--- /dev/null
+From ee92efe41cf358f4b99e73509f2bfd4733609f26 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 17 Sep 2018 18:10:05 -0700
+Subject: IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit ee92efe41cf358f4b99e73509f2bfd4733609f26 upstream.
+
+Use different loop variables for the inner and outer loop. This avoids
+that an infinite loop occurs if there are more RDMA channels than
+target->req_ring_size.
+
+Fixes: d92c0da71a35 ("IB/srp: Add multichannel support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2594,7 +2594,7 @@ static int srp_reset_device(struct scsi_
+ {
+ struct srp_target_port *target = host_to_target(scmnd->device->host);
+ struct srp_rdma_ch *ch;
+- int i;
++ int i, j;
+ u8 status;
+
+ shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
+@@ -2608,8 +2608,8 @@ static int srp_reset_device(struct scsi_
+
+ for (i = 0; i < target->ch_count; i++) {
+ ch = &target->ch[i];
+- for (i = 0; i < target->req_ring_size; ++i) {
+- struct srp_request *req = &ch->req_ring[i];
++ for (j = 0; j < target->req_ring_size; ++j) {
++ struct srp_request *req = &ch->req_ring[j];
+
+ srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
+ }
--- /dev/null
+From 91a97507323e1ad4bfc10f4a5922e67cdaf8b3cd Mon Sep 17 00:00:00 2001
+From: Aaron Ma <aaron.ma@canonical.com>
+Date: Tue, 18 Sep 2018 09:32:22 -0700
+Subject: Input: elantech - enable middle button of touchpad on ThinkPad P72
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+commit 91a97507323e1ad4bfc10f4a5922e67cdaf8b3cd upstream.
+
+Adding 2 new touchpad IDs to support middle button support.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/elantech.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1180,6 +1180,8 @@ static const struct dmi_system_id elante
+ static const char * const middle_button_pnp_ids[] = {
+ "LEN2131", /* ThinkPad P52 w/ NFC */
+ "LEN2132", /* ThinkPad P52 */
++ "LEN2133", /* ThinkPad P72 w/ NFC */
++ "LEN2134", /* ThinkPad P72 */
+ NULL
+ };
+
--- /dev/null
+From e871db8d78df1c411032cbb3acfdf8930509360e Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Tue, 11 Sep 2018 10:00:44 +0200
+Subject: Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()"
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit e871db8d78df1c411032cbb3acfdf8930509360e upstream.
+
+This reverts commit 6e22e3af7bb3a7b9dc53cb4687659f6e63fca427.
+
+The bug the patch describes to, has been already fixed in commit
+2df6948428542 ("USB: cdc-wdm: don't enable interrupts in USB-giveback")
+so need to this, revert it.
+
+Fixes: 6e22e3af7bb3 ("usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -453,7 +453,7 @@ static int clear_wdm_read_flag(struct wd
+
+ set_bit(WDM_RESPONDING, &desc->flags);
+ spin_unlock_irq(&desc->iuspin);
+- rv = usb_submit_urb(desc->response, GFP_ATOMIC);
++ rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ spin_lock_irq(&desc->iuspin);
+ if (rv) {
+ dev_err(&desc->intf->dev,
--- /dev/null
+From 8c39e2699f8acb2e29782a834e56306da24937fe Mon Sep 17 00:00:00 2001
+From: Vincent Pelletier <plr.vincent@gmail.com>
+Date: Sun, 9 Sep 2018 04:09:27 +0000
+Subject: scsi: target: iscsi: Use bin2hex instead of a re-implementation
+
+From: Vincent Pelletier <plr.vincent@gmail.com>
+
+commit 8c39e2699f8acb2e29782a834e56306da24937fe upstream.
+
+Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
+Reviewed-by: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+[plr.vincent@gmail.com: hunk context change for 4.4 and 4.9, no code change]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target_auth.c | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -26,15 +26,6 @@
+ #include "iscsi_target_nego.h"
+ #include "iscsi_target_auth.h"
+
+-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
+-{
+- int i;
+-
+- for (i = 0; i < src_len; i++) {
+- sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff);
+- }
+-}
+-
+ static void chap_gen_challenge(
+ struct iscsi_conn *conn,
+ int caller,
+@@ -47,7 +38,7 @@ static void chap_gen_challenge(
+ memset(challenge_asciihex, 0, CHAP_CHALLENGE_LENGTH * 2 + 1);
+
+ get_random_bytes(chap->challenge, CHAP_CHALLENGE_LENGTH);
+- chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge,
++ bin2hex(challenge_asciihex, chap->challenge,
+ CHAP_CHALLENGE_LENGTH);
+ /*
+ * Set CHAP_C, and copy the generated challenge into c_str.
+@@ -287,7 +278,7 @@ static int chap_server_compute_md5(
+ }
+ crypto_free_hash(tfm);
+
+- chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE);
++ bin2hex(response, server_digest, MD5_SIGNATURE_SIZE);
+ pr_debug("[server] MD5 Server Digest: %s\n", response);
+
+ if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) {
+@@ -431,7 +422,7 @@ static int chap_server_compute_md5(
+ /*
+ * Convert response from binary hex to ascii hext.
+ */
+- chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE);
++ bin2hex(response, digest, MD5_SIGNATURE_SIZE);
+ *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s",
+ response);
+ *nr_out_len += 1;
usb-handle-null-config-in-usb_find_alt_setting.patch
slub-make-cpu_partial-unsigned-int.patch
media-uvcvideo-support-realtek-s-uvc-1.5-device.patch
+usb-usbdevfs-sanitize-flags-more.patch
+usb-usbdevfs-restore-warning-for-nonsensical-flags.patch
+revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch
+usb-remove-lpm-management-from-usb_driver_claim_interface.patch
+input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch
+ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch
+scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch
--- /dev/null
+From c183813fcee44a249339b7c46e1ad271ca1870aa Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 10 Sep 2018 13:58:51 -0400
+Subject: USB: remove LPM management from usb_driver_claim_interface()
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit c183813fcee44a249339b7c46e1ad271ca1870aa upstream.
+
+usb_driver_claim_interface() disables and re-enables Link Power
+Management, but it shouldn't do either one, for the reasons listed
+below. This patch removes the two LPM-related function calls from the
+routine.
+
+The reason for disabling LPM in the analogous function
+usb_probe_interface() is so that drivers won't have to deal with
+unwanted LPM transitions in their probe routine. But
+usb_driver_claim_interface() doesn't call the driver's probe routine
+(or any other callbacks), so that reason doesn't apply here.
+
+Furthermore, no driver other than usbfs will ever call
+usb_driver_claim_interface() unless it is already bound to another
+interface in the same device, which means disabling LPM here would be
+redundant. usbfs doesn't interact with LPM at all.
+
+Lastly, the error return from usb_unlocked_disable_lpm() isn't handled
+properly; the code doesn't clean up its earlier actions before
+returning.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Fixes: 8306095fd2c1 ("USB: Disable USB 3.0 LPM in critical sections.")
+CC: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/driver.c | 15 ---------------
+ 1 file changed, 15 deletions(-)
+
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -509,7 +509,6 @@ int usb_driver_claim_interface(struct us
+ struct device *dev;
+ struct usb_device *udev;
+ int retval = 0;
+- int lpm_disable_error = -ENODEV;
+
+ if (!iface)
+ return -ENODEV;
+@@ -530,16 +529,6 @@ int usb_driver_claim_interface(struct us
+
+ iface->condition = USB_INTERFACE_BOUND;
+
+- /* See the comment about disabling LPM in usb_probe_interface(). */
+- if (driver->disable_hub_initiated_lpm) {
+- lpm_disable_error = usb_unlocked_disable_lpm(udev);
+- if (lpm_disable_error) {
+- dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.",
+- __func__, driver->name);
+- return -ENOMEM;
+- }
+- }
+-
+ /* Claimed interfaces are initially inactive (suspended) and
+ * runtime-PM-enabled, but only if the driver has autosuspend
+ * support. Otherwise they are marked active, to prevent the
+@@ -558,10 +547,6 @@ int usb_driver_claim_interface(struct us
+ if (device_is_registered(dev))
+ retval = device_bind_driver(dev);
+
+- /* Attempt to re-enable USB3 LPM, if the disable was successful. */
+- if (!lpm_disable_error)
+- usb_unlocked_enable_lpm(udev);
+-
+ if (retval) {
+ dev->driver = NULL;
+ usb_set_intfdata(iface, NULL);
--- /dev/null
+From 81e0403b26d94360abd1f6a57311337973bc82cd Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 5 Sep 2018 12:07:03 +0200
+Subject: USB: usbdevfs: restore warning for nonsensical flags
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 81e0403b26d94360abd1f6a57311337973bc82cd upstream.
+
+If we filter flags before they reach the core we need to generate our
+own warnings.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Fixes: 0cb54a3e47cb ("USB: debugging code shouldn't alter control flow")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/devio.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1535,6 +1535,11 @@ static int proc_do_submiturb(struct usb_
+ u |= URB_NO_INTERRUPT;
+ as->urb->transfer_flags = u;
+
++ if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
++ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
++ if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
++ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
++
+ as->urb->transfer_buffer_length = uurb->buffer_length;
+ as->urb->setup_packet = (unsigned char *)dr;
+ dr = NULL;
--- /dev/null
+From 7a68d9fb851012829c29e770621905529bd9490b Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 5 Sep 2018 12:07:02 +0200
+Subject: USB: usbdevfs: sanitize flags more
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 7a68d9fb851012829c29e770621905529bd9490b upstream.
+
+Requesting a ZERO_PACKET or not is sensible only for output.
+In the input direction the device decides.
+Likewise accepting short packets makes sense only for input.
+
+This allows operation with panic_on_warn without opening up
+a local DOS.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Reported-by: syzbot+843efa30c8821bd69f53@syzkaller.appspotmail.com
+Fixes: 0cb54a3e47cb ("USB: debugging code shouldn't alter control flow")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/devio.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1289,10 +1289,13 @@ static int proc_do_submiturb(struct usb_
+ struct async *as = NULL;
+ struct usb_ctrlrequest *dr = NULL;
+ unsigned int u, totlen, isofrmlen;
+- int i, ret, is_in, num_sgs = 0, ifnum = -1;
++ int i, ret, num_sgs = 0, ifnum = -1;
+ int number_of_packets = 0;
+ unsigned int stream_id = 0;
+ void *buf;
++ bool is_in;
++ bool allow_short = false;
++ bool allow_zero = false;
+ unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK |
+ USBDEVFS_URB_BULK_CONTINUATION |
+ USBDEVFS_URB_NO_FSBR |
+@@ -1326,6 +1329,8 @@ static int proc_do_submiturb(struct usb_
+ u = 0;
+ switch (uurb->type) {
+ case USBDEVFS_URB_TYPE_CONTROL:
++ if (is_in)
++ allow_short = true;
+ if (!usb_endpoint_xfer_control(&ep->desc))
+ return -EINVAL;
+ /* min 8 byte setup packet */
+@@ -1366,6 +1371,10 @@ static int proc_do_submiturb(struct usb_
+ break;
+
+ case USBDEVFS_URB_TYPE_BULK:
++ if (!is_in)
++ allow_zero = true;
++ else
++ allow_short = true;
+ switch (usb_endpoint_type(&ep->desc)) {
+ case USB_ENDPOINT_XFER_CONTROL:
+ case USB_ENDPOINT_XFER_ISOC:
+@@ -1386,6 +1395,10 @@ static int proc_do_submiturb(struct usb_
+ if (!usb_endpoint_xfer_int(&ep->desc))
+ return -EINVAL;
+ interrupt_urb:
++ if (!is_in)
++ allow_zero = true;
++ else
++ allow_short = true;
+ break;
+
+ case USBDEVFS_URB_TYPE_ISO:
+@@ -1512,11 +1525,11 @@ static int proc_do_submiturb(struct usb_
+ u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
+ if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
+ u |= URB_ISO_ASAP;
+- if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
++ if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
+ u |= URB_SHORT_NOT_OK;
+ if (uurb->flags & USBDEVFS_URB_NO_FSBR)
+ u |= URB_NO_FSBR;
+- if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
++ if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+ u |= URB_ZERO_PACKET;
+ if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
+ u |= URB_NO_INTERRUPT;
projects / thirdparty / kernel / stable-queue.git / commitdiff
