--- /dev/null
+From 99fee508245825765ff60155fed43f970ff83a8f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 11 Oct 2017 16:39:02 +0200
+Subject: ALSA: caiaq: Fix stray URB at probe error path
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 99fee508245825765ff60155fed43f970ff83a8f upstream.
+
+caiaq driver doesn't kill the URB properly at its error path during
+the probe, which may lead to a use-after-free error later. This patch
+addresses it.
+
+Reported-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/caiaq/device.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/sound/usb/caiaq/device.c
++++ b/sound/usb/caiaq/device.c
+@@ -469,10 +469,12 @@ static int init_card(struct snd_usb_caia
+
+ err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
+ if (err)
+- return err;
++ goto err_kill_urb;
+
+- if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ))
+- return -ENODEV;
++ if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) {
++ err = -ENODEV;
++ goto err_kill_urb;
++ }
+
+ usb_string(usb_dev, usb_dev->descriptor.iManufacturer,
+ cdev->vendor_name, CAIAQ_USB_STR_LEN);
+@@ -507,6 +509,10 @@ static int init_card(struct snd_usb_caia
+
+ setup_card(cdev);
+ return 0;
++
++ err_kill_urb:
++ usb_kill_urb(&cdev->ep1_in_urb);
++ return err;
+ }
+
+ static int snd_probe(struct usb_interface *intf,
--- /dev/null
+From c95072b3d88fac4be295815f2b67df366c0c297f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 9 Oct 2017 14:51:23 +0200
+Subject: ALSA: line6: Fix leftover URB at error-path during probe
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c95072b3d88fac4be295815f2b67df366c0c297f upstream.
+
+While line6_probe() may kick off URB for a control MIDI endpoint, the
+function doesn't clean up it properly at its error path. This results
+in a leftover URB action that is eventually triggered later and causes
+an Oops like:
+ general protection fault: 0000 [#1] PREEMPT SMP KASAN
+ CPU: 1 PID: 0 Comm: swapper/1 Not tainted
+ RIP: 0010:usb_fill_bulk_urb ./include/linux/usb.h:1619
+ RIP: 0010:line6_start_listen+0x3fe/0x9e0 sound/usb/line6/driver.c:76
+ Call Trace:
+ <IRQ>
+ line6_data_received+0x1f7/0x470 sound/usb/line6/driver.c:326
+ __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
+ usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845
+ dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965
+ call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281
+ ....
+
+Since the whole clean-up procedure is done in line6_disconnect()
+callback, we can simply call it in the error path instead of
+open-coding the whole again. It'll fix such an issue automagically.
+
+The bug was spotted by syzkaller.
+
+Fixes: eedd0e95d355 ("ALSA: line6: Don't forget to call driver's destructor at error path")
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/line6/driver.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -586,9 +586,10 @@ int line6_probe(struct usb_interface *in
+ return 0;
+
+ error:
+- if (line6->disconnect)
+- line6->disconnect(line6);
+- snd_card_free(card);
++ /* we can call disconnect callback here because no close-sync is
++ * needed yet at this point
++ */
++ line6_disconnect(interface);
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(line6_probe);
--- /dev/null
+From 5803b023881857db32ffefa0d269c90280a67ee0 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 9 Oct 2017 10:02:56 +0200
+Subject: ALSA: seq: Fix copy_from_user() call inside lock
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 5803b023881857db32ffefa0d269c90280a67ee0 upstream.
+
+The event handler in the virmidi sequencer code takes a read-lock for
+the linked list traverse, while it's calling snd_seq_dump_var_event()
+in the loop. The latter function may expand the user-space data
+depending on the event type. It eventually invokes copy_from_user(),
+which might be a potential dead-lock.
+
+The sequencer core guarantees that the user-space data is passed only
+with atomic=0 argument, but snd_virmidi_dev_receive_event() ignores it
+and always takes read-lock(). For avoiding the problem above, this
+patch introduces rwsem for non-atomic case, while keeping rwlock for
+atomic case.
+
+Also while we're at it: the superfluous irq flags is dropped in
+snd_virmidi_input_open().
+
+Reported-by: Jia-Ju Bai <baijiaju1990@163.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/seq_virmidi.h | 1 +
+ sound/core/seq/seq_virmidi.c | 27 +++++++++++++++++++--------
+ 2 files changed, 20 insertions(+), 8 deletions(-)
+
+--- a/include/sound/seq_virmidi.h
++++ b/include/sound/seq_virmidi.h
+@@ -60,6 +60,7 @@ struct snd_virmidi_dev {
+ int port; /* created/attached port */
+ unsigned int flags; /* SNDRV_VIRMIDI_* */
+ rwlock_t filelist_lock;
++ struct rw_semaphore filelist_sem;
+ struct list_head filelist;
+ };
+
+--- a/sound/core/seq/seq_virmidi.c
++++ b/sound/core/seq/seq_virmidi.c
+@@ -77,13 +77,17 @@ static void snd_virmidi_init_event(struc
+ * decode input event and put to read buffer of each opened file
+ */
+ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
+- struct snd_seq_event *ev)
++ struct snd_seq_event *ev,
++ bool atomic)
+ {
+ struct snd_virmidi *vmidi;
+ unsigned char msg[4];
+ int len;
+
+- read_lock(&rdev->filelist_lock);
++ if (atomic)
++ read_lock(&rdev->filelist_lock);
++ else
++ down_read(&rdev->filelist_sem);
+ list_for_each_entry(vmidi, &rdev->filelist, list) {
+ if (!vmidi->trigger)
+ continue;
+@@ -97,7 +101,10 @@ static int snd_virmidi_dev_receive_event
+ snd_rawmidi_receive(vmidi->substream, msg, len);
+ }
+ }
+- read_unlock(&rdev->filelist_lock);
++ if (atomic)
++ read_unlock(&rdev->filelist_lock);
++ else
++ up_read(&rdev->filelist_sem);
+
+ return 0;
+ }
+@@ -115,7 +122,7 @@ int snd_virmidi_receive(struct snd_rawmi
+ struct snd_virmidi_dev *rdev;
+
+ rdev = rmidi->private_data;
+- return snd_virmidi_dev_receive_event(rdev, ev);
++ return snd_virmidi_dev_receive_event(rdev, ev, true);
+ }
+ #endif /* 0 */
+
+@@ -130,7 +137,7 @@ static int snd_virmidi_event_input(struc
+ rdev = private_data;
+ if (!(rdev->flags & SNDRV_VIRMIDI_USE))
+ return 0; /* ignored */
+- return snd_virmidi_dev_receive_event(rdev, ev);
++ return snd_virmidi_dev_receive_event(rdev, ev, atomic);
+ }
+
+ /*
+@@ -209,7 +216,6 @@ static int snd_virmidi_input_open(struct
+ struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
+ struct snd_rawmidi_runtime *runtime = substream->runtime;
+ struct snd_virmidi *vmidi;
+- unsigned long flags;
+
+ vmidi = kzalloc(sizeof(*vmidi), GFP_KERNEL);
+ if (vmidi == NULL)
+@@ -223,9 +229,11 @@ static int snd_virmidi_input_open(struct
+ vmidi->client = rdev->client;
+ vmidi->port = rdev->port;
+ runtime->private_data = vmidi;
+- write_lock_irqsave(&rdev->filelist_lock, flags);
++ down_write(&rdev->filelist_sem);
++ write_lock_irq(&rdev->filelist_lock);
+ list_add_tail(&vmidi->list, &rdev->filelist);
+- write_unlock_irqrestore(&rdev->filelist_lock, flags);
++ write_unlock_irq(&rdev->filelist_lock);
++ up_write(&rdev->filelist_sem);
+ vmidi->rdev = rdev;
+ return 0;
+ }
+@@ -264,9 +272,11 @@ static int snd_virmidi_input_close(struc
+ struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
+ struct snd_virmidi *vmidi = substream->runtime->private_data;
+
++ down_write(&rdev->filelist_sem);
+ write_lock_irq(&rdev->filelist_lock);
+ list_del(&vmidi->list);
+ write_unlock_irq(&rdev->filelist_lock);
++ up_write(&rdev->filelist_sem);
+ snd_midi_event_free(vmidi->parser);
+ substream->runtime->private_data = NULL;
+ kfree(vmidi);
+@@ -520,6 +530,7 @@ int snd_virmidi_new(struct snd_card *car
+ rdev->rmidi = rmidi;
+ rdev->device = device;
+ rdev->client = -1;
++ init_rwsem(&rdev->filelist_sem);
+ rwlock_init(&rdev->filelist_lock);
+ INIT_LIST_HEAD(&rdev->filelist);
+ rdev->seq_mode = SNDRV_VIRMIDI_SEQ_DISPATCH;
--- /dev/null
+From 71105998845fb012937332fe2e806d443c09e026 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 9 Oct 2017 11:09:20 +0200
+Subject: ALSA: seq: Fix use-after-free at creating a port
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 71105998845fb012937332fe2e806d443c09e026 upstream.
+
+There is a potential race window opened at creating and deleting a
+port via ioctl, as spotted by fuzzing. snd_seq_create_port() creates
+a port object and returns its pointer, but it doesn't take the
+refcount, thus it can be deleted immediately by another thread.
+Meanwhile, snd_seq_ioctl_create_port() still calls the function
+snd_seq_system_client_ev_port_start() with the created port object
+that is being deleted, and this triggers use-after-free like:
+
+ BUG: KASAN: use-after-free in snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] at addr ffff8801f2241cb1
+ =============================================================================
+ BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected
+ -----------------------------------------------------------------------------
+ INFO: Allocated in snd_seq_create_port+0x94/0x9b0 [snd_seq] age=1 cpu=3 pid=4511
+ ___slab_alloc+0x425/0x460
+ __slab_alloc+0x20/0x40
+ kmem_cache_alloc_trace+0x150/0x190
+ snd_seq_create_port+0x94/0x9b0 [snd_seq]
+ snd_seq_ioctl_create_port+0xd1/0x630 [snd_seq]
+ snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
+ snd_seq_ioctl+0x40/0x80 [snd_seq]
+ do_vfs_ioctl+0x54b/0xda0
+ SyS_ioctl+0x79/0x90
+ entry_SYSCALL_64_fastpath+0x16/0x75
+ INFO: Freed in port_delete+0x136/0x1a0 [snd_seq] age=1 cpu=2 pid=4717
+ __slab_free+0x204/0x310
+ kfree+0x15f/0x180
+ port_delete+0x136/0x1a0 [snd_seq]
+ snd_seq_delete_port+0x235/0x350 [snd_seq]
+ snd_seq_ioctl_delete_port+0xc8/0x180 [snd_seq]
+ snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
+ snd_seq_ioctl+0x40/0x80 [snd_seq]
+ do_vfs_ioctl+0x54b/0xda0
+ SyS_ioctl+0x79/0x90
+ entry_SYSCALL_64_fastpath+0x16/0x75
+ Call Trace:
+ [<ffffffff81b03781>] dump_stack+0x63/0x82
+ [<ffffffff81531b3b>] print_trailer+0xfb/0x160
+ [<ffffffff81536db4>] object_err+0x34/0x40
+ [<ffffffff815392d3>] kasan_report.part.2+0x223/0x520
+ [<ffffffffa07aadf4>] ? snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]
+ [<ffffffff815395fe>] __asan_report_load1_noabort+0x2e/0x30
+ [<ffffffffa07aadf4>] snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]
+ [<ffffffffa07aa8f0>] ? snd_seq_ioctl_delete_port+0x180/0x180 [snd_seq]
+ [<ffffffff8136be50>] ? taskstats_exit+0xbc0/0xbc0
+ [<ffffffffa07abc5c>] snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
+ [<ffffffffa07abd10>] snd_seq_ioctl+0x40/0x80 [snd_seq]
+ [<ffffffff8136d433>] ? acct_account_cputime+0x63/0x80
+ [<ffffffff815b515b>] do_vfs_ioctl+0x54b/0xda0
+ .....
+
+We may fix this in a few different ways, and in this patch, it's fixed
+simply by taking the refcount properly at snd_seq_create_port() and
+letting the caller unref the object after use. Also, there is another
+potential use-after-free by sprintf() call in snd_seq_create_port(),
+and this is moved inside the lock.
+
+This fix covers CVE-2017-15265.
+
+Reported-and-tested-by: Michael23 Yu <ycqzsy@gmail.com>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/seq_clientmgr.c | 6 +++++-
+ sound/core/seq/seq_ports.c | 7 +++++--
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1260,6 +1260,7 @@ static int snd_seq_ioctl_create_port(str
+ struct snd_seq_client_port *port;
+ struct snd_seq_port_info info;
+ struct snd_seq_port_callback *callback;
++ int port_idx;
+
+ if (copy_from_user(&info, arg, sizeof(info)))
+ return -EFAULT;
+@@ -1273,7 +1274,9 @@ static int snd_seq_ioctl_create_port(str
+ return -ENOMEM;
+
+ if (client->type == USER_CLIENT && info.kernel) {
+- snd_seq_delete_port(client, port->addr.port);
++ port_idx = port->addr.port;
++ snd_seq_port_unlock(port);
++ snd_seq_delete_port(client, port_idx);
+ return -EINVAL;
+ }
+ if (client->type == KERNEL_CLIENT) {
+@@ -1294,6 +1297,7 @@ static int snd_seq_ioctl_create_port(str
+
+ snd_seq_set_port_info(port, &info);
+ snd_seq_system_client_ev_port_start(port->addr.client, port->addr.port);
++ snd_seq_port_unlock(port);
+
+ if (copy_to_user(arg, &info, sizeof(info)))
+ return -EFAULT;
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -122,7 +122,9 @@ static void port_subs_info_init(struct s
+ }
+
+
+-/* create a port, port number is returned (-1 on failure) */
++/* create a port, port number is returned (-1 on failure);
++ * the caller needs to unref the port via snd_seq_port_unlock() appropriately
++ */
+ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
+ int port)
+ {
+@@ -151,6 +153,7 @@ struct snd_seq_client_port *snd_seq_crea
+ snd_use_lock_init(&new_port->use_lock);
+ port_subs_info_init(&new_port->c_src);
+ port_subs_info_init(&new_port->c_dest);
++ snd_use_lock_use(&new_port->use_lock);
+
+ num = port >= 0 ? port : 0;
+ mutex_lock(&client->ports_mutex);
+@@ -165,9 +168,9 @@ struct snd_seq_client_port *snd_seq_crea
+ list_add_tail(&new_port->list, &p->list);
+ client->num_ports++;
+ new_port->addr.port = num; /* store the port number in the port */
++ sprintf(new_port->name, "port-%d", num);
+ write_unlock_irqrestore(&client->ports_lock, flags);
+ mutex_unlock(&client->ports_mutex);
+- sprintf(new_port->name, "port-%d", num);
+
+ return new_port;
+ }
--- /dev/null
+From 124751d5e63c823092060074bd0abaae61aaa9c4 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Oct 2017 14:10:32 +0200
+Subject: ALSA: usb-audio: Kill stray URB at exiting
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 124751d5e63c823092060074bd0abaae61aaa9c4 upstream.
+
+USB-audio driver may leave a stray URB for the mixer interrupt when it
+exits by some error during probe. This leads to a use-after-free
+error as spotted by syzkaller like:
+ ==================================================================
+ BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0
+ Call Trace:
+ <IRQ>
+ __dump_stack lib/dump_stack.c:16
+ dump_stack+0x292/0x395 lib/dump_stack.c:52
+ print_address_description+0x78/0x280 mm/kasan/report.c:252
+ kasan_report_error mm/kasan/report.c:351
+ kasan_report+0x23d/0x350 mm/kasan/report.c:409
+ __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430
+ snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490
+ __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
+ ....
+
+ Allocated by task 1484:
+ save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
+ save_stack+0x43/0xd0 mm/kasan/kasan.c:447
+ set_track mm/kasan/kasan.c:459
+ kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
+ kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772
+ kmalloc ./include/linux/slab.h:493
+ kzalloc ./include/linux/slab.h:666
+ snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540
+ create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516
+ snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560
+ create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59
+ snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560
+ usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618
+ ....
+
+ Freed by task 1484:
+ save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
+ save_stack+0x43/0xd0 mm/kasan/kasan.c:447
+ set_track mm/kasan/kasan.c:459
+ kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524
+ slab_free_hook mm/slub.c:1390
+ slab_free_freelist_hook mm/slub.c:1412
+ slab_free mm/slub.c:2988
+ kfree+0xf6/0x2f0 mm/slub.c:3919
+ snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244
+ snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250
+ __snd_device_free+0x1ff/0x380 sound/core/device.c:91
+ snd_device_free_all+0x8f/0xe0 sound/core/device.c:244
+ snd_card_do_free sound/core/init.c:461
+ release_card_device+0x47/0x170 sound/core/init.c:181
+ device_release+0x13f/0x210 drivers/base/core.c:814
+ ....
+
+Actually such a URB is killed properly at disconnection when the
+device gets probed successfully, and what we need is to apply it for
+the error-path, too.
+
+In this patch, we apply snd_usb_mixer_disconnect() at releasing.
+Also introduce a new flag, disconnected, to struct usb_mixer_interface
+for not performing the disconnection procedure twice.
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer.c | 12 ++++++++++--
+ sound/usb/mixer.h | 2 ++
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2161,6 +2161,9 @@ static int parse_audio_unit(struct mixer
+
+ static void snd_usb_mixer_free(struct usb_mixer_interface *mixer)
+ {
++ /* kill pending URBs */
++ snd_usb_mixer_disconnect(mixer);
++
+ kfree(mixer->id_elems);
+ if (mixer->urb) {
+ kfree(mixer->urb->transfer_buffer);
+@@ -2504,8 +2507,13 @@ _error:
+
+ void snd_usb_mixer_disconnect(struct usb_mixer_interface *mixer)
+ {
+- usb_kill_urb(mixer->urb);
+- usb_kill_urb(mixer->rc_urb);
++ if (mixer->disconnected)
++ return;
++ if (mixer->urb)
++ usb_kill_urb(mixer->urb);
++ if (mixer->rc_urb)
++ usb_kill_urb(mixer->rc_urb);
++ mixer->disconnected = true;
+ }
+
+ #ifdef CONFIG_PM
+--- a/sound/usb/mixer.h
++++ b/sound/usb/mixer.h
+@@ -22,6 +22,8 @@ struct usb_mixer_interface {
+ struct urb *rc_urb;
+ struct usb_ctrlrequest *rc_setup_packet;
+ u8 rc_buffer[6];
++
++ bool disconnected;
+ };
+
+ #define MAX_CHANNELS 16 /* max logical channels */
--- /dev/null
+From b61907bb42409adf9b3120f741af7c57dd7e3db2 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Mon, 9 Oct 2017 23:30:02 +0800
+Subject: crypto: shash - Fix zero-length shash ahash digest crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+commit b61907bb42409adf9b3120f741af7c57dd7e3db2 upstream.
+
+The shash ahash digest adaptor function may crash if given a
+zero-length input together with a null SG list. This is because
+it tries to read the SG list before looking at the length.
+
+This patch fixes it by checking the length first.
+
+Reported-by: Stephan Müller<smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Tested-by: Stephan Müller <smueller@chronox.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/shash.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/crypto/shash.c
++++ b/crypto/shash.c
+@@ -274,12 +274,14 @@ static int shash_async_finup(struct ahas
+
+ int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc)
+ {
+- struct scatterlist *sg = req->src;
+- unsigned int offset = sg->offset;
+ unsigned int nbytes = req->nbytes;
++ struct scatterlist *sg;
++ unsigned int offset;
+ int err;
+
+- if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) {
++ if (nbytes &&
++ (sg = req->src, offset = sg->offset,
++ nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset))) {
+ void *data;
+
+ data = kmap_atomic(sg_page(sg));
--- /dev/null
+From 899f0429c7d3eed886406cd72182bee3b96aa1f9 Mon Sep 17 00:00:00 2001
+From: Andreas Gruenbacher <agruenba@redhat.com>
+Date: Mon, 9 Oct 2017 11:13:18 +0200
+Subject: direct-io: Prevent NULL pointer access in submit_page_section
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+commit 899f0429c7d3eed886406cd72182bee3b96aa1f9 upstream.
+
+In the code added to function submit_page_section by commit b1058b981,
+sdio->bio can currently be NULL when calling dio_bio_submit. This then
+leads to a NULL pointer access in dio_bio_submit, so check for a NULL
+bio in submit_page_section before trying to submit it instead.
+
+Fixes xfstest generic/250 on gfs2.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/direct-io.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/direct-io.c
++++ b/fs/direct-io.c
+@@ -823,7 +823,8 @@ out:
+ */
+ if (sdio->boundary) {
+ ret = dio_send_cur_page(dio, sdio, map_bh);
+- dio_bio_submit(dio, sdio);
++ if (sdio->bio)
++ dio_bio_submit(dio, sdio);
+ page_cache_release(sdio->cur_page);
+ sdio->cur_page = NULL;
+ }
--- /dev/null
+From 87a2f622cc6446c7d09ac655b7b9b04886f16a4c Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Mon, 18 Sep 2017 11:16:26 +0300
+Subject: dmaengine: edma: Align the memcpy acnt array size with the transfer
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit 87a2f622cc6446c7d09ac655b7b9b04886f16a4c upstream.
+
+Memory to Memory transfers does not have any special alignment needs
+regarding to acnt array size, but if one of the areas are in memory mapped
+regions (like PCIe memory), we need to make sure that the acnt array size
+is aligned with the mem copy parameters.
+
+Before "dmaengine: edma: Optimize memcpy operation" change the memcpy was set
+up in a different way: acnt == number of bytes in a word based on
+__ffs((src | dest | len), bcnt and ccnt for looping the necessary number of
+words to comlete the trasnfer.
+
+Instead of reverting the commit we can fix it to make sure that the ACNT size
+is aligned to the traswnfer.
+
+Fixes: df6694f80365a (dmaengine: edma: Optimize memcpy operation)
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/edma.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/dma/edma.c
++++ b/drivers/dma/edma.c
+@@ -1126,11 +1126,24 @@ static struct dma_async_tx_descriptor *e
+ struct edma_desc *edesc;
+ struct device *dev = chan->device->dev;
+ struct edma_chan *echan = to_edma_chan(chan);
+- unsigned int width, pset_len;
++ unsigned int width, pset_len, array_size;
+
+ if (unlikely(!echan || !len))
+ return NULL;
+
++ /* Align the array size (acnt block) with the transfer properties */
++ switch (__ffs((src | dest | len))) {
++ case 0:
++ array_size = SZ_32K - 1;
++ break;
++ case 1:
++ array_size = SZ_32K - 2;
++ break;
++ default:
++ array_size = SZ_32K - 4;
++ break;
++ }
++
+ if (len < SZ_64K) {
+ /*
+ * Transfer size less than 64K can be handled with one paRAM
+@@ -1152,7 +1165,7 @@ static struct dma_async_tx_descriptor *e
+ * When the full_length is multibple of 32767 one slot can be
+ * used to complete the transfer.
+ */
+- width = SZ_32K - 1;
++ width = array_size;
+ pset_len = rounddown(len, width);
+ /* One slot is enough for lengths multiple of (SZ_32K -1) */
+ if (unlikely(pset_len == len))
+@@ -1202,7 +1215,7 @@ static struct dma_async_tx_descriptor *e
+ }
+ dest += pset_len;
+ src += pset_len;
+- pset_len = width = len % (SZ_32K - 1);
++ pset_len = width = len % array_size;
+
+ ret = edma_config_pset(chan, &edesc->pset[1], src, dest, 1,
+ width, pset_len, DMA_MEM_TO_MEM);
--- /dev/null
+From 95d78c28b5a85bacbc29b8dba7c04babb9b0d467 Mon Sep 17 00:00:00 2001
+From: Vitaly Mayatskikh <v.mayatskih@gmail.com>
+Date: Fri, 22 Sep 2017 01:18:39 -0400
+Subject: fix unbalanced page refcounting in bio_map_user_iov
+
+From: Vitaly Mayatskikh <v.mayatskih@gmail.com>
+
+commit 95d78c28b5a85bacbc29b8dba7c04babb9b0d467 upstream.
+
+bio_map_user_iov and bio_unmap_user do unbalanced pages refcounting if
+IO vector has small consecutive buffers belonging to the same page.
+bio_add_pc_page merges them into one, but the page reference is never
+dropped.
+
+Signed-off-by: Vitaly Mayatskikh <v.mayatskih@gmail.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/bio.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1320,6 +1320,7 @@ struct bio *bio_map_user_iov(struct requ
+ offset = uaddr & ~PAGE_MASK;
+ for (j = cur_page; j < page_limit; j++) {
+ unsigned int bytes = PAGE_SIZE - offset;
++ unsigned short prev_bi_vcnt = bio->bi_vcnt;
+
+ if (len <= 0)
+ break;
+@@ -1334,6 +1335,13 @@ struct bio *bio_map_user_iov(struct requ
+ bytes)
+ break;
+
++ /*
++ * check if vector was merged with previous
++ * drop page reference if needed
++ */
++ if (bio->bi_vcnt == prev_bi_vcnt)
++ put_page(pages[j]);
++
+ len -= bytes;
+ offset = 0;
+ }
--- /dev/null
+From f043bfc98c193c284e2cd768fefabe18ac2fed9b Mon Sep 17 00:00:00 2001
+From: Jaejoong Kim <climbbb.kim@gmail.com>
+Date: Thu, 28 Sep 2017 19:16:30 +0900
+Subject: HID: usbhid: fix out-of-bounds bug
+
+From: Jaejoong Kim <climbbb.kim@gmail.com>
+
+commit f043bfc98c193c284e2cd768fefabe18ac2fed9b upstream.
+
+The hid descriptor identifies the length and type of subordinate
+descriptors for a device. If the received hid descriptor is smaller than
+the size of the struct hid_descriptor, it is possible to cause
+out-of-bounds.
+
+In addition, if bNumDescriptors of the hid descriptor have an incorrect
+value, this can also cause out-of-bounds while approaching hdesc->desc[n].
+
+So check the size of hid descriptor and bNumDescriptors.
+
+ BUG: KASAN: slab-out-of-bounds in usbhid_parse+0x9b1/0xa20
+ Read of size 1 at addr ffff88006c5f8edf by task kworker/1:2/1261
+
+ CPU: 1 PID: 1261 Comm: kworker/1:2 Not tainted
+ 4.14.0-rc1-42251-gebb2c2437d80 #169
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
+ Workqueue: usb_hub_wq hub_event
+ Call Trace:
+ __dump_stack lib/dump_stack.c:16
+ dump_stack+0x292/0x395 lib/dump_stack.c:52
+ print_address_description+0x78/0x280 mm/kasan/report.c:252
+ kasan_report_error mm/kasan/report.c:351
+ kasan_report+0x22f/0x340 mm/kasan/report.c:409
+ __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427
+ usbhid_parse+0x9b1/0xa20 drivers/hid/usbhid/hid-core.c:1004
+ hid_add_device+0x16b/0xb30 drivers/hid/hid-core.c:2944
+ usbhid_probe+0xc28/0x1100 drivers/hid/usbhid/hid-core.c:1369
+ usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
+ really_probe drivers/base/dd.c:413
+ driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
+ __device_attach_driver+0x230/0x290 drivers/base/dd.c:653
+ bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
+ __device_attach+0x26e/0x3d0 drivers/base/dd.c:710
+ device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
+ bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
+ device_add+0xd0b/0x1660 drivers/base/core.c:1835
+ usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932
+ generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
+ usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
+ really_probe drivers/base/dd.c:413
+ driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
+ __device_attach_driver+0x230/0x290 drivers/base/dd.c:653
+ bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
+ __device_attach+0x26e/0x3d0 drivers/base/dd.c:710
+ device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
+ bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
+ device_add+0xd0b/0x1660 drivers/base/core.c:1835
+ usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
+ hub_port_connect drivers/usb/core/hub.c:4903
+ hub_port_connect_change drivers/usb/core/hub.c:5009
+ port_event drivers/usb/core/hub.c:5115
+ hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195
+ process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119
+ worker_thread+0x221/0x1850 kernel/workqueue.c:2253
+ kthread+0x3a1/0x470 kernel/kthread.c:231
+ ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/usbhid/hid-core.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -971,6 +971,8 @@ static int usbhid_parse(struct hid_devic
+ unsigned int rsize = 0;
+ char *rdesc;
+ int ret, n;
++ int num_descriptors;
++ size_t offset = offsetof(struct hid_descriptor, desc);
+
+ quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor),
+ le16_to_cpu(dev->descriptor.idProduct));
+@@ -993,10 +995,18 @@ static int usbhid_parse(struct hid_devic
+ return -ENODEV;
+ }
+
++ if (hdesc->bLength < sizeof(struct hid_descriptor)) {
++ dbg_hid("hid descriptor is too short\n");
++ return -EINVAL;
++ }
++
+ hid->version = le16_to_cpu(hdesc->bcdHID);
+ hid->country = hdesc->bCountryCode;
+
+- for (n = 0; n < hdesc->bNumDescriptors; n++)
++ num_descriptors = min_t(int, hdesc->bNumDescriptors,
++ (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
++
++ for (n = 0; n < num_descriptors; n++)
+ if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
+ rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
+
--- /dev/null
+From ce76353f169a6471542d999baf3d29b121dce9c0 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <jroedel@suse.de>
+Date: Fri, 13 Oct 2017 14:32:37 +0200
+Subject: iommu/amd: Finish TLB flush in amd_iommu_unmap()
+
+From: Joerg Roedel <jroedel@suse.de>
+
+commit ce76353f169a6471542d999baf3d29b121dce9c0 upstream.
+
+The function only sends the flush command to the IOMMU(s),
+but does not wait for its completion when it returns. Fix
+that.
+
+Fixes: 601367d76bd1 ('x86/amd-iommu: Remove iommu_flush_domain function')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3096,6 +3096,7 @@ static size_t amd_iommu_unmap(struct iom
+ mutex_unlock(&domain->api_lock);
+
+ domain_flush_tlb_pde(domain);
++ domain_flush_complete(domain);
+
+ return unmap_size;
+ }
--- /dev/null
+From 8eb3f87d903168bdbd1222776a6b1e281f50513e Mon Sep 17 00:00:00 2001
+From: Haozhong Zhang <haozhong.zhang@intel.com>
+Date: Tue, 10 Oct 2017 15:01:22 +0800
+Subject: KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit
+
+From: Haozhong Zhang <haozhong.zhang@intel.com>
+
+commit 8eb3f87d903168bdbd1222776a6b1e281f50513e upstream.
+
+When KVM emulates an exit from L2 to L1, it loads L1 CR4 into the
+guest CR4. Before this CR4 loading, the guest CR4 refers to L2
+CR4. Because these two CR4's are in different levels of guest, we
+should vmx_set_cr4() rather than kvm_set_cr4() here. The latter, which
+is used to handle guest writes to its CR4, checks the guest change to
+CR4 and may fail if the change is invalid.
+
+The failure may cause trouble. Consider we start
+ a L1 guest with non-zero L1 PCID in use,
+ (i.e. L1 CR4.PCIDE == 1 && L1 CR3.PCID != 0)
+and
+ a L2 guest with L2 PCID disabled,
+ (i.e. L2 CR4.PCIDE == 0)
+and following events may happen:
+
+1. If kvm_set_cr4() is used in load_vmcs12_host_state() to load L1 CR4
+ into guest CR4 (in VMCS01) for L2 to L1 exit, it will fail because
+ of PCID check. As a result, the guest CR4 recorded in L0 KVM (i.e.
+ vcpu->arch.cr4) is left to the value of L2 CR4.
+
+2. Later, if L1 attempts to change its CR4, e.g., clearing VMXE bit,
+ kvm_set_cr4() in L0 KVM will think L1 also wants to enable PCID,
+ because the wrong L2 CR4 is used by L0 KVM as L1 CR4. As L1
+ CR3.PCID != 0, L0 KVM will inject GP to L1 guest.
+
+Fixes: 4704d0befb072 ("KVM: nVMX: Exiting from L2 to L1")
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Haozhong Zhang <haozhong.zhang@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/vmx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10369,7 +10369,7 @@ static void load_vmcs12_host_state(struc
+ * (KVM doesn't change it)- no reason to call set_cr4_guest_host_mask();
+ */
+ vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
+- kvm_set_cr4(vcpu, vmcs12->host_cr4);
++ vmx_set_cr4(vcpu, vmcs12->host_cr4);
+
+ nested_ept_uninit_mmu_context(vcpu);
+
--- /dev/null
+From ca8eb05b5f332a9e1ab3e2ece498d49f4d683470 Mon Sep 17 00:00:00 2001
+From: Paul Burton <paul.burton@imgtec.com>
+Date: Fri, 8 Sep 2017 15:12:21 -0700
+Subject: MIPS: math-emu: Remove pr_err() calls from fpu_emu()
+
+From: Paul Burton <paul.burton@imgtec.com>
+
+commit ca8eb05b5f332a9e1ab3e2ece498d49f4d683470 upstream.
+
+The FPU emulator includes 2 calls to pr_err() which are triggered by
+invalid instruction encodings for MIPSr6 cmp.cond.fmt instructions.
+These cases are not kernel errors, merely invalid instructions which are
+already handled by delivering a SIGILL which will provide notification
+that something failed in cases where that makes sense.
+
+In cases where that SIGILL is somewhat expected & being handled, for
+example when crashme happens to generate one of the affected bad
+encodings, the message is printed with no useful context about what
+triggered it & spams the kernel log for no good reason.
+
+Remove the pr_err() calls to make crashme run silently & treat the bad
+encodings the same way we do others, with a SIGILL & no further kernel
+log output.
+
+Signed-off-by: Paul Burton <paul.burton@imgtec.com>
+Fixes: f8c3c6717a71 ("MIPS: math-emu: Add support for the CMP.condn.fmt R6 instruction")
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/17253/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/math-emu/cp1emu.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -2360,7 +2360,6 @@ dcopuop:
+ break;
+ default:
+ /* Reserved R6 ops */
+- pr_err("Reserved MIPS R6 CMP.condn.S operation\n");
+ return SIGILL;
+ }
+ }
+@@ -2434,7 +2433,6 @@ dcopuop:
+ break;
+ default:
+ /* Reserved R6 ops */
+- pr_err("Reserved MIPS R6 CMP.condn.D operation\n");
+ return SIGILL;
+ }
+ }
nl80211-define-policy-for-packet-pattern-attributes.patch
iwlwifi-mvm-use-iwl_hcmd_nocopy-for-mcast_filter_cmd.patch
rcu-allow-for-page-faults-in-nmi-handlers.patch
+usb-dummy-hcd-fix-deadlock-caused-by-disconnect-detection.patch
+mips-math-emu-remove-pr_err-calls-from-fpu_emu.patch
+dmaengine-edma-align-the-memcpy-acnt-array-size-with-the-transfer.patch
+hid-usbhid-fix-out-of-bounds-bug.patch
+crypto-shash-fix-zero-length-shash-ahash-digest-crash.patch
+kvm-nvmx-fix-guest-cr4-loading-when-emulating-l2-to-l1-exit.patch
+usb-renesas_usbhs-fix-dmac-sequence-for-receiving-zero-length-packet.patch
+iommu-amd-finish-tlb-flush-in-amd_iommu_unmap.patch
+alsa-usb-audio-kill-stray-urb-at-exiting.patch
+alsa-seq-fix-use-after-free-at-creating-a-port.patch
+alsa-seq-fix-copy_from_user-call-inside-lock.patch
+alsa-caiaq-fix-stray-urb-at-probe-error-path.patch
+alsa-line6-fix-leftover-urb-at-error-path-during-probe.patch
+usb-gadget-composite-fix-use-after-free-in-usb_composite_overwrite_options.patch
+direct-io-prevent-null-pointer-access-in-submit_page_section.patch
+fix-unbalanced-page-refcounting-in-bio_map_user_iov.patch
+usb-serial-ftdi_sio-add-id-for-cypress-wiced-dev-board.patch
+usb-serial-cp210x-add-support-for-elv-tfd500.patch
+usb-serial-option-add-support-for-tp-link-lte-module.patch
+usb-serial-qcserial-add-dell-dw5818-dw5819.patch
+usb-serial-console-fix-use-after-free-after-failed-setup.patch
--- /dev/null
+From ab219221a5064abfff9f78c323c4a257b16cdb81 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 6 Oct 2017 10:27:44 -0400
+Subject: USB: dummy-hcd: Fix deadlock caused by disconnect detection
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit ab219221a5064abfff9f78c323c4a257b16cdb81 upstream.
+
+The dummy-hcd driver calls the gadget driver's disconnect callback
+under the wrong conditions. It should invoke the callback when Vbus
+power is turned off, but instead it does so when the D+ pullup is
+turned off.
+
+This can cause a deadlock in the composite core when a gadget driver
+is unregistered:
+
+[ 88.361471] ============================================
+[ 88.362014] WARNING: possible recursive locking detected
+[ 88.362580] 4.14.0-rc2+ #9 Not tainted
+[ 88.363010] --------------------------------------------
+[ 88.363561] v4l_id/526 is trying to acquire lock:
+[ 88.364062] (&(&cdev->lock)->rlock){....}, at: [<ffffffffa0547e03>] composite_disconnect+0x43/0x100 [libcomposite]
+[ 88.365051]
+[ 88.365051] but task is already holding lock:
+[ 88.365826] (&(&cdev->lock)->rlock){....}, at: [<ffffffffa0547b09>] usb_function_deactivate+0x29/0x80 [libcomposite]
+[ 88.366858]
+[ 88.366858] other info that might help us debug this:
+[ 88.368301] Possible unsafe locking scenario:
+[ 88.368301]
+[ 88.369304] CPU0
+[ 88.369701] ----
+[ 88.370101] lock(&(&cdev->lock)->rlock);
+[ 88.370623] lock(&(&cdev->lock)->rlock);
+[ 88.371145]
+[ 88.371145] *** DEADLOCK ***
+[ 88.371145]
+[ 88.372211] May be due to missing lock nesting notation
+[ 88.372211]
+[ 88.373191] 2 locks held by v4l_id/526:
+[ 88.373715] #0: (&(&cdev->lock)->rlock){....}, at: [<ffffffffa0547b09>] usb_function_deactivate+0x29/0x80 [libcomposite]
+[ 88.374814] #1: (&(&dum_hcd->dum->lock)->rlock){....}, at: [<ffffffffa05bd48d>] dummy_pullup+0x7d/0xf0 [dummy_hcd]
+[ 88.376289]
+[ 88.376289] stack backtrace:
+[ 88.377726] CPU: 0 PID: 526 Comm: v4l_id Not tainted 4.14.0-rc2+ #9
+[ 88.378557] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
+[ 88.379504] Call Trace:
+[ 88.380019] dump_stack+0x86/0xc7
+[ 88.380605] __lock_acquire+0x841/0x1120
+[ 88.381252] lock_acquire+0xd5/0x1c0
+[ 88.381865] ? composite_disconnect+0x43/0x100 [libcomposite]
+[ 88.382668] _raw_spin_lock_irqsave+0x40/0x54
+[ 88.383357] ? composite_disconnect+0x43/0x100 [libcomposite]
+[ 88.384290] composite_disconnect+0x43/0x100 [libcomposite]
+[ 88.385490] set_link_state+0x2d4/0x3c0 [dummy_hcd]
+[ 88.386436] dummy_pullup+0xa7/0xf0 [dummy_hcd]
+[ 88.387195] usb_gadget_disconnect+0xd8/0x160 [udc_core]
+[ 88.387990] usb_gadget_deactivate+0xd3/0x160 [udc_core]
+[ 88.388793] usb_function_deactivate+0x64/0x80 [libcomposite]
+[ 88.389628] uvc_function_disconnect+0x1e/0x40 [usb_f_uvc]
+
+This patch changes the code to test the port-power status bit rather
+than the port-connect status bit when deciding whether to isue the
+callback.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: David Tulloh <david@tulloh.id.au>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/dummy_hcd.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -420,6 +420,7 @@ static void set_link_state_by_speed(stru
+ static void set_link_state(struct dummy_hcd *dum_hcd)
+ {
+ struct dummy *dum = dum_hcd->dum;
++ unsigned int power_bit;
+
+ dum_hcd->active = 0;
+ if (dum->pullup)
+@@ -430,17 +431,19 @@ static void set_link_state(struct dummy_
+ return;
+
+ set_link_state_by_speed(dum_hcd);
++ power_bit = (dummy_hcd_to_hcd(dum_hcd)->speed == HCD_USB3 ?
++ USB_SS_PORT_STAT_POWER : USB_PORT_STAT_POWER);
+
+ if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) == 0 ||
+ dum_hcd->active)
+ dum_hcd->resuming = 0;
+
+ /* Currently !connected or in reset */
+- if ((dum_hcd->port_status & USB_PORT_STAT_CONNECTION) == 0 ||
++ if ((dum_hcd->port_status & power_bit) == 0 ||
+ (dum_hcd->port_status & USB_PORT_STAT_RESET) != 0) {
+- unsigned disconnect = USB_PORT_STAT_CONNECTION &
++ unsigned int disconnect = power_bit &
+ dum_hcd->old_status & (~dum_hcd->port_status);
+- unsigned reset = USB_PORT_STAT_RESET &
++ unsigned int reset = USB_PORT_STAT_RESET &
+ (~dum_hcd->old_status) & dum_hcd->port_status;
+
+ /* Report reset and disconnect events to the driver */
--- /dev/null
+From aec17e1e249567e82b26dafbb86de7d07fde8729 Mon Sep 17 00:00:00 2001
+From: Andrew Gabbasov <andrew_gabbasov@mentor.com>
+Date: Sat, 30 Sep 2017 08:55:55 -0700
+Subject: usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options
+
+From: Andrew Gabbasov <andrew_gabbasov@mentor.com>
+
+commit aec17e1e249567e82b26dafbb86de7d07fde8729 upstream.
+
+KASAN enabled configuration reports an error
+
+ BUG: KASAN: use-after-free in usb_composite_overwrite_options+...
+ [libcomposite] at addr ...
+ Read of size 1 by task ...
+
+when some driver is un-bound and then bound again.
+For example, this happens with FunctionFS driver when "ffs-test"
+test application is run several times in a row.
+
+If the driver has empty manufacturer ID string in initial static data,
+it is then replaced with generated string. After driver unbinding
+the generated string is freed, but the driver data still keep that
+pointer. And if the driver is then bound again, that pointer
+is re-used for string emptiness check.
+
+The fix is to clean up the driver string data upon its unbinding
+to drop the pointer to freed memory.
+
+Fixes: cc2683c318a5 ("usb: gadget: Provide a default implementation of default manufacturer string")
+Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/composite.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1905,6 +1905,8 @@ static DEVICE_ATTR_RO(suspended);
+ static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)
+ {
+ struct usb_composite_dev *cdev = get_gadget_data(gadget);
++ struct usb_gadget_strings *gstr = cdev->driver->strings[0];
++ struct usb_string *dev_str = gstr->strings;
+
+ /* composite_disconnect() must already have been called
+ * by the underlying peripheral controller driver!
+@@ -1924,6 +1926,9 @@ static void __composite_unbind(struct us
+
+ composite_dev_cleanup(cdev);
+
++ if (dev_str[USB_GADGET_MANUFACTURER_IDX].s == cdev->def_manufacturer)
++ dev_str[USB_GADGET_MANUFACTURER_IDX].s = "";
++
+ kfree(cdev->def_manufacturer);
+ kfree(cdev);
+ set_gadget_data(gadget, NULL);
--- /dev/null
+From 29c7f3e68eec4ae94d85ad7b5dfdafdb8089f513 Mon Sep 17 00:00:00 2001
+From: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
+Date: Mon, 2 Oct 2017 14:01:41 +0900
+Subject: usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
+
+From: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
+
+commit 29c7f3e68eec4ae94d85ad7b5dfdafdb8089f513 upstream.
+
+The DREQE bit of the DnFIFOSEL should be set to 1 after the DE bit of
+USB-DMAC on R-Car SoCs is set to 1 after the USB-DMAC received a
+zero-length packet. Otherwise, a transfer completion interruption
+of USB-DMAC doesn't happen. Even if the driver changes the sequence,
+normal operations (transmit/receive without zero-length packet) will
+not cause any side-effects. So, this patch fixes the sequence anyway.
+
+Signed-off-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
+[shimoda: revise the commit log]
+Fixes: e73a9891b3a1 ("usb: renesas_usbhs: add DMAEngine support")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/renesas_usbhs/fifo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -858,9 +858,9 @@ static void xfer_work(struct work_struct
+ fifo->name, usbhs_pipe_number(pipe), pkt->length, pkt->zero);
+
+ usbhs_pipe_running(pipe, 1);
+- usbhsf_dma_start(pipe, fifo);
+ usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans);
+ dma_async_issue_pending(chan);
++ usbhsf_dma_start(pipe, fifo);
+ usbhs_pipe_enable(pipe);
+
+ xfer_work_end:
--- /dev/null
+From 299d7572e46f98534033a9e65973f13ad1ce9047 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 4 Oct 2017 11:01:13 +0200
+Subject: USB: serial: console: fix use-after-free after failed setup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 299d7572e46f98534033a9e65973f13ad1ce9047 upstream.
+
+Make sure to reset the USB-console port pointer when console setup fails
+in order to avoid having the struct usb_serial be prematurely freed by
+the console code when the device is later disconnected.
+
+Fixes: 73e487fdb75f ("[PATCH] USB console: fix disconnection issues")
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/console.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/console.c
++++ b/drivers/usb/serial/console.c
+@@ -189,6 +189,7 @@ static int usb_console_setup(struct cons
+ tty_kref_put(tty);
+ reset_open_count:
+ port->port.count = 0;
++ info->port = NULL;
+ usb_autopm_put_interface(serial->interface);
+ error_get_interface:
+ usb_serial_put(serial);
--- /dev/null
+From c496ad835c31ad639b6865714270b3003df031f6 Mon Sep 17 00:00:00 2001
+From: Andreas Engel <anen-nospam@gmx.net>
+Date: Mon, 18 Sep 2017 21:11:57 +0200
+Subject: USB: serial: cp210x: add support for ELV TFD500
+
+From: Andreas Engel <anen-nospam@gmx.net>
+
+commit c496ad835c31ad639b6865714270b3003df031f6 upstream.
+
+Add the USB device id for the ELV TFD500 data logger.
+
+Signed-off-by: Andreas Engel <anen-nospam@gmx.net>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -170,6 +170,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
++ { USB_DEVICE(0x18EF, 0xE032) }, /* ELV TFD500 Data Logger */
+ { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
+ { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
+ { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */
--- /dev/null
+From a6c215e21b0dc5fe9416dce90f9acc2ea53c4502 Mon Sep 17 00:00:00 2001
+From: Jeffrey Chu <jeffrey.chu@cypress.com>
+Date: Fri, 8 Sep 2017 21:08:58 +0000
+Subject: USB: serial: ftdi_sio: add id for Cypress WICED dev board
+
+From: Jeffrey Chu <jeffrey.chu@cypress.com>
+
+commit a6c215e21b0dc5fe9416dce90f9acc2ea53c4502 upstream.
+
+Add CYPRESS_VID vid and CYPRESS_WICED_BT_USB and CYPRESS_WICED_WL_USB
+device IDs to ftdi_sio driver.
+
+Signed-off-by: Jeffrey Chu <jeffrey.chu@cypress.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 7 +++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1015,6 +1015,8 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
+ { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },
++ { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },
+ { } /* Terminating entry */
+ };
+
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -610,6 +610,13 @@
+ #define ADI_GNICEPLUS_PID 0xF001
+
+ /*
++ * Cypress WICED USB UART
++ */
++#define CYPRESS_VID 0x04B4
++#define CYPRESS_WICED_BT_USB_PID 0x009B
++#define CYPRESS_WICED_WL_USB_PID 0xF900
++
++/*
+ * Microchip Technology, Inc.
+ *
+ * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
--- /dev/null
+From 837ddc4793a69b256ac5e781a5e729b448a8d983 Mon Sep 17 00:00:00 2001
+From: Henryk Heisig <hyniu@o2.pl>
+Date: Mon, 11 Sep 2017 17:57:34 +0200
+Subject: USB: serial: option: add support for TP-Link LTE module
+
+From: Henryk Heisig <hyniu@o2.pl>
+
+commit 837ddc4793a69b256ac5e781a5e729b448a8d983 upstream.
+
+This commit adds support for TP-Link LTE mPCIe module is used
+in in TP-Link MR200v1, MR6400v1 and v2 routers.
+
+Signed-off-by: Henryk Heisig <hyniu@o2.pl>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -522,6 +522,7 @@ static void option_instat_callback(struc
+
+ /* TP-LINK Incorporated products */
+ #define TPLINK_VENDOR_ID 0x2357
++#define TPLINK_PRODUCT_LTE 0x000D
+ #define TPLINK_PRODUCT_MA180 0x0201
+
+ /* Changhong products */
+@@ -2011,6 +2012,7 @@ static const struct usb_device_id option
+ { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
+ { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
+ { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */
+ { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(TPLINK_VENDOR_ID, 0x9000), /* TP-Link MA260 */
--- /dev/null
+From f5d9644c5fca7d8e8972268598bb516a7eae17f9 Mon Sep 17 00:00:00 2001
+From: Shrirang Bagul <shrirang.bagul@canonical.com>
+Date: Fri, 29 Sep 2017 12:39:51 +0800
+Subject: USB: serial: qcserial: add Dell DW5818, DW5819
+
+From: Shrirang Bagul <shrirang.bagul@canonical.com>
+
+commit f5d9644c5fca7d8e8972268598bb516a7eae17f9 upstream.
+
+Dell Wireless 5819/5818 devices are re-branded Sierra Wireless MC74
+series which will by default boot with vid 0x413c and pid's 0x81cf,
+0x81d0, 0x81d1, 0x81d2.
+
+Signed-off-by: Shrirang Bagul <shrirang.bagul@canonical.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/qcserial.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -174,6 +174,10 @@ static const struct usb_device_id id_tab
+ {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+ {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */
+ {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */
++ {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */
++ {DEVICE_SWI(0x413c, 0x81d0)}, /* Dell Wireless 5819 */
++ {DEVICE_SWI(0x413c, 0x81d1)}, /* Dell Wireless 5818 */
++ {DEVICE_SWI(0x413c, 0x81d2)}, /* Dell Wireless 5818 */
+
+ /* Huawei devices */
+ {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
projects / thirdparty / kernel / stable-queue.git / commitdiff
