kernel/3.10: add '003-11-' prefix for patches backported from 3.11

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>

SVN-Revision: 38217

1 files changed, 50 insertions, 0 deletions

diff --git a/target/linux/generic/patches-3.10/003-11-008-hso-Fix-stack-corruption-on-some-architectures.patch b/target/linux/generic/patches-3.10/003-11-008-hso-Fix-stack-corruption-on-some-architectures.patch
new file mode 100644
index 0000000000..e44f713d63
--- /dev/null
+++ b/target/linux/generic/patches-3.10/003-11-008-hso-Fix-stack-corruption-on-some-architectures.patch
@@ -0,0 +1,50 @@
+From e75dc677ff8d06ffa61bef6fee436227ae5440c6 Mon Sep 17 00:00:00 2001
+From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
+Date: Wed, 21 Aug 2013 01:43:19 -0700
+Subject: [PATCH] hso: Fix stack corruption on some architectures
+
+commit e75dc677ff8d06ffa61bef6fee436227ae5440c6 upstream.
+
+As Sergei Shtylyov explained in the #mipslinux IRC channel:
+[Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case?
+[Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches
+[Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci?
+[Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain
+[Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited
+[Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others)
+
+Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/usb/hso.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -2816,13 +2816,16 @@ exit:
+ static int hso_get_config_data(struct usb_interface *interface)
+ {
+ 	struct usb_device *usbdev = interface_to_usbdev(interface);
+-	u8 config_data[17];
++	u8 *config_data = kmalloc(17, GFP_KERNEL);
+ 	u32 if_num = interface->altsetting->desc.bInterfaceNumber;
+ 	s32 result;
+ 
++	if (!config_data)
++		return -ENOMEM;
+ 	if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
+ 			    0x86, 0xC0, 0, 0, config_data, 17,
+ 			    USB_CTRL_SET_TIMEOUT) != 0x11) {
++		kfree(config_data);
+ 		return -EIO;
+ 	}
+ 
+@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct us
+ 	if (config_data[16] & 0x1)
+ 		result |= HSO_INFO_CRC_BUG;
+ 
++	kfree(config_data);
+ 	return result;
+ }
+