From fd352ac6f94aea03caba45e2bd3601ea12bf7702 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 14 Mar 2013 13:09:50 -0700 Subject: [PATCH] 3.0-stable patches added patches: qcaux-add-franklin-u600.patch usb-cdc-wdm-fix-buffer-overflow.patch usb-option-add-huawei-e5331.patch virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch --- queue-3.0/qcaux-add-franklin-u600.patch | 29 +++++++ queue-3.0/series | 4 + .../usb-cdc-wdm-fix-buffer-overflow.patch | 87 +++++++++++++++++++ queue-3.0/usb-option-add-huawei-e5331.patch | 29 +++++++ ...e-device-registrations-fixes-crashes.patch | 61 +++++++++++++ 5 files changed, 210 insertions(+) create mode 100644 queue-3.0/qcaux-add-franklin-u600.patch create mode 100644 queue-3.0/series create mode 100644 queue-3.0/usb-cdc-wdm-fix-buffer-overflow.patch create mode 100644 queue-3.0/usb-option-add-huawei-e5331.patch create mode 100644 queue-3.0/virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch diff --git a/queue-3.0/qcaux-add-franklin-u600.patch b/queue-3.0/qcaux-add-franklin-u600.patch new file mode 100644 index 00000000000..65f761669ac --- /dev/null +++ b/queue-3.0/qcaux-add-franklin-u600.patch @@ -0,0 +1,29 @@ +From 2d90e63603ac235aecd7d20e234616e0682c8b1f Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Tue, 19 Feb 2013 09:47:09 -0600 +Subject: qcaux: add Franklin U600 + +From: Dan Williams + +commit 2d90e63603ac235aecd7d20e234616e0682c8b1f upstream. + +4 ports; AT/PPP is standard CDC-ACM. The other three (added by this +patch) are QCDM/DIAG, possibly GPS, and unknown. + +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/qcaux.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/qcaux.c ++++ b/drivers/usb/serial/qcaux.c +@@ -69,6 +69,7 @@ static struct usb_device_id id_table[] = + { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xfd, 0xff) }, /* NMEA */ + { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xfe, 0xff) }, /* WMC */ + { USB_VENDOR_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, 0xff, 0xff, 0xff) }, /* DIAG */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1fac, 0x0151, 0xff, 0xff, 0xff) }, + { }, + }; + MODULE_DEVICE_TABLE(usb, id_table); diff --git a/queue-3.0/series b/queue-3.0/series new file mode 100644 index 00000000000..6b8ba24b9fc --- /dev/null +++ b/queue-3.0/series @@ -0,0 +1,4 @@ +qcaux-add-franklin-u600.patch +virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch +usb-option-add-huawei-e5331.patch +usb-cdc-wdm-fix-buffer-overflow.patch diff --git a/queue-3.0/usb-cdc-wdm-fix-buffer-overflow.patch b/queue-3.0/usb-cdc-wdm-fix-buffer-overflow.patch new file mode 100644 index 00000000000..fa7149d2231 --- /dev/null +++ b/queue-3.0/usb-cdc-wdm-fix-buffer-overflow.patch @@ -0,0 +1,87 @@ +From c0f5ecee4e741667b2493c742b60b6218d40b3aa Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 12 Mar 2013 14:52:42 +0100 +Subject: USB: cdc-wdm: fix buffer overflow + +From: Oliver Neukum + +commit c0f5ecee4e741667b2493c742b60b6218d40b3aa upstream. + +The buffer for responses must not overflow. +If this would happen, set a flag, drop the data and return +an error after user space has read all remaining data. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-wdm.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -54,6 +54,7 @@ MODULE_DEVICE_TABLE (usb, wdm_ids); + #define WDM_POLL_RUNNING 6 + #define WDM_RESPONDING 7 + #define WDM_SUSPENDING 8 ++#define WDM_OVERFLOW 10 + + #define WDM_MAX 16 + +@@ -118,6 +119,7 @@ static void wdm_in_callback(struct urb * + { + struct wdm_device *desc = urb->context; + int status = urb->status; ++ int length = urb->actual_length; + + spin_lock(&desc->iuspin); + clear_bit(WDM_RESPONDING, &desc->flags); +@@ -148,9 +150,17 @@ static void wdm_in_callback(struct urb * + } + + desc->rerr = status; +- desc->reslength = urb->actual_length; +- memmove(desc->ubuf + desc->length, desc->inbuf, desc->reslength); +- desc->length += desc->reslength; ++ if (length + desc->length > desc->wMaxCommand) { ++ /* The buffer would overflow */ ++ set_bit(WDM_OVERFLOW, &desc->flags); ++ } else { ++ /* we may already be in overflow */ ++ if (!test_bit(WDM_OVERFLOW, &desc->flags)) { ++ memmove(desc->ubuf + desc->length, desc->inbuf, length); ++ desc->length += length; ++ desc->reslength = length; ++ } ++ } + skip_error: + wake_up(&desc->wait); + +@@ -417,6 +427,11 @@ retry: + rv = -ENODEV; + goto err; + } ++ if (test_bit(WDM_OVERFLOW, &desc->flags)) { ++ clear_bit(WDM_OVERFLOW, &desc->flags); ++ rv = -ENOBUFS; ++ goto err; ++ } + i++; + if (file->f_flags & O_NONBLOCK) { + if (!test_bit(WDM_READ, &desc->flags)) { +@@ -456,6 +471,7 @@ retry: + spin_unlock_irq(&desc->iuspin); + goto retry; + } ++ + if (!desc->reslength) { /* zero length read */ + dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__); + clear_bit(WDM_READ, &desc->flags); +@@ -901,6 +917,7 @@ static int wdm_post_reset(struct usb_int + struct wdm_device *desc = usb_get_intfdata(intf); + int rv; + ++ clear_bit(WDM_OVERFLOW, &desc->flags); + rv = recover_from_urb_loss(desc); + mutex_unlock(&desc->wlock); + mutex_unlock(&desc->rlock); diff --git a/queue-3.0/usb-option-add-huawei-e5331.patch b/queue-3.0/usb-option-add-huawei-e5331.patch new file mode 100644 index 00000000000..f14c8070974 --- /dev/null +++ b/queue-3.0/usb-option-add-huawei-e5331.patch @@ -0,0 +1,29 @@ +From daec90e7382cbd0e73eb6861109b3da91e5ab1f3 Mon Sep 17 00:00:00 2001 +From: Bjørn Mork +Date: Wed, 27 Feb 2013 15:52:56 +0100 +Subject: USB: option: add Huawei E5331 + +From: Bjørn Mork + +commit daec90e7382cbd0e73eb6861109b3da91e5ab1f3 upstream. + +Another device using CDC ACM with vendor specific protocol to mark +serial functions. + +Signed-off-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -579,6 +579,7 @@ static const struct usb_device_id option + { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c05, USB_CLASS_COMM, 0x02, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c1f, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, diff --git a/queue-3.0/virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch b/queue-3.0/virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch new file mode 100644 index 00000000000..5abb40c04df --- /dev/null +++ b/queue-3.0/virtio-rng-disallow-multiple-device-registrations-fixes-crashes.patch @@ -0,0 +1,61 @@ +From e84e7a56a3aa2963db506299e29a5f3f09377f9b Mon Sep 17 00:00:00 2001 +From: Amit Shah +Date: Fri, 8 Mar 2013 11:30:18 +1100 +Subject: virtio: rng: disallow multiple device registrations, fixes crashes + +From: Amit Shah + +commit e84e7a56a3aa2963db506299e29a5f3f09377f9b upstream. + +The code currently only supports one virtio-rng device at a time. +Invoking guests with multiple devices causes the guest to blow up. + +Check if we've already registered and initialised the driver. Also +cleanup in case of registration errors or hot-unplug so that a new +device can be used. + +Reported-by: Peter Krempa +Reported-by: +Signed-off-by: Amit Shah +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/hw_random/virtio-rng.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -88,14 +88,22 @@ static int virtrng_probe(struct virtio_d + { + int err; + ++ if (vq) { ++ /* We only support one device for now */ ++ return -EBUSY; ++ } + /* We expect a single virtqueue. */ + vq = virtio_find_single_vq(vdev, random_recv_done, "input"); +- if (IS_ERR(vq)) +- return PTR_ERR(vq); ++ if (IS_ERR(vq)) { ++ err = PTR_ERR(vq); ++ vq = NULL; ++ return err; ++ } + + err = hwrng_register(&virtio_hwrng); + if (err) { + vdev->config->del_vqs(vdev); ++ vq = NULL; + return err; + } + +@@ -107,6 +115,7 @@ static void __devexit virtrng_remove(str + vdev->config->reset(vdev); + hwrng_unregister(&virtio_hwrng); + vdev->config->del_vqs(vdev); ++ vq = NULL; + } + + static struct virtio_device_id id_table[] = { -- 2.47.3