From 9fdceb8455cff0b4400cdbac99e3d1af66ddd8bf Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 24 Jun 2013 15:06:46 -0700 Subject: [PATCH] 3.4-stable patches added patches: input-add-missing-dependencies-on-config_has_iomem.patch input-cyttsp-fix-memcpy-size-param.patch target-iscsi-don-t-corrupt-bh_count-in-iscsit_stop_time2retain_timer.patch usb-serial-ti_usb_3410_5052-new-device-id-for-abbot-strip-port-cable.patch --- ...ing-dependencies-on-config_has_iomem.patch | 41 ++++++++++ .../input-cyttsp-fix-memcpy-size-param.patch | 33 ++++++++ queue-3.4/series | 4 + ...unt-in-iscsit_stop_time2retain_timer.patch | 81 +++++++++++++++++++ ...device-id-for-abbot-strip-port-cable.patch | 45 +++++++++++ 5 files changed, 204 insertions(+) create mode 100644 queue-3.4/input-add-missing-dependencies-on-config_has_iomem.patch create mode 100644 queue-3.4/input-cyttsp-fix-memcpy-size-param.patch create mode 100644 queue-3.4/target-iscsi-don-t-corrupt-bh_count-in-iscsit_stop_time2retain_timer.patch create mode 100644 queue-3.4/usb-serial-ti_usb_3410_5052-new-device-id-for-abbot-strip-port-cable.patch diff --git a/queue-3.4/input-add-missing-dependencies-on-config_has_iomem.patch b/queue-3.4/input-add-missing-dependencies-on-config_has_iomem.patch new file mode 100644 index 00000000000..4a09a63f94e --- /dev/null +++ b/queue-3.4/input-add-missing-dependencies-on-config_has_iomem.patch @@ -0,0 +1,41 @@ +From 150e5928d6063b273a80d9d6722417ac3c93ff82 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Mon, 10 Jun 2013 11:05:40 -0700 +Subject: Input: add missing dependencies on CONFIG_HAS_IOMEM + +From: Ben Hutchings + +commit 150e5928d6063b273a80d9d6722417ac3c93ff82 upstream. + +Several drivers don't build on s390 with CONFIG_PCI disabled as +they require MMIO functions. + +Signed-off-by: Ben Hutchings +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/keyboard/Kconfig | 1 + + drivers/input/serio/Kconfig | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/input/keyboard/Kconfig ++++ b/drivers/input/keyboard/Kconfig +@@ -404,6 +404,7 @@ config KEYBOARD_TEGRA + + config KEYBOARD_OPENCORES + tristate "OpenCores Keyboard Controller" ++ depends on HAS_IOMEM + help + Say Y here if you want to use the OpenCores Keyboard Controller + http://www.opencores.org/project,keyboardcontroller +--- a/drivers/input/serio/Kconfig ++++ b/drivers/input/serio/Kconfig +@@ -204,6 +204,7 @@ config SERIO_XILINX_XPS_PS2 + + config SERIO_ALTERA_PS2 + tristate "Altera UP PS/2 controller" ++ depends on HAS_IOMEM + help + Say Y here if you have Altera University Program PS/2 ports. + diff --git a/queue-3.4/input-cyttsp-fix-memcpy-size-param.patch b/queue-3.4/input-cyttsp-fix-memcpy-size-param.patch new file mode 100644 index 00000000000..3c038d9c2dc --- /dev/null +++ b/queue-3.4/input-cyttsp-fix-memcpy-size-param.patch @@ -0,0 +1,33 @@ +From d2983cdb480157f637df07723f28aaa657b1080d Mon Sep 17 00:00:00 2001 +From: Ferruh Yigit +Date: Thu, 23 May 2013 09:56:55 -0700 +Subject: Input: cyttsp - fix memcpy size param + +From: Ferruh Yigit + +commit d2983cdb480157f637df07723f28aaa657b1080d upstream. + +memcpy param is wrong because of offset in bl_cmd, this may corrupt the +stack which may cause a crash. + +Tested-by: Ferruh Yigit on TMA300-DVK +Signed-off-by: Ferruh Yigit +Acked-by: Javier Martinez Canillas +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/touchscreen/cyttsp_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/touchscreen/cyttsp_core.c ++++ b/drivers/input/touchscreen/cyttsp_core.c +@@ -133,7 +133,7 @@ static int cyttsp_exit_bl_mode(struct cy + memcpy(bl_cmd, bl_command, sizeof(bl_command)); + if (ts->pdata->bl_keys) + memcpy(&bl_cmd[sizeof(bl_command) - CY_NUM_BL_KEYS], +- ts->pdata->bl_keys, sizeof(bl_command)); ++ ts->pdata->bl_keys, CY_NUM_BL_KEYS); + + error = ttsp_write_block_data(ts, CY_REG_BASE, + sizeof(bl_cmd), bl_cmd); diff --git a/queue-3.4/series b/queue-3.4/series index c5b5f6a151e..76da9b51cb8 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -21,3 +21,7 @@ packet-packet_getname_spkt-make-sure-string-is-always-0-terminated.patch l2tp-fix-ppp-header-erasure-and-memory-leak.patch l2tp-fix-sendmsg-return-value.patch bonding-rlb-mode-of-bond-should-not-alter-arp-originating-via-bridge.patch +input-cyttsp-fix-memcpy-size-param.patch +input-add-missing-dependencies-on-config_has_iomem.patch +usb-serial-ti_usb_3410_5052-new-device-id-for-abbot-strip-port-cable.patch +target-iscsi-don-t-corrupt-bh_count-in-iscsit_stop_time2retain_timer.patch diff --git a/queue-3.4/target-iscsi-don-t-corrupt-bh_count-in-iscsit_stop_time2retain_timer.patch b/queue-3.4/target-iscsi-don-t-corrupt-bh_count-in-iscsit_stop_time2retain_timer.patch new file mode 100644 index 00000000000..010961a5ec3 --- /dev/null +++ b/queue-3.4/target-iscsi-don-t-corrupt-bh_count-in-iscsit_stop_time2retain_timer.patch @@ -0,0 +1,81 @@ +From 574780fd5e6ec52bd43e0bdb777a19e4c4c6aa9c Mon Sep 17 00:00:00 2001 +From: Joern Engel +Date: Thu, 30 May 2013 16:36:51 -0400 +Subject: target/iscsi: don't corrupt bh_count in iscsit_stop_time2retain_timer() + +From: Joern Engel + +commit 574780fd5e6ec52bd43e0bdb777a19e4c4c6aa9c upstream. + +Here is a fun one. Bug seems to have been introduced by commit 140854cb, +almost two years ago. I have no idea why we only started seeing it now, +but we did. + +Rough callgraph: +core_tpg_set_initiator_node_queue_depth() +`-> spin_lock_irqsave(&tpg->session_lock, flags); +`-> lio_tpg_shutdown_session() + `-> iscsit_stop_time2retain_timer() + `-> spin_unlock_bh(&se_tpg->session_lock); + `-> spin_lock_bh(&se_tpg->session_lock); +`-> spin_unlock_irqrestore(&tpg->session_lock, flags); + +core_tpg_set_initiator_node_queue_depth() used to call spin_lock_bh(), +but 140854cb changed that to spin_lock_irqsave(). However, +lio_tpg_shutdown_session() still claims to be called with spin_lock_bh() +held, as does iscsit_stop_time2retain_timer(): + * Called with spin_lock_bh(&struct se_portal_group->session_lock) held + +Stale documentation is mostly annoying, but in this case the dropping +the lock with the _bh variant is plain wrong. It is also wrong to drop +locks two functions below the lock-holder, but I will ignore that bit +for now. + +After some more locking and unlocking we eventually hit this backtrace: +------------[ cut here ]------------ +WARNING: at kernel/softirq.c:159 local_bh_enable_ip+0xe8/0x100() +Pid: 24645, comm: lio_helper.py Tainted: G O 3.6.11+ +Call Trace: + [] warn_slowpath_common+0x7f/0xc0 + [] ? iscsit_inc_conn_usage_count+0x37/0x50 [iscsi_target_mod] + [] warn_slowpath_null+0x1a/0x20 + [] local_bh_enable_ip+0xe8/0x100 + [] _raw_spin_unlock_bh+0x15/0x20 + [] iscsit_inc_conn_usage_count+0x37/0x50 [iscsi_target_mod] + [] iscsit_stop_session+0xfa/0x1c0 [iscsi_target_mod] + [] lio_tpg_shutdown_session+0x7b/0x90 [iscsi_target_mod] + [] core_tpg_set_initiator_node_queue_depth+0xe4/0x290 [target_core_mod] + [] iscsit_tpg_set_initiator_node_queue_depth+0x12/0x20 [iscsi_target_mod] + [] lio_target_nacl_store_cmdsn_depth+0xa9/0x180 [iscsi_target_mod] + [] target_fabric_nacl_base_attr_store+0x39/0x40 [target_core_mod] + [] configfs_write_file+0xbd/0x120 + [] vfs_write+0xc6/0x180 + [] sys_write+0x51/0x90 + [] system_call_fastpath+0x16/0x1b +---[ end trace 3747632b9b164652 ]--- + +As a pure band-aid, this patch drops the _bh. + +Signed-off-by: Joern Engel +Signed-off-by: Nicholas Bellinger + +--- + drivers/target/iscsi/iscsi_target_erl0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target_erl0.c ++++ b/drivers/target/iscsi/iscsi_target_erl0.c +@@ -831,11 +831,11 @@ extern int iscsit_stop_time2retain_timer + return 0; + + sess->time2retain_timer_flags |= ISCSI_TF_STOP; +- spin_unlock_bh(&se_tpg->session_lock); ++ spin_unlock(&se_tpg->session_lock); + + del_timer_sync(&sess->time2retain_timer); + +- spin_lock_bh(&se_tpg->session_lock); ++ spin_lock(&se_tpg->session_lock); + sess->time2retain_timer_flags &= ~ISCSI_TF_RUNNING; + pr_debug("Stopped Time2Retain Timer for SID: %u\n", + sess->sid); diff --git a/queue-3.4/usb-serial-ti_usb_3410_5052-new-device-id-for-abbot-strip-port-cable.patch b/queue-3.4/usb-serial-ti_usb_3410_5052-new-device-id-for-abbot-strip-port-cable.patch new file mode 100644 index 00000000000..47569c0220e --- /dev/null +++ b/queue-3.4/usb-serial-ti_usb_3410_5052-new-device-id-for-abbot-strip-port-cable.patch @@ -0,0 +1,45 @@ +From 35a2fbc941accd0e9f1bfadd669311786118d874 Mon Sep 17 00:00:00 2001 +From: Anders Hammarquist +Date: Wed, 19 Jun 2013 01:45:48 +0200 +Subject: USB: serial: ti_usb_3410_5052: new device id for Abbot strip port cable + +From: Anders Hammarquist + +commit 35a2fbc941accd0e9f1bfadd669311786118d874 upstream. + +Add product id for Abbott strip port cable for Precision meter which +uses the TI 3410 chip. + +Signed-off-by: Anders Hammarquist +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ti_usb_3410_5052.c | 3 ++- + drivers/usb/serial/ti_usb_3410_5052.h | 4 +++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -179,7 +179,8 @@ static struct usb_device_id ti_id_table_ + { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) }, + { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) }, + { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) }, +- { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) }, ++ { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STEREO_PLUG_ID) }, ++ { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) }, + { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) }, + }; + +--- a/drivers/usb/serial/ti_usb_3410_5052.h ++++ b/drivers/usb/serial/ti_usb_3410_5052.h +@@ -52,7 +52,9 @@ + + /* Abbott Diabetics vendor and product ids */ + #define ABBOTT_VENDOR_ID 0x1a61 +-#define ABBOTT_PRODUCT_ID 0x3410 ++#define ABBOTT_STEREO_PLUG_ID 0x3410 ++#define ABBOTT_PRODUCT_ID ABBOTT_STEREO_PLUG_ID ++#define ABBOTT_STRIP_PORT_ID 0x3420 + + /* Commands */ + #define TI_GET_VERSION 0x01 -- 2.47.3