--- /dev/null
+From cc824534d4fef0e46e4486d5c1e10d3c6b1ebadc Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 25 Aug 2014 16:15:35 -0700
+Subject: ARM: OMAP2+: hwmod: Rearm wake-up interrupts for DT when MUSB is idled
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit cc824534d4fef0e46e4486d5c1e10d3c6b1ebadc upstream.
+
+Looks like MUSB cable removal can cause wake-up interrupts to
+stop working for device tree based booting at least for UART3
+even as nothing is dynamically remuxed. This can be fixed by
+calling reconfigure_io_chain() for device tree based booting
+in hwmod code. Note that we already do that for legacy booting
+if the legacy mux is configured.
+
+My guess is that this is related to UART3 and MUSB ULPI
+hsusb0_data0 and hsusb0_data1 support for Carkit mode that
+somehow affect the configured IO chain for UART3 and require
+rearming the wake-up interrupts.
+
+In general, for device tree based booting, pinctrl-single
+calls the rearm hook that in turn calls reconfigure_io_chain
+so calling reconfigure_io_chain should not be needed from the
+hwmod code for other events.
+
+So let's limit the hwmod rearming of iochain only to
+HWMOD_FORCE_MSTANDBY where MUSB is currently the only user
+of it. If we see other devices needing similar changes we can
+add more checks for it.
+
+Cc: Paul Walmsley <paul@pwsan.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/omap_hwmod.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2177,6 +2177,8 @@ static int _enable(struct omap_hwmod *oh
+ oh->mux->pads_dynamic))) {
+ omap_hwmod_mux(oh->mux, _HWMOD_STATE_ENABLED);
+ _reconfigure_io_chain();
++ } else if (oh->flags & HWMOD_FORCE_MSTANDBY) {
++ _reconfigure_io_chain();
+ }
+
+ _add_initiator_dep(oh, mpu_oh);
+@@ -2283,6 +2285,8 @@ static int _idle(struct omap_hwmod *oh)
+ if (oh->mux && oh->mux->pads_dynamic) {
+ omap_hwmod_mux(oh->mux, _HWMOD_STATE_IDLE);
+ _reconfigure_io_chain();
++ } else if (oh->flags & HWMOD_FORCE_MSTANDBY) {
++ _reconfigure_io_chain();
+ }
+
+ oh->_state = _HWMOD_STATE_IDLE;
--- /dev/null
+From 022eaa7517017efe4f6538750c2b59a804dc7df7 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Wed, 27 Aug 2014 18:40:05 -0400
+Subject: jbd2: fix infinite loop when recovering corrupt journal blocks
+
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+
+commit 022eaa7517017efe4f6538750c2b59a804dc7df7 upstream.
+
+When recovering the journal, don't fall into an infinite loop if we
+encounter a corrupt journal block. Instead, just skip the block and
+return an error, which fails the mount and thus forces the user to run
+a full filesystem fsck.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/recovery.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/fs/jbd2/recovery.c
++++ b/fs/jbd2/recovery.c
+@@ -427,6 +427,7 @@ static int do_one_pass(journal_t *journa
+ int tag_bytes = journal_tag_bytes(journal);
+ __u32 crc32_sum = ~0; /* Transactional Checksums */
+ int descr_csum_size = 0;
++ int block_error = 0;
+
+ /*
+ * First thing is to establish what we expect to find in the log
+@@ -599,7 +600,8 @@ static int do_one_pass(journal_t *journa
+ "checksum recovering "
+ "block %llu in log\n",
+ blocknr);
+- continue;
++ block_error = 1;
++ goto skip_write;
+ }
+
+ /* Find a buffer for the new
+@@ -798,7 +800,8 @@ static int do_one_pass(journal_t *journa
+ success = -EIO;
+ }
+ }
+-
++ if (block_error && success == 0)
++ success = -EIO;
+ return success;
+
+ failed:
--- /dev/null
+From d9499a95716db0d4bc9b67e88fd162133e7d6b08 Mon Sep 17 00:00:00 2001
+From: Kinglong Mee <kinglongmee@gmail.com>
+Date: Wed, 30 Jul 2014 21:26:05 +0800
+Subject: NFSD: Decrease nfsd_users in nfsd_startup_generic fail
+
+From: Kinglong Mee <kinglongmee@gmail.com>
+
+commit d9499a95716db0d4bc9b67e88fd162133e7d6b08 upstream.
+
+A memory allocation failure could cause nfsd_startup_generic to fail, in
+which case nfsd_users wouldn't be incorrectly left elevated.
+
+After nfsd restarts nfsd_startup_generic will then succeed without doing
+anything--the first consequence is likely nfs4_start_net finding a bad
+laundry_wq and crashing.
+
+Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
+Fixes: 4539f14981ce "nfsd: replace boolean nfsd_up flag by users counter"
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfssvc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -220,7 +220,8 @@ static int nfsd_startup_generic(int nrse
+ */
+ ret = nfsd_racache_init(2*nrservs);
+ if (ret)
+- return ret;
++ goto dec_users;
++
+ ret = nfs4_state_start();
+ if (ret)
+ goto out_racache;
+@@ -228,6 +229,8 @@ static int nfsd_startup_generic(int nrse
+
+ out_racache:
+ nfsd_racache_shutdown();
++dec_users:
++ nfsd_users--;
+ return ret;
+ }
+
--- /dev/null
+From f87d928f6d98644d39809a013a22f981d39017cf Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Sun, 24 Aug 2014 14:46:48 -0400
+Subject: NFSv3: Fix another acl regression
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit f87d928f6d98644d39809a013a22f981d39017cf upstream.
+
+When creating a new object on the NFS server, we should not be sending
+posix setacl requests unless the preceding posix_acl_create returned a
+non-trivial acl. Doing so, causes Solaris servers in particular to
+return an EINVAL.
+
+Fixes: 013cdf1088d72 (nfs: use generic posix ACL infrastructure,,,)
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1132786
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs3acl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs3acl.c
++++ b/fs/nfs/nfs3acl.c
+@@ -305,7 +305,10 @@ static int nfs3_proc_setacls(struct inod
+ .rpc_argp = &args,
+ .rpc_resp = &fattr,
+ };
+- int status;
++ int status = 0;
++
++ if (acl == NULL && (!S_ISDIR(inode->i_mode) || dfacl == NULL))
++ goto out;
+
+ status = -EOPNOTSUPP;
+ if (!nfs_server_capable(inode, NFS_CAP_ACLS))
--- /dev/null
+From aee7af356e151494d5014f57b33460b162f181b5 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Mon, 25 Aug 2014 22:33:12 -0400
+Subject: NFSv4: Fix problems with close in the presence of a delegation
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit aee7af356e151494d5014f57b33460b162f181b5 upstream.
+
+In the presence of delegations, we can no longer assume that the
+state->n_rdwr, state->n_rdonly, state->n_wronly reflect the open
+stateid share mode, and so we need to calculate the initial value
+for calldata->arg.fmode using the state->flags.
+
+Reported-by: James Drews <drews@engr.wisc.edu>
+Fixes: 88069f77e1ac5 (NFSv41: Fix a potential state leakage when...)
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4proc.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2287,6 +2287,7 @@ static void nfs4_close_prepare(struct rp
+ struct nfs4_closedata *calldata = data;
+ struct nfs4_state *state = calldata->state;
+ struct inode *inode = calldata->inode;
++ bool is_rdonly, is_wronly, is_rdwr;
+ int call_close = 0;
+
+ dprintk("%s: begin!\n", __func__);
+@@ -2294,18 +2295,24 @@ static void nfs4_close_prepare(struct rp
+ goto out_wait;
+
+ task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
+- calldata->arg.fmode = FMODE_READ|FMODE_WRITE;
+ spin_lock(&state->owner->so_lock);
++ is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
++ is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
++ is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
++ /* Calculate the current open share mode */
++ calldata->arg.fmode = 0;
++ if (is_rdonly || is_rdwr)
++ calldata->arg.fmode |= FMODE_READ;
++ if (is_wronly || is_rdwr)
++ calldata->arg.fmode |= FMODE_WRITE;
+ /* Calculate the change in open mode */
+ if (state->n_rdwr == 0) {
+ if (state->n_rdonly == 0) {
+- call_close |= test_bit(NFS_O_RDONLY_STATE, &state->flags);
+- call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
++ call_close |= is_rdonly || is_rdwr;
+ calldata->arg.fmode &= ~FMODE_READ;
+ }
+ if (state->n_wronly == 0) {
+- call_close |= test_bit(NFS_O_WRONLY_STATE, &state->flags);
+- call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
++ call_close |= is_wronly || is_rdwr;
+ calldata->arg.fmode &= ~FMODE_WRITE;
+ }
+ }
btrfs-fix-csum-tree-corruption-duplicate-and-outdated-checksums.patch
mei-reset-client-state-on-queued-connect-request.patch
mei-nfc-fix-memory-leak-in-error-path.patch
+jbd2-fix-infinite-loop-when-recovering-corrupt-journal-blocks.patch
+staging-speakup-update-__speakup_paste_selection-tty-ab-usage-to-match-vt.patch
+xhci-treat-not-finding-the-event_seg-on-comp_stop-the-same-as-comp_stop_inval.patch
+usb-xhci-amd-chipset-also-needs-short-tx-quirk.patch
+arm-omap2-hwmod-rearm-wake-up-interrupts-for-dt-when-musb-is-idled.patch
+usb-ftdi_sio-add-basic-micro-atom-nano-usb2serial-pid.patch
+usb-ftdi_sio-added-pid-for-new-ekey-device.patch
+usb-whiteheat-added-bounds-checking-for-bulk-command-response.patch
+usb-hub-prevent-hub-autosuspend-if-usbcore.autosuspend-is-1.patch
+nfsd-decrease-nfsd_users-in-nfsd_startup_generic-fail.patch
+svcrdma-select-nfsv4.1-backchannel-transport-based-on-forward-channel.patch
+nfsv3-fix-another-acl-regression.patch
+nfsv4-fix-problems-with-close-in-the-presence-of-a-delegation.patch
+vm_is_stack-use-for_each_thread-rather-then-buggy-while_each_thread.patch
--- /dev/null
+From 28a821c306889b9f2c3fff49abedc9b2c743eb73 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 19 May 2014 01:03:06 +0100
+Subject: Staging: speakup: Update __speakup_paste_selection() tty (ab)usage to match vt
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 28a821c306889b9f2c3fff49abedc9b2c743eb73 upstream.
+
+This function is largely a duplicate of paste_selection() in
+drivers/tty/vt/selection.c, but with its own selection state. The
+speakup selection mechanism should really be merged with vt.
+
+For now, apply the changes from 'TTY: vt, fix paste_selection ldisc
+handling', 'tty: Make ldisc input flow control concurrency-friendly',
+and 'tty: Fix unsafe vt paste_selection()'.
+
+References: https://bugs.debian.org/735202
+References: https://bugs.debian.org/744015
+Reported-by: Paul Gevers <elbrus@debian.org>
+Reported-and-tested-by: Jarek Czekalski <jarekczek@poczta.onet.pl>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+[bwh: Backported to 3.10:
+ - Only apply the changes from 'TTY: vt, fix paste_selection ldisc handling'
+ - Add the same FIXME comment as vt's paste_selection() has in this version]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/selection.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/speakup/selection.c
++++ b/drivers/staging/speakup/selection.c
+@@ -5,6 +5,7 @@
+ #include <linux/device.h> /* for dev_warn */
+ #include <linux/selection.h>
+ #include <linux/workqueue.h>
++#include <linux/tty.h>
+ #include <asm/cmpxchg.h>
+
+ #include "speakup.h"
+@@ -135,8 +136,12 @@ static void __speakup_paste_selection(st
+ struct tty_struct *tty = xchg(&spw->tty, NULL);
+ struct vc_data *vc = (struct vc_data *) tty->driver_data;
+ int pasted = 0, count;
++ struct tty_ldisc *ld;
+ DECLARE_WAITQUEUE(wait, current);
+
++ ld = tty_ldisc_ref_wait(tty);
++
++ /* FIXME: this is completely unsafe */
+ add_wait_queue(&vc->paste_wait, &wait);
+ while (sel_buffer && sel_buffer_lth > pasted) {
+ set_current_state(TASK_INTERRUPTIBLE);
+@@ -146,12 +151,13 @@ static void __speakup_paste_selection(st
+ }
+ count = sel_buffer_lth - pasted;
+ count = min_t(int, count, tty->receive_room);
+- tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted,
+- NULL, count);
++ ld->ops->receive_buf(tty, sel_buffer + pasted, NULL, count);
+ pasted += count;
+ }
+ remove_wait_queue(&vc->paste_wait, &wait);
+ current->state = TASK_RUNNING;
++
++ tty_ldisc_deref(ld);
+ tty_kref_put(tty);
+ }
+
--- /dev/null
+From 3c45ddf823d679a820adddd53b52c6699c9a05ac Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Wed, 16 Jul 2014 15:38:32 -0400
+Subject: svcrdma: Select NFSv4.1 backchannel transport based on forward channel
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 3c45ddf823d679a820adddd53b52c6699c9a05ac upstream.
+
+The current code always selects XPRT_TRANSPORT_BC_TCP for the back
+channel, even when the forward channel was not TCP (eg, RDMA). When
+a 4.1 mount is attempted with RDMA, the server panics in the TCP BC
+code when trying to send CB_NULL.
+
+Instead, construct the transport protocol number from the forward
+channel transport or'd with XPRT_TRANSPORT_BC. Transports that do
+not support bi-directional RPC will not have registered a "BC"
+transport, causing create_backchannel_client() to fail immediately.
+
+Fixes: https://bugzilla.linux-nfs.org/show_bug.cgi?id=265
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4callback.c | 3 ++-
+ include/linux/sunrpc/svc_xprt.h | 1 +
+ net/sunrpc/svcsock.c | 2 ++
+ net/sunrpc/xprt.c | 2 +-
+ net/sunrpc/xprtrdma/svc_rdma_transport.c | 1 +
+ 5 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -672,7 +672,8 @@ static int setup_callback_client(struct
+ clp->cl_cb_session = ses;
+ args.bc_xprt = conn->cb_xprt;
+ args.prognumber = clp->cl_cb_session->se_cb_prog;
+- args.protocol = XPRT_TRANSPORT_BC_TCP;
++ args.protocol = conn->cb_xprt->xpt_class->xcl_ident |
++ XPRT_TRANSPORT_BC;
+ args.authflavor = ses->se_cb_sec.flavor;
+ }
+ /* Create RPC client */
+--- a/include/linux/sunrpc/svc_xprt.h
++++ b/include/linux/sunrpc/svc_xprt.h
+@@ -32,6 +32,7 @@ struct svc_xprt_class {
+ struct svc_xprt_ops *xcl_ops;
+ struct list_head xcl_list;
+ u32 xcl_max_payload;
++ int xcl_ident;
+ };
+
+ /*
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -683,6 +683,7 @@ static struct svc_xprt_class svc_udp_cla
+ .xcl_owner = THIS_MODULE,
+ .xcl_ops = &svc_udp_ops,
+ .xcl_max_payload = RPCSVC_MAXPAYLOAD_UDP,
++ .xcl_ident = XPRT_TRANSPORT_UDP,
+ };
+
+ static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv)
+@@ -1275,6 +1276,7 @@ static struct svc_xprt_class svc_tcp_cla
+ .xcl_owner = THIS_MODULE,
+ .xcl_ops = &svc_tcp_ops,
+ .xcl_max_payload = RPCSVC_MAXPAYLOAD_TCP,
++ .xcl_ident = XPRT_TRANSPORT_TCP,
+ };
+
+ void svc_init_xprt_sock(void)
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -1290,7 +1290,7 @@ struct rpc_xprt *xprt_create_transport(s
+ }
+ }
+ spin_unlock(&xprt_list_lock);
+- printk(KERN_ERR "RPC: transport (%d) not supported\n", args->ident);
++ dprintk("RPC: transport (%d) not supported\n", args->ident);
+ return ERR_PTR(-EIO);
+
+ found:
+--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+@@ -89,6 +89,7 @@ struct svc_xprt_class svc_rdma_class = {
+ .xcl_owner = THIS_MODULE,
+ .xcl_ops = &svc_rdma_ops,
+ .xcl_max_payload = RPCSVC_MAXPAYLOAD_TCP,
++ .xcl_ident = XPRT_TRANSPORT_RDMA,
+ };
+
+ struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt)
--- /dev/null
+From 6552cc7f09261db2aeaae389aa2c05a74b3a93b4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 13 Aug 2014 17:56:52 +0200
+Subject: USB: ftdi_sio: add Basic Micro ATOM Nano USB2Serial PID
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 6552cc7f09261db2aeaae389aa2c05a74b3a93b4 upstream.
+
+Add device id for Basic Micro ATOM Nano USB2Serial adapters.
+
+Reported-by: Nicolas Alt <n.alt@mytum.de>
+Tested-by: Nicolas Alt <n.alt@mytum.de>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -154,6 +154,7 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_BM_ATOM_NANO_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -42,6 +42,8 @@
+ /* www.candapter.com Ewert Energy Systems CANdapter device */
+ #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
+
++#define FTDI_BM_ATOM_NANO_PID 0xa559 /* Basic Micro ATOM Nano USB2Serial */
++
+ /*
+ * Texas Instruments XDS100v2 JTAG / BeagleBone A3
+ * http://processors.wiki.ti.com/index.php/XDS100
--- /dev/null
+From 646907f5bfb0782c731ae9ff6fb63471a3566132 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ja=C5=A1a=20Bartelj?= <jasa.bartelj@gmail.com>
+Date: Sat, 16 Aug 2014 12:44:27 +0200
+Subject: USB: ftdi_sio: Added PID for new ekey device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jaša Bartelj <jasa.bartelj@gmail.com>
+
+commit 646907f5bfb0782c731ae9ff6fb63471a3566132 upstream.
+
+Added support to the ftdi_sio driver for ekey Converter USB which
+uses an FT232BM chip.
+
+Signed-off-by: Jaša Bartelj <jasa.bartelj@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 5 +++++
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -951,6 +951,8 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
++ /* ekey Devices */
++ { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
+ /* Infineon Devices */
+ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
+ { }, /* Optional parameter entry */
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1380,3 +1380,8 @@
+ #define BRAINBOXES_US_160_6_PID 0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
+ #define BRAINBOXES_US_160_7_PID 0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
+ #define BRAINBOXES_US_160_8_PID 0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
++
++/*
++ * ekey biometric systems GmbH (http://ekey.net/)
++ */
++#define FTDI_EKEY_CONV_USB_PID 0xCB08 /* Converter USB */
--- /dev/null
+From bdd405d2a5287bdb9b04670ea255e1f122138e66 Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Mon, 4 Aug 2014 12:44:46 +0300
+Subject: usb: hub: Prevent hub autosuspend if usbcore.autosuspend is -1
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit bdd405d2a5287bdb9b04670ea255e1f122138e66 upstream.
+
+If user specifies that USB autosuspend must be disabled by module
+parameter "usbcore.autosuspend=-1" then we must prevent
+autosuspend of USB hub devices as well.
+
+commit 596d789a211d introduced in v3.8 changed the original behaivour
+and stopped respecting the usbcore.autosuspend parameter for hubs.
+
+Fixes: 596d789a211d "USB: set hub's default autosuspend delay as 0"
+
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Tested-by: Michael Welling <mwelling@emacinc.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1699,8 +1699,12 @@ static int hub_probe(struct usb_interfac
+ * - Change autosuspend delay of hub can avoid unnecessary auto
+ * suspend timer for hub, also may decrease power consumption
+ * of USB bus.
++ *
++ * - If user has indicated to prevent autosuspend by passing
++ * usbcore.autosuspend = -1 then keep autosuspend disabled.
+ */
+- pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
++ if (hdev->dev.power.autosuspend_delay >= 0)
++ pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
+
+ /*
+ * Hubs have proper suspend/resume support, except for root hubs
--- /dev/null
+From 6817ae225cd650fb1c3295d769298c38b1eba818 Mon Sep 17 00:00:00 2001
+From: James Forshaw <forshaw@google.com>
+Date: Sat, 23 Aug 2014 14:39:48 -0700
+Subject: USB: whiteheat: Added bounds checking for bulk command response
+
+From: James Forshaw <forshaw@google.com>
+
+commit 6817ae225cd650fb1c3295d769298c38b1eba818 upstream.
+
+This patch fixes a potential security issue in the whiteheat USB driver
+which might allow a local attacker to cause kernel memory corrpution. This
+is due to an unchecked memcpy into a fixed size buffer (of 64 bytes). On
+EHCI and XHCI busses it's possible to craft responses greater than 64
+bytes leading a buffer overflow.
+
+Signed-off-by: James Forshaw <forshaw@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/whiteheat.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -521,6 +521,10 @@ static void command_port_read_callback(s
+ dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__);
+ return;
+ }
++ if (!urb->actual_length) {
++ dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__);
++ return;
++ }
+ if (status) {
+ dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status);
+ if (status != -ENOENT)
+@@ -541,7 +545,8 @@ static void command_port_read_callback(s
+ /* These are unsolicited reports from the firmware, hence no
+ waiting command to wakeup */
+ dev_dbg(&urb->dev->dev, "%s - event received\n", __func__);
+- } else if (data[0] == WHITEHEAT_GET_DTR_RTS) {
++ } else if ((data[0] == WHITEHEAT_GET_DTR_RTS) &&
++ (urb->actual_length - 1 <= sizeof(command_info->result_buffer))) {
+ memcpy(command_info->result_buffer, &data[1],
+ urb->actual_length - 1);
+ command_info->command_finished = WHITEHEAT_CMD_COMPLETE;
--- /dev/null
+From 2597fe99bb0259387111d0431691f5daac84f5a5 Mon Sep 17 00:00:00 2001
+From: Huang Rui <ray.huang@amd.com>
+Date: Tue, 19 Aug 2014 15:17:57 +0300
+Subject: usb: xhci: amd chipset also needs short TX quirk
+
+From: Huang Rui <ray.huang@amd.com>
+
+commit 2597fe99bb0259387111d0431691f5daac84f5a5 upstream.
+
+AMD xHC also needs short tx quirk after tested on most of chipset
+generations. That's because there is the same incorrect behavior like
+Fresco Logic host. Please see below message with on USB webcam
+attached on xHC host:
+
+[ 139.262944] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
+[ 139.266934] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
+[ 139.270913] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
+[ 139.274937] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
+[ 139.278914] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
+[ 139.282936] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
+[ 139.286915] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
+[ 139.290938] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
+[ 139.294913] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
+[ 139.298917] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
+
+Reported-by: Arindam Nath <arindam.nath@amd.com>
+Tested-by: Shriraj-Rai P <shriraj-rai.p@amd.com>
+Signed-off-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -87,6 +87,10 @@ static void xhci_pci_quirks(struct devic
+ /* AMD PLL quirk */
+ if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
+ xhci->quirks |= XHCI_AMD_PLL_FIX;
++
++ if (pdev->vendor == PCI_VENDOR_ID_AMD)
++ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
++
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
+ xhci->quirks |= XHCI_LPM_SUPPORT;
+ xhci->quirks |= XHCI_INTEL_HOST;
--- /dev/null
+From 4449a51a7c281602d3a385044ab928322a122a02 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Fri, 8 Aug 2014 14:19:17 -0700
+Subject: vm_is_stack: use for_each_thread() rather then buggy while_each_thread()
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 4449a51a7c281602d3a385044ab928322a122a02 upstream.
+
+Aleksei hit the soft lockup during reading /proc/PID/smaps. David
+investigated the problem and suggested the right fix.
+
+while_each_thread() is racy and should die, this patch updates
+vm_is_stack().
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Reported-by: Aleksei Besogonov <alex.besogonov@gmail.com>
+Tested-by: Aleksei Besogonov <alex.besogonov@gmail.com>
+Suggested-by: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/util.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -272,17 +272,14 @@ pid_t vm_is_stack(struct task_struct *ta
+
+ if (in_group) {
+ struct task_struct *t;
+- rcu_read_lock();
+- if (!pid_alive(task))
+- goto done;
+
+- t = task;
+- do {
++ rcu_read_lock();
++ for_each_thread(task, t) {
+ if (vm_is_stack_for_task(t, vma)) {
+ ret = t->pid;
+ goto done;
+ }
+- } while_each_thread(task, t);
++ }
+ done:
+ rcu_read_unlock();
+ }
--- /dev/null
+From 9a54886342e227433aebc9d374f8ae268a836475 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 19 Aug 2014 15:17:56 +0300
+Subject: xhci: Treat not finding the event_seg on COMP_STOP the same as COMP_STOP_INVAL
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 9a54886342e227433aebc9d374f8ae268a836475 upstream.
+
+When using a Renesas uPD720231 chipset usb-3 uas to sata bridge with a 120G
+Crucial M500 ssd, model string: Crucial_ CT120M500SSD1, together with a
+the integrated Intel xhci controller on a Haswell laptop:
+
+00:14.0 USB controller [0c03]: Intel Corporation 8 Series USB xHCI HC [8086:9c31] (rev 04)
+
+The following error gets logged to dmesg:
+
+xhci error: Transfer event TRB DMA ptr not part of current TD
+
+Treating COMP_STOP the same as COMP_STOP_INVAL when no event_seg gets found
+fixes this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2532,7 +2532,8 @@ static int handle_tx_event(struct xhci_h
+ * last TRB of the previous TD. The command completion handle
+ * will take care the rest.
+ */
+- if (!event_seg && trb_comp_code == COMP_STOP_INVAL) {
++ if (!event_seg && (trb_comp_code == COMP_STOP ||
++ trb_comp_code == COMP_STOP_INVAL)) {
+ ret = 0;
+ goto cleanup;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
