4.9-stable patches

added patches:
	usb-gadget-composite-always-set-ep-mult-to-a-sensible-value.patch

diff --git a/queue-4.9/series b/queue-4.9/series
index aae541eab2e8ba0d0011d9af03abdafc27382778..09a6f0906f599ba4ad82d1cbe84e583cd444d06e 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -52,3 +52,4 @@ loop-return-proper-error-from-loop_queue_rq.patch
 nvmet-fix-possible-infinite-loop-triggered-on-hot-namespace-removal.patch
 mm-vmscan.c-set-correct-defer-count-for-shrinker.patch
 mm-page_alloc-keep-pcp-count-and-list-contents-in-sync-if-struct-page-is-corrupted.patch
+usb-gadget-composite-always-set-ep-mult-to-a-sensible-value.patch

diff --git a/queue-4.9/usb-gadget-composite-always-set-ep-mult-to-a-sensible-value.patch b/queue-4.9/usb-gadget-composite-always-set-ep-mult-to-a-sensible-value.patch
new file mode 100644 (file)
index 0000000..8d8ce27
--- /dev/null
+++ b/queue-4.9/usb-gadget-composite-always-set-ep-mult-to-a-sensible-value.patch
@@ -0,0 +1,67 @@
+From eaa496ffaaf19591fe471a36cef366146eeb9153 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Wed, 28 Sep 2016 12:33:31 +0300
+Subject: usb: gadget: composite: always set ep->mult to a sensible value
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit eaa496ffaaf19591fe471a36cef366146eeb9153 upstream.
+
+ep->mult is supposed to be set to Isochronous and
+Interrupt Endapoint's multiplier value. This value
+is computed from different places depending on the
+link speed.
+
+If we're dealing with HighSpeed, then it's part of
+bits [12:11] of wMaxPacketSize. This case wasn't
+taken into consideration before.
+
+While at that, also make sure the ep->mult defaults
+to one so drivers can use it unconditionally and
+assume they'll never multiply ep->maxpacket to zero.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/composite.c          |    9 +++++++--
+ drivers/usb/gadget/function/uvc_video.c |    2 +-
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -201,7 +201,12 @@ ep_found:
+       _ep->desc = chosen_desc;
+       _ep->comp_desc = NULL;
+       _ep->maxburst = 0;
+-      _ep->mult = 0;
++      _ep->mult = 1;
++
++      if (g->speed == USB_SPEED_HIGH && (usb_endpoint_xfer_isoc(_ep->desc) ||
++                              usb_endpoint_xfer_int(_ep->desc)))
++              _ep->mult = usb_endpoint_maxp(_ep->desc) & 0x7ff;
++
+       if (!want_comp_desc)
+               return 0;
+ 
+@@ -218,7 +223,7 @@ ep_found:
+               switch (usb_endpoint_type(_ep->desc)) {
+               case USB_ENDPOINT_XFER_ISOC:
+                       /* mult: bits 1:0 of bmAttributes */
+-                      _ep->mult = comp_desc->bmAttributes & 0x3;
++                      _ep->mult = (comp_desc->bmAttributes & 0x3) + 1;
+               case USB_ENDPOINT_XFER_BULK:
+               case USB_ENDPOINT_XFER_INT:
+                       _ep->maxburst = comp_desc->bMaxBurst + 1;
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -243,7 +243,7 @@ uvc_video_alloc_requests(struct uvc_vide
+ 
+       req_size = video->ep->maxpacket
+                * max_t(unsigned int, video->ep->maxburst, 1)
+-               * (video->ep->mult + 1);
++               * (video->ep->mult);
+ 
+       for (i = 0; i < UVC_NUM_REQUESTS; ++i) {
+               video->req_buffer[i] = kmalloc(req_size, GFP_KERNEL);