4.0-stable patches

added patches:
	usb-gadget-f_fs-add-extra-check-before-unregister_gadget_item.patch
	usb-gadget-f_fs-fix-check-in-read-operation.patch

diff --git a/queue-4.0/series b/queue-4.0/series
index 1fe20cf7713c3354d28f97c476add27f1a0aaefe..d5f3cc1064b8dc67e940230e6ee4f0cf878d61a9 100644 (file)
--- a/queue-4.0/series
+++ b/queue-4.0/series
@@ -24,3 +24,5 @@ amd-xgbe-add-the-__gfp_nowarn-flag-to-rx-buffer-allocation.patch
 net-mvneta-introduce-compatible-string-marvell-armada-xp-neta.patch
 arm-mvebu-update-ethernet-compatible-string-for-armada-xp.patch
 net-mvneta-disable-ip-checksum-with-jumbo-frames-for-armada-370.patch
+usb-gadget-f_fs-fix-check-in-read-operation.patch
+usb-gadget-f_fs-add-extra-check-before-unregister_gadget_item.patch

diff --git a/queue-4.0/usb-gadget-f_fs-add-extra-check-before-unregister_gadget_item.patch b/queue-4.0/usb-gadget-f_fs-add-extra-check-before-unregister_gadget_item.patch
new file mode 100644 (file)
index 0000000..6f51268
--- /dev/null
+++ b/queue-4.0/usb-gadget-f_fs-add-extra-check-before-unregister_gadget_item.patch
@@ -0,0 +1,47 @@
+From f14e9ad17f46051b02bffffac2036486097de19e Mon Sep 17 00:00:00 2001
+From: Rui Miguel Silva <rui.silva@linaro.org>
+Date: Wed, 20 May 2015 14:52:40 +0100
+Subject: usb: gadget: f_fs: add extra check before unregister_gadget_item
+
+From: Rui Miguel Silva <rui.silva@linaro.org>
+
+commit f14e9ad17f46051b02bffffac2036486097de19e upstream.
+
+ffs_closed can race with configfs_rmdir which will call config_item_release, so
+add an extra check to avoid calling the unregister_gadget_item with an null
+gadget item.
+
+Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_fs.c |   10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -3433,6 +3433,7 @@ done:
+ static void ffs_closed(struct ffs_data *ffs)
+ {
+       struct ffs_dev *ffs_obj;
++      struct f_fs_opts *opts;
+ 
+       ENTER();
+       ffs_dev_lock();
+@@ -3446,8 +3447,13 @@ static void ffs_closed(struct ffs_data *
+       if (ffs_obj->ffs_closed_callback)
+               ffs_obj->ffs_closed_callback(ffs);
+ 
+-      if (!ffs_obj->opts || ffs_obj->opts->no_configfs
+-          || !ffs_obj->opts->func_inst.group.cg_item.ci_parent)
++      if (ffs_obj->opts)
++              opts = ffs_obj->opts;
++      else
++              goto done;
++
++      if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent
++          || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount))
+               goto done;
+ 
+       unregister_gadget_item(ffs_obj->opts->

diff --git a/queue-4.0/usb-gadget-f_fs-fix-check-in-read-operation.patch b/queue-4.0/usb-gadget-f_fs-fix-check-in-read-operation.patch
new file mode 100644 (file)
index 0000000..5a78f92
--- /dev/null
+++ b/queue-4.0/usb-gadget-f_fs-fix-check-in-read-operation.patch
@@ -0,0 +1,34 @@
+From 342f39a6c8d34d638a87b7d5f2156adc4db2585c Mon Sep 17 00:00:00 2001
+From: Rui Miguel Silva <rui.silva@linaro.org>
+Date: Wed, 20 May 2015 14:53:33 +0100
+Subject: usb: gadget: f_fs: fix check in read operation
+
+From: Rui Miguel Silva <rui.silva@linaro.org>
+
+commit 342f39a6c8d34d638a87b7d5f2156adc4db2585c upstream.
+
+when copying to iter the size can be different then the iov count,
+the check for full iov is wrong and make any read on request which
+is not the exactly size of iov to return -EFAULT.
+
+So, just check the success of the copy.
+
+Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_fs.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -845,7 +845,7 @@ static ssize_t ffs_epfile_io(struct file
+                               ret = ep->status;
+                               if (io_data->read && ret > 0) {
+                                       ret = copy_to_iter(data, ret, &io_data->data);
+-                                      if (unlikely(iov_iter_count(&io_data->data)))
++                                      if (!ret)
+                                               ret = -EFAULT;
+                               }
+                       }