--- /dev/null
+From bd352e1adfe0d02d3ea7c8e3fb19183dc317e679 Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Tue, 5 Dec 2017 11:15:47 -0800
+Subject: can: ems_usb: cancel urb on -EPIPE and -EPROTO
+
+From: Martin Kelly <mkelly@xevo.com>
+
+commit bd352e1adfe0d02d3ea7c8e3fb19183dc317e679 upstream.
+
+In mcba_usb, we have observed that when you unplug the device, the driver will
+endlessly resubmit failing URBs, which can cause CPU stalls. This issue
+is fixed in mcba_usb by catching the codes seen on device disconnect
+(-EPIPE and -EPROTO).
+
+This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it
+in the same way.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/ems_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -288,6 +288,8 @@ static void ems_usb_read_interrupt_callb
+
+ case -ECONNRESET: /* unlink */
+ case -ENOENT:
++ case -EPIPE:
++ case -EPROTO:
+ case -ESHUTDOWN:
+ return;
+
--- /dev/null
+From 7a31ced3de06e9878e4f9c3abe8f87d9344d8144 Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Tue, 5 Dec 2017 11:15:48 -0800
+Subject: can: esd_usb2: cancel urb on -EPIPE and -EPROTO
+
+From: Martin Kelly <mkelly@xevo.com>
+
+commit 7a31ced3de06e9878e4f9c3abe8f87d9344d8144 upstream.
+
+In mcba_usb, we have observed that when you unplug the device, the driver will
+endlessly resubmit failing URBs, which can cause CPU stalls. This issue
+is fixed in mcba_usb by catching the codes seen on device disconnect
+(-EPIPE and -EPROTO).
+
+This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it
+in the same way.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/esd_usb2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/esd_usb2.c
++++ b/drivers/net/can/usb/esd_usb2.c
+@@ -393,6 +393,8 @@ static void esd_usb2_read_bulk_callback(
+ break;
+
+ case -ENOENT:
++ case -EPIPE:
++ case -EPROTO:
+ case -ESHUTDOWN:
+ return;
+
--- /dev/null
+From 29c64b17a0bc72232acc45e9533221d88a262efb Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Mon, 27 Nov 2017 09:18:21 +0100
+Subject: can: flexcan: fix VF610 state transition issue
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 29c64b17a0bc72232acc45e9533221d88a262efb upstream.
+
+Enable FLEXCAN_QUIRK_BROKEN_PERR_STATE for VF610 to report correct state
+transitions.
+
+Tested-by: Mirza Krak <mirza.krak@gmail.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/flexcan.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -189,7 +189,7 @@
+ * MX35 FlexCAN2 03.00.00.00 no no ? no no
+ * MX53 FlexCAN2 03.00.00.00 yes no no no no
+ * MX6s FlexCAN3 10.00.12.00 yes yes no no yes
+- * VF610 FlexCAN3 ? no yes ? yes yes?
++ * VF610 FlexCAN3 ? no yes no yes yes?
+ *
+ * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected.
+ */
+@@ -297,7 +297,8 @@ static const struct flexcan_devtype_data
+
+ static const struct flexcan_devtype_data fsl_vf610_devtype_data = {
+ .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS |
+- FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_OFF_TIMESTAMP,
++ FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_OFF_TIMESTAMP |
++ FLEXCAN_QUIRK_BROKEN_PERR_STATE,
+ };
+
+ static const struct can_bittiming_const flexcan_bittiming_const = {
--- /dev/null
+From 6aa8d5945502baf4687d80de59b7ac865e9e666b Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Tue, 5 Dec 2017 11:15:49 -0800
+Subject: can: kvaser_usb: cancel urb on -EPIPE and -EPROTO
+
+From: Martin Kelly <mkelly@xevo.com>
+
+commit 6aa8d5945502baf4687d80de59b7ac865e9e666b upstream.
+
+In mcba_usb, we have observed that when you unplug the device, the driver will
+endlessly resubmit failing URBs, which can cause CPU stalls. This issue
+is fixed in mcba_usb by catching the codes seen on device disconnect
+(-EPIPE and -EPROTO).
+
+This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it
+in the same way.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1326,6 +1326,8 @@ static void kvaser_usb_read_bulk_callbac
+ case 0:
+ break;
+ case -ENOENT:
++ case -EPIPE:
++ case -EPROTO:
+ case -ESHUTDOWN:
+ return;
+ default:
--- /dev/null
+From e84f44eb5523401faeb9cc1c97895b68e3cfb78d Mon Sep 17 00:00:00 2001
+From: Jimmy Assarsson <jimmyassarsson@gmail.com>
+Date: Tue, 21 Nov 2017 08:22:27 +0100
+Subject: can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback()
+
+From: Jimmy Assarsson <jimmyassarsson@gmail.com>
+
+commit e84f44eb5523401faeb9cc1c97895b68e3cfb78d upstream.
+
+The conditon in the while-loop becomes true when actual_length is less than
+2 (MSG_HEADER_LEN). In best case we end up with a former, already
+dispatched msg, that got msg->len greater than actual_length. This will
+result in a "Format error" error printout.
+
+Problem seen when unplugging a Kvaser USB device connected to a vbox guest.
+
+warning: comparison between signed and unsigned integer expressions
+[-Wsign-compare]
+
+Signed-off-by: Jimmy Assarsson <jimmyassarsson@gmail.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1334,7 +1334,7 @@ static void kvaser_usb_read_bulk_callbac
+ goto resubmit_urb;
+ }
+
+- while (pos <= urb->actual_length - MSG_HEADER_LEN) {
++ while (pos <= (int)(urb->actual_length - MSG_HEADER_LEN)) {
+ msg = urb->transfer_buffer + pos;
+
+ /* The Kvaser firmware can only read and write messages that
--- /dev/null
+From 435019b48033138581a6171093b181fc6b4d3d30 Mon Sep 17 00:00:00 2001
+From: Jimmy Assarsson <jimmyassarsson@gmail.com>
+Date: Tue, 21 Nov 2017 08:22:26 +0100
+Subject: can: kvaser_usb: free buf in error paths
+
+From: Jimmy Assarsson <jimmyassarsson@gmail.com>
+
+commit 435019b48033138581a6171093b181fc6b4d3d30 upstream.
+
+The allocated buffer was not freed if usb_submit_urb() failed.
+
+Signed-off-by: Jimmy Assarsson <jimmyassarsson@gmail.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -813,6 +813,7 @@ static int kvaser_usb_simple_msg_async(s
+ if (err) {
+ netdev_err(netdev, "Error transmitting URB\n");
+ usb_unanchor_urb(urb);
++ kfree(buf);
+ usb_free_urb(urb);
+ return err;
+ }
+@@ -1768,6 +1769,7 @@ static netdev_tx_t kvaser_usb_start_xmit
+ spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
+
+ usb_unanchor_urb(urb);
++ kfree(buf);
+
+ stats->tx_dropped++;
+
--- /dev/null
+From 8bd13bd522ff7dfa0eb371921aeb417155f7a3be Mon Sep 17 00:00:00 2001
+From: Jimmy Assarsson <jimmyassarsson@gmail.com>
+Date: Tue, 21 Nov 2017 08:22:28 +0100
+Subject: can: kvaser_usb: ratelimit errors if incomplete messages are received
+
+From: Jimmy Assarsson <jimmyassarsson@gmail.com>
+
+commit 8bd13bd522ff7dfa0eb371921aeb417155f7a3be upstream.
+
+Avoid flooding the kernel log with "Formate error", if incomplete message
+are received.
+
+Signed-off-by: Jimmy Assarsson <jimmyassarsson@gmail.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -609,8 +609,8 @@ static int kvaser_usb_wait_msg(const str
+ }
+
+ if (pos + tmp->len > actual_len) {
+- dev_err(dev->udev->dev.parent,
+- "Format error\n");
++ dev_err_ratelimited(dev->udev->dev.parent,
++ "Format error\n");
+ break;
+ }
+
+@@ -1353,7 +1353,8 @@ static void kvaser_usb_read_bulk_callbac
+ }
+
+ if (pos + msg->len > urb->actual_length) {
+- dev_err(dev->udev->dev.parent, "Format error\n");
++ dev_err_ratelimited(dev->udev->dev.parent,
++ "Format error\n");
+ break;
+ }
+
--- /dev/null
+From c7f33023308f3142433b7379718af5f0c2c322a6 Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Tue, 5 Dec 2017 10:34:03 -0800
+Subject: can: mcba_usb: cancel urb on -EPROTO
+
+From: Martin Kelly <mkelly@xevo.com>
+
+commit c7f33023308f3142433b7379718af5f0c2c322a6 upstream.
+
+When we unplug the device, we can see both -EPIPE and -EPROTO depending
+on exact timing and what system we run on. If we continue to resubmit
+URBs, they will immediately fail, and they can cause stalls, especially
+on slower CPUs.
+
+Fix this by not resubmitting on -EPROTO, as we already do on -EPIPE.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/mcba_usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -593,6 +593,7 @@ static void mcba_usb_read_bulk_callback(
+
+ case -ENOENT:
+ case -EPIPE:
++ case -EPROTO:
+ case -ESHUTDOWN:
+ return;
+
--- /dev/null
+From 1cb35a33a28394fd711bb26ddf3a564f4e9d9125 Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Mon, 27 Nov 2017 15:49:16 -0800
+Subject: can: mcba_usb: fix device disconnect bug
+
+From: Martin Kelly <mkelly@xevo.com>
+
+commit 1cb35a33a28394fd711bb26ddf3a564f4e9d9125 upstream.
+
+Currently, when you disconnect the device, the driver infinitely
+resubmits all URBs, so you see:
+
+Rx URB aborted (-32)
+
+in an infinite loop.
+
+Fix this by catching -EPIPE (what we get in urb->status when the device
+disconnects) and not resubmitting.
+
+With this patch, I can plug and unplug many times and the driver
+recovers correctly.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/mcba_usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -592,6 +592,7 @@ static void mcba_usb_read_bulk_callback(
+ break;
+
+ case -ENOENT:
++ case -EPIPE:
+ case -ESHUTDOWN:
+ return;
+
--- /dev/null
+From 5c2cb02edf79ad79d9b8d07c6d52243a948c4c9f Mon Sep 17 00:00:00 2001
+From: Stephane Grosjean <s.grosjean@peak-system.com>
+Date: Thu, 23 Nov 2017 15:44:35 +0100
+Subject: can: peak/pci: fix potential bug when probe() fails
+
+From: Stephane Grosjean <s.grosjean@peak-system.com>
+
+commit 5c2cb02edf79ad79d9b8d07c6d52243a948c4c9f upstream.
+
+PCI/PCIe drivers for PEAK-System CAN/CAN-FD interfaces do some access to the
+PCI config during probing. In case one of these accesses fails, a POSITIVE
+PCIBIOS_xxx error code is returned back. This POSITIVE error code MUST be
+converted into a NEGATIVE errno for the probe() function to indicate it
+failed. Using the pcibios_err_to_errno() function, we make sure that the
+return code will always be negative.
+
+Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/peak_canfd/peak_pciefd_main.c | 5 ++++-
+ drivers/net/can/sja1000/peak_pci.c | 5 ++++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c
++++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c
+@@ -825,7 +825,10 @@ err_release_regions:
+ err_disable_pci:
+ pci_disable_device(pdev);
+
+- return err;
++ /* pci_xxx_config_word() return positive PCIBIOS_xxx error codes while
++ * the probe() function must return a negative errno in case of failure
++ * (err is unchanged if negative) */
++ return pcibios_err_to_errno(err);
+ }
+
+ /* free the board structure object, as well as its resources: */
+--- a/drivers/net/can/sja1000/peak_pci.c
++++ b/drivers/net/can/sja1000/peak_pci.c
+@@ -717,7 +717,10 @@ failure_release_regions:
+ failure_disable_pci:
+ pci_disable_device(pdev);
+
+- return err;
++ /* pci_xxx_config_word() return positive PCIBIOS_xxx error codes while
++ * the probe() function must return a negative errno in case of failure
++ * (err is unchanged if negative) */
++ return pcibios_err_to_errno(err);
+ }
+
+ static void peak_pci_remove(struct pci_dev *pdev)
--- /dev/null
+From 91785de6f94b58c3fb6664609e3682f011bd28d2 Mon Sep 17 00:00:00 2001
+From: Stephane Grosjean <s.grosjean@peak-system.com>
+Date: Thu, 7 Dec 2017 16:13:43 +0100
+Subject: can: peak/pcie_fd: fix potential bug in restarting tx queue
+
+From: Stephane Grosjean <s.grosjean@peak-system.com>
+
+commit 91785de6f94b58c3fb6664609e3682f011bd28d2 upstream.
+
+Don't rely on can_get_echo_skb() return value to wake the network tx
+queue up: can_get_echo_skb() returns 0 if the echo array slot was not
+occupied, but also when the DLC of the released echo frame was 0.
+
+Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/peak_canfd/peak_canfd.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/can/peak_canfd/peak_canfd.c
++++ b/drivers/net/can/peak_canfd/peak_canfd.c
+@@ -258,21 +258,18 @@ static int pucan_handle_can_rx(struct pe
+ /* if this frame is an echo, */
+ if ((rx_msg_flags & PUCAN_MSG_LOOPED_BACK) &&
+ !(rx_msg_flags & PUCAN_MSG_SELF_RECEIVE)) {
+- int n;
+ unsigned long flags;
+
+ spin_lock_irqsave(&priv->echo_lock, flags);
+- n = can_get_echo_skb(priv->ndev, msg->client);
++ can_get_echo_skb(priv->ndev, msg->client);
+ spin_unlock_irqrestore(&priv->echo_lock, flags);
+
+ /* count bytes of the echo instead of skb */
+ stats->tx_bytes += cf_len;
+ stats->tx_packets++;
+
+- if (n) {
+- /* restart tx queue only if a slot is free */
+- netif_wake_queue(priv->ndev);
+- }
++ /* restart tx queue (a slot is free) */
++ netif_wake_queue(priv->ndev);
+
+ return 0;
+ }
--- /dev/null
+From f6c23b174c3c96616514827407769cbcfc8005cf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Oliver=20St=C3=A4bler?= <oliver.staebler@bytesatwork.ch>
+Date: Mon, 20 Nov 2017 14:45:15 +0100
+Subject: can: ti_hecc: Fix napi poll return value for repoll
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Oliver Stäbler <oliver.staebler@bytesatwork.ch>
+
+commit f6c23b174c3c96616514827407769cbcfc8005cf upstream.
+
+After commit d75b1ade567f ("net: less interrupt masking in NAPI") napi
+repoll is done only when work_done == budget.
+So we need to return budget if there are still packets to receive.
+
+Signed-off-by: Oliver Stäbler <oliver.staebler@bytesatwork.ch>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/ti_hecc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/can/ti_hecc.c
++++ b/drivers/net/can/ti_hecc.c
+@@ -637,6 +637,9 @@ static int ti_hecc_rx_poll(struct napi_s
+ mbx_mask = hecc_read(priv, HECC_CANMIM);
+ mbx_mask |= HECC_TX_MBOX_MASK;
+ hecc_write(priv, HECC_CANMIM, mbx_mask);
++ } else {
++ /* repoll is done only if whole budget is used */
++ num_pkts = quota;
+ }
+
+ return num_pkts;
--- /dev/null
+From 12147edc434c9e4c7c2f5fee2e5519b2e5ac34ce Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Tue, 5 Dec 2017 11:15:50 -0800
+Subject: can: usb_8dev: cancel urb on -EPIPE and -EPROTO
+
+From: Martin Kelly <mkelly@xevo.com>
+
+commit 12147edc434c9e4c7c2f5fee2e5519b2e5ac34ce upstream.
+
+In mcba_usb, we have observed that when you unplug the device, the driver will
+endlessly resubmit failing URBs, which can cause CPU stalls. This issue
+is fixed in mcba_usb by catching the codes seen on device disconnect
+(-EPIPE and -EPROTO).
+
+This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it
+in the same way.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/usb_8dev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/usb_8dev.c
++++ b/drivers/net/can/usb/usb_8dev.c
+@@ -524,6 +524,8 @@ static void usb_8dev_read_bulk_callback(
+ break;
+
+ case -ENOENT:
++ case -EPIPE:
++ case -EPROTO:
+ case -ESHUTDOWN:
+ return;
+
--- /dev/null
+From eb281683621b71ab9710d9dccbbef0c2e1769c97 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 3 Nov 2017 15:30:52 +0100
+Subject: serdev: ttyport: add missing receive_buf sanity checks
+
+From: Johan Hovold <johan@kernel.org>
+
+commit eb281683621b71ab9710d9dccbbef0c2e1769c97 upstream.
+
+The receive_buf tty-port callback should return the number of bytes
+accepted and must specifically never return a negative errno (or a value
+larger than the buffer size) to the tty layer.
+
+A serdev driver not providing a receive_buf callback would currently
+cause the flush_to_ldisc() worker to spin in a tight loop when the tty
+buffer pointers are incremented with -EINVAL (-22) after data has been
+received.
+
+A serdev driver occasionally returning a negative errno (or a too large
+byte count) could cause information leaks or crashes when accessing
+memory outside the tty buffers in consecutive callbacks.
+
+Fixes: cd6484e1830b ("serdev: Introduce new bus for serial attached devices")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serdev/serdev-ttyport.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serdev/serdev-ttyport.c
++++ b/drivers/tty/serdev/serdev-ttyport.c
+@@ -35,11 +35,22 @@ static int ttyport_receive_buf(struct tt
+ {
+ struct serdev_controller *ctrl = port->client_data;
+ struct serport *serport = serdev_controller_get_drvdata(ctrl);
++ int ret;
+
+ if (!test_bit(SERPORT_ACTIVE, &serport->flags))
+ return 0;
+
+- return serdev_controller_receive_buf(ctrl, cp, count);
++ ret = serdev_controller_receive_buf(ctrl, cp, count);
++
++ dev_WARN_ONCE(&ctrl->dev, ret < 0 || ret > count,
++ "receive_buf returns %d (count = %zu)\n",
++ ret, count);
++ if (ret < 0)
++ return 0;
++ else if (ret > count)
++ return count;
++
++ return ret;
+ }
+
+ static void ttyport_write_wakeup(struct tty_port *port)
--- /dev/null
+From 8bcd4e6a8decac251d55c4377e2e67f052777ce0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 3 Nov 2017 15:30:55 +0100
+Subject: serdev: ttyport: fix NULL-deref on hangup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 8bcd4e6a8decac251d55c4377e2e67f052777ce0 upstream.
+
+Make sure to use a properly refcounted tty_struct in write_wake up to
+avoid dereferencing a NULL-pointer when a port is being hung up.
+
+Fixes: bed35c6dfa6a ("serdev: add a tty port controller driver")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serdev/serdev-ttyport.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serdev/serdev-ttyport.c
++++ b/drivers/tty/serdev/serdev-ttyport.c
+@@ -57,12 +57,19 @@ static void ttyport_write_wakeup(struct
+ {
+ struct serdev_controller *ctrl = port->client_data;
+ struct serport *serport = serdev_controller_get_drvdata(ctrl);
++ struct tty_struct *tty;
+
+- if (test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &port->tty->flags) &&
++ tty = tty_port_tty_get(port);
++ if (!tty)
++ return;
++
++ if (test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) &&
+ test_bit(SERPORT_ACTIVE, &serport->flags))
+ serdev_controller_write_wakeup(ctrl);
+
+- wake_up_interruptible_poll(&port->tty->write_wait, POLLOUT);
++ wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
++
++ tty_kref_put(tty);
+ }
+
+ static const struct tty_port_client_operations client_ops = {
--- /dev/null
+From 90dbad8cd6efccbdce109d5ef0724f8434a6cdde Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 3 Nov 2017 15:30:56 +0100
+Subject: serdev: ttyport: fix tty locking in close
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 90dbad8cd6efccbdce109d5ef0724f8434a6cdde upstream.
+
+Make sure to hold the tty lock as required when calling tty-driver
+close() (e.g. to avoid racing with hangup()).
+
+Note that the serport active flag is currently set under the lock at
+controller open, but really isn't protected by it.
+
+Fixes: cd6484e1830b ("serdev: Introduce new bus for serial attached devices")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serdev/serdev-ttyport.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/serdev/serdev-ttyport.c
++++ b/drivers/tty/serdev/serdev-ttyport.c
+@@ -149,8 +149,10 @@ static void ttyport_close(struct serdev_
+
+ clear_bit(SERPORT_ACTIVE, &serport->flags);
+
++ tty_lock(tty);
+ if (tty->ops->close)
+ tty->ops->close(tty, NULL);
++ tty_unlock(tty);
+
+ tty_release_struct(tty, serport->tty_idx);
+ }
--- /dev/null
+From a3acc696085e112733d191a77b106e67a4fa110b Mon Sep 17 00:00:00 2001
+From: John Keeping <john@metanate.com>
+Date: Mon, 27 Nov 2017 18:15:40 +0000
+Subject: usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT
+
+From: John Keeping <john@metanate.com>
+
+commit a3acc696085e112733d191a77b106e67a4fa110b upstream.
+
+The specification says that the Reserved1 field in OS_DESC_EXT_COMPAT
+must have the value "1", but when this feature was first implemented we
+rejected any non-zero values.
+
+This was adjusted to accept all non-zero values (while now rejecting
+zero) in commit 53642399aa71 ("usb: gadget: f_fs: Fix wrong check on
+reserved1 of OS_DESC_EXT_COMPAT"), but that breaks any userspace
+programs that worked previously by returning EINVAL when Reserved1 == 0
+which was previously the only value that succeeded!
+
+If we just set the field to "1" ourselves, both old and new userspace
+programs continue to work correctly and, as a bonus, old programs are
+now compliant with the specification without having to fix anything
+themselves.
+
+Fixes: 53642399aa71 ("usb: gadget: f_fs: Fix wrong check on reserved1 of OS_DESC_EXT_COMPAT")
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_fs.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -2286,9 +2286,18 @@ static int __ffs_data_do_os_desc(enum ff
+ int i;
+
+ if (len < sizeof(*d) ||
+- d->bFirstInterfaceNumber >= ffs->interfaces_count ||
+- !d->Reserved1)
++ d->bFirstInterfaceNumber >= ffs->interfaces_count)
+ return -EINVAL;
++ if (d->Reserved1 != 1) {
++ /*
++ * According to the spec, Reserved1 must be set to 1
++ * but older kernels incorrectly rejected non-zero
++ * values. We fix it here to avoid returning EINVAL
++ * in response to values we used to accept.
++ */
++ pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n");
++ d->Reserved1 = 1;
++ }
+ for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
+ if (d->Reserved2[i])
+ return -EINVAL;
--- /dev/null
+From a4f0927ef588cf62bb864707261482c874352942 Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Tue, 31 Oct 2017 15:56:29 +0200
+Subject: usb: gadget: core: Fix ->udc_set_speed() speed handling
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit a4f0927ef588cf62bb864707261482c874352942 upstream.
+
+Currently UDC core calls ->udc_set_speed() with the speed parameter
+containing the maximum speed supported by the gadget function
+driver. This might very well be more than that supported by the
+UDC controller driver.
+
+Select the lesser of the 2 speeds so both UDC and gadget function
+driver are operating within limits.
+
+This fixes PHY Erratic errors and 2 second enumeration delay on
+TI's AM437x platforms.
+
+Fixes: 6099eca796ae ("usb: gadget: core: introduce ->udc_set_speed() method")
+Reported-by: Dylan Howey <Dylan.Howey@tennantco.com>
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/core.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -1080,8 +1080,12 @@ static inline void usb_gadget_udc_stop(s
+ static inline void usb_gadget_udc_set_speed(struct usb_udc *udc,
+ enum usb_device_speed speed)
+ {
+- if (udc->gadget->ops->udc_set_speed)
+- udc->gadget->ops->udc_set_speed(udc->gadget, speed);
++ if (udc->gadget->ops->udc_set_speed) {
++ enum usb_device_speed s;
++
++ s = min(speed, udc->gadget->max_speed);
++ udc->gadget->ops->udc_set_speed(udc->gadget, s);
++ }
+ }
+
+ /**
--- /dev/null
+From a58204ab91ad8cae4d8474aa0ba5d1fc504860c9 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Mon, 13 Nov 2017 17:59:18 +0900
+Subject: usb: gadget: udc: renesas_usb3: fix number of the pipes
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit a58204ab91ad8cae4d8474aa0ba5d1fc504860c9 upstream.
+
+This controller on R-Car Gen3 has 6 pipes that included PIPE 0 for
+control actually. But, the datasheet has error in writing as it has
+31 pipes. (However, the previous code defined 30 pipes wrongly...)
+
+Anyway, this patch fixes it.
+
+Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -254,7 +254,7 @@
+ #define USB3_EP0_SS_MAX_PACKET_SIZE 512
+ #define USB3_EP0_HSFS_MAX_PACKET_SIZE 64
+ #define USB3_EP0_BUF_SIZE 8
+-#define USB3_MAX_NUM_PIPES 30
++#define USB3_MAX_NUM_PIPES 6 /* This includes PIPE 0 */
+ #define USB3_WAIT_US 3
+ #define USB3_DMA_NUM_SETTING_AREA 4
+ /*
projects / thirdparty / kernel / stable-queue.git / commitdiff
