staging-comedi-adl_pci7x3x-fix-digital-output-on-pci-7230.patch
clk-versatile-off-by-one-in-clk_sp810_timerclken_of_get.patch
pci-fix-ti816x-class-code-quirk.patch
+usb-symbolserial-use-usb_get_serial_port_data.patch
+usb-ftdi_sio-added-custom-pid-for-customware-products.patch
+usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch
+usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch
--- /dev/null
+From b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Mon, 27 Jul 2015 12:25:27 +0530
+Subject: usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream.
+
+DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and
+the size of bounce buffer is 512 bytes. However if the host initiates OUT
+transfers of size more than 512 bytes (and non max packet aligned), the
+driver throws a WARN dump but still programs the TRB to receive more than
+512 bytes. This will cause bounce buffer to overflow and corrupt the
+adjacent memory locations which can be fatal.
+
+Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE
+(512) bytes.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/ep0.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -793,6 +793,11 @@ static void dwc3_ep0_complete_data(struc
+ unsigned maxp = ep0->endpoint.maxpacket;
+
+ transfer_size += (maxp - (transfer_size % maxp));
++
++ /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */
++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE)
++ transfer_size = DWC3_EP0_BOUNCE_SIZE;
++
+ transferred = min_t(u32, ur->length,
+ transfer_size - length);
+ memcpy(ur->buf, dwc->ep0_bounce, transferred);
+@@ -905,11 +910,14 @@ static void __dwc3_ep0_do_control_data(s
+ return;
+ }
+
+- WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE);
+-
+ maxpacket = dep->endpoint.maxpacket;
+ transfer_size = roundup(req->request.length, maxpacket);
+
++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) {
++ dev_WARN(dwc->dev, "bounce buf can't handle req len\n");
++ transfer_size = DWC3_EP0_BOUNCE_SIZE;
++ }
++
+ dwc->ep0_bounced = true;
+
+ /*
--- /dev/null
+From 1fb8dc36384ae1140ee6ccc470de74397606a9d5 Mon Sep 17 00:00:00 2001
+From: Matthijs Kooijman <matthijs@stdin.nl>
+Date: Tue, 18 Aug 2015 10:33:56 +0200
+Subject: USB: ftdi_sio: Added custom PID for CustomWare products
+
+From: Matthijs Kooijman <matthijs@stdin.nl>
+
+commit 1fb8dc36384ae1140ee6ccc470de74397606a9d5 upstream.
+
+CustomWare uses the FTDI VID with custom PIDs for their ShipModul MiniPlex
+products.
+
+Signed-off-by: Matthijs Kooijman <matthijs@stdin.nl>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 4 ++++
+ drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -618,6 +618,10 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2WI_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX3_PID) },
+ /*
+ * ELV devices:
+ */
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -568,6 +568,14 @@
+ */
+ #define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
+
++/*
++ * CustomWare / ShipModul NMEA multiplexers product ids (FTDI_VID)
++ */
++#define FTDI_CUSTOMWARE_MINIPLEX_PID 0xfd48 /* MiniPlex first generation NMEA Multiplexer */
++#define FTDI_CUSTOMWARE_MINIPLEX2_PID 0xfd49 /* MiniPlex-USB and MiniPlex-2 series */
++#define FTDI_CUSTOMWARE_MINIPLEX2WI_PID 0xfd4a /* MiniPlex-2Wi */
++#define FTDI_CUSTOMWARE_MINIPLEX3_PID 0xfd4b /* MiniPlex-3 series */
++
+
+ /********************************/
+ /** third-party VID/PID combos **/
--- /dev/null
+From 0521cfd06e1ebcd575e7ae36aab068b38df23850 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Mon, 17 Aug 2015 10:23:03 +0800
+Subject: usb: host: ehci-sys: delete useless bus_to_hcd conversion
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit 0521cfd06e1ebcd575e7ae36aab068b38df23850 upstream.
+
+The ehci platform device's drvdata is the pointer of struct usb_hcd
+already, so we doesn't need to call bus_to_hcd conversion again.
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-sysfs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ehci-sysfs.c
++++ b/drivers/usb/host/ehci-sysfs.c
+@@ -29,7 +29,7 @@ static ssize_t show_companion(struct dev
+ int count = PAGE_SIZE;
+ char *ptr = buf;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ nports = HCS_N_PORTS(ehci->hcs_params);
+
+ for (index = 0; index < nports; ++index) {
+@@ -54,7 +54,7 @@ static ssize_t store_companion(struct de
+ struct ehci_hcd *ehci;
+ int portnum, new_owner;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ new_owner = PORT_OWNER; /* Owned by companion */
+ if (sscanf(buf, "%d", &portnum) != 1)
+ return -EINVAL;
+@@ -85,7 +85,7 @@ static ssize_t show_uframe_periodic_max(
+ struct ehci_hcd *ehci;
+ int n;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ n = scnprintf(buf, PAGE_SIZE, "%d\n", ehci->uframe_periodic_max);
+ return n;
+ }
+@@ -101,7 +101,7 @@ static ssize_t store_uframe_periodic_max
+ unsigned long flags;
+ ssize_t ret;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ if (kstrtouint(buf, 0, &uframe_periodic_max) < 0)
+ return -EINVAL;
+
--- /dev/null
+From 951d3793bbfc0a441d791d820183aa3085c83ea9 Mon Sep 17 00:00:00 2001
+From: Philipp Hachtmann <hachti@hachti.de>
+Date: Mon, 17 Aug 2015 17:31:46 +0200
+Subject: USB: symbolserial: Use usb_get_serial_port_data
+
+From: Philipp Hachtmann <hachti@hachti.de>
+
+commit 951d3793bbfc0a441d791d820183aa3085c83ea9 upstream.
+
+The driver used usb_get_serial_data(port->serial) which compiled but resulted
+in a NULL pointer being returned (and subsequently used). I did not go deeper
+into this but I guess this is a regression.
+
+Signed-off-by: Philipp Hachtmann <hachti@hachti.de>
+Fixes: a85796ee5149 ("USB: symbolserial: move private-data allocation to
+port_probe")
+Acked-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/symbolserial.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/symbolserial.c
++++ b/drivers/usb/serial/symbolserial.c
+@@ -96,7 +96,7 @@ exit:
+
+ static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+- struct symbol_private *priv = usb_get_serial_data(port->serial);
++ struct symbol_private *priv = usb_get_serial_port_data(port);
+ unsigned long flags;
+ int result = 0;
+
+@@ -122,7 +122,7 @@ static void symbol_close(struct usb_seri
+ static void symbol_throttle(struct tty_struct *tty)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+- struct symbol_private *priv = usb_get_serial_data(port->serial);
++ struct symbol_private *priv = usb_get_serial_port_data(port);
+
+ spin_lock_irq(&priv->lock);
+ priv->throttled = true;
+@@ -132,7 +132,7 @@ static void symbol_throttle(struct tty_s
+ static void symbol_unthrottle(struct tty_struct *tty)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+- struct symbol_private *priv = usb_get_serial_data(port->serial);
++ struct symbol_private *priv = usb_get_serial_port_data(port);
+ int result;
+ bool was_throttled;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
