diff options
| author | Greg Kroah-Hartman <gregkh@suse.de> | 2010-06-04 09:58:15 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-06-04 09:58:15 -0700 |
| commit | 08c499a70f60eb1d0fb6b59460aeea00babe99f6 (patch) | |
| tree | a167c53053b8d577ae696045167ad57797e8cad2 | |
| parent | e13f442cd0070ef9d0b868cd624a52d7ab4e0a84 (diff) | |
| download | patches-08c499a70f60eb1d0fb6b59460aeea00babe99f6.tar.gz | |
more bug fixes
6 files changed, 382 insertions, 0 deletions
diff --git a/driver-core.current/fix-setattr-error-handling-in-sysfs-configfs.patch b/driver-core.current/fix-setattr-error-handling-in-sysfs-configfs.patch index 4a73ce643539ac..d445dd5457a3c4 100644 --- a/driver-core.current/fix-setattr-error-handling-in-sysfs-configfs.patch +++ b/driver-core.current/fix-setattr-error-handling-in-sysfs-configfs.patch @@ -12,6 +12,7 @@ attributes have been changed. Fix consistency by changing the generic inode attributes only when it is guaranteed to succeed. Signed-off-by: Nick Piggin <npiggin@suse.de> +Acked-by: Joel Becker <joel.becker@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- @@ -24,6 +24,8 @@ tty.current/altera_uart-don-t-take-spinlock-in-already-protected-functions.patch tty.current/altera_uart-simplify-altera_uart_console_putc.patch tty.current/tty-fix-a-little-bug-in-scrup-vt.c.patch tty.current/serial-altera_uart-proper-section-for-altera_uart_remove.patch +tty.current/vt_ioctl-return-efault-on-copy_from_user-errors.patch +tty.current/serial-add-support-for-various-titan-pci-cards.patch ################################# # USB patches for 2.6.35 @@ -72,6 +74,8 @@ staging.current/staging-comedi-fixing-ni_labpc-to-mite-dependancy.patch staging.current/staging-comedi-correct-parameter-gainlkup-for-daqcard-6024e-in-driver-ni_mio_cs.c.patch staging.current/staging-use-gfp_atomic-when-a-lock-is-held.patch staging.current/staging-eliminate-a-null-pointer-dereference.patch +staging.current/staging-rc2860-return-efault-on-copy_to_user-errors.patch +staging.current/staging-sep-return-efault-on-copy_to_user-errors.patch ##################################################################### @@ -94,3 +98,4 @@ staging.current/staging-eliminate-a-null-pointer-dereference.patch # staging stuff is now in the staging-next tree on git.kernel.org + diff --git a/staging.current/staging-rc2860-return-efault-on-copy_to_user-errors.patch b/staging.current/staging-rc2860-return-efault-on-copy_to_user-errors.patch new file mode 100644 index 00000000000000..cc5b7d7a45b7cc --- /dev/null +++ b/staging.current/staging-rc2860-return-efault-on-copy_to_user-errors.patch @@ -0,0 +1,32 @@ +From error27@gmail.com Fri Jun 4 09:50:35 2010 +From: Dan Carpenter <error27@gmail.com> +Date: Fri, 4 Jun 2010 12:39:51 +0200 +Subject: Staging: rc2860: return -EFAULT on copy_to_user errors +To: Greg Kroah-Hartman <gregkh@suse.de> +Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org +Message-ID: <20100604103951.GE5483@bicker> +Content-Disposition: inline + + +copy_to_user() returns the number of bytes remaining but we want to +return a negative error code. This is in the ioctl handler and the +error code gets passed to userspace. + +Signed-off-by: Dan Carpenter <error27@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/staging/rt2860/sta_ioctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/staging/rt2860/sta_ioctl.c ++++ b/drivers/staging/rt2860/sta_ioctl.c +@@ -2522,6 +2522,8 @@ int rt28xx_sta_ioctl(IN struct net_devic + Status = + copy_to_user(erq->pointer, pAd->nickname, + erq->length); ++ if (Status) ++ Status = -EFAULT; + break; + } + case SIOCGIWRATE: /*get default bit rate (bps) */ diff --git a/staging.current/staging-sep-return-efault-on-copy_to_user-errors.patch b/staging.current/staging-sep-return-efault-on-copy_to_user-errors.patch new file mode 100644 index 00000000000000..c1987cde183547 --- /dev/null +++ b/staging.current/staging-sep-return-efault-on-copy_to_user-errors.patch @@ -0,0 +1,189 @@ +From error27@gmail.com Fri Jun 4 09:50:45 2010 +From: Dan Carpenter <error27@gmail.com> +Date: Fri, 4 Jun 2010 12:38:40 +0200 +Subject: Staging: sep: return -EFAULT on copy_to_user errors +To: Greg Kroah-Hartman <gregkh@suse.de> +Cc: Alan Cox <alan@linux.intel.com>, Ben Hutchings <ben@decadent.org.uk>, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org +Message-ID: <20100604103840.GD5483@bicker> +Content-Disposition: inline + + +copy_to_user() returns the number of bytes remaining but we want to +return a negative error code here. These functions are used in the +ioctl handler and the error code gets returned to userspace. + +Signed-off-by: Dan Carpenter <error27@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/staging/sep/sep_driver.c | 52 ++++++++++++++++++++++++++++++--------- + 1 file changed, 40 insertions(+), 12 deletions(-) + +--- a/drivers/staging/sep/sep_driver.c ++++ b/drivers/staging/sep/sep_driver.c +@@ -594,8 +594,10 @@ static int sep_allocate_data_pool_memory + dbg("SEP Driver:--------> sep_allocate_data_pool_memory_handler start\n"); + + error = copy_from_user(&command_args, (void *) arg, sizeof(struct sep_driver_alloc_t)); +- if (error) ++ if (error) { ++ error = -EFAULT; + goto end_function; ++ } + + /* allocate memory */ + if ((sep->data_pool_bytes_allocated + command_args.num_bytes) > SEP_DRIVER_DATA_POOL_SHARED_AREA_SIZE_IN_BYTES) { +@@ -609,8 +611,10 @@ static int sep_allocate_data_pool_memory + + /* write the memory back to the user space */ + error = copy_to_user((void *) arg, (void *) &command_args, sizeof(struct sep_driver_alloc_t)); +- if (error) ++ if (error) { ++ error = -EFAULT; + goto end_function; ++ } + + /* set the allocation */ + sep->data_pool_bytes_allocated += command_args.num_bytes; +@@ -661,6 +665,8 @@ static int sep_write_into_data_pool_hand + } + /* copy the application data */ + error = copy_from_user(virt_address, (void *) app_in_address, num_bytes); ++ if (error) ++ error = -EFAULT; + end_function: + dbg("SEP Driver:<-------- sep_write_into_data_pool_handler end\n"); + return error; +@@ -711,6 +717,8 @@ static int sep_read_from_data_pool_handl + + /* copy the application data */ + error = copy_to_user((void *) app_out_address, virt_address, num_bytes); ++ if (error) ++ error = -EFAULT; + end_function: + dbg("SEP Driver:<-------- sep_read_from_data_pool_handler end\n"); + return error; +@@ -1448,8 +1456,10 @@ static int sep_create_sync_dma_tables_ha + dbg("SEP Driver:--------> sep_create_sync_dma_tables_handler start\n"); + + error = copy_from_user(&command_args, (void *) arg, sizeof(struct sep_driver_build_sync_table_t)); +- if (error) ++ if (error) { ++ error = -EFAULT; + goto end_function; ++ } + + edbg("app_in_address is %08lx\n", command_args.app_in_address); + edbg("app_out_address is %08lx\n", command_args.app_out_address); +@@ -1799,8 +1809,10 @@ static int sep_create_flow_dma_tables_ha + goto end_function; + + error = copy_from_user(&command_args, (void *) arg, sizeof(struct sep_driver_build_flow_table_t)); +- if (error) ++ if (error) { ++ error = -EFAULT; + goto end_function; ++ } + + /* create flow tables */ + error = sep_prepare_flow_dma_tables(sep, command_args.num_virtual_buffers, command_args.virt_buff_data_addr, flow_context_ptr, &first_table_data, &last_table_data, command_args.isKernelVirtualAddress); +@@ -1819,8 +1831,10 @@ static int sep_create_flow_dma_tables_ha + + /* send the parameters to user application */ + error = copy_to_user((void *) arg, &command_args, sizeof(struct sep_driver_build_flow_table_t)); +- if (error) ++ if (error) { ++ error = -EFAULT; + goto end_function_with_error; ++ } + + /* all the flow created - update the flow entry with temp id */ + flow_context_ptr->flow_id = SEP_TEMP_FLOW_ID; +@@ -1861,8 +1875,10 @@ static int sep_add_flow_tables_handler(s + + /* get input parameters */ + error = copy_from_user(&command_args, (void *) arg, sizeof(struct sep_driver_add_flow_table_t)); +- if (error) ++ if (error) { ++ error = -EFAULT; + goto end_function; ++ } + + /* find the flow structure for the flow id */ + flow_context_ptr = sep_find_flow_context(sep, command_args.flow_id); +@@ -1933,6 +1949,8 @@ static int sep_add_flow_tables_handler(s + + /* send the parameters to user application */ + error = copy_to_user((void *) arg, &command_args, sizeof(struct sep_driver_add_flow_table_t)); ++ if (error) ++ error = -EFAULT; + end_function_with_error: + /* free the allocated tables */ + sep_deallocated_flow_tables(&first_table_data); +@@ -1953,8 +1971,10 @@ static int sep_add_flow_tables_message_h + dbg("SEP Driver:--------> sep_add_flow_tables_message_handler start\n"); + + error = copy_from_user(&command_args, (void *) arg, sizeof(struct sep_driver_add_message_t)); +- if (error) ++ if (error) { ++ error = -EFAULT; + goto end_function; ++ } + + /* check input */ + if (command_args.message_size_in_bytes > SEP_MAX_ADD_MESSAGE_LENGTH_IN_BYTES) { +@@ -1970,6 +1990,8 @@ static int sep_add_flow_tables_message_h + /* copy the message into context */ + flow_context_ptr->message_size_in_bytes = command_args.message_size_in_bytes; + error = copy_from_user(flow_context_ptr->message, (void *) command_args.message_address, command_args.message_size_in_bytes); ++ if (error) ++ error = -EFAULT; + end_function: + dbg("SEP Driver:<-------- sep_add_flow_tables_message_handler end\n"); + return error; +@@ -1994,6 +2016,8 @@ static int sep_get_static_pool_addr_hand + + /* send the parameters to user application */ + error = copy_to_user((void *) arg, &command_args, sizeof(struct sep_driver_static_pool_addr_t)); ++ if (error) ++ error = -EFAULT; + dbg("SEP Driver:<-------- sep_get_static_pool_addr_handler end\n"); + return error; + } +@@ -2010,8 +2034,10 @@ static int sep_get_physical_mapped_offse + dbg("SEP Driver:--------> sep_get_physical_mapped_offset_handler start\n"); + + error = copy_from_user(&command_args, (void *) arg, sizeof(struct sep_driver_get_mapped_offset_t)); +- if (error) ++ if (error) { ++ error = -EFAULT; + goto end_function; ++ } + + if (command_args.physical_address < sep->shared_bus) { + error = -EINVAL; +@@ -2025,6 +2051,8 @@ static int sep_get_physical_mapped_offse + + /* send the parameters to user application */ + error = copy_to_user((void *) arg, &command_args, sizeof(struct sep_driver_get_mapped_offset_t)); ++ if (error) ++ error = -EFAULT; + end_function: + dbg("SEP Driver:<-------- sep_get_physical_mapped_offset_handler end\n"); + return error; +@@ -2070,11 +2098,11 @@ static int sep_init_handler(struct sep_d + error = 0; + + error = copy_from_user(&command_args, (void *) arg, sizeof(struct sep_driver_init_t)); +- +- dbg("SEP Driver:--------> sep_init_handler - finished copy_from_user \n"); +- +- if (error) ++ if (error) { ++ error = -EFAULT; + goto end_function; ++ } ++ dbg("SEP Driver:--------> sep_init_handler - finished copy_from_user\n"); + + /* PATCH - configure the DMA to single -burst instead of multi-burst */ + /*sep_configure_dma_burst(); */ diff --git a/tty.current/serial-add-support-for-various-titan-pci-cards.patch b/tty.current/serial-add-support-for-various-titan-pci-cards.patch new file mode 100644 index 00000000000000..dd0fbf08f00935 --- /dev/null +++ b/tty.current/serial-add-support-for-various-titan-pci-cards.patch @@ -0,0 +1,122 @@ +From yegor_sub1@visionsystems.de Fri Jun 4 09:52:12 2010 +From: Yegor Yefremov <yegor_sub1@visionsystems.de> +Date: Fri, 04 Jun 2010 09:58:18 +0200 +Subject: serial: add support for various Titan PCI cards +To: linux-serial@vger.kernel.org +Cc: greg@kroah.com +Message-ID: <4C08B21A.4030002@visionsystems.de> + + +serial: add support for various Titan PCI cards + +Models: 200I, 400I, 800I, 400EH, 800EH, 800EHB, + 100E, 200E, 400E, 800E, 200EI, 200EISI + +Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/serial/8250_pci.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 71 insertions(+) + +--- a/drivers/serial/8250_pci.c ++++ b/drivers/serial/8250_pci.c +@@ -982,6 +982,18 @@ static int skip_tx_en_setup(struct seria + #define PCI_SUBDEVICE_ID_POCTAL422 0x0408 + #define PCI_VENDOR_ID_ADVANTECH 0x13fe + #define PCI_DEVICE_ID_ADVANTECH_PCI3620 0x3620 ++#define PCI_DEVICE_ID_TITAN_200I 0x8028 ++#define PCI_DEVICE_ID_TITAN_400I 0x8048 ++#define PCI_DEVICE_ID_TITAN_800I 0x8088 ++#define PCI_DEVICE_ID_TITAN_800EH 0xA007 ++#define PCI_DEVICE_ID_TITAN_800EHB 0xA008 ++#define PCI_DEVICE_ID_TITAN_400EH 0xA009 ++#define PCI_DEVICE_ID_TITAN_100E 0xA010 ++#define PCI_DEVICE_ID_TITAN_200E 0xA012 ++#define PCI_DEVICE_ID_TITAN_400E 0xA013 ++#define PCI_DEVICE_ID_TITAN_800E 0xA014 ++#define PCI_DEVICE_ID_TITAN_200EI 0xA016 ++#define PCI_DEVICE_ID_TITAN_200EISI 0xA017 + + /* Unknown vendors/cards - this should not be in linux/pci_ids.h */ + #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584 +@@ -1541,6 +1553,10 @@ enum pci_board_num_t { + pbn_b3_4_115200, + pbn_b3_8_115200, + ++ pbn_b4_bt_2_921600, ++ pbn_b4_bt_4_921600, ++ pbn_b4_bt_8_921600, ++ + /* + * Board-specific versions. + */ +@@ -1995,6 +2011,25 @@ static struct pciserial_board pci_boards + .uart_offset = 8, + }, + ++ [pbn_b4_bt_2_921600] = { ++ .flags = FL_BASE4, ++ .num_ports = 2, ++ .base_baud = 921600, ++ .uart_offset = 8, ++ }, ++ [pbn_b4_bt_4_921600] = { ++ .flags = FL_BASE4, ++ .num_ports = 4, ++ .base_baud = 921600, ++ .uart_offset = 8, ++ }, ++ [pbn_b4_bt_8_921600] = { ++ .flags = FL_BASE4, ++ .num_ports = 8, ++ .base_baud = 921600, ++ .uart_offset = 8, ++ }, ++ + /* + * Entries following this are board-specific. + */ +@@ -3043,6 +3078,42 @@ static struct pci_device_id serial_pci_t + { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_800L, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_b0_bt_8_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200I, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b4_bt_2_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400I, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b4_bt_4_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_800I, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b4_bt_8_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400EH, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_4_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_800EH, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_4_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_800EHB, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_4_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_100E, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_oxsemi_1_4000000 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200E, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_oxsemi_2_4000000 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400E, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_oxsemi_4_4000000 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_800E, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_oxsemi_8_4000000 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EI, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_oxsemi_2_4000000 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_oxsemi_2_4000000 }, + + { PCI_VENDOR_ID_SIIG, PCI_DEVICE_ID_SIIG_1S_10x_550, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, diff --git a/tty.current/vt_ioctl-return-efault-on-copy_from_user-errors.patch b/tty.current/vt_ioctl-return-efault-on-copy_from_user-errors.patch new file mode 100644 index 00000000000000..5796b4b726df06 --- /dev/null +++ b/tty.current/vt_ioctl-return-efault-on-copy_from_user-errors.patch @@ -0,0 +1,33 @@ +From error27@gmail.com Fri Jun 4 09:50:59 2010 +From: Dan Carpenter <error27@gmail.com> +Date: Fri, 4 Jun 2010 12:20:46 +0200 +Subject: vt_ioctl: return -EFAULT on copy_from_user errors +To: Greg Kroah-Hartman <gregkh@suse.de> +Cc: Alan Cox <alan@linux.intel.com>, Arnd Bergmann <arnd@arndb.de>, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org +Message-ID: <20100604102046.GY5483@bicker> +Content-Disposition: inline + + +copy_from_user() returns the number of bytes remaining but we want to +return a negative error code here. + +Signed-off-by: Dan Carpenter <error27@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/char/vt_ioctl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/char/vt_ioctl.c ++++ b/drivers/char/vt_ioctl.c +@@ -1303,7 +1303,9 @@ int vt_ioctl(struct tty_struct *tty, str + if (!perm) + goto eperm; + ret = copy_from_user(&ui, up, sizeof(struct unimapinit)); +- if (!ret) ++ if (ret) ++ ret = -EFAULT; ++ else + con_clear_unimap(vc, &ui); + break; + } |