revert-uapi-fix-linux-rds.h-userspace-compilation-errors.patch
uapi-fix-linux-rds.h-userspace-compilation-error.patch
uapi-fix-linux-rds.h-userspace-compilation-errors.patch
+usb-usbfs-compute-urb-actual_length-for-isochronous.patch
+usb-add-delay-init-quirk-for-corsair-k70-lux-keyboards.patch
+usb-serial-qcserial-add-pid-vid-for-sierra-wireless-em7355-fw-update.patch
+usb-serial-garmin_gps-fix-i-o-after-failed-probe-and-remove.patch
+usb-serial-garmin_gps-fix-memory-leak-on-probe-errors.patch
--- /dev/null
+From a0fea6027f19c62727315aba1a7fae75a9caa842 Mon Sep 17 00:00:00 2001
+From: Bernhard Rosenkraenzer <bernhard.rosenkranzer@linaro.org>
+Date: Fri, 3 Nov 2017 16:46:02 +0100
+Subject: USB: Add delay-init quirk for Corsair K70 LUX keyboards
+
+From: Bernhard Rosenkraenzer <bernhard.rosenkranzer@linaro.org>
+
+commit a0fea6027f19c62727315aba1a7fae75a9caa842 upstream.
+
+Without this patch, K70 LUX keyboards don't work, saying
+usb 3-3: unable to read config index 0 descriptor/all
+usb 3-3: can't read configurations, error -110
+usb usb3-port3: unable to enumerate USB device
+
+Signed-off-by: Bernhard Rosenkraenzer <Bernhard.Rosenkranzer@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -221,6 +221,9 @@ static const struct usb_device_id usb_qu
+ /* Corsair Strafe RGB */
+ { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+
++ /* Corsair K70 LUX */
++ { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ /* MIDI keyboard WORLDE MINI */
+ { USB_DEVICE(0x1c75, 0x0204), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
--- /dev/null
+From 19a565d9af6e0d828bd0d521d3bafd5017f4ce52 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 11 Oct 2017 14:02:57 +0200
+Subject: USB: serial: garmin_gps: fix I/O after failed probe and remove
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 19a565d9af6e0d828bd0d521d3bafd5017f4ce52 upstream.
+
+Make sure to stop any submitted interrupt and bulk-out URBs before
+returning after failed probe and when the port is being unbound to avoid
+later NULL-pointer dereferences in the completion callbacks.
+
+Also fix up the related and broken I/O cancellation on failed open and
+on close. (Note that port->write_urb was never submitted.)
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/garmin_gps.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/garmin_gps.c
++++ b/drivers/usb/serial/garmin_gps.c
+@@ -138,6 +138,7 @@ struct garmin_data {
+ __u8 privpkt[4*6];
+ spinlock_t lock;
+ struct list_head pktlist;
++ struct usb_anchor write_urbs;
+ };
+
+
+@@ -906,7 +907,7 @@ static int garmin_init_session(struct us
+ sizeof(GARMIN_START_SESSION_REQ), 0);
+
+ if (status < 0)
+- break;
++ goto err_kill_urbs;
+ }
+
+ if (status > 0)
+@@ -914,6 +915,12 @@ static int garmin_init_session(struct us
+ }
+
+ return status;
++
++err_kill_urbs:
++ usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
++ usb_kill_urb(port->interrupt_in_urb);
++
++ return status;
+ }
+
+
+@@ -931,7 +938,6 @@ static int garmin_open(struct tty_struct
+ spin_unlock_irqrestore(&garmin_data_p->lock, flags);
+
+ /* shutdown any bulk reads that might be going on */
+- usb_kill_urb(port->write_urb);
+ usb_kill_urb(port->read_urb);
+
+ if (garmin_data_p->state == STATE_RESET)
+@@ -954,7 +960,7 @@ static void garmin_close(struct usb_seri
+
+ /* shutdown our urbs */
+ usb_kill_urb(port->read_urb);
+- usb_kill_urb(port->write_urb);
++ usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
+
+ /* keep reset state so we know that we must start a new session */
+ if (garmin_data_p->state != STATE_RESET)
+@@ -1038,12 +1044,14 @@ static int garmin_write_bulk(struct usb_
+ }
+
+ /* send it down the pipe */
++ usb_anchor_urb(urb, &garmin_data_p->write_urbs);
+ status = usb_submit_urb(urb, GFP_ATOMIC);
+ if (status) {
+ dev_err(&port->dev,
+ "%s - usb_submit_urb(write bulk) failed with status = %d\n",
+ __func__, status);
+ count = status;
++ usb_unanchor_urb(urb);
+ kfree(buffer);
+ }
+
+@@ -1402,6 +1410,7 @@ static int garmin_port_probe(struct usb_
+ garmin_data_p->state = 0;
+ garmin_data_p->flags = 0;
+ garmin_data_p->count = 0;
++ init_usb_anchor(&garmin_data_p->write_urbs);
+ usb_set_serial_port_data(port, garmin_data_p);
+
+ status = garmin_init_session(port);
+@@ -1414,6 +1423,7 @@ static int garmin_port_remove(struct usb
+ {
+ struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
+
++ usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
+ usb_kill_urb(port->interrupt_in_urb);
+ del_timer_sync(&garmin_data_p->timer);
+ kfree(garmin_data_p);
--- /dev/null
+From 74d471b598444b7f2d964930f7234779c80960a0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 11 Oct 2017 14:02:58 +0200
+Subject: USB: serial: garmin_gps: fix memory leak on probe errors
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 74d471b598444b7f2d964930f7234779c80960a0 upstream.
+
+Make sure to free the port private data before returning after a failed
+probe attempt.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/garmin_gps.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/serial/garmin_gps.c
++++ b/drivers/usb/serial/garmin_gps.c
+@@ -1414,6 +1414,12 @@ static int garmin_port_probe(struct usb_
+ usb_set_serial_port_data(port, garmin_data_p);
+
+ status = garmin_init_session(port);
++ if (status)
++ goto err_free;
++
++ return 0;
++err_free:
++ kfree(garmin_data_p);
+
+ return status;
+ }
--- /dev/null
+From 771394a54148f18926ca86414e51c69eda27d0cd Mon Sep 17 00:00:00 2001
+From: Douglas Fischer <douglas.fischer@outlook.com>
+Date: Sun, 29 Oct 2017 23:29:55 +0000
+Subject: USB: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update
+
+From: Douglas Fischer <douglas.fischer@outlook.com>
+
+commit 771394a54148f18926ca86414e51c69eda27d0cd upstream.
+
+Add USB PID/VID for Sierra Wireless EM7355 LTE modem QDL firmware update
+mode.
+
+Signed-off-by: Douglas Fischer <douglas.fischer@outlook.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/qcserial.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -148,6 +148,7 @@ static const struct usb_device_id id_tab
+ {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */
+ {DEVICE_SWI(0x1199, 0x68c0)}, /* Sierra Wireless MC7304/MC7354 */
+ {DEVICE_SWI(0x1199, 0x901c)}, /* Sierra Wireless EM7700 */
++ {DEVICE_SWI(0x1199, 0x901e)}, /* Sierra Wireless EM7355 QDL */
+ {DEVICE_SWI(0x1199, 0x901f)}, /* Sierra Wireless EM7355 */
+ {DEVICE_SWI(0x1199, 0x9040)}, /* Sierra Wireless Modem */
+ {DEVICE_SWI(0x1199, 0x9041)}, /* Sierra Wireless MC7305/MC7355 */
--- /dev/null
+From 2ef47001b3ee3ded579b7532ebdcf8680e4d8c54 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 8 Nov 2017 12:23:17 -0500
+Subject: USB: usbfs: compute urb->actual_length for isochronous
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 2ef47001b3ee3ded579b7532ebdcf8680e4d8c54 upstream.
+
+The USB kerneldoc says that the actual_length field "is read in
+non-iso completion functions", but the usbfs driver uses it for all
+URB types in processcompl(). Since not all of the host controller
+drivers set actual_length for isochronous URBs, programs using usbfs
+with some host controllers don't work properly. For example, Minas
+reports that a USB camera controlled by libusb doesn't work properly
+with a dwc2 controller.
+
+It doesn't seem worthwhile to change the HCDs and the documentation,
+since the in-kernel USB class drivers evidently don't rely on
+actual_length for isochronous transfers. The easiest solution is for
+usbfs to calculate the actual_length value for itself, by adding up
+the lengths of the individual packets in an isochronous transfer.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Reported-and-tested-by: wlf <wulf@rock-chips.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/devio.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1653,6 +1653,18 @@ static int proc_unlinkurb(struct usb_dev
+ return 0;
+ }
+
++static void compute_isochronous_actual_length(struct urb *urb)
++{
++ unsigned int i;
++
++ if (urb->number_of_packets > 0) {
++ urb->actual_length = 0;
++ for (i = 0; i < urb->number_of_packets; i++)
++ urb->actual_length +=
++ urb->iso_frame_desc[i].actual_length;
++ }
++}
++
+ static int processcompl(struct async *as, void __user * __user *arg)
+ {
+ struct urb *urb = as->urb;
+@@ -1660,6 +1672,7 @@ static int processcompl(struct async *as
+ void __user *addr = as->userurb;
+ unsigned int i;
+
++ compute_isochronous_actual_length(urb);
+ if (as->userbuffer && urb->actual_length) {
+ if (copy_urb_data_to_user(as->userbuffer, urb))
+ goto err_out;
+@@ -1829,6 +1842,7 @@ static int processcompl_compat(struct as
+ void __user *addr = as->userurb;
+ unsigned int i;
+
++ compute_isochronous_actual_length(urb);
+ if (as->userbuffer && urb->actual_length) {
+ if (copy_urb_data_to_user(as->userbuffer, urb))
+ return -EFAULT;
projects / thirdparty / kernel / stable-queue.git / commitdiff
