--- /dev/null
+From b8995f527aac143e83d3900ff39357651ea4e0f6 Mon Sep 17 00:00:00 2001
+From: Chanwoo Choi <cw00.choi@samsung.com>
+Date: Thu, 21 Apr 2016 18:58:31 +0900
+Subject: serial: samsung: Reorder the sequence of clock control when call s3c24xx_serial_set_termios()
+
+From: Chanwoo Choi <cw00.choi@samsung.com>
+
+commit b8995f527aac143e83d3900ff39357651ea4e0f6 upstream.
+
+This patch fixes the broken serial log when changing the clock source
+of uart device. Before disabling the original clock source, this patch
+enables the new clock source to protect the clock off state for a split second.
+
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+---
+ drivers/tty/serial/samsung.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -734,6 +734,8 @@ static void s3c24xx_serial_set_termios(s
+ /* check to see if we need to change clock source */
+
+ if (ourport->baudclk != clk) {
++ clk_prepare_enable(clk);
++
+ s3c24xx_serial_setsource(port, clk_sel);
+
+ if (!IS_ERR(ourport->baudclk)) {
+@@ -741,8 +743,6 @@ static void s3c24xx_serial_set_termios(s
+ ourport->baudclk = ERR_PTR(-EINVAL);
+ }
+
+- clk_prepare_enable(clk);
+-
+ ourport->baudclk = clk;
+ ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0;
+ }
acpi-osi-fix-an-issue-that-acpi_osi-cannot-disable-acpica-internal-strings.patch
mmc-longer-timeout-for-long-read-time-quirk.patch
bluetooth-vhci-purge-unhandled-skbs.patch
+usb-serial-mxuport-fix-use-after-free-in-probe-error-path.patch
+usb-serial-keyspan-fix-use-after-free-in-probe-error-path.patch
+usb-serial-quatech2-fix-use-after-free-in-probe-error-path.patch
+usb-serial-io_edgeport-fix-memory-leaks-in-attach-error-path.patch
+usb-serial-io_edgeport-fix-memory-leaks-in-probe-error-path.patch
+usb-serial-option-add-support-for-cinterion-ph8-and-ahxx.patch
+tty-vt-return-error-when-con_startup-fails.patch
+serial-samsung-reorder-the-sequence-of-clock-control-when-call-s3c24xx_serial_set_termios.patch
--- /dev/null
+From 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Tue, 3 May 2016 17:05:54 +0200
+Subject: tty: vt, return error when con_startup fails
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 upstream.
+
+When csw->con_startup() fails in do_register_con_driver, we return no
+error (i.e. 0). This was changed back in 2006 by commit 3e795de763.
+Before that we used to return -ENODEV.
+
+So fix the return value to be -ENODEV in that case again.
+
+Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console")
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Reported-by: "Dan Carpenter" <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/vt/vt.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -3512,9 +3512,10 @@ static int do_register_con_driver(const
+ goto err;
+
+ desc = csw->con_startup();
+-
+- if (!desc)
++ if (!desc) {
++ retval = -ENODEV;
+ goto err;
++ }
+
+ retval = -EINVAL;
+
--- /dev/null
+From c5c0c55598cefc826d6cfb0a417eeaee3631715c Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sun, 8 May 2016 20:07:56 +0200
+Subject: USB: serial: io_edgeport: fix memory leaks in attach error path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c5c0c55598cefc826d6cfb0a417eeaee3631715c upstream.
+
+Private data, URBs and buffers allocated for Epic devices during
+attach were never released on errors (e.g. missing endpoints).
+
+Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/io_edgeport.c | 39 ++++++++++++++++++++++++++++-----------
+ 1 file changed, 28 insertions(+), 11 deletions(-)
+
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -2856,14 +2856,16 @@ static int edge_startup(struct usb_seria
+ /* not set up yet, so do it now */
+ edge_serial->interrupt_read_urb =
+ usb_alloc_urb(0, GFP_KERNEL);
+- if (!edge_serial->interrupt_read_urb)
+- return -ENOMEM;
++ if (!edge_serial->interrupt_read_urb) {
++ response = -ENOMEM;
++ break;
++ }
+
+ edge_serial->interrupt_in_buffer =
+ kmalloc(buffer_size, GFP_KERNEL);
+ if (!edge_serial->interrupt_in_buffer) {
+- usb_free_urb(edge_serial->interrupt_read_urb);
+- return -ENOMEM;
++ response = -ENOMEM;
++ break;
+ }
+ edge_serial->interrupt_in_endpoint =
+ endpoint->bEndpointAddress;
+@@ -2891,14 +2893,16 @@ static int edge_startup(struct usb_seria
+ /* not set up yet, so do it now */
+ edge_serial->read_urb =
+ usb_alloc_urb(0, GFP_KERNEL);
+- if (!edge_serial->read_urb)
+- return -ENOMEM;
++ if (!edge_serial->read_urb) {
++ response = -ENOMEM;
++ break;
++ }
+
+ edge_serial->bulk_in_buffer =
+ kmalloc(buffer_size, GFP_KERNEL);
+ if (!edge_serial->bulk_in_buffer) {
+- usb_free_urb(edge_serial->read_urb);
+- return -ENOMEM;
++ response = -ENOMEM;
++ break;
+ }
+ edge_serial->bulk_in_endpoint =
+ endpoint->bEndpointAddress;
+@@ -2924,9 +2928,22 @@ static int edge_startup(struct usb_seria
+ }
+ }
+
+- if (!interrupt_in_found || !bulk_in_found || !bulk_out_found) {
+- dev_err(ddev, "Error - the proper endpoints were not found!\n");
+- return -ENODEV;
++ if (response || !interrupt_in_found || !bulk_in_found ||
++ !bulk_out_found) {
++ if (!response) {
++ dev_err(ddev, "expected endpoints not found\n");
++ response = -ENODEV;
++ }
++
++ usb_free_urb(edge_serial->interrupt_read_urb);
++ kfree(edge_serial->interrupt_in_buffer);
++
++ usb_free_urb(edge_serial->read_urb);
++ kfree(edge_serial->bulk_in_buffer);
++
++ kfree(edge_serial);
++
++ return response;
+ }
+
+ /* start interrupt read for this edgeport this interrupt will
--- /dev/null
+From c8d62957d450cc1a22ce3242908709fe367ddc8e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sun, 8 May 2016 20:07:57 +0200
+Subject: USB: serial: io_edgeport: fix memory leaks in probe error path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c8d62957d450cc1a22ce3242908709fe367ddc8e upstream.
+
+URBs and buffers allocated in attach for Epic devices would never be
+deallocated in case of a later probe error (e.g. failure to allocate
+minor numbers) as disconnect is then never called.
+
+Fix by moving deallocation to release and making sure that the
+URBs are first unlinked.
+
+Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect,
+release")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/io_edgeport.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -2966,16 +2966,9 @@ static void edge_disconnect(struct usb_s
+ {
+ struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
+
+- /* stop reads and writes on all ports */
+- /* free up our endpoint stuff */
+ if (edge_serial->is_epic) {
+ usb_kill_urb(edge_serial->interrupt_read_urb);
+- usb_free_urb(edge_serial->interrupt_read_urb);
+- kfree(edge_serial->interrupt_in_buffer);
+-
+ usb_kill_urb(edge_serial->read_urb);
+- usb_free_urb(edge_serial->read_urb);
+- kfree(edge_serial->bulk_in_buffer);
+ }
+ }
+
+@@ -2988,6 +2981,16 @@ static void edge_release(struct usb_seri
+ {
+ struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
+
++ if (edge_serial->is_epic) {
++ usb_kill_urb(edge_serial->interrupt_read_urb);
++ usb_free_urb(edge_serial->interrupt_read_urb);
++ kfree(edge_serial->interrupt_in_buffer);
++
++ usb_kill_urb(edge_serial->read_urb);
++ usb_free_urb(edge_serial->read_urb);
++ kfree(edge_serial->bulk_in_buffer);
++ }
++
+ kfree(edge_serial);
+ }
+
--- /dev/null
+From 35be1a71d70775e7bd7e45fa6d2897342ff4c9d2 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sun, 8 May 2016 20:07:58 +0200
+Subject: USB: serial: keyspan: fix use-after-free in probe error path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 35be1a71d70775e7bd7e45fa6d2897342ff4c9d2 upstream.
+
+The interface instat and indat URBs were submitted in attach, but never
+unlinked in release before deallocating the corresponding transfer
+buffers.
+
+In the case of a late probe error (e.g. due to failed minor allocation),
+disconnect would not have been called before release, causing the
+buffers to be freed while the URBs are still in use. We'd also end up
+with active URBs for an unbound interface.
+
+Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect,
+release")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/keyspan.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -2406,6 +2406,10 @@ static void keyspan_release(struct usb_s
+
+ s_priv = usb_get_serial_data(serial);
+
++ /* Make sure to unlink the URBs submitted in attach. */
++ usb_kill_urb(s_priv->instat_urb);
++ usb_kill_urb(s_priv->indat_urb);
++
+ usb_free_urb(s_priv->instat_urb);
+ usb_free_urb(s_priv->indat_urb);
+ usb_free_urb(s_priv->glocont_urb);
--- /dev/null
+From 9e45284984096314994777f27e1446dfbfd2f0d7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sun, 8 May 2016 20:08:01 +0200
+Subject: USB: serial: mxuport: fix use-after-free in probe error path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 9e45284984096314994777f27e1446dfbfd2f0d7 upstream.
+
+The interface read and event URBs are submitted in attach, but were
+never explicitly unlinked by the driver. Instead the URBs would have
+been killed by usb-serial core on disconnect.
+
+In case of a late probe error (e.g. due to failed minor allocation),
+disconnect is never called and we could end up with active URBs for an
+unbound interface. This in turn could lead to deallocated memory being
+dereferenced in the completion callbacks.
+
+Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX
+driver")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mxuport.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/usb/serial/mxuport.c
++++ b/drivers/usb/serial/mxuport.c
+@@ -1263,6 +1263,15 @@ static int mxuport_attach(struct usb_ser
+ return 0;
+ }
+
++static void mxuport_release(struct usb_serial *serial)
++{
++ struct usb_serial_port *port0 = serial->port[0];
++ struct usb_serial_port *port1 = serial->port[1];
++
++ usb_serial_generic_close(port1);
++ usb_serial_generic_close(port0);
++}
++
+ static int mxuport_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+ struct mxuport_port *mxport = usb_get_serial_port_data(port);
+@@ -1365,6 +1374,7 @@ static struct usb_serial_driver mxuport_
+ .probe = mxuport_probe,
+ .port_probe = mxuport_port_probe,
+ .attach = mxuport_attach,
++ .release = mxuport_release,
+ .calc_num_ports = mxuport_calc_num_ports,
+ .open = mxuport_open,
+ .close = mxuport_close,
--- /dev/null
+From 444f94e9e625f6ec6bbe2cb232a6451c637f35a3 Mon Sep 17 00:00:00 2001
+From: Schemmel Hans-Christoph <Hans-Christoph.Schemmel@gemalto.com>
+Date: Fri, 29 Apr 2016 08:51:06 +0000
+Subject: USB: serial: option: add support for Cinterion PH8 and AHxx
+
+From: Schemmel Hans-Christoph <Hans-Christoph.Schemmel@gemalto.com>
+
+commit 444f94e9e625f6ec6bbe2cb232a6451c637f35a3 upstream.
+
+Added support for Gemalto's Cinterion PH8 and AHxx products
+with 2 RmNet Interfaces and products with 1 RmNet + 1 USB Audio interface.
+
+In addition some minor renaming and formatting.
+
+Signed-off-by: Hans-Christoph Schemmel <hans-christoph.schemmel@gemalto.com>
+[johan: sort current entries and trim trailing whitespace ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -375,18 +375,22 @@ static void option_instat_callback(struc
+ #define HAIER_PRODUCT_CE81B 0x10f8
+ #define HAIER_PRODUCT_CE100 0x2009
+
+-/* Cinterion (formerly Siemens) products */
+-#define SIEMENS_VENDOR_ID 0x0681
+-#define CINTERION_VENDOR_ID 0x1e2d
++/* Gemalto's Cinterion products (formerly Siemens) */
++#define SIEMENS_VENDOR_ID 0x0681
++#define CINTERION_VENDOR_ID 0x1e2d
++#define CINTERION_PRODUCT_HC25_MDMNET 0x0040
+ #define CINTERION_PRODUCT_HC25_MDM 0x0047
+-#define CINTERION_PRODUCT_HC25_MDMNET 0x0040
++#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */
+ #define CINTERION_PRODUCT_HC28_MDM 0x004C
+-#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */
+ #define CINTERION_PRODUCT_EU3_E 0x0051
+ #define CINTERION_PRODUCT_EU3_P 0x0052
+ #define CINTERION_PRODUCT_PH8 0x0053
+ #define CINTERION_PRODUCT_AHXX 0x0055
+ #define CINTERION_PRODUCT_PLXX 0x0060
++#define CINTERION_PRODUCT_PH8_2RMNET 0x0082
++#define CINTERION_PRODUCT_PH8_AUDIO 0x0083
++#define CINTERION_PRODUCT_AHXX_2RMNET 0x0084
++#define CINTERION_PRODUCT_AHXX_AUDIO 0x0085
+
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID 0x0b3c
+@@ -641,6 +645,10 @@ static const struct option_blacklist_inf
+ .reserved = BIT(1) | BIT(2) | BIT(3),
+ };
+
++static const struct option_blacklist_info cinterion_rmnet2_blacklist = {
++ .reserved = BIT(4) | BIT(5),
++};
++
+ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -1712,7 +1720,13 @@ static const struct usb_device_id option
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_2RMNET, 0xff),
++ .driver_info = (kernel_ulong_t)&cinterion_rmnet2_blacklist },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_AUDIO, 0xff),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) },
++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
--- /dev/null
+From 028c49f5e02a257c94129cd815f7c8485f51d4ef Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sun, 8 May 2016 20:08:02 +0200
+Subject: USB: serial: quatech2: fix use-after-free in probe error path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 028c49f5e02a257c94129cd815f7c8485f51d4ef upstream.
+
+The interface read URB is submitted in attach, but was only unlinked by
+the driver at disconnect.
+
+In case of a late probe error (e.g. due to failed minor allocation),
+disconnect is never called and we would end up with active URBs for an
+unbound interface. This in turn could lead to deallocated memory being
+dereferenced in the completion callback.
+
+Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/quatech2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/quatech2.c
++++ b/drivers/usb/serial/quatech2.c
+@@ -141,6 +141,7 @@ static void qt2_release(struct usb_seria
+
+ serial_priv = usb_get_serial_data(serial);
+
++ usb_kill_urb(serial_priv->read_urb);
+ usb_free_urb(serial_priv->read_urb);
+ kfree(serial_priv->read_buffer);
+ kfree(serial_priv);
projects / thirdparty / kernel / stable-queue.git / commitdiff
