]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 16 Sep 2015 18:30:42 +0000 (11:30 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 16 Sep 2015 18:30:42 +0000 (11:30 -0700)
added patches:
usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch
usb-ftdi_sio-added-custom-pid-for-customware-products.patch
usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch
usb-symbolserial-use-usb_get_serial_port_data.patch

queue-3.10/series
queue-3.10/usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch [new file with mode: 0644]
queue-3.10/usb-ftdi_sio-added-custom-pid-for-customware-products.patch [new file with mode: 0644]
queue-3.10/usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch [new file with mode: 0644]
queue-3.10/usb-symbolserial-use-usb_get_serial_port_data.patch [new file with mode: 0644]

index 585264f0969d4d4340c876d3ecb7ea80d60a0ec5..f91a18167068bc2521688d25a4f2e3e2d495be55 100644 (file)
@@ -4,3 +4,7 @@ iio-add-inverse-unit-conversion-macros.patch
 iio-adis16480-fix-scale-factors.patch
 clk-versatile-off-by-one-in-clk_sp810_timerclken_of_get.patch
 pci-fix-ti816x-class-code-quirk.patch
+usb-symbolserial-use-usb_get_serial_port_data.patch
+usb-ftdi_sio-added-custom-pid-for-customware-products.patch
+usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch
+usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch
diff --git a/queue-3.10/usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch b/queue-3.10/usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch
new file mode 100644 (file)
index 0000000..77d424a
--- /dev/null
@@ -0,0 +1,58 @@
+From b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Mon, 27 Jul 2015 12:25:27 +0530
+Subject: usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream.
+
+DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and
+the size of bounce buffer is 512 bytes. However if the host initiates OUT
+transfers of size more than 512 bytes (and non max packet aligned), the
+driver throws a WARN dump but still programs the TRB to receive more than
+512 bytes. This will cause bounce buffer to overflow and corrupt the
+adjacent memory locations which can be fatal.
+
+Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE
+(512) bytes.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/ep0.c |   12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -804,6 +804,11 @@ static void dwc3_ep0_complete_data(struc
+               unsigned maxp = ep0->endpoint.maxpacket;
+               transfer_size += (maxp - (transfer_size % maxp));
++
++              /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */
++              if (transfer_size > DWC3_EP0_BOUNCE_SIZE)
++                      transfer_size = DWC3_EP0_BOUNCE_SIZE;
++
+               transferred = min_t(u32, ur->length,
+                               transfer_size - length);
+               memcpy(ur->buf, dwc->ep0_bounce, transferred);
+@@ -916,11 +921,14 @@ static void __dwc3_ep0_do_control_data(s
+                       return;
+               }
+-              WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE);
+-
+               maxpacket = dep->endpoint.maxpacket;
+               transfer_size = roundup(req->request.length, maxpacket);
++              if (transfer_size > DWC3_EP0_BOUNCE_SIZE) {
++                      dev_WARN(dwc->dev, "bounce buf can't handle req len\n");
++                      transfer_size = DWC3_EP0_BOUNCE_SIZE;
++              }
++
+               dwc->ep0_bounced = true;
+               /*
diff --git a/queue-3.10/usb-ftdi_sio-added-custom-pid-for-customware-products.patch b/queue-3.10/usb-ftdi_sio-added-custom-pid-for-customware-products.patch
new file mode 100644 (file)
index 0000000..3c1374f
--- /dev/null
@@ -0,0 +1,51 @@
+From 1fb8dc36384ae1140ee6ccc470de74397606a9d5 Mon Sep 17 00:00:00 2001
+From: Matthijs Kooijman <matthijs@stdin.nl>
+Date: Tue, 18 Aug 2015 10:33:56 +0200
+Subject: USB: ftdi_sio: Added custom PID for CustomWare products
+
+From: Matthijs Kooijman <matthijs@stdin.nl>
+
+commit 1fb8dc36384ae1140ee6ccc470de74397606a9d5 upstream.
+
+CustomWare uses the FTDI VID with custom PIDs for their ShipModul MiniPlex
+products.
+
+Signed-off-by: Matthijs Kooijman <matthijs@stdin.nl>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c     |    4 ++++
+ drivers/usb/serial/ftdi_sio_ids.h |    8 ++++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -621,6 +621,10 @@ static struct usb_device_id id_table_com
+       { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+               .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+       { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
++      { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
++      { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
++      { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2WI_PID) },
++      { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX3_PID) },
+       /*
+        * ELV devices:
+        */
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -568,6 +568,14 @@
+  */
+ #define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
++/*
++ * CustomWare / ShipModul NMEA multiplexers product ids (FTDI_VID)
++ */
++#define FTDI_CUSTOMWARE_MINIPLEX_PID  0xfd48  /* MiniPlex first generation NMEA Multiplexer */
++#define FTDI_CUSTOMWARE_MINIPLEX2_PID 0xfd49  /* MiniPlex-USB and MiniPlex-2 series */
++#define FTDI_CUSTOMWARE_MINIPLEX2WI_PID       0xfd4a  /* MiniPlex-2Wi */
++#define FTDI_CUSTOMWARE_MINIPLEX3_PID 0xfd4b  /* MiniPlex-3 series */
++
+ /********************************/
+ /** third-party VID/PID combos **/
diff --git a/queue-3.10/usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch b/queue-3.10/usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch
new file mode 100644 (file)
index 0000000..e07ac43
--- /dev/null
@@ -0,0 +1,58 @@
+From 0521cfd06e1ebcd575e7ae36aab068b38df23850 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Mon, 17 Aug 2015 10:23:03 +0800
+Subject: usb: host: ehci-sys: delete useless bus_to_hcd conversion
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit 0521cfd06e1ebcd575e7ae36aab068b38df23850 upstream.
+
+The ehci platform device's drvdata is the pointer of struct usb_hcd
+already, so we doesn't need to call bus_to_hcd conversion again.
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-sysfs.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ehci-sysfs.c
++++ b/drivers/usb/host/ehci-sysfs.c
+@@ -29,7 +29,7 @@ static ssize_t show_companion(struct dev
+       int                     count = PAGE_SIZE;
+       char                    *ptr = buf;
+-      ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++      ehci = hcd_to_ehci(dev_get_drvdata(dev));
+       nports = HCS_N_PORTS(ehci->hcs_params);
+       for (index = 0; index < nports; ++index) {
+@@ -54,7 +54,7 @@ static ssize_t store_companion(struct de
+       struct ehci_hcd         *ehci;
+       int                     portnum, new_owner;
+-      ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++      ehci = hcd_to_ehci(dev_get_drvdata(dev));
+       new_owner = PORT_OWNER;         /* Owned by companion */
+       if (sscanf(buf, "%d", &portnum) != 1)
+               return -EINVAL;
+@@ -85,7 +85,7 @@ static ssize_t show_uframe_periodic_max(
+       struct ehci_hcd         *ehci;
+       int                     n;
+-      ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++      ehci = hcd_to_ehci(dev_get_drvdata(dev));
+       n = scnprintf(buf, PAGE_SIZE, "%d\n", ehci->uframe_periodic_max);
+       return n;
+ }
+@@ -102,7 +102,7 @@ static ssize_t store_uframe_periodic_max
+       unsigned long           flags;
+       ssize_t                 ret;
+-      ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++      ehci = hcd_to_ehci(dev_get_drvdata(dev));
+       if (kstrtouint(buf, 0, &uframe_periodic_max) < 0)
+               return -EINVAL;
diff --git a/queue-3.10/usb-symbolserial-use-usb_get_serial_port_data.patch b/queue-3.10/usb-symbolserial-use-usb_get_serial_port_data.patch
new file mode 100644 (file)
index 0000000..8931b43
--- /dev/null
@@ -0,0 +1,52 @@
+From 951d3793bbfc0a441d791d820183aa3085c83ea9 Mon Sep 17 00:00:00 2001
+From: Philipp Hachtmann <hachti@hachti.de>
+Date: Mon, 17 Aug 2015 17:31:46 +0200
+Subject: USB: symbolserial: Use usb_get_serial_port_data
+
+From: Philipp Hachtmann <hachti@hachti.de>
+
+commit 951d3793bbfc0a441d791d820183aa3085c83ea9 upstream.
+
+The driver used usb_get_serial_data(port->serial) which compiled but resulted
+in a NULL pointer being returned (and subsequently used). I did not go deeper
+into this but I guess this is a regression.
+
+Signed-off-by: Philipp Hachtmann <hachti@hachti.de>
+Fixes: a85796ee5149 ("USB: symbolserial: move private-data allocation to
+port_probe")
+Acked-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/symbolserial.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/symbolserial.c
++++ b/drivers/usb/serial/symbolserial.c
+@@ -97,7 +97,7 @@ exit:
+ static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+-      struct symbol_private *priv = usb_get_serial_data(port->serial);
++      struct symbol_private *priv = usb_get_serial_port_data(port);
+       unsigned long flags;
+       int result = 0;
+@@ -123,7 +123,7 @@ static void symbol_close(struct usb_seri
+ static void symbol_throttle(struct tty_struct *tty)
+ {
+       struct usb_serial_port *port = tty->driver_data;
+-      struct symbol_private *priv = usb_get_serial_data(port->serial);
++      struct symbol_private *priv = usb_get_serial_port_data(port);
+       spin_lock_irq(&priv->lock);
+       priv->throttled = true;
+@@ -133,7 +133,7 @@ static void symbol_throttle(struct tty_s
+ static void symbol_unthrottle(struct tty_struct *tty)
+ {
+       struct usb_serial_port *port = tty->driver_data;
+-      struct symbol_private *priv = usb_get_serial_data(port->serial);
++      struct symbol_private *priv = usb_get_serial_port_data(port);
+       int result;
+       bool was_throttled;