From: Greg Kroah-Hartman Date: Mon, 10 Nov 2014 05:18:22 +0000 (+0900) Subject: 3.14-stable patches X-Git-Tag: v3.10.60~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=48d151b574cadf2a0714356efa3649b81b240388;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch usb-opticon-fix-non-atomic-allocation-in-write-path.patch usb-remove-references-to-non-existent-plat_s5p-symbol.patch usb-storage-handle-a-skipped-data-phase.patch --- diff --git a/queue-3.14/alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch b/queue-3.14/alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch new file mode 100644 index 00000000000..150f46dc55d --- /dev/null +++ b/queue-3.14/alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch @@ -0,0 +1,103 @@ +From 0725dda207e95ff25f1aa01432250323e0ec49d6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 5 Nov 2014 15:08:49 +0100 +Subject: ALSA: usb-audio: Fix device_del() sysfs warnings at disconnect + +From: Takashi Iwai + +commit 0725dda207e95ff25f1aa01432250323e0ec49d6 upstream. + +Some USB-audio devices show weird sysfs warnings at disconnecting the +devices, e.g. + usb 1-3: USB disconnect, device number 3 + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 973 at fs/sysfs/group.c:216 device_del+0x39/0x180() + sysfs group ffffffff8183df40 not found for kobject 'midiC1D0' + Call Trace: + [] ? dump_stack+0x49/0x71 + [] ? warn_slowpath_common+0x82/0xb0 + [] ? warn_slowpath_fmt+0x45/0x50 + [] ? device_del+0x39/0x180 + [] ? device_unregister+0x9/0x20 + [] ? device_destroy+0x34/0x40 + [] ? snd_unregister_device+0x7f/0xd0 [snd] + [] ? snd_rawmidi_dev_disconnect+0xce/0x100 [snd_rawmidi] + [] ? snd_device_disconnect+0x62/0x90 [snd] + [] ? snd_device_disconnect_all+0x3c/0x60 [snd] + [] ? snd_card_disconnect+0x124/0x1a0 [snd] + [] ? usb_audio_disconnect+0x88/0x1c0 [snd_usb_audio] + [] ? usb_unbind_interface+0x5e/0x1b0 [usbcore] + [] ? __device_release_driver+0x79/0xf0 + [] ? device_release_driver+0x25/0x40 + [] ? bus_remove_device+0xf1/0x130 + [] ? device_del+0x109/0x180 + [] ? usb_disable_device+0x95/0x1f0 [usbcore] + [] ? usb_disconnect+0x8f/0x190 [usbcore] + [] ? hub_thread+0x539/0x13a0 [usbcore] + [] ? sched_clock_local+0x15/0x80 + [] ? sched_clock_cpu+0xb8/0xd0 + [] ? bit_waitqueue+0xb0/0xb0 + [] ? usb_port_resume+0x430/0x430 [usbcore] + [] ? usb_port_resume+0x430/0x430 [usbcore] + [] ? kthread+0xce/0xf0 + [] ? kthread_create_on_node+0x1c0/0x1c0 + [] ? ret_from_fork+0x7c/0xb0 + [] ? kthread_create_on_node+0x1c0/0x1c0 + ---[ end trace 40b1928d1136b91e ]--- + +This comes from the fact that usb-audio driver may receive the +disconnect callback multiple times, per each usb interface. When a +device has both audio and midi interfaces, it gets called twice, and +currently the driver tries to release resources at the last call. +At this point, the first parent interface has been already deleted, +thus deleting a child of the first parent hits such a warning. + +For fixing this problem, we need to call snd_card_disconnect() and +cancel pending operations at the very first disconnect while the +release of the whole objects waits until the last disconnect call. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=80931 +Reported-and-tested-by: Tomas Gayoso +Reported-and-tested-by: Chris J Arges +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -586,18 +586,19 @@ static void snd_usb_audio_disconnect(str + { + struct snd_card *card; + struct list_head *p; ++ bool was_shutdown; + + if (chip == (void *)-1L) + return; + + card = chip->card; + down_write(&chip->shutdown_rwsem); ++ was_shutdown = chip->shutdown; + chip->shutdown = 1; + up_write(&chip->shutdown_rwsem); + + mutex_lock(®ister_mutex); +- chip->num_interfaces--; +- if (chip->num_interfaces <= 0) { ++ if (!was_shutdown) { + struct snd_usb_endpoint *ep; + + snd_card_disconnect(card); +@@ -617,6 +618,10 @@ static void snd_usb_audio_disconnect(str + list_for_each(p, &chip->mixer_list) { + snd_usb_mixer_disconnect(p); + } ++ } ++ ++ chip->num_interfaces--; ++ if (chip->num_interfaces <= 0) { + usb_chip[chip->index] = NULL; + mutex_unlock(®ister_mutex); + snd_card_free_when_closed(card); diff --git a/queue-3.14/series b/queue-3.14/series index 61945107c83..fe8e8ae4712 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -155,3 +155,9 @@ hid-usbhid-add-always-poll-quirk.patch hid-usbhid-enable-always-poll-quirk-for-elan-touchscreen.patch hid-usbhid-enable-always-poll-quirk-for-elan-touchscreen-009b.patch hid-usbhid-enable-always-poll-quirk-for-elan-touchscreen-016f.patch +alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch +usb-storage-handle-a-skipped-data-phase.patch +usb-opticon-fix-non-atomic-allocation-in-write-path.patch +usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch +usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch +usb-remove-references-to-non-existent-plat_s5p-symbol.patch diff --git a/queue-3.14/usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch b/queue-3.14/usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch new file mode 100644 index 00000000000..23570086ce8 --- /dev/null +++ b/queue-3.14/usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch @@ -0,0 +1,76 @@ +From 90a646c770c50cc206ceba0d7b50453c46c13c36 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 1 Oct 2014 11:29:14 +0200 +Subject: usb: Do not allow usb_alloc_streams on unconfigured devices + +From: Hans de Goede + +commit 90a646c770c50cc206ceba0d7b50453c46c13c36 upstream. + +This commit fixes the following oops: + +[10238.622067] scsi host3: uas_eh_bus_reset_handler start +[10240.766164] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd +[10245.779365] usb 3-4: device descriptor read/8, error -110 +[10245.883331] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd +[10250.897603] usb 3-4: device descriptor read/8, error -110 +[10251.058200] BUG: unable to handle kernel NULL pointer dereference at 0000000000000040 +[10251.058244] IP: [] xhci_check_streams_endpoint+0x91/0x140 + +[10251.059473] Call Trace: +[10251.059487] [] xhci_calculate_streams_and_bitmask+0xbc/0x130 +[10251.059520] [] xhci_alloc_streams+0x10f/0x5a0 +[10251.059548] [] ? check_preempt_curr+0x75/0xa0 +[10251.059575] [] ? ttwu_do_wakeup+0x2c/0x100 +[10251.059601] [] ? ttwu_do_activate.constprop.111+0x66/0x70 +[10251.059635] [] usb_alloc_streams+0xab/0xf0 +[10251.059662] [] uas_configure_endpoints+0x128/0x150 [uas] +[10251.059694] [] uas_post_reset+0x3c/0xb0 [uas] +[10251.059722] [] usb_reset_device+0x1b9/0x2a0 +[10251.059749] [] uas_eh_bus_reset_handler+0xb2/0x190 [uas] +[10251.059781] [] scsi_try_bus_reset+0x53/0x110 +[10251.059808] [] scsi_eh_bus_reset+0xf7/0x270 + + +The problem is the following call sequence (simplified): + +1) usb_reset_device +2) usb_reset_and_verify_device +2) hub_port_init +3) hub_port_finish_reset +3) xhci_discover_or_reset_device + This frees xhci->devs[slot_id]->eps[ep_index].ring for all eps but 0 +4) usb_get_device_descriptor + This fails +5) hub_port_init fails +6) usb_reset_and_verify_device fails, does not restore device config +7) uas_post_reset +8) xhci_alloc_streams + NULL deref on the free-ed ring + +This commit fixes this by not allowing usb_alloc_streams to continue if +the device is not configured. + +Note that we do allow usb_free_streams to continue after a (logical) +disconnect, as it is necessary to explicitly free the streams at the xhci +controller level. + +Signed-off-by: Hans de Goede +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2057,6 +2057,8 @@ int usb_alloc_streams(struct usb_interfa + return -EINVAL; + if (dev->speed != USB_SPEED_SUPER) + return -EINVAL; ++ if (dev->state < USB_STATE_CONFIGURED) ++ return -ENODEV; + + /* Streams only apply to bulk endpoints. */ + for (i = 0; i < num_eps; i++) diff --git a/queue-3.14/usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch b/queue-3.14/usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch new file mode 100644 index 00000000000..33bc893c306 --- /dev/null +++ b/queue-3.14/usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch @@ -0,0 +1,41 @@ +From 191252837626fca0de694c18bb2aa64c118eda89 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 29 Oct 2014 09:07:30 +0100 +Subject: USB: kobil_sct: fix non-atomic allocation in write path + +From: Johan Hovold + +commit 191252837626fca0de694c18bb2aa64c118eda89 upstream. + +Write may be called from interrupt context so make sure to use +GFP_ATOMIC for all allocations in write. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/kobil_sct.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/kobil_sct.c ++++ b/drivers/usb/serial/kobil_sct.c +@@ -335,7 +335,8 @@ static int kobil_write(struct tty_struct + port->interrupt_out_urb->transfer_buffer_length = length; + + priv->cur_pos = priv->cur_pos + length; +- result = usb_submit_urb(port->interrupt_out_urb, GFP_NOIO); ++ result = usb_submit_urb(port->interrupt_out_urb, ++ GFP_ATOMIC); + dev_dbg(&port->dev, "%s - Send write URB returns: %i\n", __func__, result); + todo = priv->filled - priv->cur_pos; + +@@ -350,7 +351,7 @@ static int kobil_write(struct tty_struct + if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID || + priv->device_type == KOBIL_ADAPTER_K_PRODUCT_ID) { + result = usb_submit_urb(port->interrupt_in_urb, +- GFP_NOIO); ++ GFP_ATOMIC); + dev_dbg(&port->dev, "%s - Send read URB returns: %i\n", __func__, result); + } + } diff --git a/queue-3.14/usb-opticon-fix-non-atomic-allocation-in-write-path.patch b/queue-3.14/usb-opticon-fix-non-atomic-allocation-in-write-path.patch new file mode 100644 index 00000000000..903855b612b --- /dev/null +++ b/queue-3.14/usb-opticon-fix-non-atomic-allocation-in-write-path.patch @@ -0,0 +1,31 @@ +From e681286de221af78fc85db9222b6a203148c005a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 29 Oct 2014 09:07:31 +0100 +Subject: USB: opticon: fix non-atomic allocation in write path + +From: Johan Hovold + +commit e681286de221af78fc85db9222b6a203148c005a upstream. + +Write may be called from interrupt context so make sure to use +GFP_ATOMIC for all allocations in write. + +Fixes: 0d930e51cfe6 ("USB: opticon: Add Opticon OPN2001 write support") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/opticon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/opticon.c ++++ b/drivers/usb/serial/opticon.c +@@ -215,7 +215,7 @@ static int opticon_write(struct tty_stru + + /* The connected devices do not have a bulk write endpoint, + * to transmit data to de barcode device the control endpoint is used */ +- dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO); ++ dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC); + if (!dr) { + count = -ENOMEM; + goto error_no_dr; diff --git a/queue-3.14/usb-remove-references-to-non-existent-plat_s5p-symbol.patch b/queue-3.14/usb-remove-references-to-non-existent-plat_s5p-symbol.patch new file mode 100644 index 00000000000..fbfccf52961 --- /dev/null +++ b/queue-3.14/usb-remove-references-to-non-existent-plat_s5p-symbol.patch @@ -0,0 +1,43 @@ +From cd6e245a2d061a8367e37aaece32cf3fc922de80 Mon Sep 17 00:00:00 2001 +From: Sylwester Nawrocki +Date: Tue, 7 Oct 2014 11:12:07 +0200 +Subject: usb: Remove references to non-existent PLAT_S5P symbol + +From: Sylwester Nawrocki + +commit cd6e245a2d061a8367e37aaece32cf3fc922de80 upstream. + +The PLAT_S5P Kconfig symbol was removed in commit d78c16ccde96 +("ARM: SAMSUNG: Remove remaining legacy code"). There are still +some references left, fix that by replacing them with ARCH_S5PV210. + +Fixes: d78c16ccde96 ("ARM: SAMSUNG: Remove remaining legacy code") +Reported-by: Paul Bolle +Acked-by: Jingoo Han +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/Kconfig ++++ b/drivers/usb/host/Kconfig +@@ -205,7 +205,7 @@ config USB_EHCI_SH + + config USB_EHCI_EXYNOS + tristate "EHCI support for Samsung S5P/EXYNOS SoC Series" +- depends on PLAT_S5P || ARCH_EXYNOS ++ depends on ARCH_S5PV210 || ARCH_EXYNOS + help + Enable support for the Samsung Exynos SOC's on-chip EHCI controller. + +@@ -494,7 +494,7 @@ config USB_OHCI_SH + + config USB_OHCI_EXYNOS + tristate "OHCI support for Samsung S5P/EXYNOS SoC Series" +- depends on PLAT_S5P || ARCH_EXYNOS ++ depends on ARCH_S5PV210 || ARCH_EXYNOS + help + Enable support for the Samsung Exynos SOC's on-chip OHCI controller. + diff --git a/queue-3.14/usb-storage-handle-a-skipped-data-phase.patch b/queue-3.14/usb-storage-handle-a-skipped-data-phase.patch new file mode 100644 index 00000000000..6d488841fe8 --- /dev/null +++ b/queue-3.14/usb-storage-handle-a-skipped-data-phase.patch @@ -0,0 +1,81 @@ +From 93c9bf4d1838d5851a18ca398b0ad66397f05056 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 31 Oct 2014 14:49:47 -0400 +Subject: usb-storage: handle a skipped data phase + +From: Alan Stern + +commit 93c9bf4d1838d5851a18ca398b0ad66397f05056 upstream. + +Sometimes mass-storage devices using the Bulk-only transport will +mistakenly skip the data phase of a command. Rather than sending the +data expected by the host or sending a zero-length packet, they go +directly to the status phase and send the CSW. + +This causes problems for usb-storage, for obvious reasons. The driver +will interpret the CSW as a short data transfer and will wait to +receive a CSW. The device won't have anything left to send, so the +command eventually times out. + +The SCSI layer doesn't retry commands after they time out (this is a +relatively recent change). Therefore we should do our best to detect +a skipped data phase and handle it promptly. + +This patch adds code to do that. If usb-storage receives a short +13-byte data transfer from the device, and if the first four bytes of +the data match the CSW signature, the driver will set the residue to +the full transfer length and interpret the data as a CSW. + +This fixes Bugzilla #86611. + +Signed-off-by: Alan Stern +CC: Matthew Dharm +Tested-by: Paul Osmialowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/transport.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -1118,6 +1118,31 @@ int usb_stor_Bulk_transport(struct scsi_ + */ + if (result == USB_STOR_XFER_LONG) + fake_sense = 1; ++ ++ /* ++ * Sometimes a device will mistakenly skip the data phase ++ * and go directly to the status phase without sending a ++ * zero-length packet. If we get a 13-byte response here, ++ * check whether it really is a CSW. ++ */ ++ if (result == USB_STOR_XFER_SHORT && ++ srb->sc_data_direction == DMA_FROM_DEVICE && ++ transfer_length - scsi_get_resid(srb) == ++ US_BULK_CS_WRAP_LEN) { ++ struct scatterlist *sg = NULL; ++ unsigned int offset = 0; ++ ++ if (usb_stor_access_xfer_buf((unsigned char *) bcs, ++ US_BULK_CS_WRAP_LEN, srb, &sg, ++ &offset, FROM_XFER_BUF) == ++ US_BULK_CS_WRAP_LEN && ++ bcs->Signature == ++ cpu_to_le32(US_BULK_CS_SIGN)) { ++ usb_stor_dbg(us, "Device skipped data phase\n"); ++ scsi_set_resid(srb, transfer_length); ++ goto skipped_data_phase; ++ } ++ } + } + + /* See flow chart on pg 15 of the Bulk Only Transport spec for +@@ -1153,6 +1178,7 @@ int usb_stor_Bulk_transport(struct scsi_ + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; + ++ skipped_data_phase: + /* check bulk status */ + residue = le32_to_cpu(bcs->Residue); + usb_stor_dbg(us, "Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n",