From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 16 Aug 2013 22:55:07 +0000 (-0700)
Subject: 3.4-stable patches
X-Git-Tag: v3.0.92~15
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f12e9ace9eba193fd28b28944e212f472183704e;p=thirdparty%2Fkernel%2Fstable-queue.git

3.4-stable patches

added patches:
	usb-add-two-quirky-touchscreen.patch
	usb-mos7720-fix-broken-control-requests.patch
---

diff --git a/queue-3.4/series b/queue-3.4/series
index 7a97c2c2319..73f1d6c1936 100644
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -24,3 +24,5 @@ iwl4965-set-power-mode-early.patch
 iwl4965-reset-firmware-after-rfkill-off.patch
 can-pcan_usb-fix-wrong-memcpy-bytes-length.patch
 genetlink-fix-family-dump-race.patch
+usb-add-two-quirky-touchscreen.patch
+usb-mos7720-fix-broken-control-requests.patch
diff --git a/queue-3.4/usb-add-two-quirky-touchscreen.patch b/queue-3.4/usb-add-two-quirky-touchscreen.patch
new file mode 100644
index 00000000000..ce54dd360df
--- /dev/null
+++ b/queue-3.4/usb-add-two-quirky-touchscreen.patch
@@ -0,0 +1,33 @@
+From 304ab4ab079a8ed03ce39f1d274964a532db036b Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.de>
+Date: Wed, 14 Aug 2013 11:01:46 +0200
+Subject: usb: add two quirky touchscreen
+
+From: Oliver Neukum <oneukum@suse.de>
+
+commit 304ab4ab079a8ed03ce39f1d274964a532db036b upstream.
+
+These devices tend to become unresponsive after S3
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -100,6 +100,12 @@ static const struct usb_device_id usb_qu
+ 	{ USB_DEVICE(0x04d8, 0x000c), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+ 
++	/* CarrolTouch 4000U */
++	{ USB_DEVICE(0x04e7, 0x0009), .driver_info = USB_QUIRK_RESET_RESUME },
++
++	/* CarrolTouch 4500U */
++	{ USB_DEVICE(0x04e7, 0x0030), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ 	/* Samsung Android phone modem - ID conflict with SPH-I500 */
+ 	{ USB_DEVICE(0x04e8, 0x6601), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
diff --git a/queue-3.4/usb-mos7720-fix-broken-control-requests.patch b/queue-3.4/usb-mos7720-fix-broken-control-requests.patch
new file mode 100644
index 00000000000..78d49eaaf20
--- /dev/null
+++ b/queue-3.4/usb-mos7720-fix-broken-control-requests.patch
@@ -0,0 +1,74 @@
+From ef6c8c1d733e244f0499035be0dabe1f4ed98c6f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 13 Aug 2013 13:27:34 +0200
+Subject: USB: mos7720: fix broken control requests
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit ef6c8c1d733e244f0499035be0dabe1f4ed98c6f upstream.
+
+The parallel-port code of the drivers used a stack allocated
+control-request buffer for asynchronous (and possibly deferred) control
+requests. This not only violates the no-DMA-from-stack requirement but
+could also lead to corrupt control requests being submitted.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mos7720.c |   21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -97,6 +97,7 @@ struct urbtracker {
+ 	struct list_head        urblist_entry;
+ 	struct kref             ref_count;
+ 	struct urb              *urb;
++	struct usb_ctrlrequest	*setup;
+ };
+ 
+ enum mos7715_pp_modes {
+@@ -279,6 +280,7 @@ static void destroy_urbtracker(struct kr
+ 	struct mos7715_parport *mos_parport = urbtrack->mos_parport;
+ 	dbg("%s called", __func__);
+ 	usb_free_urb(urbtrack->urb);
++	kfree(urbtrack->setup);
+ 	kfree(urbtrack);
+ 	kref_put(&mos_parport->ref_count, destroy_mos_parport);
+ }
+@@ -363,7 +365,6 @@ static int write_parport_reg_nonblock(st
+ 	struct urbtracker *urbtrack;
+ 	int ret_val;
+ 	unsigned long flags;
+-	struct usb_ctrlrequest setup;
+ 	struct usb_serial *serial = mos_parport->serial;
+ 	struct usb_device *usbdev = serial->dev;
+ 	dbg("%s called", __func__);
+@@ -382,14 +383,20 @@ static int write_parport_reg_nonblock(st
+ 		kfree(urbtrack);
+ 		return -ENOMEM;
+ 	}
+-	setup.bRequestType = (__u8)0x40;
+-	setup.bRequest = (__u8)0x0e;
+-	setup.wValue = get_reg_value(reg, dummy);
+-	setup.wIndex = get_reg_index(reg);
+-	setup.wLength = 0;
++	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++	if (!urbtrack->setup) {
++		usb_free_urb(urbtrack->urb);
++		kfree(urbtrack);
++		return -ENOMEM;
++	}
++	urbtrack->setup->bRequestType = (__u8)0x40;
++	urbtrack->setup->bRequest = (__u8)0x0e;
++	urbtrack->setup->wValue = get_reg_value(reg, dummy);
++	urbtrack->setup->wIndex = get_reg_index(reg);
++	urbtrack->setup->wLength = 0;
+ 	usb_fill_control_urb(urbtrack->urb, usbdev,
+ 			     usb_sndctrlpipe(usbdev, 0),
+-			     (unsigned char *)&setup,
++			     (unsigned char *)urbtrack->setup,
+ 			     NULL, 0, async_complete, urbtrack);
+ 	kref_init(&urbtrack->ref_count);
+ 	INIT_LIST_HEAD(&urbtrack->urblist_entry);