From: Greg Kroah-Hartman Date: Fri, 7 Jul 2017 09:50:34 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.9.37~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=026d71a0ce9386cea3bba7c53ec233584df4c72a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: add-usb-quirk-for-hvr-950q-to-avoid-intermittent-device-resets.patch drm-virtio-don-t-leak-bo-on-drm_gem_object_init-failure.patch usb-dwc3-replace-p-with-pk.patch usb-fix-typo-in-the-definition-of-endpointrequest.patch usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch usb-usbip-set-buffer-pointers-to-null-after-free.patch --- diff --git a/queue-4.4/add-usb-quirk-for-hvr-950q-to-avoid-intermittent-device-resets.patch b/queue-4.4/add-usb-quirk-for-hvr-950q-to-avoid-intermittent-device-resets.patch new file mode 100644 index 00000000000..4ebd3603cb0 --- /dev/null +++ b/queue-4.4/add-usb-quirk-for-hvr-950q-to-avoid-intermittent-device-resets.patch @@ -0,0 +1,40 @@ +From 6836796de4019944f4ba4c99a360e8250fd2e735 Mon Sep 17 00:00:00 2001 +From: Devin Heitmueller +Date: Tue, 27 Jun 2017 13:08:51 -0400 +Subject: Add USB quirk for HVR-950q to avoid intermittent device resets + +From: Devin Heitmueller + +commit 6836796de4019944f4ba4c99a360e8250fd2e735 upstream. + +The USB core and sysfs will attempt to enumerate certain parameters +which are unsupported by the au0828 - causing inconsistent behavior +and sometimes causing the chip to reset. Avoid making these calls. + +This problem manifested as intermittent cases where the au8522 would +be reset on analog video startup, in particular when starting up ALSA +audio streaming in parallel - the sysfs entries created by +snd-usb-audio on streaming startup would result in unsupported control +messages being sent during tuning which would put the chip into an +unknown state. + +Signed-off-by: Devin Heitmueller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -223,6 +223,10 @@ static const struct usb_device_id usb_qu + /* Blackmagic Design UltraStudio SDI */ + { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* Hauppauge HVR-950q */ ++ { USB_DEVICE(0x2040, 0x7200), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-4.4/drm-virtio-don-t-leak-bo-on-drm_gem_object_init-failure.patch b/queue-4.4/drm-virtio-don-t-leak-bo-on-drm_gem_object_init-failure.patch new file mode 100644 index 00000000000..406d16fb850 --- /dev/null +++ b/queue-4.4/drm-virtio-don-t-leak-bo-on-drm_gem_object_init-failure.patch @@ -0,0 +1,35 @@ +From 385aee965b4e4c36551c362a334378d2985b722a Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Thu, 6 Apr 2017 17:59:40 +0200 +Subject: drm/virtio: don't leak bo on drm_gem_object_init failure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gerd Hoffmann + +commit 385aee965b4e4c36551c362a334378d2985b722a upstream. + +Reported-by: 李强 +Signed-off-by: Gerd Hoffmann +Link: http://patchwork.freedesktop.org/patch/msgid/20170406155941.458-1-kraxel@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/virtio/virtgpu_object.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/virtio/virtgpu_object.c ++++ b/drivers/gpu/drm/virtio/virtgpu_object.c +@@ -81,8 +81,10 @@ int virtio_gpu_object_create(struct virt + return -ENOMEM; + size = roundup(size, PAGE_SIZE); + ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size); +- if (ret != 0) ++ if (ret != 0) { ++ kfree(bo); + return ret; ++ } + bo->dumb = false; + virtio_gpu_init_ttm_placement(bo, pinned); + diff --git a/queue-4.4/series b/queue-4.4/series index 6f2379f46bb..eef9e0ecae9 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -4,3 +4,9 @@ driver-core-platform-fix-race-condition-with-driver_override.patch bgmac-reset-enable-ethernet-core-before-using-it.patch mm-fix-classzone_idx-underflow-in-shrink_zones.patch tracing-kprobes-allow-to-create-probe-with-a-module-name-starting-with-a-digit.patch +drm-virtio-don-t-leak-bo-on-drm_gem_object_init-failure.patch +usb-dwc3-replace-p-with-pk.patch +usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch +add-usb-quirk-for-hvr-950q-to-avoid-intermittent-device-resets.patch +usb-usbip-set-buffer-pointers-to-null-after-free.patch +usb-fix-typo-in-the-definition-of-endpointrequest.patch diff --git a/queue-4.4/usb-dwc3-replace-p-with-pk.patch b/queue-4.4/usb-dwc3-replace-p-with-pk.patch new file mode 100644 index 00000000000..5b7d1ea57cd --- /dev/null +++ b/queue-4.4/usb-dwc3-replace-p-with-pk.patch @@ -0,0 +1,62 @@ +From 04fb365c453e14ff9e8a28f1c46050d920a27a4a Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Wed, 17 May 2017 15:57:45 +0300 +Subject: usb: dwc3: replace %p with %pK + +From: Felipe Balbi + +commit 04fb365c453e14ff9e8a28f1c46050d920a27a4a upstream. + +%p will leak kernel pointers, so let's not expose the information on +dmesg and instead use %pK. %pK will only show the actual addresses if +explicitly enabled under /proc/sys/kernel/kptr_restrict. + +Acked-by: Greg Kroah-Hartman +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/dwc3-st.c | 2 +- + drivers/usb/dwc3/gadget.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-st.c ++++ b/drivers/usb/dwc3/dwc3-st.c +@@ -224,7 +224,7 @@ static int st_dwc3_probe(struct platform + + dwc3_data->syscfg_reg_off = res->start; + +- dev_vdbg(&pdev->dev, "glue-logic addr 0x%p, syscfg-reg offset 0x%x\n", ++ dev_vdbg(&pdev->dev, "glue-logic addr 0x%pK, syscfg-reg offset 0x%x\n", + dwc3_data->glue_base, dwc3_data->syscfg_reg_off); + + dwc3_data->rstc_pwrdn = devm_reset_control_get(dev, "powerdown"); +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1219,7 +1219,7 @@ static int dwc3_gadget_ep_queue(struct u + goto out; + } + +- if (WARN(req->dep != dep, "request %p belongs to '%s'\n", ++ if (WARN(req->dep != dep, "request %pK belongs to '%s'\n", + request, req->dep->name)) { + ret = -EINVAL; + goto out; +@@ -1264,7 +1264,7 @@ static int dwc3_gadget_ep_dequeue(struct + dwc3_stop_active_transfer(dwc, dep->number, true); + goto out1; + } +- dev_err(dwc->dev, "request %p was not queued to %s\n", ++ dev_err(dwc->dev, "request %pK was not queued to %s\n", + request, ep->name); + ret = -EINVAL; + goto out0; +@@ -1866,7 +1866,7 @@ static int __dwc3_cleanup_done_trbs(stru + * would help. Lets hope that if this occurs, someone + * fixes the root cause instead of looking away :) + */ +- dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n", ++ dev_err(dwc->dev, "%s's TRB (%pK) still owned by HW\n", + dep->name, trb); + count = trb->size & DWC3_TRB_SIZE_MASK; + diff --git a/queue-4.4/usb-fix-typo-in-the-definition-of-endpointrequest.patch b/queue-4.4/usb-fix-typo-in-the-definition-of-endpointrequest.patch new file mode 100644 index 00000000000..bff527b5c7e --- /dev/null +++ b/queue-4.4/usb-fix-typo-in-the-definition-of-endpointrequest.patch @@ -0,0 +1,34 @@ +From 7cf916bd639bd26db7214f2205bccdb4b9306256 Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Tue, 13 Jun 2017 16:01:13 +1000 +Subject: usb: Fix typo in the definition of Endpoint[out]Request + +From: Benjamin Herrenschmidt + +commit 7cf916bd639bd26db7214f2205bccdb4b9306256 upstream. + +The current definition is wrong. This breaks my upcoming +Aspeed virtual hub driver. + +Signed-off-by: Benjamin Herrenschmidt +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/usb/hcd.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -560,9 +560,9 @@ extern void usb_ep0_reinit(struct usb_de + ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) + + #define EndpointRequest \ +- ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) ++ ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8) + #define EndpointOutRequest \ +- ((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) ++ ((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8) + + /* class requests from the USB 2.0 hub spec, table 11-15 */ + /* GetBusState and SetHubDescriptor are optional, omitted */ diff --git a/queue-4.4/usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch b/queue-4.4/usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch new file mode 100644 index 00000000000..e9517a0709a --- /dev/null +++ b/queue-4.4/usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch @@ -0,0 +1,30 @@ +From fd90f73a9925f248d696bde1cfc836d9fda5570d Mon Sep 17 00:00:00 2001 +From: Jeremie Rapin +Date: Wed, 28 Jun 2017 18:23:25 +0200 +Subject: USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick + +From: Jeremie Rapin + +commit fd90f73a9925f248d696bde1cfc836d9fda5570d upstream. + +Added the USB serial device ID for the CEL ZigBee EM3588 +radio stick. + +Signed-off-by: Jeremie Rapin +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -134,6 +134,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ + { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ + { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ ++ { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/queue-4.4/usb-usbip-set-buffer-pointers-to-null-after-free.patch b/queue-4.4/usb-usbip-set-buffer-pointers-to-null-after-free.patch new file mode 100644 index 00000000000..ac3458fa47b --- /dev/null +++ b/queue-4.4/usb-usbip-set-buffer-pointers-to-null-after-free.patch @@ -0,0 +1,53 @@ +From b3b51417d0af63fb9a06662dc292200aed9ea53f Mon Sep 17 00:00:00 2001 +From: Michael Grzeschik +Date: Mon, 22 May 2017 13:02:44 +0200 +Subject: usb: usbip: set buffer pointers to NULL after free + +From: Michael Grzeschik + +commit b3b51417d0af63fb9a06662dc292200aed9ea53f upstream. + +The usbip stack dynamically allocates the transfer_buffer and +setup_packet of each urb that got generated by the tcp to usb stub code. +As these pointers are always used only once we will set them to NULL +after use. This is done likewise to the free_urb code in vudc_dev.c. +This patch fixes double kfree situations where the usbip remote side +added the URB_FREE_BUFFER. + +Signed-off-by: Michael Grzeschik +Acked-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/usbip/stub_main.c | 4 ++++ + drivers/usb/usbip/stub_tx.c | 4 ++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/usb/usbip/stub_main.c ++++ b/drivers/usb/usbip/stub_main.c +@@ -262,7 +262,11 @@ void stub_device_cleanup_urbs(struct stu + kmem_cache_free(stub_priv_cache, priv); + + kfree(urb->transfer_buffer); ++ urb->transfer_buffer = NULL; ++ + kfree(urb->setup_packet); ++ urb->setup_packet = NULL; ++ + usb_free_urb(urb); + } + } +--- a/drivers/usb/usbip/stub_tx.c ++++ b/drivers/usb/usbip/stub_tx.c +@@ -28,7 +28,11 @@ static void stub_free_priv_and_urb(struc + struct urb *urb = priv->urb; + + kfree(urb->setup_packet); ++ urb->setup_packet = NULL; ++ + kfree(urb->transfer_buffer); ++ urb->transfer_buffer = NULL; ++ + list_del(&priv->list); + kmem_cache_free(stub_priv_cache, priv); + usb_free_urb(urb);