From: Greg Kroah-Hartman Date: Tue, 17 Jul 2012 18:47:17 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.38~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f69ff5d80223fb77a5051620478af50282bc13be;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: hwmon-it87-preserve-configuration-register-bits-on-init.patch media-cx231xx-don-t-dma-to-random-addresses.patch remove-easily-user-triggerable-bug-from-generic_setlease.patch --- diff --git a/queue-3.4/hwmon-it87-preserve-configuration-register-bits-on-init.patch b/queue-3.4/hwmon-it87-preserve-configuration-register-bits-on-init.patch new file mode 100644 index 00000000000..29a5f129705 --- /dev/null +++ b/queue-3.4/hwmon-it87-preserve-configuration-register-bits-on-init.patch @@ -0,0 +1,34 @@ +From 41002f8dd5938d5ad1d008ce5bfdbfe47fa7b4e8 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Thu, 12 Jul 2012 22:47:37 +0200 +Subject: hwmon: (it87) Preserve configuration register bits on init + +From: Jean Delvare + +commit 41002f8dd5938d5ad1d008ce5bfdbfe47fa7b4e8 upstream. + +We were accidentally losing one bit in the configuration register on +device initialization. It was reported to freeze one specific system +right away. Properly preserve all bits we don't explicitly want to +change in order to prevent that. + +Reported-by: Stevie Trujillo +Signed-off-by: Jean Delvare +Reviewed-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/it87.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/it87.c ++++ b/drivers/hwmon/it87.c +@@ -2157,7 +2157,7 @@ static void __devinit it87_init_device(s + + /* Start monitoring */ + it87_write_value(data, IT87_REG_CONFIG, +- (it87_read_value(data, IT87_REG_CONFIG) & 0x36) ++ (it87_read_value(data, IT87_REG_CONFIG) & 0x3e) + | (update_vbat ? 0x41 : 0x01)); + } + diff --git a/queue-3.4/media-cx231xx-don-t-dma-to-random-addresses.patch b/queue-3.4/media-cx231xx-don-t-dma-to-random-addresses.patch new file mode 100644 index 00000000000..41a27c0eb32 --- /dev/null +++ b/queue-3.4/media-cx231xx-don-t-dma-to-random-addresses.patch @@ -0,0 +1,59 @@ +From a7deca6fa79d5c65575532e780f3c93f6bf8ddad Mon Sep 17 00:00:00 2001 +From: David Dillow +Date: Mon, 18 Jun 2012 00:15:21 -0300 +Subject: media: cx231xx: don't DMA to random addresses + +From: David Dillow + +commit a7deca6fa79d5c65575532e780f3c93f6bf8ddad upstream. + +Commit 7a6f6c29d264cdd2fe0eb3d923217eed5f0ad134 (cx231xx: use +URB_NO_TRANSFER_DMA_MAP) was intended to avoid mapping the DMA buffer +for URB twice. This works for the URBs allocated with usb_alloc_urb(), +as those are allocated from cohernent DMA pools, but the flag was also +added for the VBI and audio URBs, which have a manually allocated area. +This leaves the random trash in the structure after allocation as the +DMA address, corrupting memory and preventing VBI and audio from +working. Letting the USB core map the buffers solves the problem. + +Signed-off-by: David Dillow +Cc: Sri Deevi +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/cx231xx/cx231xx-audio.c | 4 ++-- + drivers/media/video/cx231xx/cx231xx-vbi.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/video/cx231xx/cx231xx-audio.c ++++ b/drivers/media/video/cx231xx/cx231xx-audio.c +@@ -307,7 +307,7 @@ static int cx231xx_init_audio_isoc(struc + urb->context = dev; + urb->pipe = usb_rcvisocpipe(dev->udev, + dev->adev.end_point_addr); +- urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP; ++ urb->transfer_flags = URB_ISO_ASAP; + urb->transfer_buffer = dev->adev.transfer_buffer[i]; + urb->interval = 1; + urb->complete = cx231xx_audio_isocirq; +@@ -368,7 +368,7 @@ static int cx231xx_init_audio_bulk(struc + urb->context = dev; + urb->pipe = usb_rcvbulkpipe(dev->udev, + dev->adev.end_point_addr); +- urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP; ++ urb->transfer_flags = 0; + urb->transfer_buffer = dev->adev.transfer_buffer[i]; + urb->complete = cx231xx_audio_bulkirq; + urb->transfer_buffer_length = sb_size; +--- a/drivers/media/video/cx231xx/cx231xx-vbi.c ++++ b/drivers/media/video/cx231xx/cx231xx-vbi.c +@@ -452,7 +452,7 @@ int cx231xx_init_vbi_isoc(struct cx231xx + return -ENOMEM; + } + dev->vbi_mode.bulk_ctl.urb[i] = urb; +- urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP; ++ urb->transfer_flags = 0; + + dev->vbi_mode.bulk_ctl.transfer_buffer[i] = + kzalloc(sb_size, GFP_KERNEL); diff --git a/queue-3.4/remove-easily-user-triggerable-bug-from-generic_setlease.patch b/queue-3.4/remove-easily-user-triggerable-bug-from-generic_setlease.patch new file mode 100644 index 00000000000..26a323e58cb --- /dev/null +++ b/queue-3.4/remove-easily-user-triggerable-bug-from-generic_setlease.patch @@ -0,0 +1,39 @@ +From 8d657eb3b43861064d36241e88d9d61c709f33f0 Mon Sep 17 00:00:00 2001 +From: Dave Jones +Date: Fri, 13 Jul 2012 13:35:36 -0400 +Subject: Remove easily user-triggerable BUG from generic_setlease + +From: Dave Jones + +commit 8d657eb3b43861064d36241e88d9d61c709f33f0 upstream. + +This can be trivially triggered from userspace by passing in something unexpected. + + kernel BUG at fs/locks.c:1468! + invalid opcode: 0000 [#1] SMP + RIP: 0010:generic_setlease+0xc2/0x100 + Call Trace: + __vfs_setlease+0x35/0x40 + fcntl_setlease+0x76/0x150 + sys_fcntl+0x1c6/0x810 + system_call_fastpath+0x1a/0x1f + +Signed-off-by: Dave Jones +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/locks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -1465,7 +1465,7 @@ int generic_setlease(struct file *filp, + case F_WRLCK: + return generic_add_lease(filp, arg, flp); + default: +- BUG(); ++ return -EINVAL; + } + } + EXPORT_SYMBOL(generic_setlease); diff --git a/queue-3.4/series b/queue-3.4/series new file mode 100644 index 00000000000..ef73d03020c --- /dev/null +++ b/queue-3.4/series @@ -0,0 +1,3 @@ +remove-easily-user-triggerable-bug-from-generic_setlease.patch +media-cx231xx-don-t-dma-to-random-addresses.patch +hwmon-it87-preserve-configuration-register-bits-on-init.patch