diff options
| author | Greg Kroah-Hartman <gregkh@suse.de> | 2010-09-20 15:44:28 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-09-20 15:44:28 -0700 |
| commit | 6e59f9739ac77a39f6db572f31b6f2c98b8c7b96 (patch) | |
| tree | b85c27d23f80949e95ce29c7beacbbaf28c21a4b /usb.current | |
| parent | fe83d996a57d531befd6e154b407f439b830cb3b (diff) | |
| download | patches-6e59f9739ac77a39f6db572f31b6f2c98b8c7b96.tar.gz | |
actually commit the patches...
Diffstat (limited to 'usb.current')
| -rw-r--r-- | usb.current/usb-musb-maintainers-fix-my-mail-address.patch | 38 | ||||
| -rw-r--r-- | usb.current/usb-serial-mos-prevent-reading-uninitialized.patch | 49 |
2 files changed, 87 insertions, 0 deletions
diff --git a/usb.current/usb-musb-maintainers-fix-my-mail-address.patch b/usb.current/usb-musb-maintainers-fix-my-mail-address.patch new file mode 100644 index 00000000000000..342d153ccb263d --- /dev/null +++ b/usb.current/usb-musb-maintainers-fix-my-mail-address.patch @@ -0,0 +1,38 @@ +From linux-usb-owner@vger.kernel.org Thu Sep 16 12:12:37 2010 +From: Felipe Balbi <balbi@ti.com> +To: Greg KH <greg@kroah.com> +Cc: Felipe Balbi <balbi@ti.com> +Subject: USB: musb: MAINTAINERS: Fix my mail address +Date: Thu, 9 Sep 2010 09:04:25 +0300 +Message-Id: <1284012265-20479-1-git-send-email-balbi@ti.com> + +If we don't, contributors to musb and any USB OMAP +code will be sending mails to an unexistent inbox. + +Signed-off-by: Felipe Balbi <balbi@ti.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + MAINTAINERS | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -3942,7 +3942,7 @@ F: drivers/char/isicom.c + F: include/linux/isicom.h + + MUSB MULTIPOINT HIGH SPEED DUAL-ROLE CONTROLLER +-M: Felipe Balbi <felipe.balbi@nokia.com> ++M: Felipe Balbi <balbi@ti.com> + L: linux-usb@vger.kernel.org + T: git git://gitorious.org/usb/usb.git + S: Maintained +@@ -4240,7 +4240,7 @@ S: Maintained + F: drivers/char/hw_random/omap-rng.c + + OMAP USB SUPPORT +-M: Felipe Balbi <felipe.balbi@nokia.com> ++M: Felipe Balbi <balbi@ti.com> + M: David Brownell <dbrownell@users.sourceforge.net> + L: linux-usb@vger.kernel.org + L: linux-omap@vger.kernel.org diff --git a/usb.current/usb-serial-mos-prevent-reading-uninitialized.patch b/usb.current/usb-serial-mos-prevent-reading-uninitialized.patch new file mode 100644 index 00000000000000..0663c6f911ed26 --- /dev/null +++ b/usb.current/usb-serial-mos-prevent-reading-uninitialized.patch @@ -0,0 +1,49 @@ +From linux-usb-owner@vger.kernel.org Wed Sep 15 15:20:45 2010 +Subject: USB: serial/mos*: prevent reading uninitialized + stack memory +From: Dan Rosenberg <drosenberg@vsecurity.com> +To: linux-usb@vger.kernel.org +Cc: linux-kernel@vger.kernel.org, <security@kernel.org>, + stable@kernel.org +Date: Wed, 15 Sep 2010 17:44:16 -0400 +Message-ID: <1284587056.6275.100.camel@dan> + +The TIOCGICOUNT device ioctl in both mos7720.c and mos7840.c allows +unprivileged users to read uninitialized stack memory, because the +"reserved" member of the serial_icounter_struct struct declared on the +stack is not altered or zeroed before being copied back to the user. +This patch takes care of it. + +Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> +Cc: stable <stable@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/mos7720.c | 3 +++ + drivers/usb/serial/mos7840.c | 3 +++ + 2 files changed, 6 insertions(+) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -2024,6 +2024,9 @@ static int mos7720_ioctl(struct tty_stru + + case TIOCGICOUNT: + cnow = mos7720_port->icount; ++ ++ memset(&icount, 0, sizeof(struct serial_icounter_struct)); ++ + icount.cts = cnow.cts; + icount.dsr = cnow.dsr; + icount.rng = cnow.rng; +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -2285,6 +2285,9 @@ static int mos7840_ioctl(struct tty_stru + case TIOCGICOUNT: + cnow = mos7840_port->icount; + smp_rmb(); ++ ++ memset(&icount, 0, sizeof(struct serial_icounter_struct)); ++ + icount.cts = cnow.cts; + icount.dsr = cnow.dsr; + icount.rng = cnow.rng; |