a/queue-3.0/dccp-check-ccid-before-dereferencing.patch b/queue-3.0/dccp-check-ccid-before-dereferencing.patch new file mode 100644 index 00000000000..f7f1370f3c3 --- /dev/null +++ b/queue-3.0/dccp-check-ccid-before-dereferencing.patch @@ -0,0 +1,43 @@ +From 276bdb82dedb290511467a5a4fdbe9f0b52dce6f Mon Sep 17 00:00:00 2001 +From: Mathias Krause +Date: Wed, 15 Aug 2012 11:31:54 +0000 +Subject: dccp: check ccid before dereferencing + +From: Mathias Krause + +commit 276bdb82dedb290511467a5a4fdbe9f0b52dce6f upstream. + +ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with +a NULL ccid pointer leading to a NULL pointer dereference. This could +lead to a privilege escalation if the attacker is able to map page 0 and +prepare it with a fake ccid_ops pointer. + +Signed-off-by: Mathias Krause +Cc: Gerrit Renker +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/dccp/ccid.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/dccp/ccid.h ++++ b/net/dccp/ccid.h +@@ -246,7 +246,7 @@ static inline int ccid_hc_rx_getsockopt( + u32 __user *optval, int __user *optlen) + { + int rc = -ENOPROTOOPT; +- if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL) ++ if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL) + rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len, + optval, optlen); + return rc; +@@ -257,7 +257,7 @@ static inline int ccid_hc_tx_getsockopt( + u32 __user *optval, int __user *optlen) + { + int rc = -ENOPROTOOPT; +- if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL) ++ if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL) + rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len, + optval, optlen); + return rc; diff --git a/queue-3.0/drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch b/queue-3.0/drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch new file mode 100644 index 00000000000..5af42fe9b2d --- /dev/null +++ b/queue-3.0/drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch @@ -0,0 +1,30 @@ +From c4903429a92be60e6fe59868924a65eca4cd1a38 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Tue, 28 Aug 2012 21:40:51 -0400 +Subject: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot + +From: Dave Airlie + +commit c4903429a92be60e6fe59868924a65eca4cd1a38 upstream. + +This will cause udev to load vmwgfx instead of waiting for X +to do it. + +Reviewed-by: Jakob Bornecrantz +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -147,6 +147,7 @@ static struct pci_device_id vmw_pci_id_l + {0x15ad, 0x0405, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VMWGFX_CHIP_SVGAII}, + {0, 0, 0} + }; ++MODULE_DEVICE_TABLE(pci, vmw_pci_id_list); + + static int enable_fbdev; + diff --git a/queue-3.0/hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch b/queue-3.0/hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch new file mode 100644 index 00000000000..caffaa6471a --- /dev/null +++ b/queue-3.0/hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch @@ -0,0 +1,41 @@ +From 43ca6cb28c871f2fbad10117b0648e5ae3b0f638 Mon Sep 17 00:00:00 2001 +From: Luca Tettamanti +Date: Tue, 21 Aug 2012 17:36:28 +0200 +Subject: hwmon: (asus_atk0110) Add quirk for Asus M5A78L +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luca Tettamanti + +commit 43ca6cb28c871f2fbad10117b0648e5ae3b0f638 upstream. + +The old interface is bugged and reads the wrong sensor when retrieving +the reading for the chassis fan (it reads the CPU sensor); the new +interface works fine. + +Reported-by: Göran Uddeborg +Tested-by: Göran Uddeborg +Signed-off-by: Luca Tettamanti +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/asus_atk0110.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hwmon/asus_atk0110.c ++++ b/drivers/hwmon/asus_atk0110.c +@@ -34,6 +34,12 @@ static const struct dmi_system_id __init + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "SABERTOOTH X58") + } ++ }, { ++ /* Old interface reads the same sensor for fan0 and fan1 */ ++ .ident = "Asus M5A78L", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "M5A78L") ++ } + }, + { } + }; diff --git a/queue-3.0/parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch b/queue-3.0/parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch new file mode 100644 index 00000000000..c5013179d83 --- /dev/null +++ b/queue-3.0/parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch @@ -0,0 +1,59 @@ +From bba3d8c3b3c0f2123be5bc687d1cddc13437c923 Mon Sep 17 00:00:00 2001 +From: Mel Gorman +Date: Mon, 23 Jul 2012 12:16:19 +0100 +Subject: PARISC: Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts + +From: Mel Gorman + +commit bba3d8c3b3c0f2123be5bc687d1cddc13437c923 upstream. + +The following build error occured during a parisc build with +swap-over-NFS patches applied. + +net/core/sock.c:274:36: error: initializer element is not constant +net/core/sock.c:274:36: error: (near initialization for 'memalloc_socks') +net/core/sock.c:274:36: error: initializer element is not constant + +Dave Anglin says: +> Here is the line in sock.i: +> +> struct static_key memalloc_socks = ((struct static_key) { .enabled = +> ((atomic_t) { (0) }) }); + +The above line contains two compound literals. It also uses a designated +initializer to initialize the field enabled. A compound literal is not a +constant expression. + +The location of the above statement isn't fully clear, but if a compound +literal occurs outside the body of a function, the initializer list must +consist of constant expressions. + +Reported-by: Fengguang Wu +Signed-off-by: Mel Gorman +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/atomic.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/parisc/include/asm/atomic.h ++++ b/arch/parisc/include/asm/atomic.h +@@ -248,7 +248,7 @@ static __inline__ int atomic_add_unless( + + #define atomic_sub_and_test(i,v) (atomic_sub_return((i),(v)) == 0) + +-#define ATOMIC_INIT(i) ((atomic_t) { (i) }) ++#define ATOMIC_INIT(i) { (i) } + + #define smp_mb__before_atomic_dec() smp_mb() + #define smp_mb__after_atomic_dec() smp_mb() +@@ -257,7 +257,7 @@ static __inline__ int atomic_add_unless( + + #ifdef CONFIG_64BIT + +-#define ATOMIC64_INIT(i) ((atomic64_t) { (i) }) ++#define ATOMIC64_INIT(i) { (i) } + + static __inline__ s64 + __atomic64_add_return(s64 i, atomic64_t *v) diff --git a/queue-3.0/series b/queue-3.0/series index 55cf763fd34..896dd5978f1 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -40,3 +40,7 @@ udf-fix-data-corruption-for-files-in-icb.patch ext3-fix-fdatasync-for-files-with-only-i_size-changes.patch fuse-fix-retrieve-length.patch input-i8042-add-gigabyte-t1005-series-netbooks-to-noloop-table.patch +drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch +parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch +dccp-check-ccid-before-dereferencing.patch +hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch