From: Greg Kroah-Hartman Date: Mon, 5 Sep 2016 14:20:27 +0000 (+0200) Subject: 3.14-stable patches X-Git-Tag: v3.14.78~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=41792568f40d2a4bc9335a1444b5470633ab3cf9;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: acpi-sysfs-fix-error-code-in-get_status.patch crypto-nx-off-by-one-bug-in-nx_of_update_msc.patch input-i8042-break-load-dependency-between-atkbd-psmouse-and-i8042.patch input-i8042-set-up-shared-ps2_cmd_mutex-for-aux-ports.patch input-tegra-kbc-fix-inverted-reset-logic.patch staging-comedi-daqboard2000-bug-fix-board-type-matching-code.patch usb-fix-typo-in-wmaxpacketsize-validation.patch usb-serial-mos7720-fix-non-atomic-allocation-in-write-path.patch usb-serial-mos7840-fix-non-atomic-allocation-in-write-path.patch --- diff --git a/queue-3.14/acpi-sysfs-fix-error-code-in-get_status.patch b/queue-3.14/acpi-sysfs-fix-error-code-in-get_status.patch new file mode 100644 index 00000000000..faec169dc5b --- /dev/null +++ b/queue-3.14/acpi-sysfs-fix-error-code-in-get_status.patch @@ -0,0 +1,55 @@ +From f18ebc211e259d4f591e39e74b2aa2de226c9a1d Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 5 May 2016 16:23:04 +0300 +Subject: ACPI / sysfs: fix error code in get_status() + +From: Dan Carpenter + +commit f18ebc211e259d4f591e39e74b2aa2de226c9a1d upstream. + +The problem with ornamental, do-nothing gotos is that they lead to +"forgot to set the error code" bugs. We should be returning -EINVAL +here but we don't. It leads to an uninitalized variable in +counter_show(): + + drivers/acpi/sysfs.c:603 counter_show() + error: uninitialized symbol 'status'. + +Fixes: 1c8fce27e275 (ACPI: introduce drivers/acpi/sysfs.c) +Signed-off-by: Dan Carpenter +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/sysfs.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -494,23 +494,22 @@ static void acpi_global_event_handler(u3 + static int get_status(u32 index, acpi_event_status *status, + acpi_handle *handle) + { +- int result = 0; ++ int result; + + if (index >= num_gpes + ACPI_NUM_FIXED_EVENTS) +- goto end; ++ return -EINVAL; + + if (index < num_gpes) { + result = acpi_get_gpe_device(index, handle); + if (result) { + ACPI_EXCEPTION((AE_INFO, AE_NOT_FOUND, + "Invalid GPE 0x%x", index)); +- goto end; ++ return result; + } + result = acpi_get_gpe_status(*handle, index, status); + } else if (index < (num_gpes + ACPI_NUM_FIXED_EVENTS)) + result = acpi_get_event_status(index - num_gpes, status); + +-end: + return result; + } + diff --git a/queue-3.14/crypto-nx-off-by-one-bug-in-nx_of_update_msc.patch b/queue-3.14/crypto-nx-off-by-one-bug-in-nx_of_update_msc.patch new file mode 100644 index 00000000000..3520d45afeb --- /dev/null +++ b/queue-3.14/crypto-nx-off-by-one-bug-in-nx_of_update_msc.patch @@ -0,0 +1,36 @@ +From e514cc0a492a3f39ef71b31590a7ef67537ee04b Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 15 Jul 2016 14:09:13 +0300 +Subject: crypto: nx - off by one bug in nx_of_update_msc() + +From: Dan Carpenter + +commit e514cc0a492a3f39ef71b31590a7ef67537ee04b upstream. + +The props->ap[] array is defined like this: + + struct alg_props ap[NX_MAX_FC][NX_MAX_MODE][3]; + +So we can see that if msc->fc and msc->mode are == to NX_MAX_FC or +NX_MAX_MODE then we're off by one. + +Fixes: ae0222b7289d ('powerpc/crypto: nx driver code supporting nx encryption') +Signed-off-by: Dan Carpenter +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/nx/nx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/nx/nx.c ++++ b/drivers/crypto/nx/nx.c +@@ -330,7 +330,7 @@ static void nx_of_update_msc(struct devi + ((bytes_so_far + sizeof(struct msc_triplet)) <= lenp) && + i < msc->triplets; + i++) { +- if (msc->fc > NX_MAX_FC || msc->mode > NX_MAX_MODE) { ++ if (msc->fc >= NX_MAX_FC || msc->mode >= NX_MAX_MODE) { + dev_err(dev, "unknown function code/mode " + "combo: %d/%d (ignored)\n", msc->fc, + msc->mode); diff --git a/queue-3.14/input-i8042-break-load-dependency-between-atkbd-psmouse-and-i8042.patch b/queue-3.14/input-i8042-break-load-dependency-between-atkbd-psmouse-and-i8042.patch new file mode 100644 index 00000000000..3b32c4b6492 --- /dev/null +++ b/queue-3.14/input-i8042-break-load-dependency-between-atkbd-psmouse-and-i8042.patch @@ -0,0 +1,168 @@ +From 4097461897df91041382ff6fcd2bfa7ee6b2448c Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Mon, 25 Jul 2016 11:36:54 -0700 +Subject: Input: i8042 - break load dependency between atkbd/psmouse and i8042 + +From: Dmitry Torokhov + +commit 4097461897df91041382ff6fcd2bfa7ee6b2448c upstream. + +As explained in 1407814240-4275-1-git-send-email-decui@microsoft.com we +have a hard load dependency between i8042 and atkbd which prevents +keyboard from working on Gen2 Hyper-V VMs. + +> hyperv_keyboard invokes serio_interrupt(), which needs a valid serio +> driver like atkbd.c. atkbd.c depends on libps2.c because it invokes +> ps2_command(). libps2.c depends on i8042.c because it invokes +> i8042_check_port_owner(). As a result, hyperv_keyboard actually +> depends on i8042.c. +> +> For a Generation 2 Hyper-V VM (meaning no i8042 device emulated), if a +> Linux VM (like Arch Linux) happens to configure CONFIG_SERIO_I8042=m +> rather than =y, atkbd.ko can't load because i8042.ko can't load(due to +> no i8042 device emulated) and finally hyperv_keyboard can't work and +> the user can't input: https://bugs.archlinux.org/task/39820 +> (Ubuntu/RHEL/SUSE aren't affected since they use CONFIG_SERIO_I8042=y) + +To break the dependency we move away from using i8042_check_port_owner() +and instead allow serio port owner specify a mutex that clients should use +to serialize PS/2 command stream. + +Reported-by: Mark Laws +Tested-by: Mark Laws +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/i8042.c | 16 +--------------- + drivers/input/serio/libps2.c | 10 ++++------ + include/linux/i8042.h | 6 ------ + include/linux/serio.h | 24 +++++++++++++++++++----- + 4 files changed, 24 insertions(+), 32 deletions(-) + +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -1230,6 +1230,7 @@ static int __init i8042_create_kbd_port( + serio->start = i8042_start; + serio->stop = i8042_stop; + serio->close = i8042_port_close; ++ serio->ps2_cmd_mutex = &i8042_mutex; + serio->port_data = port; + serio->dev.parent = &i8042_platform_device->dev; + strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name)); +@@ -1321,21 +1322,6 @@ static void i8042_unregister_ports(void) + } + } + +-/* +- * Checks whether port belongs to i8042 controller. +- */ +-bool i8042_check_port_owner(const struct serio *port) +-{ +- int i; +- +- for (i = 0; i < I8042_NUM_PORTS; i++) +- if (i8042_ports[i].serio == port) +- return true; +- +- return false; +-} +-EXPORT_SYMBOL(i8042_check_port_owner); +- + static void i8042_free_irqs(void) + { + if (i8042_aux_irq_registered) +--- a/drivers/input/serio/libps2.c ++++ b/drivers/input/serio/libps2.c +@@ -56,19 +56,17 @@ EXPORT_SYMBOL(ps2_sendbyte); + + void ps2_begin_command(struct ps2dev *ps2dev) + { +- mutex_lock(&ps2dev->cmd_mutex); ++ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex; + +- if (i8042_check_port_owner(ps2dev->serio)) +- i8042_lock_chip(); ++ mutex_lock(m); + } + EXPORT_SYMBOL(ps2_begin_command); + + void ps2_end_command(struct ps2dev *ps2dev) + { +- if (i8042_check_port_owner(ps2dev->serio)) +- i8042_unlock_chip(); ++ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex; + +- mutex_unlock(&ps2dev->cmd_mutex); ++ mutex_unlock(m); + } + EXPORT_SYMBOL(ps2_end_command); + +--- a/include/linux/i8042.h ++++ b/include/linux/i8042.h +@@ -62,7 +62,6 @@ struct serio; + void i8042_lock_chip(void); + void i8042_unlock_chip(void); + int i8042_command(unsigned char *param, int command); +-bool i8042_check_port_owner(const struct serio *); + int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str, + struct serio *serio)); + int i8042_remove_filter(bool (*filter)(unsigned char data, unsigned char str, +@@ -83,11 +82,6 @@ static inline int i8042_command(unsigned + return -ENODEV; + } + +-static inline bool i8042_check_port_owner(const struct serio *serio) +-{ +- return false; +-} +- + static inline int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str, + struct serio *serio)) + { +--- a/include/linux/serio.h ++++ b/include/linux/serio.h +@@ -29,7 +29,8 @@ struct serio { + + struct serio_device_id id; + +- spinlock_t lock; /* protects critical sections from port's interrupt handler */ ++ /* Protects critical sections from port's interrupt handler */ ++ spinlock_t lock; + + int (*write)(struct serio *, unsigned char); + int (*open)(struct serio *); +@@ -38,16 +39,29 @@ struct serio { + void (*stop)(struct serio *); + + struct serio *parent; +- struct list_head child_node; /* Entry in parent->children list */ ++ /* Entry in parent->children list */ ++ struct list_head child_node; + struct list_head children; +- unsigned int depth; /* level of nesting in serio hierarchy */ ++ /* Level of nesting in serio hierarchy */ ++ unsigned int depth; + +- struct serio_driver *drv; /* accessed from interrupt, must be protected by serio->lock and serio->sem */ +- struct mutex drv_mutex; /* protects serio->drv so attributes can pin driver */ ++ /* ++ * serio->drv is accessed from interrupt handlers; when modifying ++ * caller should acquire serio->drv_mutex and serio->lock. ++ */ ++ struct serio_driver *drv; ++ /* Protects serio->drv so attributes can pin current driver */ ++ struct mutex drv_mutex; + + struct device dev; + + struct list_head node; ++ ++ /* ++ * For use by PS/2 layer when several ports share hardware and ++ * may get indigestion when exposed to concurrent access (i8042). ++ */ ++ struct mutex *ps2_cmd_mutex; + }; + #define to_serio_port(d) container_of(d, struct serio, dev) + diff --git a/queue-3.14/input-i8042-set-up-shared-ps2_cmd_mutex-for-aux-ports.patch b/queue-3.14/input-i8042-set-up-shared-ps2_cmd_mutex-for-aux-ports.patch new file mode 100644 index 00000000000..e4f5b6c3742 --- /dev/null +++ b/queue-3.14/input-i8042-set-up-shared-ps2_cmd_mutex-for-aux-ports.patch @@ -0,0 +1,34 @@ +From 47af45d684b5f3ae000ad448db02ce4f13f73273 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Tue, 16 Aug 2016 17:38:54 -0700 +Subject: Input: i8042 - set up shared ps2_cmd_mutex for AUX ports + +From: Dmitry Torokhov + +commit 47af45d684b5f3ae000ad448db02ce4f13f73273 upstream. + +The commit 4097461897df ("Input: i8042 - break load dependency ...") +correctly set up ps2_cmd_mutex pointer for the KBD port but forgot to do +the same for AUX port(s), which results in communication on KBD and AUX +ports to clash with each other. + +Fixes: 4097461897df ("Input: i8042 - break load dependency ...") +Reported-by: Bruno Wolff III +Tested-by: Bruno Wolff III +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/i8042.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -1258,6 +1258,7 @@ static int __init i8042_create_aux_port( + serio->write = i8042_aux_write; + serio->start = i8042_start; + serio->stop = i8042_stop; ++ serio->ps2_cmd_mutex = &i8042_mutex; + serio->port_data = port; + serio->dev.parent = &i8042_platform_device->dev; + if (idx < 0) { diff --git a/queue-3.14/input-tegra-kbc-fix-inverted-reset-logic.patch b/queue-3.14/input-tegra-kbc-fix-inverted-reset-logic.patch new file mode 100644 index 00000000000..cc2bb0eeed4 --- /dev/null +++ b/queue-3.14/input-tegra-kbc-fix-inverted-reset-logic.patch @@ -0,0 +1,35 @@ +From fae16989be77b09bab86c79233e4b511ea769cea Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Mon, 22 Aug 2016 13:25:56 -0700 +Subject: Input: tegra-kbc - fix inverted reset logic + +From: Masahiro Yamada + +commit fae16989be77b09bab86c79233e4b511ea769cea upstream. + +Commit fe6b0dfaba68 ("Input: tegra-kbc - use reset framework") +accidentally converted _deassert to _assert, so there is no code +to wake up this hardware. + +Fixes: fe6b0dfaba68 ("Input: tegra-kbc - use reset framework") +Signed-off-by: Masahiro Yamada +Acked-by: Thierry Reding +Acked-by: Laxman Dewangan +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/keyboard/tegra-kbc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/keyboard/tegra-kbc.c ++++ b/drivers/input/keyboard/tegra-kbc.c +@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_ + /* Reset the KBC controller to clear all previous status.*/ + reset_control_assert(kbc->rst); + udelay(100); +- reset_control_assert(kbc->rst); ++ reset_control_deassert(kbc->rst); + udelay(100); + + tegra_kbc_config_pins(kbc); diff --git a/queue-3.14/series b/queue-3.14/series index e34d65d551d..438887cea4a 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -24,3 +24,12 @@ cdc-acm-fix-wrong-pipe-type-on-rx-interrupt-xfers.patch megaraid_sas-fix-probing-cards-without-io-port.patch gpio-fix-of-build-problem-on-um.patch fs-seq_file-fix-out-of-bounds-read.patch +input-tegra-kbc-fix-inverted-reset-logic.patch +input-i8042-break-load-dependency-between-atkbd-psmouse-and-i8042.patch +input-i8042-set-up-shared-ps2_cmd_mutex-for-aux-ports.patch +crypto-nx-off-by-one-bug-in-nx_of_update_msc.patch +usb-fix-typo-in-wmaxpacketsize-validation.patch +usb-serial-mos7720-fix-non-atomic-allocation-in-write-path.patch +usb-serial-mos7840-fix-non-atomic-allocation-in-write-path.patch +staging-comedi-daqboard2000-bug-fix-board-type-matching-code.patch +acpi-sysfs-fix-error-code-in-get_status.patch diff --git a/queue-3.14/staging-comedi-daqboard2000-bug-fix-board-type-matching-code.patch b/queue-3.14/staging-comedi-daqboard2000-bug-fix-board-type-matching-code.patch new file mode 100644 index 00000000000..635c4592f2b --- /dev/null +++ b/queue-3.14/staging-comedi-daqboard2000-bug-fix-board-type-matching-code.patch @@ -0,0 +1,35 @@ +From 80e162ee9b31d77d851b10f8c5299132be1e120f Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 29 Jun 2016 20:27:44 +0100 +Subject: staging: comedi: daqboard2000: bug fix board type matching code + +From: Ian Abbott + +commit 80e162ee9b31d77d851b10f8c5299132be1e120f upstream. + +`daqboard2000_find_boardinfo()` is supposed to check if the +DaqBoard/2000 series model is supported, based on the PCI subvendor and +subdevice ID. The current code is wrong as it is comparing the PCI +device's subdevice ID to an expected, fixed value for the subvendor ID. +It should be comparing the PCI device's subvendor ID to this fixed +value. Correct it. + +Fixes: 7e8401b23e7f ("staging: comedi: daqboard2000: add back subsystem_device check") +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/daqboard2000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/daqboard2000.c ++++ b/drivers/staging/comedi/drivers/daqboard2000.c +@@ -658,7 +658,7 @@ static const void *daqboard2000_find_boa + const struct daq200_boardtype *board; + int i; + +- if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH) ++ if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH) + return NULL; + + for (i = 0; i < ARRAY_SIZE(boardtypes); i++) { diff --git a/queue-3.14/usb-fix-typo-in-wmaxpacketsize-validation.patch b/queue-3.14/usb-fix-typo-in-wmaxpacketsize-validation.patch new file mode 100644 index 00000000000..cbfe06cf5aa --- /dev/null +++ b/queue-3.14/usb-fix-typo-in-wmaxpacketsize-validation.patch @@ -0,0 +1,31 @@ +From 6c73358c83ce870c0cf32413e5cadb3b9a39c606 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 22 Aug 2016 16:58:53 -0400 +Subject: USB: fix typo in wMaxPacketSize validation + +From: Alan Stern + +commit 6c73358c83ce870c0cf32413e5cadb3b9a39c606 upstream. + +The maximum value allowed for wMaxPacketSize of a high-speed interrupt +endpoint is 1024 bytes, not 1023. + +Signed-off-by: Alan Stern +Fixes: aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/config.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -159,7 +159,7 @@ static const unsigned short high_speed_m + [USB_ENDPOINT_XFER_CONTROL] = 64, + [USB_ENDPOINT_XFER_ISOC] = 1024, + [USB_ENDPOINT_XFER_BULK] = 512, +- [USB_ENDPOINT_XFER_INT] = 1023, ++ [USB_ENDPOINT_XFER_INT] = 1024, + }; + static const unsigned short super_speed_maxpacket_maxes[4] = { + [USB_ENDPOINT_XFER_CONTROL] = 512, diff --git a/queue-3.14/usb-serial-mos7720-fix-non-atomic-allocation-in-write-path.patch b/queue-3.14/usb-serial-mos7720-fix-non-atomic-allocation-in-write-path.patch new file mode 100644 index 00000000000..d225415d14f --- /dev/null +++ b/queue-3.14/usb-serial-mos7720-fix-non-atomic-allocation-in-write-path.patch @@ -0,0 +1,36 @@ +From 5a5a1d614287a647b36dff3f40c2b0ceabbc83ec Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Fri, 12 Aug 2016 01:05:08 +0300 +Subject: USB: serial: mos7720: fix non-atomic allocation in write path + +From: Alexey Khoroshilov + +commit 5a5a1d614287a647b36dff3f40c2b0ceabbc83ec upstream. + +There is an allocation with GFP_KERNEL flag in mos7720_write(), +while it may be called from interrupt context. + +Follow-up for commit 191252837626 ("USB: kobil_sct: fix non-atomic +allocation in write path") + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7720.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -1239,7 +1239,7 @@ static int mos7720_write(struct tty_stru + + if (urb->transfer_buffer == NULL) { + urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!urb->transfer_buffer) + goto exit; + } diff --git a/queue-3.14/usb-serial-mos7840-fix-non-atomic-allocation-in-write-path.patch b/queue-3.14/usb-serial-mos7840-fix-non-atomic-allocation-in-write-path.patch new file mode 100644 index 00000000000..d1f8b0c5c61 --- /dev/null +++ b/queue-3.14/usb-serial-mos7840-fix-non-atomic-allocation-in-write-path.patch @@ -0,0 +1,38 @@ +From 3b7c7e52efda0d4640060de747768360ba70a7c0 Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Fri, 12 Aug 2016 01:05:09 +0300 +Subject: USB: serial: mos7840: fix non-atomic allocation in write path + +From: Alexey Khoroshilov + +commit 3b7c7e52efda0d4640060de747768360ba70a7c0 upstream. + +There is an allocation with GFP_KERNEL flag in mos7840_write(), +while it may be called from interrupt context. + +Follow-up for commit 191252837626 ("USB: kobil_sct: fix non-atomic +allocation in write path") + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7840.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -1372,8 +1372,8 @@ static int mos7840_write(struct tty_stru + } + + if (urb->transfer_buffer == NULL) { +- urb->transfer_buffer = +- kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL); ++ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, ++ GFP_ATOMIC); + if (!urb->transfer_buffer) + goto exit; + }