3.18-stable patches

added patches:
	revert-led-core-fix-brightness-setting-when-setting-delay_off-0.patch
	xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch

diff --git a/queue-3.18/revert-led-core-fix-brightness-setting-when-setting-delay_off-0.patch b/queue-3.18/revert-led-core-fix-brightness-setting-when-setting-delay_off-0.patch
new file mode 100644 (file)
index 0000000..4ffbed1
--- /dev/null
+++ b/queue-3.18/revert-led-core-fix-brightness-setting-when-setting-delay_off-0.patch
@@ -0,0 +1,33 @@
+From 3f3437fbb2d8f780e84f507282d03facb4ccf248 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Date: Thu, 8 Mar 2018 15:59:07 +0000
+Subject: Revert "led: core: Fix brightness setting when setting delay_off=0"
+
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+
+This reverts commit 20f6d9c2af33da892a0e03ffd6249c7ab81edfb7, which
+was commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c upstream.
+The bug that it should fix was only introduced in Linux 4.7, and
+in 4.4 it causes a regression.
+
+Reported-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Cc: Matthieu CASTET <matthieu.castet@parrot.com>
+Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Cc: Wang Han <wanghan1995315@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/leds/led-core.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/leds/led-core.c
++++ b/drivers/leds/led-core.c
+@@ -76,7 +76,7 @@ void led_blink_set(struct led_classdev *
+                  unsigned long *delay_on,
+                  unsigned long *delay_off)
+ {
+-      led_stop_software_blink(led_cdev);
++      del_timer_sync(&led_cdev->blink_timer);
+ 
+       led_cdev->flags &= ~LED_BLINK_ONESHOT;
+       led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP;

diff --git a/queue-3.18/series b/queue-3.18/series
index 3885c0d9d12d3904f9c3c3e7aba80d3a7660b983..180827fb25dfa97d09f4214492793b0e0b2df8c0 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -44,3 +44,5 @@ usb-gadget-change-len-to-size_t-on-alloc_ep_req.patch
 usb-gadget-fix-usb_ep_align_maybe-endianness-and-new-usb_ep_align.patch
 usb-gadget-align-buffer-size-when-allocating-for-out-endpoint.patch
 usb-gadget-f_hid-fix-prevent-accessing-released-memory.patch
+revert-led-core-fix-brightness-setting-when-setting-delay_off-0.patch
+xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch

diff --git a/queue-3.18/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch b/queue-3.18/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch
new file mode 100644 (file)
index 0000000..8b34cca
--- /dev/null
+++ b/queue-3.18/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch
@@ -0,0 +1,37 @@
+From 3ae43090f13b7f6b6a8d4f4889727d2db4e81dd8 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Date: Thu, 11 Jan 2018 17:01:36 +0000
+Subject: xhci: Fix ring leak in failure path of xhci_alloc_virt_device()
+
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+
+This is a stable-only fix for the backport of commit 5d9b70f7d52e
+("xhci: Don't add a virt_dev to the devs array before it's fully
+allocated").
+
+In branches that predate commit c5628a2af83a ("xhci: remove endpoint
+ring cache") there is an additional failure path in
+xhci_alloc_virt_device() where ring cache allocation fails, in
+which case we need to free the ring allocated for endpoint 0.
+
+Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Cc: Mathias Nyman <mathias.nyman@intel.com>
+Cc: Wang Han <wanghan1995315@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-mem.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1032,7 +1032,8 @@ int xhci_alloc_virt_device(struct xhci_h
+ 
+       return 1;
+ fail:
+-
++      if (dev->eps[0].ring)
++              xhci_ring_free(xhci, dev->eps[0].ring);
+       if (dev->in_ctx)
+               xhci_free_container_ctx(xhci, dev->in_ctx);
+       if (dev->out_ctx)