From: Greg Kroah-Hartman Date: Wed, 11 Mar 2015 15:34:54 +0000 (+0100) Subject: 3.19-stable patches X-Git-Tag: v3.10.72~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2bbc3dc867a8192544590c4c6e9dcbefe9382eeb;p=thirdparty%2Fkernel%2Fstable-queue.git 3.19-stable patches added patches: mac80211-notify-channel-switch-at-the-end-of-ieee80211_chswitch_post_beacon.patch mac80211-send-eapol-frames-at-lowest-rate.patch net-irda-fix-wait_until_sent-poll-timeout.patch revert-usb-serial-make-bulk_out_size-a-lower-limit.patch tty-fix-tty_wait_until_sent-on-64-bit-machines.patch uas-add-us_fl_no_report_opcodes-for-jmicron-jms539.patch usb-dwc3-dwc3-omap-fix-disable-irq.patch usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch usb-gadget-configfs-don-t-nul-terminate-sub-compatible-ids.patch usb-mxuport-fix-null-deref-when-used-as-a-console.patch usb-serial-cp210x-adding-seletek-device-id-s.patch usb-serial-fix-infinite-wait_until_sent-timeout.patch usb-serial-fix-potential-use-after-free-after-failed-probe.patch usb-serial-fix-tty-device-error-handling-at-probe.patch usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch usb-xhci-platform-move-the-marvell-quirks-after-the-enabling-the-clocks.patch xhci-allocate-correct-amount-of-scratchpad-buffers.patch xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch --- diff --git a/queue-3.19/mac80211-notify-channel-switch-at-the-end-of-ieee80211_chswitch_post_beacon.patch b/queue-3.19/mac80211-notify-channel-switch-at-the-end-of-ieee80211_chswitch_post_beacon.patch new file mode 100644 index 00000000000..8763b93e2f3 --- /dev/null +++ b/queue-3.19/mac80211-notify-channel-switch-at-the-end-of-ieee80211_chswitch_post_beacon.patch @@ -0,0 +1,43 @@ +From 688b1ecfb9ed0484754d2653386e3c44c58ede5c Mon Sep 17 00:00:00 2001 +From: Luciano Coelho +Date: Tue, 16 Dec 2014 16:01:39 +0200 +Subject: mac80211: notify channel switch at the end of ieee80211_chswitch_post_beacon() + +From: Luciano Coelho + +commit 688b1ecfb9ed0484754d2653386e3c44c58ede5c upstream. + +The call to cfg80211_ch_switch_notify() should be at the end of the +ieee80211_chswitch_post_beacon() function, because it should only be +sent if everything succeeded. + +Fixes: d04b5ac9e70b ("cfg80211/mac80211: allow any interface to send channel switch notifications") +Signed-off-by: Luciano Coelho +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mlme.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -1054,8 +1054,6 @@ static void ieee80211_chswitch_post_beac + sdata->csa_block_tx = false; + } + +- cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef); +- + sdata->vif.csa_active = false; + ifmgd->csa_waiting_bcn = false; + +@@ -1067,6 +1065,8 @@ static void ieee80211_chswitch_post_beac + &ifmgd->csa_connection_drop_work); + return; + } ++ ++ cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef); + } + + void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success) diff --git a/queue-3.19/mac80211-send-eapol-frames-at-lowest-rate.patch b/queue-3.19/mac80211-send-eapol-frames-at-lowest-rate.patch new file mode 100644 index 00000000000..8d6ea6ecc2f --- /dev/null +++ b/queue-3.19/mac80211-send-eapol-frames-at-lowest-rate.patch @@ -0,0 +1,66 @@ +From 9c1c98a3bb7b7593b60264b9a07e001e68b46697 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Thu, 26 Feb 2015 15:50:50 +0200 +Subject: mac80211: Send EAPOL frames at lowest rate + +From: Jouni Malinen + +commit 9c1c98a3bb7b7593b60264b9a07e001e68b46697 upstream. + +The current minstrel_ht rate control behavior is somewhat optimistic in +trying to find optimum TX rate. While this is usually fine for normal +Data frames, there are cases where a more conservative set of retry +parameters would be beneficial to make the connection more robust. + +EAPOL frames are critical to the authentication and especially the +EAPOL-Key message 4/4 (the last message in the 4-way handshake) is +important to get through to the AP. If that message is lost, the only +recovery mechanism in many cases is to reassociate with the AP and start +from scratch. This can often be avoided by trying to send the frame with +more conservative rate and/or with more link layer retries. + +In most cases, minstrel_ht is currently using the initial EAPOL-Key +frames for probing higher rates and this results in only five link layer +transmission attempts (one at high(ish) MCS and four at MCS0). While +this works with most APs, it looks like there are some deployed APs that +may have issues with the EAPOL frames using HT MCS immediately after +association. Similarly, there may be issues in cases where the signal +strength or radio environment is not good enough to be able to get +frames through even at couple of MCS 0 tries. + +The best approach for this would likely to be to reduce the TX rate for +the last rate (3rd rate parameter in the set) to a low basic rate (say, +6 Mbps on 5 GHz and 2 or 5.5 Mbps on 2.4 GHz), but doing that cleanly +requires some more effort. For now, we can start with a simple one-liner +that forces the minimum rate to be used for EAPOL frames similarly how +the TX rate is selected for the IEEE 802.11 Management frames. This does +result in a small extra latency added to the cases where the AP would be +able to receive the higher rate, but taken into account how small number +of EAPOL frames are used, this is likely to be insignificant. A future +optimization in the minstrel_ht design can also allow this patch to be +reverted to get back to the more optimized initial TX rate. + +It should also be noted that many drivers that do not use minstrel as +the rate control algorithm are already doing similar workarounds by +forcing the lowest TX rate to be used for EAPOL frames. + +Reported-by: Linus Torvalds +Tested-by: Linus Torvalds +Signed-off-by: Jouni Malinen +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/tx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -566,6 +566,7 @@ ieee80211_tx_h_check_control_port_protoc + if (tx->sdata->control_port_no_encrypt) + info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; + info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO; ++ info->flags |= IEEE80211_TX_CTL_USE_MINRATE; + } + + return TX_CONTINUE; diff --git a/queue-3.19/net-irda-fix-wait_until_sent-poll-timeout.patch b/queue-3.19/net-irda-fix-wait_until_sent-poll-timeout.patch new file mode 100644 index 00000000000..5e9b50c5007 --- /dev/null +++ b/queue-3.19/net-irda-fix-wait_until_sent-poll-timeout.patch @@ -0,0 +1,37 @@ +From 2c3fbe3cf28fbd7001545a92a83b4f8acfd9fa36 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 4 Mar 2015 10:39:03 +0100 +Subject: net: irda: fix wait_until_sent poll timeout + +From: Johan Hovold + +commit 2c3fbe3cf28fbd7001545a92a83b4f8acfd9fa36 upstream. + +In case an infinite timeout (0) is requested, the irda wait_until_sent +implementation would use a zero poll timeout rather than the default +200ms. + +Note that wait_until_sent is currently never called with a 0-timeout +argument due to a bug in tty_wait_until_sent. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + net/irda/ircomm/ircomm_tty.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/irda/ircomm/ircomm_tty.c ++++ b/net/irda/ircomm/ircomm_tty.c +@@ -798,7 +798,9 @@ static void ircomm_tty_wait_until_sent(s + orig_jiffies = jiffies; + + /* Set poll time to 200 ms */ +- poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200)); ++ poll_time = msecs_to_jiffies(200); ++ if (timeout) ++ poll_time = min_t(unsigned long, timeout, poll_time); + + spin_lock_irqsave(&self->spinlock, flags); + while (self->tx_skb && self->tx_skb->len) { diff --git a/queue-3.19/revert-usb-serial-make-bulk_out_size-a-lower-limit.patch b/queue-3.19/revert-usb-serial-make-bulk_out_size-a-lower-limit.patch new file mode 100644 index 00000000000..9506b9959e3 --- /dev/null +++ b/queue-3.19/revert-usb-serial-make-bulk_out_size-a-lower-limit.patch @@ -0,0 +1,51 @@ +From bc4b1f486fe69b86769e07c8edce472327a8462b Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 15 Feb 2015 11:57:53 +0700 +Subject: Revert "USB: serial: make bulk_out_size a lower limit" + +From: Johan Hovold + +commit bc4b1f486fe69b86769e07c8edce472327a8462b upstream. + +This reverts commit 5083fd7bdfe6760577235a724cf6dccae13652c2. + +A bulk-out size smaller than the end-point size is indeed valid. The +offending commit broke the usb-debug driver for EHCI debug devices, +which use 8-byte buffers. + +Fixes: 5083fd7bdfe6 ("USB: serial: make bulk_out_size a lower limit") +Reported-by: "Li, Elvin" +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb-serial.c | 5 +++-- + include/linux/usb/serial.h | 3 +-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -940,8 +940,9 @@ static int usb_serial_probe(struct usb_i + port = serial->port[i]; + if (kfifo_alloc(&port->write_fifo, PAGE_SIZE, GFP_KERNEL)) + goto probe_error; +- buffer_size = max_t(int, serial->type->bulk_out_size, +- usb_endpoint_maxp(endpoint)); ++ buffer_size = serial->type->bulk_out_size; ++ if (!buffer_size) ++ buffer_size = usb_endpoint_maxp(endpoint); + port->bulk_out_size = buffer_size; + port->bulk_out_endpointAddress = endpoint->bEndpointAddress; + +--- a/include/linux/usb/serial.h ++++ b/include/linux/usb/serial.h +@@ -190,8 +190,7 @@ static inline void usb_set_serial_data(s + * @num_ports: the number of different ports this device will have. + * @bulk_in_size: minimum number of bytes to allocate for bulk-in buffer + * (0 = end-point size) +- * @bulk_out_size: minimum number of bytes to allocate for bulk-out buffer +- * (0 = end-point size) ++ * @bulk_out_size: bytes to allocate for bulk-out buffer (0 = end-point size) + * @calc_num_ports: pointer to a function to determine how many ports this + * device has dynamically. It will be called after the probe() + * callback is called, but before attach() diff --git a/queue-3.19/series b/queue-3.19/series index f1a5c6128d3..809db5d19c4 100644 --- a/queue-3.19/series +++ b/queue-3.19/series @@ -74,4 +74,23 @@ btrfs-fix-data-loss-in-the-fast-fsync-path.patch btrfs-__add_inode_ref-out-of-bounds-memory-read-when-looking-for-extended-ref.patch kvm-emulate-fix-cmpxchg8b-on-32-bit-hosts.patch kvm-mips-fix-trace-event-to-save-pc-directly.patch -target-fix-r_holder-bit-usage-for-allregistrants.patch +uas-add-us_fl_no_report_opcodes-for-jmicron-jms539.patch +revert-usb-serial-make-bulk_out_size-a-lower-limit.patch +usb-serial-cp210x-adding-seletek-device-id-s.patch +usb-mxuport-fix-null-deref-when-used-as-a-console.patch +usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch +usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch +usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch +usb-dwc3-dwc3-omap-fix-disable-irq.patch +usb-gadget-configfs-don-t-nul-terminate-sub-compatible-ids.patch +usb-xhci-platform-move-the-marvell-quirks-after-the-enabling-the-clocks.patch +xhci-allocate-correct-amount-of-scratchpad-buffers.patch +xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch +xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch +mac80211-send-eapol-frames-at-lowest-rate.patch +mac80211-notify-channel-switch-at-the-end-of-ieee80211_chswitch_post_beacon.patch +net-irda-fix-wait_until_sent-poll-timeout.patch +usb-serial-fix-infinite-wait_until_sent-timeout.patch +tty-fix-tty_wait_until_sent-on-64-bit-machines.patch +usb-serial-fix-potential-use-after-free-after-failed-probe.patch +usb-serial-fix-tty-device-error-handling-at-probe.patch diff --git a/queue-3.19/target-fix-r_holder-bit-usage-for-allregistrants.patch b/queue-3.19/target-fix-r_holder-bit-usage-for-allregistrants.patch deleted file mode 100644 index c72bcf014e5..00000000000 --- a/queue-3.19/target-fix-r_holder-bit-usage-for-allregistrants.patch +++ /dev/null @@ -1,80 +0,0 @@ -From d16ca7c5198fd668db10d2c7b048ed3359c12c54 Mon Sep 17 00:00:00 2001 -From: Nicholas Bellinger -Date: Sun, 14 Dec 2014 01:47:19 -0800 -Subject: target: Fix R_HOLDER bit usage for AllRegistrants - -From: Nicholas Bellinger - -commit d16ca7c5198fd668db10d2c7b048ed3359c12c54 upstream. - -This patch fixes the usage of R_HOLDER bit for an All Registrants -reservation in READ_FULL_STATUS, where only the registration who -issued RESERVE was being reported as having an active reservation. - -It changes core_scsi3_pri_read_full_status() to check ahead of the -list walk of active registrations to see if All Registrants is active, -and if so set R_HOLDER bit and scope/type fields for all active -registrations. - -Reported-by: Ilias Tsitsimpis -Cc: James Bottomley -Signed-off-by: Nicholas Bellinger -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c -index f91b6a1b846e..c4a8da5415c5 100644 ---- a/drivers/target/target_core_pr.c -+++ b/drivers/target/target_core_pr.c -@@ -3834,7 +3834,8 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd) - unsigned char *buf; - u32 add_desc_len = 0, add_len = 0, desc_len, exp_desc_len; - u32 off = 8; /* off into first Full Status descriptor */ -- int format_code = 0; -+ int format_code = 0, pr_res_type = 0, pr_res_scope = 0; -+ bool all_reg = false; - - if (cmd->data_length < 8) { - pr_err("PRIN SA READ_FULL_STATUS SCSI Data Length: %u" -@@ -3851,6 +3852,19 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd) - buf[2] = ((dev->t10_pr.pr_generation >> 8) & 0xff); - buf[3] = (dev->t10_pr.pr_generation & 0xff); - -+ spin_lock(&dev->dev_reservation_lock); -+ if (dev->dev_pr_res_holder) { -+ struct t10_pr_registration *pr_holder = dev->dev_pr_res_holder; -+ -+ if (pr_holder->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG || -+ pr_holder->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG) { -+ all_reg = true; -+ pr_res_type = pr_holder->pr_res_type; -+ pr_res_scope = pr_holder->pr_res_scope; -+ } -+ } -+ spin_unlock(&dev->dev_reservation_lock); -+ - spin_lock(&pr_tmpl->registration_lock); - list_for_each_entry_safe(pr_reg, pr_reg_tmp, - &pr_tmpl->registration_list, pr_reg_list) { -@@ -3898,14 +3912,20 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd) - * reservation holder for PR_HOLDER bit. - * - * Also, if this registration is the reservation -- * holder, fill in SCOPE and TYPE in the next byte. -+ * holder or there is an All Registrants reservation -+ * active, fill in SCOPE and TYPE in the next byte. - */ - if (pr_reg->pr_res_holder) { - buf[off++] |= 0x01; - buf[off++] = (pr_reg->pr_res_scope & 0xf0) | - (pr_reg->pr_res_type & 0x0f); -- } else -+ } else if (all_reg) { -+ buf[off++] |= 0x01; -+ buf[off++] = (pr_res_scope & 0xf0) | -+ (pr_res_type & 0x0f); -+ } else { - off += 2; -+ } - - off += 4; /* Skip over reserved area */ - /* diff --git a/queue-3.19/tty-fix-tty_wait_until_sent-on-64-bit-machines.patch b/queue-3.19/tty-fix-tty_wait_until_sent-on-64-bit-machines.patch new file mode 100644 index 00000000000..c9b57feeb4f --- /dev/null +++ b/queue-3.19/tty-fix-tty_wait_until_sent-on-64-bit-machines.patch @@ -0,0 +1,63 @@ +From 79fbf4a550ed6a22e1ae1516113e6c7fa5d56a53 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 4 Mar 2015 10:39:06 +0100 +Subject: TTY: fix tty_wait_until_sent on 64-bit machines + +From: Johan Hovold + +commit 79fbf4a550ed6a22e1ae1516113e6c7fa5d56a53 upstream. + +Fix overflow bug in tty_wait_until_sent on 64-bit machines, where an +infinite timeout (0) would be passed to the underlying tty-driver's +wait_until_sent-operation as a negative timeout (-1), causing it to +return immediately. + +This manifests itself for example as tcdrain() returning immediately, +drivers not honouring the drain flags when setting terminal attributes, +or even dropped data on close as a requested infinite closing-wait +timeout would be ignored. + +The first symptom was reported by Asier LLANO who noted that tcdrain() +returned prematurely when using the ftdi_sio usb-serial driver. + +Fix this by passing 0 rather than MAX_SCHEDULE_TIMEOUT (LONG_MAX) to the +underlying tty driver. + +Note that the serial-core wait_until_sent-implementation is not affected +by this bug due to a lucky chance (comparison to an unsigned maximum +timeout), and neither is the cyclades one that had an explicit check for +negative timeouts, but all other tty drivers appear to be affected. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: ZIV-Asier Llano Palacios +Signed-off-by: Johan Hovold +Reviewed-by: Peter Hurley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/tty_ioctl.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/tty/tty_ioctl.c ++++ b/drivers/tty/tty_ioctl.c +@@ -217,11 +217,17 @@ void tty_wait_until_sent(struct tty_stru + #endif + if (!timeout) + timeout = MAX_SCHEDULE_TIMEOUT; ++ + if (wait_event_interruptible_timeout(tty->write_wait, +- !tty_chars_in_buffer(tty), timeout) >= 0) { +- if (tty->ops->wait_until_sent) +- tty->ops->wait_until_sent(tty, timeout); ++ !tty_chars_in_buffer(tty), timeout) < 0) { ++ return; + } ++ ++ if (timeout == MAX_SCHEDULE_TIMEOUT) ++ timeout = 0; ++ ++ if (tty->ops->wait_until_sent) ++ tty->ops->wait_until_sent(tty, timeout); + } + EXPORT_SYMBOL(tty_wait_until_sent); + diff --git a/queue-3.19/uas-add-us_fl_no_report_opcodes-for-jmicron-jms539.patch b/queue-3.19/uas-add-us_fl_no_report_opcodes-for-jmicron-jms539.patch new file mode 100644 index 00000000000..3ada709306c --- /dev/null +++ b/queue-3.19/uas-add-us_fl_no_report_opcodes-for-jmicron-jms539.patch @@ -0,0 +1,36 @@ +From 59e980efafd27df83a5c85c054f906d82bcbf752 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 23 Feb 2015 13:41:14 +0100 +Subject: uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS539 + +From: Hans de Goede + +commit 59e980efafd27df83a5c85c054f906d82bcbf752 upstream. + +Like the JMicron JMS567 enclosures with the JMS539 choke on report-opcodes, +so avoid it. + +Tested-and-reported-by: Tom Arild Naess +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_uas.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x99 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_ATA_1X), + ++/* Reported-by: Tom Arild Naess */ ++UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999, ++ "JMicron", ++ "JMS539", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_REPORT_OPCODES), ++ + /* Reported-by: Claudio Bizzarri */ + UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999, + "JMicron", diff --git a/queue-3.19/usb-dwc3-dwc3-omap-fix-disable-irq.patch b/queue-3.19/usb-dwc3-dwc3-omap-fix-disable-irq.patch new file mode 100644 index 00000000000..9779882b5aa --- /dev/null +++ b/queue-3.19/usb-dwc3-dwc3-omap-fix-disable-irq.patch @@ -0,0 +1,72 @@ +From 96e5d31244c5542f5b2ea81d76f14ba4b8a7d440 Mon Sep 17 00:00:00 2001 +From: George Cherian +Date: Fri, 13 Feb 2015 10:13:24 +0530 +Subject: usb: dwc3: dwc3-omap: Fix disable IRQ + +From: George Cherian + +commit 96e5d31244c5542f5b2ea81d76f14ba4b8a7d440 upstream. + +In the wrapper the IRQ disable should be done by writing 1's to the +IRQ*_CLR register. Existing code is broken because it instead writes +zeros to IRQ*_SET register. + +Fix this by adding functions dwc3_omap_write_irqmisc_clr() and +dwc3_omap_write_irq0_clr() which do the right thing. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Signed-off-by: George Cherian +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/dwc3-omap.c | 30 ++++++++++++++++++++++++++++-- + 1 file changed, 28 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -205,6 +205,18 @@ static void dwc3_omap_write_irq0_set(str + omap->irq0_offset, value); + } + ++static void dwc3_omap_write_irqmisc_clr(struct dwc3_omap *omap, u32 value) ++{ ++ dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_MISC + ++ omap->irqmisc_offset, value); ++} ++ ++static void dwc3_omap_write_irq0_clr(struct dwc3_omap *omap, u32 value) ++{ ++ dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_0 - ++ omap->irq0_offset, value); ++} ++ + static void dwc3_omap_set_mailbox(struct dwc3_omap *omap, + enum omap_dwc3_vbus_id_status status) + { +@@ -345,9 +357,23 @@ static void dwc3_omap_enable_irqs(struct + + static void dwc3_omap_disable_irqs(struct dwc3_omap *omap) + { ++ u32 reg; ++ + /* disable all IRQs */ +- dwc3_omap_write_irqmisc_set(omap, 0x00); +- dwc3_omap_write_irq0_set(omap, 0x00); ++ reg = USBOTGSS_IRQO_COREIRQ_ST; ++ dwc3_omap_write_irq0_clr(omap, reg); ++ ++ reg = (USBOTGSS_IRQMISC_OEVT | ++ USBOTGSS_IRQMISC_DRVVBUS_RISE | ++ USBOTGSS_IRQMISC_CHRGVBUS_RISE | ++ USBOTGSS_IRQMISC_DISCHRGVBUS_RISE | ++ USBOTGSS_IRQMISC_IDPULLUP_RISE | ++ USBOTGSS_IRQMISC_DRVVBUS_FALL | ++ USBOTGSS_IRQMISC_CHRGVBUS_FALL | ++ USBOTGSS_IRQMISC_DISCHRGVBUS_FALL | ++ USBOTGSS_IRQMISC_IDPULLUP_FALL); ++ ++ dwc3_omap_write_irqmisc_clr(omap, reg); + } + + static u64 dwc3_omap_dma_mask = DMA_BIT_MASK(32); diff --git a/queue-3.19/usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch b/queue-3.19/usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch new file mode 100644 index 00000000000..c42d8ec52ee --- /dev/null +++ b/queue-3.19/usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch @@ -0,0 +1,54 @@ +From c7d373c3f0da2b2b78c4b1ce5ae41485b3ef848c Mon Sep 17 00:00:00 2001 +From: Max Mansfield +Date: Mon, 2 Mar 2015 18:38:02 -0700 +Subject: usb: ftdi_sio: Add jtag quirk support for Cyber Cortex AV boards + +From: Max Mansfield + +commit c7d373c3f0da2b2b78c4b1ce5ae41485b3ef848c upstream. + +This patch integrates Cyber Cortex AV boards with the existing +ftdi_jtag_quirk in order to use serial port 0 with JTAG which is +required by the manufacturers' software. + +Steps: 2 + +[ftdi_sio_ids.h] +1. Defined the device PID + +[ftdi_sio.c] +2. Added a macro declaration to the ids array, in order to enable the +jtag quirk for the device. + +Signed-off-by: Max Mansfield +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 3 +++ + 2 files changed, 5 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -799,6 +799,8 @@ static const struct usb_device_id id_tab + { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, ++ { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID), +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -38,6 +38,9 @@ + + #define FTDI_LUMEL_PD12_PID 0x6002 + ++/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */ ++#define CYBER_CORTEX_AV_PID 0x8698 ++ + /* + * Marvell OpenRD Base, Client + * http://www.open-rd.org diff --git a/queue-3.19/usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch b/queue-3.19/usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch new file mode 100644 index 00000000000..adeaf48d7fb --- /dev/null +++ b/queue-3.19/usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch @@ -0,0 +1,76 @@ +From f6950344d3cf4a1e231b5828b50c4ac168db3886 Mon Sep 17 00:00:00 2001 +From: Mark Glover +Date: Fri, 13 Feb 2015 09:04:39 +0000 +Subject: USB: ftdi_sio: add PIDs for Actisense USB devices + +From: Mark Glover + +commit f6950344d3cf4a1e231b5828b50c4ac168db3886 upstream. + +These product identifiers (PID) all deal with marine NMEA format data +used on motor boats and yachts. We supply the programmed devices to +Chetco, for use inside their equipment. The PIDs are a direct copy of +our Windows device drivers (FTDI drivers with altered PIDs). + +Signed-off-by: Mark Glover +[johan: edit commit message slightly ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++++ + drivers/usb/serial/ftdi_sio_ids.h | 20 ++++++++++++++++++++ + 2 files changed, 37 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -978,6 +978,23 @@ static const struct usb_device_id id_tab + { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) }, + /* GE Healthcare devices */ + { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) }, ++ /* Active Research (Actisense) devices */ ++ { USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) }, + { } /* Terminating entry */ + }; + +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1438,3 +1438,23 @@ + */ + #define GE_HEALTHCARE_VID 0x1901 + #define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015 ++ ++/* ++ * Active Research (Actisense) devices ++ */ ++#define ACTISENSE_NDC_PID 0xD9A8 /* NDC USB Serial Adapter */ ++#define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */ ++#define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */ ++#define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */ ++#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */ ++#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */ ++#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */ ++#define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */ ++#define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */ ++#define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */ ++#define CHETCO_SEASMART_NMEA2000_PID 0xA54A /* SeaSmart NMEA2000 Gateway */ ++#define CHETCO_SEASMART_ETHERNET_PID 0xA54B /* SeaSmart Ethernet Gateway */ ++#define CHETCO_SEASMART_WIFI_PID 0xA5AC /* SeaSmart Wifi Gateway */ ++#define CHETCO_SEASMART_DISPLAY_PID 0xA5AD /* SeaSmart NMEA2000 Display */ ++#define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */ ++#define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */ diff --git a/queue-3.19/usb-gadget-configfs-don-t-nul-terminate-sub-compatible-ids.patch b/queue-3.19/usb-gadget-configfs-don-t-nul-terminate-sub-compatible-ids.patch new file mode 100644 index 00000000000..70966fcb54d --- /dev/null +++ b/queue-3.19/usb-gadget-configfs-don-t-nul-terminate-sub-compatible-ids.patch @@ -0,0 +1,62 @@ +From a0456399fb07155637a2b597b91cc1c63bc25141 Mon Sep 17 00:00:00 2001 +From: Andrzej Pietrasiewicz +Date: Fri, 13 Feb 2015 12:12:53 +0100 +Subject: usb: gadget: configfs: don't NUL-terminate (sub)compatible ids + +From: Andrzej Pietrasiewicz + +commit a0456399fb07155637a2b597b91cc1c63bc25141 upstream. + +The "Extended Compat ID OS Feature Descriptor Specification" does not +require the (sub)compatible ids to be NUL-terminated, because they +are placed in a fixed-size buffer and only unused parts of it should +contain NULs. If the buffer is fully utilized, there is no place for NULs. + +Consequently, the code which uses desc->ext_compat_id never expects the +data contained to be NUL terminated. + +If the compatible id is stored after sub-compatible id, and the compatible +id is full length (8 bytes), the (useless) NUL terminator overwrites the +first byte of the sub-compatible id. + +If the sub-compatible id is full length (8 bytes), the (useless) NUL +terminator ends up out of the buffer. The situation can happen in the RNDIS +function, where the buffer is a part of struct f_rndis_opts. The next +member of struct f_rndis_opts is a mutex, so its first byte gets +overwritten. The said byte is a part of a mutex'es member which contains +the information on whether the muext is locked or not. This can lead to a +deadlock, because, in a configfs-composed gadget when a function is linked +into a configuration with config_usb_cfg_link(), usb_get_function() +is called, which then calls rndis_alloc(), which tries locking the same +mutex and (wrongly) finds it already locked. + +This patch eliminates NUL terminating of the (sub)compatible id. + +Fixes: da4243145fb1: "usb: gadget: configfs: OS Extended Compatibility descriptors support" +Reported-by: Dan Carpenter +Signed-off-by: Andrzej Pietrasiewicz +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/configfs.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1161,7 +1161,6 @@ static ssize_t interf_grp_compatible_id_ + if (desc->opts_mutex) + mutex_lock(desc->opts_mutex); + memcpy(desc->ext_compat_id, page, l); +- desc->ext_compat_id[l] = '\0'; + + if (desc->opts_mutex) + mutex_unlock(desc->opts_mutex); +@@ -1192,7 +1191,6 @@ static ssize_t interf_grp_sub_compatible + if (desc->opts_mutex) + mutex_lock(desc->opts_mutex); + memcpy(desc->ext_compat_id + 8, page, l); +- desc->ext_compat_id[l + 8] = '\0'; + + if (desc->opts_mutex) + mutex_unlock(desc->opts_mutex); diff --git a/queue-3.19/usb-mxuport-fix-null-deref-when-used-as-a-console.patch b/queue-3.19/usb-mxuport-fix-null-deref-when-used-as-a-console.patch new file mode 100644 index 00000000000..95398c7fad5 --- /dev/null +++ b/queue-3.19/usb-mxuport-fix-null-deref-when-used-as-a-console.patch @@ -0,0 +1,34 @@ +From db81de767e375743ebb0ad2bcad3326962c2b67e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 18 Feb 2015 11:51:07 +0700 +Subject: USB: mxuport: fix null deref when used as a console + +From: Johan Hovold + +commit db81de767e375743ebb0ad2bcad3326962c2b67e upstream. + +Fix null-pointer dereference at probe when the device is used as a +console, in which case the tty argument to open will be NULL. + +Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX +driver") +Signed-off-by: Johan Hovold +Acked-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mxuport.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/mxuport.c ++++ b/drivers/usb/serial/mxuport.c +@@ -1284,7 +1284,8 @@ static int mxuport_open(struct tty_struc + } + + /* Initial port termios */ +- mxuport_set_termios(tty, port, NULL); ++ if (tty) ++ mxuport_set_termios(tty, port, NULL); + + /* + * TODO: use RQ_VENDOR_GET_MSR, once we know what it diff --git a/queue-3.19/usb-serial-cp210x-adding-seletek-device-id-s.patch b/queue-3.19/usb-serial-cp210x-adding-seletek-device-id-s.patch new file mode 100644 index 00000000000..70be7e713e7 --- /dev/null +++ b/queue-3.19/usb-serial-cp210x-adding-seletek-device-id-s.patch @@ -0,0 +1,32 @@ +From 675af70856d7cc026be8b6ea7a8b9db10b8b38a1 Mon Sep 17 00:00:00 2001 +From: Michiel vd Garde +Date: Fri, 27 Feb 2015 02:08:29 +0100 +Subject: USB: serial: cp210x: Adding Seletek device id's + +From: Michiel vd Garde + +commit 675af70856d7cc026be8b6ea7a8b9db10b8b38a1 upstream. + +These device ID's are not associated with the cp210x module currently, +but should be. This patch allows the devices to operate upon connecting +them to the usb bus as intended. + +Signed-off-by: Michiel van de Garde +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -147,6 +147,8 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */ + { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */ + { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */ ++ { USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */ ++ { USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */ + { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */ + { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */ + { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */ diff --git a/queue-3.19/usb-serial-fix-infinite-wait_until_sent-timeout.patch b/queue-3.19/usb-serial-fix-infinite-wait_until_sent-timeout.patch new file mode 100644 index 00000000000..b89363174ff --- /dev/null +++ b/queue-3.19/usb-serial-fix-infinite-wait_until_sent-timeout.patch @@ -0,0 +1,44 @@ +From f528bf4f57e43d1af4b2a5c97f09e43e0338c105 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 4 Mar 2015 10:39:05 +0100 +Subject: USB: serial: fix infinite wait_until_sent timeout + +From: Johan Hovold + +commit f528bf4f57e43d1af4b2a5c97f09e43e0338c105 upstream. + +Make sure to handle an infinite timeout (0). + +Note that wait_until_sent is currently never called with a 0-timeout +argument due to a bug in tty_wait_until_sent. + +Fixes: dcf010503966 ("USB: serial: add generic wait_until_sent +implementation") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/generic.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/generic.c ++++ b/drivers/usb/serial/generic.c +@@ -258,7 +258,8 @@ void usb_serial_generic_wait_until_sent( + * character or at least one jiffy. + */ + period = max_t(unsigned long, (10 * HZ / bps), 1); +- period = min_t(unsigned long, period, timeout); ++ if (timeout) ++ period = min_t(unsigned long, period, timeout); + + dev_dbg(&port->dev, "%s - timeout = %u ms, period = %u ms\n", + __func__, jiffies_to_msecs(timeout), +@@ -268,7 +269,7 @@ void usb_serial_generic_wait_until_sent( + schedule_timeout_interruptible(period); + if (signal_pending(current)) + break; +- if (time_after(jiffies, expire)) ++ if (timeout && time_after(jiffies, expire)) + break; + } + } diff --git a/queue-3.19/usb-serial-fix-potential-use-after-free-after-failed-probe.patch b/queue-3.19/usb-serial-fix-potential-use-after-free-after-failed-probe.patch new file mode 100644 index 00000000000..5607a3878b5 --- /dev/null +++ b/queue-3.19/usb-serial-fix-potential-use-after-free-after-failed-probe.patch @@ -0,0 +1,34 @@ +From 07fdfc5e9f1c966be8722e8fa927e5ea140df5ce Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 18 Feb 2015 10:34:50 +0700 +Subject: USB: serial: fix potential use-after-free after failed probe + +From: Johan Hovold + +commit 07fdfc5e9f1c966be8722e8fa927e5ea140df5ce upstream. + +Fix return value in probe error path, which could end up returning +success (0) on errors. This could in turn lead to use-after-free or +double free (e.g. in port_remove) when the port device is removed. + +Fixes: c706ebdfc895 ("USB: usb-serial: call port_probe and port_remove +at the right times") +Signed-off-by: Johan Hovold +Acked-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/bus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/bus.c ++++ b/drivers/usb/serial/bus.c +@@ -75,7 +75,7 @@ static int usb_serial_device_probe(struc + retval = device_create_file(dev, &dev_attr_port_number); + if (retval) { + if (driver->port_remove) +- retval = driver->port_remove(port); ++ driver->port_remove(port); + goto exit_with_autopm; + } + diff --git a/queue-3.19/usb-serial-fix-tty-device-error-handling-at-probe.patch b/queue-3.19/usb-serial-fix-tty-device-error-handling-at-probe.patch new file mode 100644 index 00000000000..a45b1b79056 --- /dev/null +++ b/queue-3.19/usb-serial-fix-tty-device-error-handling-at-probe.patch @@ -0,0 +1,50 @@ +From ca4383a3947a83286bc9b9c598a1f55e867871d7 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 18 Feb 2015 10:34:51 +0700 +Subject: USB: serial: fix tty-device error handling at probe + +From: Johan Hovold + +commit ca4383a3947a83286bc9b9c598a1f55e867871d7 upstream. + +Add missing error handling when registering the tty device at port +probe. This avoids trying to remove an uninitialised character device +when the port device is removed. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Takashi Iwai +Signed-off-by: Johan Hovold +Acked-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/bus.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/bus.c ++++ b/drivers/usb/serial/bus.c +@@ -51,6 +51,7 @@ static int usb_serial_device_probe(struc + { + struct usb_serial_driver *driver; + struct usb_serial_port *port; ++ struct device *tty_dev; + int retval = 0; + int minor; + +@@ -80,7 +81,15 @@ static int usb_serial_device_probe(struc + } + + minor = port->minor; +- tty_register_device(usb_serial_tty_driver, minor, dev); ++ tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev); ++ if (IS_ERR(tty_dev)) { ++ retval = PTR_ERR(tty_dev); ++ device_remove_file(dev, &dev_attr_port_number); ++ if (driver->port_remove) ++ driver->port_remove(port); ++ goto exit_with_autopm; ++ } ++ + dev_info(&port->serial->dev->dev, + "%s converter now attached to ttyUSB%d\n", + driver->description, minor); diff --git a/queue-3.19/usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch b/queue-3.19/usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch new file mode 100644 index 00000000000..b2f30a345ee --- /dev/null +++ b/queue-3.19/usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch @@ -0,0 +1,41 @@ +From f0c2b68198589249afd2b1f2c4e8de8c03e19c16 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 13 Feb 2015 10:54:53 -0500 +Subject: USB: usbfs: don't leak kernel data in siginfo + +From: Alan Stern + +commit f0c2b68198589249afd2b1f2c4e8de8c03e19c16 upstream. + +When a signal is delivered, the information in the siginfo structure +is copied to userspace. Good security practice dicatates that the +unused fields in this structure should be initialized to 0 so that +random kernel stack data isn't exposed to the user. This patch adds +such an initialization to the two places where usbfs raises signals. + +Signed-off-by: Alan Stern +Reported-by: Dave Mielke +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -501,6 +501,7 @@ static void async_completed(struct urb * + as->status = urb->status; + signr = as->signr; + if (signr) { ++ memset(&sinfo, 0, sizeof(sinfo)); + sinfo.si_signo = as->signr; + sinfo.si_errno = as->status; + sinfo.si_code = SI_ASYNCIO; +@@ -2371,6 +2372,7 @@ static void usbdev_remove(struct usb_dev + wake_up_all(&ps->wait); + list_del_init(&ps->list); + if (ps->discsignr) { ++ memset(&sinfo, 0, sizeof(sinfo)); + sinfo.si_signo = ps->discsignr; + sinfo.si_errno = EPIPE; + sinfo.si_code = SI_ASYNCIO; diff --git a/queue-3.19/usb-xhci-platform-move-the-marvell-quirks-after-the-enabling-the-clocks.patch b/queue-3.19/usb-xhci-platform-move-the-marvell-quirks-after-the-enabling-the-clocks.patch new file mode 100644 index 00000000000..5fe1ebc5ca5 --- /dev/null +++ b/queue-3.19/usb-xhci-platform-move-the-marvell-quirks-after-the-enabling-the-clocks.patch @@ -0,0 +1,69 @@ +From 1e7e4fb66489cc84366656ca5318f1cb61afd4ba Mon Sep 17 00:00:00 2001 +From: Maxime Ripard +Date: Tue, 24 Feb 2015 18:27:00 +0200 +Subject: usb: XHCI: platform: Move the Marvell quirks after the enabling the clocks + +From: Maxime Ripard + +commit 1e7e4fb66489cc84366656ca5318f1cb61afd4ba upstream. + +The commit 973747928514 ("usb: host: xhci-plat: add support for the Armada +375/38x XHCI controllers") extended the xhci-plat driver to support the Armada +375/38x SoCs, mostly by adding a quirk configuring the MBUS window. + +However, that quirk was run before the clock the controllers needs has been +enabled. This usually worked because the clock was first enabled by the +bootloader, and left as such until the driver is probe, where it tries to +access the MBUS configuration registers before enabling the clock. + +Things get messy when EPROBE_DEFER is involved during the probe, since as part +of its error path, the driver will rightfully disable the clock. When the +driver will be reprobed, it will retry to access the MBUS registers, but this +time with the clock disabled, which hangs forever. + +Fix this by running the quirks after the clock has been enabled by the driver. + +Signed-off-by: Maxime Ripard +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-plat.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -83,16 +83,6 @@ static int xhci_plat_probe(struct platfo + if (irq < 0) + return -ENODEV; + +- +- if (of_device_is_compatible(pdev->dev.of_node, +- "marvell,armada-375-xhci") || +- of_device_is_compatible(pdev->dev.of_node, +- "marvell,armada-380-xhci")) { +- ret = xhci_mvebu_mbus_init_quirk(pdev); +- if (ret) +- return ret; +- } +- + /* Initialize dma_mask and coherent_dma_mask to 32-bits */ + ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (ret) +@@ -127,6 +117,15 @@ static int xhci_plat_probe(struct platfo + goto put_hcd; + } + ++ if (of_device_is_compatible(pdev->dev.of_node, ++ "marvell,armada-375-xhci") || ++ of_device_is_compatible(pdev->dev.of_node, ++ "marvell,armada-380-xhci")) { ++ ret = xhci_mvebu_mbus_init_quirk(pdev); ++ if (ret) ++ goto disable_clk; ++ } ++ + ret = usb_add_hcd(hcd, irq, IRQF_SHARED); + if (ret) + goto disable_clk; diff --git a/queue-3.19/xhci-allocate-correct-amount-of-scratchpad-buffers.patch b/queue-3.19/xhci-allocate-correct-amount-of-scratchpad-buffers.patch new file mode 100644 index 00000000000..dff34107292 --- /dev/null +++ b/queue-3.19/xhci-allocate-correct-amount-of-scratchpad-buffers.patch @@ -0,0 +1,42 @@ +From 6596a926b0b6c80b730a1dd2fa91908e0a539c37 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 24 Feb 2015 18:27:01 +0200 +Subject: xhci: Allocate correct amount of scratchpad buffers + +From: Mathias Nyman + +commit 6596a926b0b6c80b730a1dd2fa91908e0a539c37 upstream. + +Include the high order bit fields for Max scratchpad buffers when +calculating how many scratchpad buffers are needed. + +I'm suprised this hasn't caused more issues, we never allocated more than +32 buffers even if xhci needed more. Either we got lucky and xhci never +really used past that area, or then we got enough zeroed dma memory anyway. + +Should be backported as far back as possible + +Reported-by: Tim Chen +Tested-by: Tim Chen +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -88,9 +88,10 @@ struct xhci_cap_regs { + #define HCS_IST(p) (((p) >> 0) & 0xf) + /* bits 4:7, max number of Event Ring segments */ + #define HCS_ERST_MAX(p) (((p) >> 4) & 0xf) ++/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */ + /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */ +-/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */ +-#define HCS_MAX_SCRATCHPAD(p) (((p) >> 27) & 0x1f) ++/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */ ++#define HCS_MAX_SCRATCHPAD(p) ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f)) + + /* HCSPARAMS3 - hcs_params3 - bitmasks */ + /* bits 0:7, Max U1 to U0 latency for the roothub ports */ diff --git a/queue-3.19/xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch b/queue-3.19/xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch new file mode 100644 index 00000000000..b551d442635 --- /dev/null +++ b/queue-3.19/xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch @@ -0,0 +1,79 @@ +From 45ba2154d12fc43b70312198ec47085f10be801a Mon Sep 17 00:00:00 2001 +From: Aleksander Morgado +Date: Fri, 6 Mar 2015 17:14:21 +0200 +Subject: xhci: fix reporting of 0-sized URBs in control endpoint + +From: Aleksander Morgado + +commit 45ba2154d12fc43b70312198ec47085f10be801a upstream. + +When a control transfer has a short data stage, the xHCI controller generates +two transfer events: a COMP_SHORT_TX event that specifies the untransferred +amount, and a COMP_SUCCESS event. But when the data stage is not short, only the +COMP_SUCCESS event occurs. Therefore, xhci-hcd must set urb->actual_length to +urb->transfer_buffer_length while processing the COMP_SUCCESS event, unless +urb->actual_length was set already by a previous COMP_SHORT_TX event. + +The driver checks this by seeing whether urb->actual_length == 0, but this alone +is the wrong test, as it is entirely possible for a short transfer to have an +urb->actual_length = 0. + +This patch changes the xhci driver to rely on a new td->urb_length_set flag, +which is set to true when a COMP_SHORT_TX event is received and the URB length +updated at that stage. + +This fixes a bug which affected the HSO plugin, which relies on URBs with +urb->actual_length == 0 to halt re-submitting the RX URB in the control +endpoint. + +Signed-off-by: Aleksander Morgado +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 10 ++++++++-- + drivers/usb/host/xhci.h | 3 +++ + 2 files changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1946,7 +1946,7 @@ static int process_ctrl_td(struct xhci_h + if (event_trb != ep_ring->dequeue) { + /* The event was for the status stage */ + if (event_trb == td->last_trb) { +- if (td->urb->actual_length != 0) { ++ if (td->urb_length_set) { + /* Don't overwrite a previously set error code + */ + if ((*status == -EINPROGRESS || *status == 0) && +@@ -1960,7 +1960,13 @@ static int process_ctrl_td(struct xhci_h + td->urb->transfer_buffer_length; + } + } else { +- /* Maybe the event was for the data stage? */ ++ /* ++ * Maybe the event was for the data stage? If so, update ++ * already the actual_length of the URB and flag it as ++ * set, so that it is not overwritten in the event for ++ * the last TRB. ++ */ ++ td->urb_length_set = true; + td->urb->actual_length = + td->urb->transfer_buffer_length - + EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)); +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1,3 +1,4 @@ ++ + /* + * xHCI host controller driver + * +@@ -1289,6 +1290,8 @@ struct xhci_td { + struct xhci_segment *start_seg; + union xhci_trb *first_trb; + union xhci_trb *last_trb; ++ /* actual_length of the URB has already been set */ ++ bool urb_length_set; + }; + + /* xHCI command default timeout value */ diff --git a/queue-3.19/xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch b/queue-3.19/xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch new file mode 100644 index 00000000000..4e9fc0e0d9f --- /dev/null +++ b/queue-3.19/xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch @@ -0,0 +1,104 @@ +From b8cb91e058cd0c0f02059c1207293c5b31d350fa Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 6 Mar 2015 17:23:19 +0200 +Subject: xhci: Workaround for PME stuck issues in Intel xhci + +From: Mathias Nyman + +commit b8cb91e058cd0c0f02059c1207293c5b31d350fa upstream. + +The xhci in Intel Sunrisepoint and Cherryview platforms need a driver +workaround for a Stuck PME that might either block PME events in suspend, +or create spurious PME events preventing runtime suspend. + +Workaround is to clear a internal PME flag, BIT(28) in a vendor specific +PMCTRL register at offset 0x80a4, in both suspend resume callbacks + +Without this, xhci connected usb devices might never be able to wake up the +system from suspend, or prevent device from going to suspend (xhci d3) + +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-pci.c | 30 ++++++++++++++++++++++++++++++ + drivers/usb/host/xhci.h | 1 + + 2 files changed, 31 insertions(+) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -37,6 +37,9 @@ + + #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31 + #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31 ++#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5 ++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f ++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f + + static const char hcd_name[] = "xhci_hcd"; + +@@ -133,6 +136,12 @@ static void xhci_pci_quirks(struct devic + pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) { + xhci->quirks |= XHCI_SPURIOUS_REBOOT; + } ++ if (pdev->vendor == PCI_VENDOR_ID_INTEL && ++ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) { ++ xhci->quirks |= XHCI_PME_STUCK_QUIRK; ++ } + if (pdev->vendor == PCI_VENDOR_ID_ETRON && + pdev->device == PCI_DEVICE_ID_EJ168) { + xhci->quirks |= XHCI_RESET_ON_RESUME; +@@ -159,6 +168,21 @@ static void xhci_pci_quirks(struct devic + "QUIRK: Resetting on resume"); + } + ++/* ++ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear ++ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4 ++ */ ++static void xhci_pme_quirk(struct xhci_hcd *xhci) ++{ ++ u32 val; ++ void __iomem *reg; ++ ++ reg = (void __iomem *) xhci->cap_regs + 0x80a4; ++ val = readl(reg); ++ writel(val | BIT(28), reg); ++ readl(reg); ++} ++ + /* called during probe() after chip reset completes */ + static int xhci_pci_setup(struct usb_hcd *hcd) + { +@@ -283,6 +307,9 @@ static int xhci_pci_suspend(struct usb_h + if (xhci->quirks & XHCI_COMP_MODE_QUIRK) + pdev->no_d3cold = true; + ++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK) ++ xhci_pme_quirk(xhci); ++ + return xhci_suspend(xhci, do_wakeup); + } + +@@ -313,6 +340,9 @@ static int xhci_pci_resume(struct usb_hc + if (pdev->vendor == PCI_VENDOR_ID_INTEL) + usb_enable_intel_xhci_ports(pdev); + ++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK) ++ xhci_pme_quirk(xhci); ++ + retval = xhci_resume(xhci, hibernated); + return retval; + } +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1564,6 +1564,7 @@ struct xhci_hcd { + #define XHCI_SPURIOUS_WAKEUP (1 << 18) + /* For controllers with a broken beyond repair streams implementation */ + #define XHCI_BROKEN_STREAMS (1 << 19) ++#define XHCI_PME_STUCK_QUIRK (1 << 20) + unsigned int num_active_eps; + unsigned int limit_active_eps; + /* There are two roothubs to keep track of bus suspend info for */