From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 28 Jul 2016 21:26:03 +0000 (-0700)
Subject: 4.6-stable patches
X-Git-Tag: v3.14.75~27
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2398d2eacb8dda0970f607dc18ed9b261b495a3c;p=thirdparty%2Fkernel%2Fstable-queue.git

4.6-stable patches

added patches:
	usb-ohci-don-t-mark-eds-as-ed_oper-if-scheduling-fails.patch
---

diff --git a/queue-4.6/usb-ohci-don-t-mark-eds-as-ed_oper-if-scheduling-fails.patch b/queue-4.6/usb-ohci-don-t-mark-eds-as-ed_oper-if-scheduling-fails.patch
new file mode 100644
index 00000000000..57b8defaac2
--- /dev/null
+++ b/queue-4.6/usb-ohci-don-t-mark-eds-as-ed_oper-if-scheduling-fails.patch
@@ -0,0 +1,50 @@
+From c66f59ee5050447b3da92d36f5385a847990a894 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Pecio?= <michal.pecio@gmail.com>
+Date: Tue, 7 Jun 2016 12:34:45 +0200
+Subject: USB: OHCI: Don't mark EDs as ED_OPER if scheduling fails
+
+From: Michał Pecio <michal.pecio@gmail.com>
+
+commit c66f59ee5050447b3da92d36f5385a847990a894 upstream.
+
+Since ed_schedule begins with marking the ED as "operational",
+the ED may be left in such state even if scheduling actually
+fails.
+
+This allows future submission attempts to smuggle this ED to the
+hardware behind the scheduler's back and without linking it to
+the ohci->eds_in_use list.
+
+The former causes bandwidth saturation and data loss on isoc
+endpoints, the latter crashes the kernel when attempt is made
+to unlink such ED from this list.
+
+Fix ed_schedule to update ED state only on successful return.
+
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ohci-q.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/ohci-q.c
++++ b/drivers/usb/host/ohci-q.c
+@@ -183,7 +183,6 @@ static int ed_schedule (struct ohci_hcd
+ {
+ 	int	branch;
+ 
+-	ed->state = ED_OPER;
+ 	ed->ed_prev = NULL;
+ 	ed->ed_next = NULL;
+ 	ed->hwNextED = 0;
+@@ -259,6 +258,8 @@ static int ed_schedule (struct ohci_hcd
+ 	/* the HC may not see the schedule updates yet, but if it does
+ 	 * then they'll be properly ordered.
+ 	 */
++
++	ed->state = ED_OPER;
+ 	return 0;
+ }
+