]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.14-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 30 Mar 2019 20:23:09 +0000 (21:23 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 30 Mar 2019 20:23:09 +0000 (21:23 +0100)
added patches:
disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch
drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch
fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch
gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch
gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch
phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch
usb-common-consider-only-available-nodes-for-dr_mode.patch
usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch
usb-mtu3-fix-extcon-dependency.patch

queue-4.14/disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch [new file with mode: 0644]
queue-4.14/drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch [new file with mode: 0644]
queue-4.14/fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch [new file with mode: 0644]
queue-4.14/gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch [new file with mode: 0644]
queue-4.14/gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch [new file with mode: 0644]
queue-4.14/phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch [new file with mode: 0644]
queue-4.14/series
queue-4.14/usb-common-consider-only-available-nodes-for-dr_mode.patch [new file with mode: 0644]
queue-4.14/usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch [new file with mode: 0644]
queue-4.14/usb-mtu3-fix-extcon-dependency.patch [new file with mode: 0644]

diff --git a/queue-4.14/disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch b/queue-4.14/disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch
new file mode 100644 (file)
index 0000000..a61003a
--- /dev/null
@@ -0,0 +1,43 @@
+From 3ec8002951ea173e24b466df1ea98c56b7920e63 Mon Sep 17 00:00:00 2001
+From: Wentao Wang <witallwang@gmail.com>
+Date: Wed, 20 Mar 2019 15:30:39 +0000
+Subject: Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wentao Wang <witallwang@gmail.com>
+
+commit 3ec8002951ea173e24b466df1ea98c56b7920e63 upstream.
+
+Echo "" to /sys/module/kgdboc/parameters/kgdboc will fail with "No such
+deviceā€ error.
+
+This is caused by function "configure_kgdboc" who init err to ENODEV
+when the config is empty (legal input) the code go out with ENODEV
+returned.
+
+Fixes: 2dd453168643 ("kgdboc: Fix restrict error")
+Signed-off-by: Wentao Wang <witallwang@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/kgdboc.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -148,8 +148,10 @@ static int configure_kgdboc(void)
+       char *cptr = config;
+       struct console *cons;
+-      if (!strlen(config) || isspace(config[0]))
++      if (!strlen(config) || isspace(config[0])) {
++              err = 0;
+               goto noconfig;
++      }
+       kgdboc_io_ops.is_console = 0;
+       kgdb_tty_driver = NULL;
diff --git a/queue-4.14/drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch b/queue-4.14/drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch
new file mode 100644 (file)
index 0000000..bb74054
--- /dev/null
@@ -0,0 +1,51 @@
+From 21d2b122732318b48c10b7262e15595ce54511d3 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Tue, 26 Feb 2019 13:44:51 -0800
+Subject: drm/vgem: fix use-after-free when drm_gem_handle_create() fails
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 21d2b122732318b48c10b7262e15595ce54511d3 upstream.
+
+If drm_gem_handle_create() fails in vgem_gem_create(), then the
+drm_vgem_gem_object is freed twice: once when the reference is dropped
+by drm_gem_object_put_unlocked(), and again by __vgem_gem_destroy().
+
+This was hit by syzkaller using fault injection.
+
+Fix it by skipping the second free.
+
+Reported-by: syzbot+e73f2fb5ed5a5df36d33@syzkaller.appspotmail.com
+Fixes: af33a9190d02 ("drm/vgem: Enable dmabuf import interfaces")
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Laura Abbott <labbott@redhat.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Acked-by: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190226214451.195123-1-ebiggers@kernel.org
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vgem/vgem_drv.c |    6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/vgem/vgem_drv.c
++++ b/drivers/gpu/drm/vgem/vgem_drv.c
+@@ -192,13 +192,9 @@ static struct drm_gem_object *vgem_gem_c
+       ret = drm_gem_handle_create(file, &obj->base, handle);
+       drm_gem_object_put_unlocked(&obj->base);
+       if (ret)
+-              goto err;
++              return ERR_PTR(ret);
+       return &obj->base;
+-
+-err:
+-      __vgem_gem_destroy(obj);
+-      return ERR_PTR(ret);
+ }
+ static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
diff --git a/queue-4.14/fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch b/queue-4.14/fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch
new file mode 100644 (file)
index 0000000..c65bb50
--- /dev/null
@@ -0,0 +1,99 @@
+From 23da9588037ecdd4901db76a5b79a42b529c4ec3 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 28 Mar 2019 20:44:40 -0700
+Subject: fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+commit 23da9588037ecdd4901db76a5b79a42b529c4ec3 upstream.
+
+Syzkaller reports:
+
+kasan: GPF could be caused by NULL-ptr deref or user memory access
+general protection fault: 0000 [#1] SMP KASAN PTI
+CPU: 1 PID: 5373 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+RIP: 0010:put_links+0x101/0x440 fs/proc/proc_sysctl.c:1599
+Code: 00 0f 85 3a 03 00 00 48 8b 43 38 48 89 44 24 20 48 83 c0 38 48 89 c2 48 89 44 24 28 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 fe 02 00 00 48 8b 74 24 20 48 c7 c7 60 2a 9d 91
+RSP: 0018:ffff8881d828f238 EFLAGS: 00010202
+RAX: dffffc0000000000 RBX: ffff8881e01b1140 RCX: ffffffff8ee98267
+RDX: 0000000000000007 RSI: ffffc90001479000 RDI: ffff8881e01b1178
+RBP: dffffc0000000000 R08: ffffed103ee27259 R09: ffffed103ee27259
+R10: 0000000000000001 R11: ffffed103ee27258 R12: fffffffffffffff4
+R13: 0000000000000006 R14: ffff8881f59838c0 R15: dffffc0000000000
+FS:  00007f072254f700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007fff8b286668 CR3: 00000001f0542002 CR4: 00000000007606e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+PKRU: 55555554
+Call Trace:
+ drop_sysctl_table+0x152/0x9f0 fs/proc/proc_sysctl.c:1629
+ get_subdir fs/proc/proc_sysctl.c:1022 [inline]
+ __register_sysctl_table+0xd65/0x1090 fs/proc/proc_sysctl.c:1335
+ br_netfilter_init+0xbc/0x1000 [br_netfilter]
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+RIP: 0033:0x462e99
+Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007f072254ec58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
+RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003
+RBP: 00007f072254ec70 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007f072254f6bc
+R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004
+Modules linked in: br_netfilter(+) dvb_usb_dibusb_mc_common dib3000mc dibx000_common dvb_usb_dibusb_common dvb_usb_dw2102 dvb_usb classmate_laptop palmas_regulator cn videobuf2_v4l2 v4l2_common snd_soc_bd28623 mptbase snd_usb_usx2y snd_usbmidi_lib snd_rawmidi wmi libnvdimm lockd sunrpc grace rc_kworld_pc150u rc_core rtc_da9063 sha1_ssse3 i2c_cros_ec_tunnel adxl34x_spi adxl34x nfnetlink lib80211 i5500_temp dvb_as102 dvb_core videobuf2_common videodev media videobuf2_vmalloc videobuf2_memops udc_core lnbp22 leds_lp3952 hid_roccat_ryos s1d13xxxfb mtd vport_geneve openvswitch nf_conncount nf_nat_ipv6 nsh geneve udp_tunnel ip6_udp_tunnel snd_soc_mt6351 sis_agp phylink snd_soc_adau1761_spi snd_soc_adau1761 snd_soc_adau17x1 snd_soc_core snd_pcm_dmaengine ac97_bus snd_compress snd_soc_adau_utils snd_soc_sigmadsp_regmap snd_soc_sigmadsp raid_class hid_roccat_konepure hid_roccat_common hid_roccat c2port_duramar2150 core mdio_bcm_unimac iptable_security iptable_raw iptable_mangle
+ iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_vti ip_gre ipip sit tunnel4 ip_tunnel hsr veth netdevsim devlink vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon dummy team bonding vcan bridge stp llc ip6_gre gre ip6_tunnel tunnel6 tun crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel joydev mousedev ide_pci_generic piix aesni_intel aes_x86_64 ide_core crypto_simd atkbd cryptd glue_helper serio_raw ata_generic pata_acpi i2c_piix4 floppy sch_fq_codel ip_tables x_tables ipv6 [last unloaded: lm73]
+Dumping ftrace buffer:
+   (ftrace buffer empty)
+---[ end trace 770020de38961fd0 ]---
+
+A new dir entry can be created in get_subdir and its 'header->parent' is
+set to NULL.  Only after insert_header success, it will be set to 'dir',
+otherwise 'header->parent' is set to NULL and drop_sysctl_table is called.
+However in err handling path of get_subdir, drop_sysctl_table also be
+called on 'new->header' regardless its value of parent pointer.  Then
+put_links is called, which triggers NULL-ptr deref when access member of
+header->parent.
+
+In fact we have multiple error paths which call drop_sysctl_table() there,
+upon failure on insert_links() we also call drop_sysctl_table().And even
+in the successful case on __register_sysctl_table() we still always call
+drop_sysctl_table().This patch fix it.
+
+Link: http://lkml.kernel.org/r/20190314085527.13244-1-yuehaibing@huawei.com
+Fixes: 0e47c99d7fe25 ("sysctl: Replace root_list with links between sysctl_table_sets")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Acked-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Cc: <stable@vger.kernel.org>    [3.4+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/proc_sysctl.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -1620,7 +1620,8 @@ static void drop_sysctl_table(struct ctl
+       if (--header->nreg)
+               return;
+-      put_links(header);
++      if (parent)
++              put_links(header);
+       start_unregistering(header);
+       if (!--header->count)
+               kfree_rcu(header, rcu);
diff --git a/queue-4.14/gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch b/queue-4.14/gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch
new file mode 100644 (file)
index 0000000..0b02590
--- /dev/null
@@ -0,0 +1,40 @@
+From c5bc6e526d3f217ed2cc3681d256dc4a2af4cc2b Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Mon, 11 Mar 2019 21:29:37 +0800
+Subject: gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit c5bc6e526d3f217ed2cc3681d256dc4a2af4cc2b upstream.
+
+Current code test wrong value so it does not verify if the written
+data is correctly read back. Fix it.
+Also make it return -EPERM if read value does not match written bit,
+just like it done for adnp_gpio_direction_output().
+
+Fixes: 5e969a401a01 ("gpio: Add Avionic Design N-bit GPIO expander support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-adnp.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/gpio-adnp.c
++++ b/drivers/gpio/gpio-adnp.c
+@@ -132,8 +132,10 @@ static int adnp_gpio_direction_input(str
+       if (err < 0)
+               goto out;
+-      if (err & BIT(pos))
+-              err = -EACCES;
++      if (value & BIT(pos)) {
++              err = -EPERM;
++              goto out;
++      }
+       err = 0;
diff --git a/queue-4.14/gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch b/queue-4.14/gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch
new file mode 100644 (file)
index 0000000..1c65add
--- /dev/null
@@ -0,0 +1,32 @@
+From 7ecced0934e574b528a1ba6c237731e682216a74 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Fri, 8 Mar 2019 22:07:57 -0600
+Subject: gpio: exar: add a check for the return value of ida_simple_get fails
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+commit 7ecced0934e574b528a1ba6c237731e682216a74 upstream.
+
+ida_simple_get may fail and return a negative error number.
+The fix checks its return value; if it fails, go to err_destroy.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-exar.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpio/gpio-exar.c
++++ b/drivers/gpio/gpio-exar.c
+@@ -148,6 +148,8 @@ static int gpio_exar_probe(struct platfo
+       mutex_init(&exar_gpio->lock);
+       index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
++      if (index < 0)
++              goto err_destroy;
+       sprintf(exar_gpio->name, "exar_gpio%d", index);
+       exar_gpio->gpio_chip.label = exar_gpio->name;
diff --git a/queue-4.14/phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch b/queue-4.14/phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch
new file mode 100644 (file)
index 0000000..1e0779d
--- /dev/null
@@ -0,0 +1,42 @@
+From 1396929e8a903db80425343cacca766a18ad6409 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Fri, 22 Mar 2019 16:51:07 +0800
+Subject: phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 1396929e8a903db80425343cacca766a18ad6409 upstream.
+
+While only the first PHY supports mode switching, the remaining PHYs
+work in USB host mode. They should support set_mode with mode=USB_HOST
+instead of failing. This is especially needed now that the USB core does
+set_mode for all USB ports, which was added in commit b97a31348379 ("usb:
+core: comply to PHY framework").
+
+Make set_mode with mode=USB_HOST a no-op instead of failing for the
+non-OTG USB PHYs.
+
+Fixes: 6ba43c291961 ("phy-sun4i-usb: Add support for phy_set_mode")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/allwinner/phy-sun4i-usb.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -480,8 +480,11 @@ static int sun4i_usb_phy_set_mode(struct
+       struct sun4i_usb_phy_data *data = to_sun4i_usb_phy_data(phy);
+       int new_mode;
+-      if (phy->index != 0)
++      if (phy->index != 0) {
++              if (mode == PHY_MODE_USB_HOST)
++                      return 0;
+               return -EINVAL;
++      }
+       switch (mode) {
+       case PHY_MODE_USB_HOST:
index 0596d6115f01abb9b3f547aebcf96e27e983f8bd..7dd9fba6bfe12c7c26793b70892c673280882271 100644 (file)
@@ -85,3 +85,12 @@ usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch
 usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch
 usb-serial-option-add-support-for-quectel-em12.patch
 usb-serial-option-add-olicard-600.patch
+disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch
+fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch
+drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch
+gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch
+gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch
+phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch
+usb-mtu3-fix-extcon-dependency.patch
+usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch
+usb-common-consider-only-available-nodes-for-dr_mode.patch
diff --git a/queue-4.14/usb-common-consider-only-available-nodes-for-dr_mode.patch b/queue-4.14/usb-common-consider-only-available-nodes-for-dr_mode.patch
new file mode 100644 (file)
index 0000000..51229af
--- /dev/null
@@ -0,0 +1,34 @@
+From 238e0268c82789e4c107a37045d529a6dbce51a9 Mon Sep 17 00:00:00 2001
+From: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+Date: Fri, 1 Mar 2019 11:05:45 +0000
+Subject: usb: common: Consider only available nodes for dr_mode
+
+From: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+
+commit 238e0268c82789e4c107a37045d529a6dbce51a9 upstream.
+
+There are cases where multiple device tree nodes point to the
+same phy node by means of the "phys" property, but we should
+only consider those nodes that are marked as available rather
+than just any node.
+
+Fixes: 98bfb3946695 ("usb: of: add an api to get dr_mode by the phy node")
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/common/common.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/common/common.c
++++ b/drivers/usb/common/common.c
+@@ -148,6 +148,8 @@ enum usb_dr_mode of_usb_get_dr_mode_by_p
+       do {
+               controller = of_find_node_with_property(controller, "phys");
++              if (!of_device_is_available(controller))
++                      continue;
+               index = 0;
+               do {
+                       if (arg0 == -1) {
diff --git a/queue-4.14/usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch b/queue-4.14/usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch
new file mode 100644 (file)
index 0000000..8bd333a
--- /dev/null
@@ -0,0 +1,64 @@
+From 072684e8c58d17e853f8e8b9f6d9ce2e58d2b036 Mon Sep 17 00:00:00 2001
+From: Radoslav Gerganov <rgerganov@vmware.com>
+Date: Tue, 5 Mar 2019 10:10:34 +0000
+Subject: USB: gadget: f_hid: fix deadlock in f_hidg_write()
+
+From: Radoslav Gerganov <rgerganov@vmware.com>
+
+commit 072684e8c58d17e853f8e8b9f6d9ce2e58d2b036 upstream.
+
+In f_hidg_write() the write_spinlock is acquired before calling
+usb_ep_queue() which causes a deadlock when dummy_hcd is being used.
+This is because dummy_queue() callbacks into f_hidg_req_complete() which
+tries to acquire the same spinlock. This is (part of) the backtrace when
+the deadlock occurs:
+
+  0xffffffffc06b1410 in f_hidg_req_complete
+  0xffffffffc06a590a in usb_gadget_giveback_request
+  0xffffffffc06cfff2 in dummy_queue
+  0xffffffffc06a4b96 in usb_ep_queue
+  0xffffffffc06b1eb6 in f_hidg_write
+  0xffffffff8127730b in __vfs_write
+  0xffffffff812774d1 in vfs_write
+  0xffffffff81277725 in SYSC_write
+
+Fix this by releasing the write_spinlock before calling usb_ep_queue()
+
+Reviewed-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Tested-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Cc: stable@vger.kernel.org # 4.11+
+Fixes: 749494b6bdbb ("usb: gadget: f_hid: fix: Move IN request allocation to set_alt()")
+Signed-off-by: Radoslav Gerganov <rgerganov@vmware.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_hid.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -395,20 +395,20 @@ try_again:
+       req->complete = f_hidg_req_complete;
+       req->context  = hidg;
++      spin_unlock_irqrestore(&hidg->write_spinlock, flags);
++
+       status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
+       if (status < 0) {
+               ERROR(hidg->func.config->cdev,
+                       "usb_ep_queue error on int endpoint %zd\n", status);
+-              goto release_write_pending_unlocked;
++              goto release_write_pending;
+       } else {
+               status = count;
+       }
+-      spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+       return status;
+ release_write_pending:
+       spin_lock_irqsave(&hidg->write_spinlock, flags);
+-release_write_pending_unlocked:
+       hidg->write_pending = 0;
+       spin_unlock_irqrestore(&hidg->write_spinlock, flags);
diff --git a/queue-4.14/usb-mtu3-fix-extcon-dependency.patch b/queue-4.14/usb-mtu3-fix-extcon-dependency.patch
new file mode 100644 (file)
index 0000000..e1c9293
--- /dev/null
@@ -0,0 +1,36 @@
+From 3d54d10c6afed34fd45b852bf76f55e8da31d8ef Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 25 Mar 2019 14:54:30 +0100
+Subject: usb: mtu3: fix EXTCON dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 3d54d10c6afed34fd45b852bf76f55e8da31d8ef upstream.
+
+When EXTCON is a loadable module, mtu3 fails to link as built-in:
+
+drivers/usb/mtu3/mtu3_plat.o: In function `mtu3_probe':
+mtu3_plat.c:(.text+0x690): undefined reference to `extcon_get_edev_by_phandle'
+
+Add a Kconfig dependency to force mtu3 also to be a loadable module
+if extconn is, but still allow it to be built without extcon.
+
+Fixes: d0ed062a8b75 ("usb: mtu3: dual-role mode support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/mtu3/Kconfig |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/mtu3/Kconfig
++++ b/drivers/usb/mtu3/Kconfig
+@@ -4,6 +4,7 @@ config USB_MTU3
+       tristate "MediaTek USB3 Dual Role controller"
+       depends on EXTCON && (USB || USB_GADGET) && HAS_DMA
+       depends on ARCH_MEDIATEK || COMPILE_TEST
++      depends on EXTCON || !EXTCON
+       select USB_XHCI_MTK if USB_SUPPORT && USB_XHCI_HCD
+       help
+         Say Y or M here if your system runs on MediaTek SoCs with