From 87d7b752043cb792386efbe2103bdcbb39a63fdd Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 14 Mar 2013 13:09:56 -0700 Subject: [PATCH] 3.4-stable patches added patches: qcaux-add-franklin-u600.patch usb-cdc-wdm-fix-buffer-overflow.patch usb-option-add-huawei-e5331.patch virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch xen-pciback-don-t-disable-a-pci-device-that-is-already-disabled.patch --- queue-3.4/qcaux-add-franklin-u600.patch | 29 +++++++ queue-3.4/series | 5 ++ .../usb-cdc-wdm-fix-buffer-overflow.patch | 87 +++++++++++++++++++ queue-3.4/usb-option-add-huawei-e5331.patch | 29 +++++++ ...e-device-registrations-fixes-crashes.patch | 61 +++++++++++++ ...-pci-device-that-is-already-disabled.patch | 51 +++++++++++ 6 files changed, 262 insertions(+) create mode 100644 queue-3.4/qcaux-add-franklin-u600.patch create mode 100644 queue-3.4/series create mode 100644 queue-3.4/usb-cdc-wdm-fix-buffer-overflow.patch create mode 100644 queue-3.4/usb-option-add-huawei-e5331.patch create mode 100644 queue-3.4/virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch create mode 100644 queue-3.4/xen-pciback-don-t-disable-a-pci-device-that-is-already-disabled.patch diff --git a/queue-3.4/qcaux-add-franklin-u600.patch b/queue-3.4/qcaux-add-franklin-u600.patch new file mode 100644 index 00000000000..65f761669ac --- /dev/null +++ b/queue-3.4/qcaux-add-franklin-u600.patch @@ -0,0 +1,29 @@ +From 2d90e63603ac235aecd7d20e234616e0682c8b1f Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Tue, 19 Feb 2013 09:47:09 -0600 +Subject: qcaux: add Franklin U600 + +From: Dan Williams + +commit 2d90e63603ac235aecd7d20e234616e0682c8b1f upstream. + +4 ports; AT/PPP is standard CDC-ACM. The other three (added by this +patch) are QCDM/DIAG, possibly GPS, and unknown. + +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/qcaux.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/qcaux.c ++++ b/drivers/usb/serial/qcaux.c +@@ -69,6 +69,7 @@ static struct usb_device_id id_table[] = + { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xfd, 0xff) }, /* NMEA */ + { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xfe, 0xff) }, /* WMC */ + { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xff, 0xff) }, /* DIAG */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1fac, 0x0151, 0xff, 0xff, 0xff) }, + { }, + }; + MODULE_DEVICE_TABLE(usb, id_table); diff --git a/queue-3.4/series b/queue-3.4/series new file mode 100644 index 00000000000..285d06ce86a --- /dev/null +++ b/queue-3.4/series @@ -0,0 +1,5 @@ +qcaux-add-franklin-u600.patch +xen-pciback-don-t-disable-a-pci-device-that-is-already-disabled.patch +virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch +usb-option-add-huawei-e5331.patch +usb-cdc-wdm-fix-buffer-overflow.patch diff --git a/queue-3.4/usb-cdc-wdm-fix-buffer-overflow.patch b/queue-3.4/usb-cdc-wdm-fix-buffer-overflow.patch new file mode 100644 index 00000000000..b98bc389689 --- /dev/null +++ b/queue-3.4/usb-cdc-wdm-fix-buffer-overflow.patch @@ -0,0 +1,87 @@ +From c0f5ecee4e741667b2493c742b60b6218d40b3aa Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 12 Mar 2013 14:52:42 +0100 +Subject: USB: cdc-wdm: fix buffer overflow + +From: Oliver Neukum + +commit c0f5ecee4e741667b2493c742b60b6218d40b3aa upstream. + +The buffer for responses must not overflow. +If this would happen, set a flag, drop the data and return +an error after user space has read all remaining data. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-wdm.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -81,6 +81,7 @@ MODULE_DEVICE_TABLE (usb, wdm_ids); + #define WDM_RESPONDING 7 + #define WDM_SUSPENDING 8 + #define WDM_RESETTING 9 ++#define WDM_OVERFLOW 10 + + #define WDM_MAX 16 + +@@ -180,6 +181,7 @@ static void wdm_in_callback(struct urb * + { + struct wdm_device *desc = urb->context; + int status = urb->status; ++ int length = urb->actual_length; + + spin_lock(&desc->iuspin); + clear_bit(WDM_RESPONDING, &desc->flags); +@@ -210,9 +212,17 @@ static void wdm_in_callback(struct urb * + } + + desc->rerr = status; +- desc->reslength = urb->actual_length; +- memmove(desc->ubuf + desc->length, desc->inbuf, desc->reslength); +- desc->length += desc->reslength; ++ if (length + desc->length > desc->wMaxCommand) { ++ /* The buffer would overflow */ ++ set_bit(WDM_OVERFLOW, &desc->flags); ++ } else { ++ /* we may already be in overflow */ ++ if (!test_bit(WDM_OVERFLOW, &desc->flags)) { ++ memmove(desc->ubuf + desc->length, desc->inbuf, length); ++ desc->length += length; ++ desc->reslength = length; ++ } ++ } + skip_error: + wake_up(&desc->wait); + +@@ -457,6 +467,11 @@ retry: + rv = -ENODEV; + goto err; + } ++ if (test_bit(WDM_OVERFLOW, &desc->flags)) { ++ clear_bit(WDM_OVERFLOW, &desc->flags); ++ rv = -ENOBUFS; ++ goto err; ++ } + i++; + if (file->f_flags & O_NONBLOCK) { + if (!test_bit(WDM_READ, &desc->flags)) { +@@ -500,6 +515,7 @@ retry: + spin_unlock_irq(&desc->iuspin); + goto retry; + } ++ + if (!desc->reslength) { /* zero length read */ + dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__); + clear_bit(WDM_READ, &desc->flags); +@@ -1023,6 +1039,7 @@ static int wdm_post_reset(struct usb_int + struct wdm_device *desc = wdm_find_device(intf); + int rv; + ++ clear_bit(WDM_OVERFLOW, &desc->flags); + clear_bit(WDM_RESETTING, &desc->flags); + rv = recover_from_urb_loss(desc); + mutex_unlock(&desc->wlock); diff --git a/queue-3.4/usb-option-add-huawei-e5331.patch b/queue-3.4/usb-option-add-huawei-e5331.patch new file mode 100644 index 00000000000..f14c8070974 --- /dev/null +++ b/queue-3.4/usb-option-add-huawei-e5331.patch @@ -0,0 +1,29 @@ +From daec90e7382cbd0e73eb6861109b3da91e5ab1f3 Mon Sep 17 00:00:00 2001 +From: Bjørn Mork +Date: Wed, 27 Feb 2013 15:52:56 +0100 +Subject: USB: option: add Huawei E5331 + +From: Bjørn Mork + +commit daec90e7382cbd0e73eb6861109b3da91e5ab1f3 upstream. + +Another device using CDC ACM with vendor specific protocol to mark +serial functions. + +Signed-off-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -579,6 +579,7 @@ static const struct usb_device_id option + { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c05, USB_CLASS_COMM, 0x02, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c1f, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, diff --git a/queue-3.4/virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch b/queue-3.4/virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch new file mode 100644 index 00000000000..15a3ffeea51 --- /dev/null +++ b/queue-3.4/virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch @@ -0,0 +1,61 @@ +From e84e7a56a3aa2963db506299e29a5f3f09377f9b Mon Sep 17 00:00:00 2001 +From: Amit Shah +Date: Fri, 8 Mar 2013 11:30:18 +1100 +Subject: virtio: rng: disallow multiple device registrations, fixes crashes + +From: Amit Shah + +commit e84e7a56a3aa2963db506299e29a5f3f09377f9b upstream. + +The code currently only supports one virtio-rng device at a time. +Invoking guests with multiple devices causes the guest to blow up. + +Check if we've already registered and initialised the driver. Also +cleanup in case of registration errors or hot-unplug so that a new +device can be used. + +Reported-by: Peter Krempa +Reported-by: +Signed-off-by: Amit Shah +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/hw_random/virtio-rng.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -89,14 +89,22 @@ static int virtrng_probe(struct virtio_d + { + int err; + ++ if (vq) { ++ /* We only support one device for now */ ++ return -EBUSY; ++ } + /* We expect a single virtqueue. */ + vq = virtio_find_single_vq(vdev, random_recv_done, "input"); +- if (IS_ERR(vq)) +- return PTR_ERR(vq); ++ if (IS_ERR(vq)) { ++ err = PTR_ERR(vq); ++ vq = NULL; ++ return err; ++ } + + err = hwrng_register(&virtio_hwrng); + if (err) { + vdev->config->del_vqs(vdev); ++ vq = NULL; + return err; + } + +@@ -108,6 +116,7 @@ static void __devexit virtrng_remove(str + vdev->config->reset(vdev); + hwrng_unregister(&virtio_hwrng); + vdev->config->del_vqs(vdev); ++ vq = NULL; + } + + static struct virtio_device_id id_table[] = { diff --git a/queue-3.4/xen-pciback-don-t-disable-a-pci-device-that-is-already-disabled.patch b/queue-3.4/xen-pciback-don-t-disable-a-pci-device-that-is-already-disabled.patch new file mode 100644 index 00000000000..44cb0dd4f68 --- /dev/null +++ b/queue-3.4/xen-pciback-don-t-disable-a-pci-device-that-is-already-disabled.patch @@ -0,0 +1,51 @@ +From bdc5c1812cea6efe1aaefb3131fcba28cd0b2b68 Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Tue, 5 Mar 2013 13:14:19 -0500 +Subject: xen/pciback: Don't disable a PCI device that is already disabled. + +From: Konrad Rzeszutek Wilk + +commit bdc5c1812cea6efe1aaefb3131fcba28cd0b2b68 upstream. + +While shuting down a HVM guest with pci devices passed through we +get this: + +pciback 0000:04:00.0: restoring config space at offset 0x4 (was 0x100000, writing 0x100002) +------------[ cut here ]------------ +WARNING: at drivers/pci/pci.c:1397 pci_disable_device+0x88/0xa0() +Hardware name: MS-7640 +Device pciback +disabling already-disabled device +Modules linked in: +Pid: 53, comm: xenwatch Not tainted 3.9.0-rc1-20130304a+ #1 +Call Trace: + [] warn_slowpath_common+0x7a/0xc0 + [] warn_slowpath_fmt+0x41/0x50 + [] pci_disable_device+0x88/0xa0 + [] xen_pcibk_reset_device+0x37/0xd0 + [] ? pcistub_put_pci_dev+0x6f/0x120 + [] pcistub_put_pci_dev+0x8d/0x120 + [] __xen_pcibk_release_devices+0x59/0xa0 + +This fixes the bug. + +Reported-and-Tested-by: Sander Eikelenboom +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/xen-pciback/pciback_ops.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/xen/xen-pciback/pciback_ops.c ++++ b/drivers/xen/xen-pciback/pciback_ops.c +@@ -113,7 +113,8 @@ void xen_pcibk_reset_device(struct pci_d + if (dev->msi_enabled) + pci_disable_msi(dev); + #endif +- pci_disable_device(dev); ++ if (pci_is_enabled(dev)) ++ pci_disable_device(dev); + + pci_write_config_word(dev, PCI_COMMAND, 0); + -- 2.47.3