[ 3.8.y.z extended stable ] Patch "hwmon: (applesmc) Check key count before proceeding" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    hwmon: (applesmc) Check key count before proceeding

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.11.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 5863b3817417138deb2079809b1777dd3b64bf8f Mon Sep 17 00:00:00 2001
From: Henrik Rydberg <rydberg at euromail.se>
Date: Thu, 26 Sep 2013 08:33:16 +0200
Subject: hwmon: (applesmc) Check key count before proceeding

commit 5f4513864304672e6ea9eac60583eeac32e679f2 upstream.

After reports from Chris and Josh Boyer of a rare crash in applesmc,
Guenter pointed at the initialization problem fixed below. The patch
has not been verified to fix the crash, but should be applied
regardless.

Reported-by: <jwboyer at fedoraproject.org>
Suggested-by: Guenter Roeck <linux at roeck-us.net>
Signed-off-by: Henrik Rydberg <rydberg at euromail.se>
Signed-off-by: Guenter Roeck <linux at roeck-us.net>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 drivers/hwmon/applesmc.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index b41baff..f75abcc 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -525,16 +525,25 @@ static int applesmc_init_smcreg_try(void)
 {
 	struct applesmc_registers *s = &smcreg;
 	bool left_light_sensor, right_light_sensor;
+	unsigned int count;
 	u8 tmp[1];
 	int ret;

 	if (s->init_complete)
 		return 0;

-	ret = read_register_count(&s->key_count);
+	ret = read_register_count(&count);
 	if (ret)
 		return ret;

+	if (s->cache && s->key_count != count) {
+		pr_warn("key count changed from %d to %d\n",
+			s->key_count, count);
+		kfree(s->cache);
+		s->cache = NULL;
+	}
+	s->key_count = count;
+
 	if (!s->cache)
 		s->cache = kcalloc(s->key_count, sizeof(*s->cache), GFP_KERNEL);
 	if (!s->cache)
--
1.8.1.2