--- /dev/null
+From 0725dda207e95ff25f1aa01432250323e0ec49d6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 5 Nov 2014 15:08:49 +0100
+Subject: ALSA: usb-audio: Fix device_del() sysfs warnings at disconnect
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0725dda207e95ff25f1aa01432250323e0ec49d6 upstream.
+
+Some USB-audio devices show weird sysfs warnings at disconnecting the
+devices, e.g.
+ usb 1-3: USB disconnect, device number 3
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 973 at fs/sysfs/group.c:216 device_del+0x39/0x180()
+ sysfs group ffffffff8183df40 not found for kobject 'midiC1D0'
+ Call Trace:
+ [<ffffffff814a3e38>] ? dump_stack+0x49/0x71
+ [<ffffffff8103cb72>] ? warn_slowpath_common+0x82/0xb0
+ [<ffffffff8103cc55>] ? warn_slowpath_fmt+0x45/0x50
+ [<ffffffff813521e9>] ? device_del+0x39/0x180
+ [<ffffffff81352339>] ? device_unregister+0x9/0x20
+ [<ffffffff81352384>] ? device_destroy+0x34/0x40
+ [<ffffffffa00ba29f>] ? snd_unregister_device+0x7f/0xd0 [snd]
+ [<ffffffffa025124e>] ? snd_rawmidi_dev_disconnect+0xce/0x100 [snd_rawmidi]
+ [<ffffffffa00c0192>] ? snd_device_disconnect+0x62/0x90 [snd]
+ [<ffffffffa00c025c>] ? snd_device_disconnect_all+0x3c/0x60 [snd]
+ [<ffffffffa00bb574>] ? snd_card_disconnect+0x124/0x1a0 [snd]
+ [<ffffffffa02e54e8>] ? usb_audio_disconnect+0x88/0x1c0 [snd_usb_audio]
+ [<ffffffffa015260e>] ? usb_unbind_interface+0x5e/0x1b0 [usbcore]
+ [<ffffffff813553e9>] ? __device_release_driver+0x79/0xf0
+ [<ffffffff81355485>] ? device_release_driver+0x25/0x40
+ [<ffffffff81354e11>] ? bus_remove_device+0xf1/0x130
+ [<ffffffff813522b9>] ? device_del+0x109/0x180
+ [<ffffffffa01501d5>] ? usb_disable_device+0x95/0x1f0 [usbcore]
+ [<ffffffffa014634f>] ? usb_disconnect+0x8f/0x190 [usbcore]
+ [<ffffffffa0149179>] ? hub_thread+0x539/0x13a0 [usbcore]
+ [<ffffffff810669f5>] ? sched_clock_local+0x15/0x80
+ [<ffffffff81066c98>] ? sched_clock_cpu+0xb8/0xd0
+ [<ffffffff81070730>] ? bit_waitqueue+0xb0/0xb0
+ [<ffffffffa0148c40>] ? usb_port_resume+0x430/0x430 [usbcore]
+ [<ffffffffa0148c40>] ? usb_port_resume+0x430/0x430 [usbcore]
+ [<ffffffff8105973e>] ? kthread+0xce/0xf0
+ [<ffffffff81059670>] ? kthread_create_on_node+0x1c0/0x1c0
+ [<ffffffff814a8b7c>] ? ret_from_fork+0x7c/0xb0
+ [<ffffffff81059670>] ? kthread_create_on_node+0x1c0/0x1c0
+ ---[ end trace 40b1928d1136b91e ]---
+
+This comes from the fact that usb-audio driver may receive the
+disconnect callback multiple times, per each usb interface. When a
+device has both audio and midi interfaces, it gets called twice, and
+currently the driver tries to release resources at the last call.
+At this point, the first parent interface has been already deleted,
+thus deleting a child of the first parent hits such a warning.
+
+For fixing this problem, we need to call snd_card_disconnect() and
+cancel pending operations at the very first disconnect while the
+release of the whole objects waits until the last disconnect call.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=80931
+Reported-and-tested-by: Tomas Gayoso <tgayoso@gmail.com>
+Reported-and-tested-by: Chris J Arges <chris.j.arges@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/card.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -591,18 +591,19 @@ static void snd_usb_audio_disconnect(str
+ {
+ struct snd_card *card;
+ struct list_head *p;
++ bool was_shutdown;
+
+ if (chip == (void *)-1L)
+ return;
+
+ card = chip->card;
+ down_write(&chip->shutdown_rwsem);
++ was_shutdown = chip->shutdown;
+ chip->shutdown = 1;
+ up_write(&chip->shutdown_rwsem);
+
+ mutex_lock(®ister_mutex);
+- chip->num_interfaces--;
+- if (chip->num_interfaces <= 0) {
++ if (!was_shutdown) {
+ struct snd_usb_endpoint *ep;
+
+ snd_card_disconnect(card);
+@@ -622,6 +623,10 @@ static void snd_usb_audio_disconnect(str
+ list_for_each(p, &chip->mixer_list) {
+ snd_usb_mixer_disconnect(p);
+ }
++ }
++
++ chip->num_interfaces--;
++ if (chip->num_interfaces <= 0) {
+ usb_chip[chip->index] = NULL;
+ mutex_unlock(®ister_mutex);
+ snd_card_free_when_closed(card);
--- /dev/null
+From a48fda9de94500a3152a56b723d0a64ae236547c Mon Sep 17 00:00:00 2001
+From: Dmitry Kasatkin <d.kasatkin@samsung.com>
+Date: Tue, 28 Oct 2014 13:31:22 +0200
+Subject: ima: check xattr value length and type in the ima_inode_setxattr()
+
+From: Dmitry Kasatkin <d.kasatkin@samsung.com>
+
+commit a48fda9de94500a3152a56b723d0a64ae236547c upstream.
+
+ima_inode_setxattr() can be called with no value. Function does not
+check the length so that following command can be used to produce
+kernel oops: setfattr -n security.ima FOO. This patch fixes it.
+
+Changes in v3:
+* for stable reverted "allow setting hash only in fix or log mode"
+ It will be a separate patch.
+
+Changes in v2:
+* testing validity of xattr type
+* allow setting hash only in fix or log mode (Mimi)
+
+[ 261.562522] BUG: unable to handle kernel NULL pointer dereference at (null)
+[ 261.564109] IP: [<ffffffff812af272>] ima_inode_setxattr+0x3e/0x5a
+[ 261.564109] PGD 3112f067 PUD 42965067 PMD 0
+[ 261.564109] Oops: 0000 [#1] SMP
+[ 261.564109] Modules linked in: bridge stp llc evdev serio_raw i2c_piix4 button fuse
+[ 261.564109] CPU: 0 PID: 3299 Comm: setxattr Not tainted 3.16.0-kds+ #2924
+[ 261.564109] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
+[ 261.564109] task: ffff8800428c2430 ti: ffff880042be0000 task.ti: ffff880042be0000
+[ 261.564109] RIP: 0010:[<ffffffff812af272>] [<ffffffff812af272>] ima_inode_setxattr+0x3e/0x5a
+[ 261.564109] RSP: 0018:ffff880042be3d50 EFLAGS: 00010246
+[ 261.564109] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000015
+[ 261.564109] RDX: 0000001500000000 RSI: 0000000000000000 RDI: ffff8800375cc600
+[ 261.564109] RBP: ffff880042be3d68 R08: 0000000000000000 R09: 00000000004d6256
+[ 261.564109] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88002149ba00
+[ 261.564109] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+[ 261.564109] FS: 00007f6c1e219740(0000) GS:ffff88005da00000(0000) knlGS:0000000000000000
+[ 261.564109] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 261.564109] CR2: 0000000000000000 CR3: 000000003b35a000 CR4: 00000000000006f0
+[ 261.564109] Stack:
+[ 261.564109] ffff88002149ba00 ffff880042be3df8 0000000000000000 ffff880042be3d98
+[ 261.564109] ffffffff812a101b ffff88002149ba00 ffff880042be3df8 0000000000000000
+[ 261.564109] 0000000000000000 ffff880042be3de0 ffffffff8116d08a ffff880042be3dc8
+[ 261.564109] Call Trace:
+[ 261.564109] [<ffffffff812a101b>] security_inode_setxattr+0x48/0x6a
+[ 261.564109] [<ffffffff8116d08a>] vfs_setxattr+0x6b/0x9f
+[ 261.564109] [<ffffffff8116d1e0>] setxattr+0x122/0x16c
+[ 261.564109] [<ffffffff811687e8>] ? mnt_want_write+0x21/0x45
+[ 261.564109] [<ffffffff8114d011>] ? __sb_start_write+0x10f/0x143
+[ 261.564109] [<ffffffff811687e8>] ? mnt_want_write+0x21/0x45
+[ 261.564109] [<ffffffff811687c0>] ? __mnt_want_write+0x48/0x4f
+[ 261.564109] [<ffffffff8116d3e6>] SyS_setxattr+0x6e/0xb0
+[ 261.564109] [<ffffffff81529da9>] system_call_fastpath+0x16/0x1b
+[ 261.564109] Code: 48 89 f7 48 c7 c6 58 36 81 81 53 31 db e8 73 27 04 00 85 c0 75 28 bf 15 00 00 00 e8 8a a5 d9 ff 84 c0 75 05 83 cb ff eb 15 31 f6 <41> 80 7d 00 03 49 8b 7c 24 68 40 0f 94 c6 e8 e1 f9 ff ff 89 d8
+[ 261.564109] RIP [<ffffffff812af272>] ima_inode_setxattr+0x3e/0x5a
+[ 261.564109] RSP <ffff880042be3d50>
+[ 261.564109] CR2: 0000000000000000
+[ 261.599998] ---[ end trace 39a89a3fc267e652 ]---
+
+Reported-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/integrity/ima/ima_appraise.c | 2 ++
+ security/integrity/integrity.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/security/integrity/ima/ima_appraise.c
++++ b/security/integrity/ima/ima_appraise.c
+@@ -378,6 +378,8 @@ int ima_inode_setxattr(struct dentry *de
+ result = ima_protect_xattr(dentry, xattr_name, xattr_value,
+ xattr_value_len);
+ if (result == 1) {
++ if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
++ return -EINVAL;
+ ima_reset_appraise_flags(dentry->d_inode,
+ (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0);
+ result = 0;
+--- a/security/integrity/integrity.h
++++ b/security/integrity/integrity.h
+@@ -61,6 +61,7 @@ enum evm_ima_xattr_type {
+ EVM_XATTR_HMAC,
+ EVM_IMA_XATTR_DIGSIG,
+ IMA_XATTR_DIGEST_NG,
++ IMA_XATTR_LAST
+ };
+
+ struct evm_ima_xattr_data {
hid-usbhid-add-another-mouse-that-needs-quirk_always_poll.patch
hid-usbhid-enable-always-poll-quirk-for-elan-touchscreen-009b.patch
hid-usbhid-enable-always-poll-quirk-for-elan-touchscreen-016f.patch
+usb-gadget-udc-core-fix-kernel-oops-with-soft-connect.patch
+alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch
+usb-storage-handle-a-skipped-data-phase.patch
+usb-opticon-fix-non-atomic-allocation-in-write-path.patch
+usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch
+usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch
+usb-remove-references-to-non-existent-plat_s5p-symbol.patch
+ima-check-xattr-value-length-and-type-in-the-ima_inode_setxattr.patch
--- /dev/null
+From 90a646c770c50cc206ceba0d7b50453c46c13c36 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 1 Oct 2014 11:29:14 +0200
+Subject: usb: Do not allow usb_alloc_streams on unconfigured devices
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 90a646c770c50cc206ceba0d7b50453c46c13c36 upstream.
+
+This commit fixes the following oops:
+
+[10238.622067] scsi host3: uas_eh_bus_reset_handler start
+[10240.766164] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd
+[10245.779365] usb 3-4: device descriptor read/8, error -110
+[10245.883331] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd
+[10250.897603] usb 3-4: device descriptor read/8, error -110
+[10251.058200] BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
+[10251.058244] IP: [<ffffffff815ac6e1>] xhci_check_streams_endpoint+0x91/0x140
+<snip>
+[10251.059473] Call Trace:
+[10251.059487] [<ffffffff815aca6c>] xhci_calculate_streams_and_bitmask+0xbc/0x130
+[10251.059520] [<ffffffff815aeb5f>] xhci_alloc_streams+0x10f/0x5a0
+[10251.059548] [<ffffffff810a4685>] ? check_preempt_curr+0x75/0xa0
+[10251.059575] [<ffffffff810a46dc>] ? ttwu_do_wakeup+0x2c/0x100
+[10251.059601] [<ffffffff810a49e6>] ? ttwu_do_activate.constprop.111+0x66/0x70
+[10251.059635] [<ffffffff815779ab>] usb_alloc_streams+0xab/0xf0
+[10251.059662] [<ffffffffc0616b48>] uas_configure_endpoints+0x128/0x150 [uas]
+[10251.059694] [<ffffffffc0616bac>] uas_post_reset+0x3c/0xb0 [uas]
+[10251.059722] [<ffffffff815727d9>] usb_reset_device+0x1b9/0x2a0
+[10251.059749] [<ffffffffc0616f42>] uas_eh_bus_reset_handler+0xb2/0x190 [uas]
+[10251.059781] [<ffffffff81514293>] scsi_try_bus_reset+0x53/0x110
+[10251.059808] [<ffffffff815163b7>] scsi_eh_bus_reset+0xf7/0x270
+<snip>
+
+The problem is the following call sequence (simplified):
+
+1) usb_reset_device
+2) usb_reset_and_verify_device
+2) hub_port_init
+3) hub_port_finish_reset
+3) xhci_discover_or_reset_device
+ This frees xhci->devs[slot_id]->eps[ep_index].ring for all eps but 0
+4) usb_get_device_descriptor
+ This fails
+5) hub_port_init fails
+6) usb_reset_and_verify_device fails, does not restore device config
+7) uas_post_reset
+8) xhci_alloc_streams
+ NULL deref on the free-ed ring
+
+This commit fixes this by not allowing usb_alloc_streams to continue if
+the device is not configured.
+
+Note that we do allow usb_free_streams to continue after a (logical)
+disconnect, as it is necessary to explicitly free the streams at the xhci
+controller level.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -2057,6 +2057,8 @@ int usb_alloc_streams(struct usb_interfa
+ return -EINVAL;
+ if (dev->speed != USB_SPEED_SUPER)
+ return -EINVAL;
++ if (dev->state < USB_STATE_CONFIGURED)
++ return -ENODEV;
+
+ for (i = 0; i < num_eps; i++) {
+ /* Streams only apply to bulk endpoints. */
--- /dev/null
+From bfa6b18c680450c17512c741ed1d818695747621 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Fri, 17 Oct 2014 11:10:25 -0500
+Subject: usb: gadget: udc: core: fix kernel oops with soft-connect
+
+From: Felipe Balbi <balbi@ti.com>
+
+commit bfa6b18c680450c17512c741ed1d818695747621 upstream.
+
+Currently, there's no guarantee that udc->driver
+will be valid when using soft_connect sysfs
+interface. In fact, we can very easily trigger
+a NULL pointer dereference by trying to disconnect
+when a gadget driver isn't loaded.
+
+Fix this bug:
+
+~# echo disconnect > soft_connect
+[ 33.685743] Unable to handle kernel NULL pointer dereference at virtual address 00000014
+[ 33.694221] pgd = ed0cc000
+[ 33.697174] [00000014] *pgd=ae351831, *pte=00000000, *ppte=00000000
+[ 33.703766] Internal error: Oops: 17 [#1] SMP ARM
+[ 33.708697] Modules linked in: xhci_plat_hcd xhci_hcd snd_soc_davinci_mcasp snd_soc_tlv320aic3x snd_soc_edma snd_soc_omap snd_soc_evm snd_soc_core dwc3 snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd lis3lv02d_i2c matrix_keypad lis3lv02d dwc3_omap input_polldev soundcore
+[ 33.734372] CPU: 0 PID: 1457 Comm: bash Not tainted 3.17.0-09740-ga93416e-dirty #345
+[ 33.742457] task: ee71ce00 ti: ee68a000 task.ti: ee68a000
+[ 33.748116] PC is at usb_udc_softconn_store+0xa4/0xec
+[ 33.753416] LR is at mark_held_locks+0x78/0x90
+[ 33.758057] pc : [<c04df128>] lr : [<c00896a4>] psr: 20000013
+[ 33.758057] sp : ee68bec8 ip : c0c00008 fp : ee68bee4
+[ 33.770050] r10: ee6b394c r9 : ee68bf80 r8 : ee6062c0
+[ 33.775508] r7 : 00000000 r6 : ee6062c0 r5 : 0000000b r4 : ee739408
+[ 33.782346] r3 : 00000000 r2 : 00000000 r1 : ee71d390 r0 : ee664170
+[ 33.789168] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+[ 33.796636] Control: 10c5387d Table: ad0cc059 DAC: 00000015
+[ 33.802638] Process bash (pid: 1457, stack limit = 0xee68a248)
+[ 33.808740] Stack: (0xee68bec8 to 0xee68c000)
+[ 33.813299] bec0: 0000000b c0411284 ee6062c0 00000000 ee68bef4 ee68bee8
+[ 33.821862] bee0: c04112ac c04df090 ee68bf14 ee68bef8 c01c2868 c0411290 0000000b ee6b3940
+[ 33.830419] bf00: 00000000 00000000 ee68bf4c ee68bf18 c01c1a24 c01c2818 00000000 00000000
+[ 33.838990] bf20: ee61b940 ee2f47c0 0000000b 000ce408 ee68bf80 c000f304 ee68a000 00000000
+[ 33.847544] bf40: ee68bf7c ee68bf50 c0152dd8 c01c1960 ee68bf7c c0170af8 ee68bf7c ee2f47c0
+[ 33.856099] bf60: ee2f47c0 000ce408 0000000b c000f304 ee68bfa4 ee68bf80 c0153330 c0152d34
+[ 33.864653] bf80: 00000000 00000000 0000000b 000ce408 b6e7fb50 00000004 00000000 ee68bfa8
+[ 33.873204] bfa0: c000f080 c01532e8 0000000b 000ce408 00000001 000ce408 0000000b 00000000
+[ 33.881763] bfc0: 0000000b 000ce408 b6e7fb50 00000004 0000000b 00000000 000c5758 00000000
+[ 33.890319] bfe0: 00000000 bec2c924 b6de422d b6e1d226 40000030 00000001 75716d2f 00657565
+[ 33.898890] [<c04df128>] (usb_udc_softconn_store) from [<c04112ac>] (dev_attr_store+0x28/0x34)
+[ 33.907920] [<c04112ac>] (dev_attr_store) from [<c01c2868>] (sysfs_kf_write+0x5c/0x60)
+[ 33.916200] [<c01c2868>] (sysfs_kf_write) from [<c01c1a24>] (kernfs_fop_write+0xd0/0x194)
+[ 33.924773] [<c01c1a24>] (kernfs_fop_write) from [<c0152dd8>] (vfs_write+0xb0/0x1bc)
+[ 33.932874] [<c0152dd8>] (vfs_write) from [<c0153330>] (SyS_write+0x54/0xb0)
+[ 33.940247] [<c0153330>] (SyS_write) from [<c000f080>] (ret_fast_syscall+0x0/0x48)
+[ 33.948160] Code: e1a01007 e12fff33 e5140004 e5143008 (e5933014)
+[ 33.954625] ---[ end trace f849bead94eab7ea ]---
+
+Fixes: 2ccea03 (usb: gadget: introduce UDC Class)
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/udc-core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/gadget/udc/udc-core.c
++++ b/drivers/usb/gadget/udc/udc-core.c
+@@ -458,6 +458,11 @@ static ssize_t usb_udc_softconn_store(st
+ {
+ struct usb_udc *udc = container_of(dev, struct usb_udc, dev);
+
++ if (!udc->driver) {
++ dev_err(dev, "soft-connect without a gadget driver\n");
++ return -EOPNOTSUPP;
++ }
++
+ if (sysfs_streq(buf, "connect")) {
+ usb_gadget_udc_start(udc->gadget, udc->driver);
+ usb_gadget_connect(udc->gadget);
--- /dev/null
+From 191252837626fca0de694c18bb2aa64c118eda89 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 29 Oct 2014 09:07:30 +0100
+Subject: USB: kobil_sct: fix non-atomic allocation in write path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 191252837626fca0de694c18bb2aa64c118eda89 upstream.
+
+Write may be called from interrupt context so make sure to use
+GFP_ATOMIC for all allocations in write.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/kobil_sct.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/kobil_sct.c
++++ b/drivers/usb/serial/kobil_sct.c
+@@ -335,7 +335,8 @@ static int kobil_write(struct tty_struct
+ port->interrupt_out_urb->transfer_buffer_length = length;
+
+ priv->cur_pos = priv->cur_pos + length;
+- result = usb_submit_urb(port->interrupt_out_urb, GFP_NOIO);
++ result = usb_submit_urb(port->interrupt_out_urb,
++ GFP_ATOMIC);
+ dev_dbg(&port->dev, "%s - Send write URB returns: %i\n", __func__, result);
+ todo = priv->filled - priv->cur_pos;
+
+@@ -350,7 +351,7 @@ static int kobil_write(struct tty_struct
+ if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID ||
+ priv->device_type == KOBIL_ADAPTER_K_PRODUCT_ID) {
+ result = usb_submit_urb(port->interrupt_in_urb,
+- GFP_NOIO);
++ GFP_ATOMIC);
+ dev_dbg(&port->dev, "%s - Send read URB returns: %i\n", __func__, result);
+ }
+ }
--- /dev/null
+From e681286de221af78fc85db9222b6a203148c005a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 29 Oct 2014 09:07:31 +0100
+Subject: USB: opticon: fix non-atomic allocation in write path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit e681286de221af78fc85db9222b6a203148c005a upstream.
+
+Write may be called from interrupt context so make sure to use
+GFP_ATOMIC for all allocations in write.
+
+Fixes: 0d930e51cfe6 ("USB: opticon: Add Opticon OPN2001 write support")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/opticon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/opticon.c
++++ b/drivers/usb/serial/opticon.c
+@@ -215,7 +215,7 @@ static int opticon_write(struct tty_stru
+
+ /* The connected devices do not have a bulk write endpoint,
+ * to transmit data to de barcode device the control endpoint is used */
+- dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO);
++ dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC);
+ if (!dr) {
+ count = -ENOMEM;
+ goto error_no_dr;
--- /dev/null
+From cd6e245a2d061a8367e37aaece32cf3fc922de80 Mon Sep 17 00:00:00 2001
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Tue, 7 Oct 2014 11:12:07 +0200
+Subject: usb: Remove references to non-existent PLAT_S5P symbol
+
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+
+commit cd6e245a2d061a8367e37aaece32cf3fc922de80 upstream.
+
+The PLAT_S5P Kconfig symbol was removed in commit d78c16ccde96
+("ARM: SAMSUNG: Remove remaining legacy code"). There are still
+some references left, fix that by replacing them with ARCH_S5PV210.
+
+Fixes: d78c16ccde96 ("ARM: SAMSUNG: Remove remaining legacy code")
+Reported-by: Paul Bolle <pebolle@tiscali.nl>
+Acked-by: Jingoo Han <jg1.han@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/Kconfig
++++ b/drivers/usb/host/Kconfig
+@@ -220,7 +220,7 @@ config USB_EHCI_SH
+
+ config USB_EHCI_EXYNOS
+ tristate "EHCI support for Samsung S5P/EXYNOS SoC Series"
+- depends on PLAT_S5P || ARCH_EXYNOS
++ depends on ARCH_S5PV210 || ARCH_EXYNOS
+ help
+ Enable support for the Samsung Exynos SOC's on-chip EHCI controller.
+
+@@ -527,7 +527,7 @@ config USB_OHCI_SH
+
+ config USB_OHCI_EXYNOS
+ tristate "OHCI support for Samsung S5P/EXYNOS SoC Series"
+- depends on PLAT_S5P || ARCH_EXYNOS
++ depends on ARCH_S5PV210 || ARCH_EXYNOS
+ help
+ Enable support for the Samsung Exynos SOC's on-chip OHCI controller.
+
--- /dev/null
+From 93c9bf4d1838d5851a18ca398b0ad66397f05056 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 31 Oct 2014 14:49:47 -0400
+Subject: usb-storage: handle a skipped data phase
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 93c9bf4d1838d5851a18ca398b0ad66397f05056 upstream.
+
+Sometimes mass-storage devices using the Bulk-only transport will
+mistakenly skip the data phase of a command. Rather than sending the
+data expected by the host or sending a zero-length packet, they go
+directly to the status phase and send the CSW.
+
+This causes problems for usb-storage, for obvious reasons. The driver
+will interpret the CSW as a short data transfer and will wait to
+receive a CSW. The device won't have anything left to send, so the
+command eventually times out.
+
+The SCSI layer doesn't retry commands after they time out (this is a
+relatively recent change). Therefore we should do our best to detect
+a skipped data phase and handle it promptly.
+
+This patch adds code to do that. If usb-storage receives a short
+13-byte data transfer from the device, and if the first four bytes of
+the data match the CSW signature, the driver will set the residue to
+the full transfer length and interpret the data as a CSW.
+
+This fixes Bugzilla #86611.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
+Tested-by: Paul Osmialowski <newchief@king.net.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/transport.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -1118,6 +1118,31 @@ int usb_stor_Bulk_transport(struct scsi_
+ */
+ if (result == USB_STOR_XFER_LONG)
+ fake_sense = 1;
++
++ /*
++ * Sometimes a device will mistakenly skip the data phase
++ * and go directly to the status phase without sending a
++ * zero-length packet. If we get a 13-byte response here,
++ * check whether it really is a CSW.
++ */
++ if (result == USB_STOR_XFER_SHORT &&
++ srb->sc_data_direction == DMA_FROM_DEVICE &&
++ transfer_length - scsi_get_resid(srb) ==
++ US_BULK_CS_WRAP_LEN) {
++ struct scatterlist *sg = NULL;
++ unsigned int offset = 0;
++
++ if (usb_stor_access_xfer_buf((unsigned char *) bcs,
++ US_BULK_CS_WRAP_LEN, srb, &sg,
++ &offset, FROM_XFER_BUF) ==
++ US_BULK_CS_WRAP_LEN &&
++ bcs->Signature ==
++ cpu_to_le32(US_BULK_CS_SIGN)) {
++ usb_stor_dbg(us, "Device skipped data phase\n");
++ scsi_set_resid(srb, transfer_length);
++ goto skipped_data_phase;
++ }
++ }
+ }
+
+ /* See flow chart on pg 15 of the Bulk Only Transport spec for
+@@ -1153,6 +1178,7 @@ int usb_stor_Bulk_transport(struct scsi_
+ if (result != USB_STOR_XFER_GOOD)
+ return USB_STOR_TRANSPORT_ERROR;
+
++ skipped_data_phase:
+ /* check bulk status */
+ residue = le32_to_cpu(bcs->Residue);
+ usb_stor_dbg(us, "Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n",
projects / thirdparty / kernel / stable-queue.git / commitdiff
