From: Greg Kroah-Hartman Date: Sun, 29 Apr 2018 11:05:37 +0000 (+0200) Subject: 3.18-stable patches X-Git-Tag: v4.16.7~38 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4e7e24ea19917b8eacfe6bf95d6e768f011574a2;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: alsa-usb-audio-skip-broken-eu-on-dell-dock-usb-audio.patch tty-n_gsm-fix-dlci-handling-for-adm-mode-if-debug-2-is-not-set.patch tty-n_gsm-fix-long-delays-with-control-frame-timeouts-in-adm-mode.patch tty-use-__gfp_nofail-for-tty_ldisc_get.patch usb-core-add-quirk-for-hp-v222w-16gb-mini.patch usb-increment-wakeup-count-on-remote-wakeup.patch usb-serial-cp210x-add-id-for-ni-usb-serial-console.patch usb-serial-ftdi_sio-use-jtag-quirk-for-arrow-usb-blaster.patch usbip-usbip_host-fix-to-hold-parent-lock-for-device_attach-calls.patch usbip-vhci_hcd-fix-usb-device-and-sockfd-leaks.patch virtio-add-ability-to-iterate-over-vqs.patch virtio_console-free-buffers-after-reset.patch --- diff --git a/queue-3.18/alsa-usb-audio-skip-broken-eu-on-dell-dock-usb-audio.patch b/queue-3.18/alsa-usb-audio-skip-broken-eu-on-dell-dock-usb-audio.patch new file mode 100644 index 00000000000..9cea59704c0 --- /dev/null +++ b/queue-3.18/alsa-usb-audio-skip-broken-eu-on-dell-dock-usb-audio.patch @@ -0,0 +1,37 @@ +From 1d8d6428d1da642ddd75b0be2d1bb1123ff8e017 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 24 Apr 2018 11:11:48 +0200 +Subject: ALSA: usb-audio: Skip broken EU on Dell dock USB-audio + +From: Takashi Iwai + +commit 1d8d6428d1da642ddd75b0be2d1bb1123ff8e017 upstream. + +The Dell Dock USB-audio device with 0bda:4014 is behaving notoriously +bad, and we have already applied some workaround to avoid the firmware +hiccup. Yet we still need to skip one thing, the Extension Unit at ID +4, which doesn't react correctly to the mixer ctl access. + +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1090658 +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer_maps.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -353,8 +353,11 @@ static struct usbmix_name_map dragonfly_ + /* + * Dell usb dock with ALC4020 codec had a firmware problem where it got + * screwed up when zero volume is passed; just skip it as a workaround ++ * ++ * Also the extension unit gives an access error, so skip it as well. + */ + static const struct usbmix_name_map dell_alc4020_map[] = { ++ { 4, NULL }, /* extension unit */ + { 16, NULL }, + { 19, NULL }, + { 0 } diff --git a/queue-3.18/series b/queue-3.18/series index b28bfff4b48..42c4252155a 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -1,3 +1,15 @@ ext4-set-h_journal-if-there-is-a-failure-starting-a-reserved-handle.patch ext4-add-validity-checks-for-bitmap-block-numbers.patch ext4-fix-bitmap-position-validation.patch +usbip-usbip_host-fix-to-hold-parent-lock-for-device_attach-calls.patch +usbip-vhci_hcd-fix-usb-device-and-sockfd-leaks.patch +usb-serial-ftdi_sio-use-jtag-quirk-for-arrow-usb-blaster.patch +usb-serial-cp210x-add-id-for-ni-usb-serial-console.patch +usb-core-add-quirk-for-hp-v222w-16gb-mini.patch +usb-increment-wakeup-count-on-remote-wakeup.patch +alsa-usb-audio-skip-broken-eu-on-dell-dock-usb-audio.patch +virtio-add-ability-to-iterate-over-vqs.patch +virtio_console-free-buffers-after-reset.patch +tty-n_gsm-fix-long-delays-with-control-frame-timeouts-in-adm-mode.patch +tty-n_gsm-fix-dlci-handling-for-adm-mode-if-debug-2-is-not-set.patch +tty-use-__gfp_nofail-for-tty_ldisc_get.patch diff --git a/queue-3.18/tty-n_gsm-fix-dlci-handling-for-adm-mode-if-debug-2-is-not-set.patch b/queue-3.18/tty-n_gsm-fix-dlci-handling-for-adm-mode-if-debug-2-is-not-set.patch new file mode 100644 index 00000000000..1e52ddd5096 --- /dev/null +++ b/queue-3.18/tty-n_gsm-fix-dlci-handling-for-adm-mode-if-debug-2-is-not-set.patch @@ -0,0 +1,69 @@ +From b2d89ad9c9682e795ed6eeb9ed455789ad6cedf1 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Sat, 7 Apr 2018 10:19:51 -0700 +Subject: tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set + +From: Tony Lindgren + +commit b2d89ad9c9682e795ed6eeb9ed455789ad6cedf1 upstream. + +At least on droid 4 with control channel in ADM mode, there is no response +to Modem Status Command (MSC). Currently gsmtty_modem_update() expects to +have data in dlci->modem_rx unless debug & 2 is set. This means that on +droid 4, things only work if debug & 2 is set. + +Let's fix the issue by ignoring empty dlci->modem_rx for ADM mode. In +the AMD mode, CMD_MSC will never respond and gsm_process_modem() won't +get called to set dlci->modem_rx. + +And according to ts_127010v140000p.pdf, MSC is only relevant if basic +option is chosen, so let's test for that too. + +Fixes: ea3d8465ab9b ("tty: n_gsm: Allow ADM response in addition to UA for control dlci") +Cc: linux-serial@vger.kernel.org +Cc: Alan Cox +Cc: Dan Williams +Cc: Jiri Prchal +Cc: Jiri Slaby +Cc: Marcel Partap +Cc: Merlijn Wajer +Cc: Michael Nazzareno Trimarchi +Cc: Michael Scott +Cc: Pavel Machek +Cc: Peter Hurley +Cc: Russ Gorby +Cc: Sascha Hauer +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/n_gsm.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -2892,11 +2892,22 @@ static int gsmtty_modem_update(struct gs + static int gsm_carrier_raised(struct tty_port *port) + { + struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port); ++ struct gsm_mux *gsm = dlci->gsm; ++ + /* Not yet open so no carrier info */ + if (dlci->state != DLCI_OPEN) + return 0; + if (debug & 2) + return 1; ++ ++ /* ++ * Basic mode with control channel in ADM mode may not respond ++ * to CMD_MSC at all and modem_rx is empty. ++ */ ++ if (gsm->encoding == 0 && gsm->dlci[0]->mode == DLCI_MODE_ADM && ++ !dlci->modem_rx) ++ return 1; ++ + return dlci->modem_rx & TIOCM_CD; + } + diff --git a/queue-3.18/tty-n_gsm-fix-long-delays-with-control-frame-timeouts-in-adm-mode.patch b/queue-3.18/tty-n_gsm-fix-long-delays-with-control-frame-timeouts-in-adm-mode.patch new file mode 100644 index 00000000000..22327462014 --- /dev/null +++ b/queue-3.18/tty-n_gsm-fix-long-delays-with-control-frame-timeouts-in-adm-mode.patch @@ -0,0 +1,91 @@ +From e9ec22547986dd32c5c70da78107ce35dbff1344 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Sat, 7 Apr 2018 10:19:50 -0700 +Subject: tty: n_gsm: Fix long delays with control frame timeouts in ADM mode + +From: Tony Lindgren + +commit e9ec22547986dd32c5c70da78107ce35dbff1344 upstream. + +Commit ea3d8465ab9b ("tty: n_gsm: Allow ADM response in addition to UA for +control dlci") added support for DLCI to stay in Asynchronous Disconnected +Mode (ADM). But we still get long delays waiting for commands to other +DLCI to complete: + +--> 5) C: SABM(P) +Q> 0) C: UIH(F) +Q> 0) C: UIH(F) +Q> 0) C: UIH(F) +... + +This happens because gsm_control_send() sets cretries timer to T2 that is +by default set to 34. This will cause resend for T2 times for the control +frame. In ADM mode, we will never get a response so the control frame, so +retries are just delaying all the commands. + +Let's fix the issue by setting DLCI_MODE_ADM flag after detecting the ADM +mode for the control DLCI. Then we can use that in gsm_control_send() to +set retries to 1. This means the control frame will be sent once allowing +the other end at an opportunity to switch from ADM to ABM mode. + +Note that retries will be decremented in gsm_control_retransmit() so +we don't want to set it to 0 here. + +Fixes: ea3d8465ab9b ("tty: n_gsm: Allow ADM response in addition to UA for control dlci") +Cc: linux-serial@vger.kernel.org +Cc: Alan Cox +Cc: Dan Williams +Cc: Jiri Prchal +Cc: Jiri Slaby +Cc: Marcel Partap +Cc: Merlijn Wajer +Cc: Michael Nazzareno Trimarchi +Cc: Michael Scott +Cc: Pavel Machek +Cc: Peter Hurley +Cc: Russ Gorby +Cc: Sascha Hauer +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/n_gsm.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -137,6 +137,9 @@ struct gsm_dlci { + struct mutex mutex; + + /* Link layer */ ++ int mode; ++#define DLCI_MODE_ABM 0 /* Normal Asynchronous Balanced Mode */ ++#define DLCI_MODE_ADM 1 /* Asynchronous Disconnected Mode */ + spinlock_t lock; /* Protects the internal state */ + struct timer_list t1; /* Retransmit timer for SABM and UA */ + int retries; +@@ -1380,7 +1383,13 @@ retry: + ctrl->data = data; + ctrl->len = clen; + gsm->pending_cmd = ctrl; +- gsm->cretries = gsm->n2; ++ ++ /* If DLCI0 is in ADM mode skip retries, it won't respond */ ++ if (gsm->dlci[0]->mode == DLCI_MODE_ADM) ++ gsm->cretries = 1; ++ else ++ gsm->cretries = gsm->n2; ++ + mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100); + gsm_control_transmit(gsm, ctrl); + spin_unlock_irqrestore(&gsm->control_lock, flags); +@@ -1488,6 +1497,7 @@ static void gsm_dlci_t1(unsigned long da + if (debug & 8) + pr_info("DLCI %d opening in ADM mode.\n", + dlci->addr); ++ dlci->mode = DLCI_MODE_ADM; + gsm_dlci_open(dlci); + } else { + gsm_dlci_close(dlci); diff --git a/queue-3.18/tty-use-__gfp_nofail-for-tty_ldisc_get.patch b/queue-3.18/tty-use-__gfp_nofail-for-tty_ldisc_get.patch new file mode 100644 index 00000000000..b5a13b54e9b --- /dev/null +++ b/queue-3.18/tty-use-__gfp_nofail-for-tty_ldisc_get.patch @@ -0,0 +1,57 @@ +From bcdd0ca8cb8730573afebcaae4138f8f4c8eaa20 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Wed, 25 Apr 2018 20:12:31 +0900 +Subject: tty: Use __GFP_NOFAIL for tty_ldisc_get() + +From: Tetsuo Handa + +commit bcdd0ca8cb8730573afebcaae4138f8f4c8eaa20 upstream. + +syzbot is reporting crashes triggered by memory allocation fault injection +at tty_ldisc_get() [1]. As an attempt to handle OOM in a graceful way, we +have tried commit 5362544bebe85071 ("tty: don't panic on OOM in +tty_set_ldisc()"). But we reverted that attempt by commit a8983d01f9b7d600 +("Revert "tty: don't panic on OOM in tty_set_ldisc()"") due to reproducible +crash. We should spend resource for finding and fixing race condition bugs +rather than complicate error paths for 2 * sizeof(void *) bytes allocation +failure. + +[1] https://syzkaller.appspot.com/bug?id=489d33fa386453859ead58ff5171d43772b13aa3 + +Signed-off-by: Tetsuo Handa +Reported-by: syzbot +Cc: Michal Hocko +Cc: Vegard Nossum +Cc: Dmitry Vyukov +Cc: Jiri Slaby +Cc: Peter Hurley +Cc: One Thousand Gnomes +Cc: Linus Torvalds +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/tty_ldisc.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/tty/tty_ldisc.c ++++ b/drivers/tty/tty_ldisc.c +@@ -171,12 +171,11 @@ static struct tty_ldisc *tty_ldisc_get(s + return ERR_CAST(ldops); + } + +- ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL); +- if (ld == NULL) { +- put_ldops(ldops); +- return ERR_PTR(-ENOMEM); +- } +- ++ /* ++ * There is no way to handle allocation failure of only 16 bytes. ++ * Let's simplify error handling and save more memory. ++ */ ++ ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL | __GFP_NOFAIL); + ld->ops = ldops; + ld->tty = tty; + diff --git a/queue-3.18/usb-core-add-quirk-for-hp-v222w-16gb-mini.patch b/queue-3.18/usb-core-add-quirk-for-hp-v222w-16gb-mini.patch new file mode 100644 index 00000000000..5302d747e76 --- /dev/null +++ b/queue-3.18/usb-core-add-quirk-for-hp-v222w-16gb-mini.patch @@ -0,0 +1,37 @@ +From 3180dabe08e3653bf0a838553905d88f3773f29c Mon Sep 17 00:00:00 2001 +From: Kamil Lulko +Date: Thu, 19 Apr 2018 16:54:02 -0700 +Subject: usb: core: Add quirk for HP v222w 16GB Mini + +From: Kamil Lulko + +commit 3180dabe08e3653bf0a838553905d88f3773f29c upstream. + +Add DELAY_INIT quirk to fix the following problem with HP +v222w 16GB Mini: + +usb 1-3: unable to read config index 0 descriptor/start: -110 +usb 1-3: can't read configurations, error -110 +usb 1-3: can't set config #1, error -110 + +Signed-off-by: Kamil Lulko +Signed-off-by: Kuppuswamy Sathyanarayanan +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -41,6 +41,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x03f0, 0x0701), .driver_info = + USB_QUIRK_STRING_FETCH_255 }, + ++ /* HP v222w 16GB Mini USB Drive */ ++ { USB_DEVICE(0x03f0, 0x3f40), .driver_info = USB_QUIRK_DELAY_INIT }, ++ + /* Creative SB Audigy 2 NX */ + { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-3.18/usb-increment-wakeup-count-on-remote-wakeup.patch b/queue-3.18/usb-increment-wakeup-count-on-remote-wakeup.patch new file mode 100644 index 00000000000..207fc62c108 --- /dev/null +++ b/queue-3.18/usb-increment-wakeup-count-on-remote-wakeup.patch @@ -0,0 +1,82 @@ +From 83a62c51ba7b3c0bf45150c4eac7aefc6c785e94 Mon Sep 17 00:00:00 2001 +From: Ravi Chandra Sadineni +Date: Fri, 20 Apr 2018 11:08:21 -0700 +Subject: USB: Increment wakeup count on remote wakeup. + +From: Ravi Chandra Sadineni + +commit 83a62c51ba7b3c0bf45150c4eac7aefc6c785e94 upstream. + +On chromebooks we depend on wakeup count to identify the wakeup source. +But currently USB devices do not increment the wakeup count when they +trigger the remote wake. This patch addresses the same. + +Resume condition is reported differently on USB 2.0 and USB 3.0 devices. + +On USB 2.0 devices, a wake capable device, if wake enabled, drives +resume signal to indicate a remote wake (USB 2.0 spec section 7.1.7.7). +The upstream facing port then sets C_PORT_SUSPEND bit and reports a +port change event (USB 2.0 spec section 11.24.2.7.2.3). Thus if a port +has resumed before driving the resume signal from the host and +C_PORT_SUSPEND is set, then the device attached to the given port might +be the reason for the last system wakeup. Increment the wakeup count for +the same. + +On USB 3.0 devices, a function may signal that it wants to exit from device +suspend by sending a Function Wake Device Notification to the host (USB3.0 +spec section 8.5.6.4) Thus on receiving the Function Wake, increment the +wakeup count. + +Signed-off-by: Ravi Chandra Sadineni +Acked-by: Alan Stern +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 1 + + drivers/usb/core/hub.c | 10 +++++++++- + 2 files changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2289,6 +2289,7 @@ void usb_hcd_resume_root_hub (struct usb + + spin_lock_irqsave (&hcd_root_hub_lock, flags); + if (hcd->rh_registered) { ++ pm_wakeup_event(&hcd->self.root_hub->dev, 0); + set_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags); + queue_work(pm_wq, &hcd->wakeup_work); + } +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -633,12 +633,17 @@ void usb_wakeup_notification(struct usb_ + unsigned int portnum) + { + struct usb_hub *hub; ++ struct usb_port *port_dev; + + if (!hdev) + return; + + hub = usb_hub_to_struct_hub(hdev); + if (hub) { ++ port_dev = hub->ports[portnum - 1]; ++ if (port_dev && port_dev->child) ++ pm_wakeup_event(&port_dev->child->dev, 0); ++ + set_bit(portnum, hub->wakeup_bits); + kick_hub_wq(hub); + } +@@ -3363,8 +3368,11 @@ int usb_port_resume(struct usb_device *u + + /* Skip the initial Clear-Suspend step for a remote wakeup */ + status = hub_port_status(hub, port1, &portstatus, &portchange); +- if (status == 0 && !port_is_suspended(hub, portstatus)) ++ if (status == 0 && !port_is_suspended(hub, portstatus)) { ++ if (portchange & USB_PORT_STAT_C_SUSPEND) ++ pm_wakeup_event(&udev->dev, 0); + goto SuspendCleared; ++ } + + /* see 7.1.7.7; affects power usage, but not budgeting */ + if (hub_is_superspeed(hub->hdev)) diff --git a/queue-3.18/usb-serial-cp210x-add-id-for-ni-usb-serial-console.patch b/queue-3.18/usb-serial-cp210x-add-id-for-ni-usb-serial-console.patch new file mode 100644 index 00000000000..9ac438f6ccf --- /dev/null +++ b/queue-3.18/usb-serial-cp210x-add-id-for-ni-usb-serial-console.patch @@ -0,0 +1,31 @@ +From 1e23aace21515a8f7615a1de016c0ea8d4e0cc6e Mon Sep 17 00:00:00 2001 +From: Kyle Roeschley +Date: Mon, 9 Apr 2018 10:23:55 -0500 +Subject: USB: serial: cp210x: add ID for NI USB serial console + +From: Kyle Roeschley + +commit 1e23aace21515a8f7615a1de016c0ea8d4e0cc6e upstream. + +Added the USB VID and PID for the USB serial console on some National +Instruments devices. + +Signed-off-by: Kyle Roeschley +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -207,6 +207,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ + { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ ++ { USB_DEVICE(0x3923, 0x7A0B) }, /* National Instruments USB Serial Console */ + { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */ + { } /* Terminating Entry */ + }; diff --git a/queue-3.18/usb-serial-ftdi_sio-use-jtag-quirk-for-arrow-usb-blaster.patch b/queue-3.18/usb-serial-ftdi_sio-use-jtag-quirk-for-arrow-usb-blaster.patch new file mode 100644 index 00000000000..2ce613f94a5 --- /dev/null +++ b/queue-3.18/usb-serial-ftdi_sio-use-jtag-quirk-for-arrow-usb-blaster.patch @@ -0,0 +1,37 @@ +From 470b5d6f0cf4674be2d1ec94e54283a1770b6a1a Mon Sep 17 00:00:00 2001 +From: Vasyl Vavrychuk +Date: Wed, 11 Apr 2018 17:05:13 +0300 +Subject: USB: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster + +From: Vasyl Vavrychuk + +commit 470b5d6f0cf4674be2d1ec94e54283a1770b6a1a upstream. + +Arrow USB Blaster integrated on MAX1000 board uses the same vendor ID +(0x0403) and product ID (0x6010) as the "original" FTDI device. + +This patch avoids picking up by ftdi_sio of the first interface of this +USB device. After that this device can be used by Arrow user-space JTAG +driver. + +Signed-off-by: Vasyl Vavrychuk +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1908,7 +1908,8 @@ static int ftdi_8u2232c_probe(struct usb + return ftdi_jtag_probe(serial); + + if (udev->product && +- (!strcmp(udev->product, "BeagleBone/XDS100V2") || ++ (!strcmp(udev->product, "Arrow USB Blaster") || ++ !strcmp(udev->product, "BeagleBone/XDS100V2") || + !strcmp(udev->product, "SNAP Connect E10"))) + return ftdi_jtag_probe(serial); + diff --git a/queue-3.18/usbip-usbip_host-fix-to-hold-parent-lock-for-device_attach-calls.patch b/queue-3.18/usbip-usbip_host-fix-to-hold-parent-lock-for-device_attach-calls.patch new file mode 100644 index 00000000000..ebd79b4ffb0 --- /dev/null +++ b/queue-3.18/usbip-usbip_host-fix-to-hold-parent-lock-for-device_attach-calls.patch @@ -0,0 +1,35 @@ +From 4bfb141bc01312a817d36627cc47c93f801c216d Mon Sep 17 00:00:00 2001 +From: Shuah Khan +Date: Thu, 5 Apr 2018 16:29:04 -0600 +Subject: usbip: usbip_host: fix to hold parent lock for device_attach() calls + +From: Shuah Khan + +commit 4bfb141bc01312a817d36627cc47c93f801c216d upstream. + +usbip_host calls device_attach() without holding dev->parent lock. +Fix it. + +Signed-off-by: Shuah Khan +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/usbip/stub_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/usbip/stub_main.c ++++ b/drivers/usb/usbip/stub_main.c +@@ -201,7 +201,12 @@ static ssize_t rebind_store(struct devic + if (!bid) + return -ENODEV; + ++ /* device_attach() callers should hold parent lock for USB */ ++ if (bid->udev->dev.parent) ++ device_lock(bid->udev->dev.parent); + ret = device_attach(&bid->udev->dev); ++ if (bid->udev->dev.parent) ++ device_unlock(bid->udev->dev.parent); + if (ret < 0) { + dev_err(&bid->udev->dev, "rebind failed\n"); + return ret; diff --git a/queue-3.18/usbip-vhci_hcd-fix-usb-device-and-sockfd-leaks.patch b/queue-3.18/usbip-vhci_hcd-fix-usb-device-and-sockfd-leaks.patch new file mode 100644 index 00000000000..530a1afdc25 --- /dev/null +++ b/queue-3.18/usbip-vhci_hcd-fix-usb-device-and-sockfd-leaks.patch @@ -0,0 +1,31 @@ +From 9020a7efe537856eb3e826ebebdf38a5d07a7857 Mon Sep 17 00:00:00 2001 +From: Shuah Khan +Date: Mon, 2 Apr 2018 14:52:32 -0600 +Subject: usbip: vhci_hcd: Fix usb device and sockfd leaks + +From: Shuah Khan + +commit 9020a7efe537856eb3e826ebebdf38a5d07a7857 upstream. + +vhci_hcd fails to do reset to put usb device and sockfd in the +module remove/stop paths. Fix the leak. + +Signed-off-by: Shuah Khan +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/usbip/usbip_common.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/usbip/usbip_common.h ++++ b/drivers/usb/usbip/usbip_common.h +@@ -248,7 +248,7 @@ enum usbip_side { + #define SDEV_EVENT_ERROR_SUBMIT (USBIP_EH_SHUTDOWN | USBIP_EH_RESET) + #define SDEV_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE) + +-#define VDEV_EVENT_REMOVED (USBIP_EH_SHUTDOWN | USBIP_EH_BYE) ++#define VDEV_EVENT_REMOVED (USBIP_EH_SHUTDOWN | USBIP_EH_RESET | USBIP_EH_BYE) + #define VDEV_EVENT_DOWN (USBIP_EH_SHUTDOWN | USBIP_EH_RESET) + #define VDEV_EVENT_ERROR_TCP (USBIP_EH_SHUTDOWN | USBIP_EH_RESET) + #define VDEV_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE) diff --git a/queue-3.18/virtio-add-ability-to-iterate-over-vqs.patch b/queue-3.18/virtio-add-ability-to-iterate-over-vqs.patch new file mode 100644 index 00000000000..49d51743979 --- /dev/null +++ b/queue-3.18/virtio-add-ability-to-iterate-over-vqs.patch @@ -0,0 +1,32 @@ +From 24a7e4d20783c0514850f24a5c41ede46ab058f0 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Fri, 20 Apr 2018 20:22:40 +0300 +Subject: virtio: add ability to iterate over vqs + +From: Michael S. Tsirkin + +commit 24a7e4d20783c0514850f24a5c41ede46ab058f0 upstream. + +For cleanup it's helpful to be able to simply scan all vqs and discard +all data. Add an iterator to do that. + +Cc: stable@vger.kernel.org +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/virtio.h | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/include/linux/virtio.h ++++ b/include/linux/virtio.h +@@ -122,6 +122,9 @@ int virtio_device_freeze(struct virtio_d + int virtio_device_restore(struct virtio_device *dev); + #endif + ++#define virtio_device_for_each_vq(vdev, vq) \ ++ list_for_each_entry(vq, &vdev->vqs, list) ++ + /** + * virtio_driver - operations for a virtio I/O driver + * @driver: underlying device driver (populate name and owner). diff --git a/queue-3.18/virtio_console-free-buffers-after-reset.patch b/queue-3.18/virtio_console-free-buffers-after-reset.patch new file mode 100644 index 00000000000..26bc6a5a6dc --- /dev/null +++ b/queue-3.18/virtio_console-free-buffers-after-reset.patch @@ -0,0 +1,142 @@ +From a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Fri, 20 Apr 2018 20:24:23 +0300 +Subject: virtio_console: free buffers after reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael S. Tsirkin + +commit a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b upstream. + +Console driver is out of spec. The spec says: + A driver MUST NOT decrement the available idx on a live + virtqueue (ie. there is no way to “unexpose” buffers). +and it does exactly that by trying to detach unused buffers +without doing a device reset first. + +Defer detaching the buffers until device unplug. + +Of course this means we might get an interrupt for +a vq without an attached port now. Handle that by +discarding the consumed buffer. + +Reported-by: Tiwei Bie +Fixes: b3258ff1d6 ("virtio: Decrement avail idx on buffer detach") +Cc: stable@vger.kernel.org +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/virtio_console.c | 49 ++++++++++++++++++++---------------------- + 1 file changed, 24 insertions(+), 25 deletions(-) + +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -1398,7 +1398,6 @@ static int add_port(struct ports_device + { + char debugfs_name[16]; + struct port *port; +- struct port_buffer *buf; + dev_t devt; + unsigned int nr_added_bufs; + int err; +@@ -1509,8 +1508,6 @@ static int add_port(struct ports_device + return 0; + + free_inbufs: +- while ((buf = virtqueue_detach_unused_buf(port->in_vq))) +- free_buf(buf, true); + free_device: + device_destroy(pdrvdata.class, port->dev->devt); + free_cdev: +@@ -1535,34 +1532,14 @@ static void remove_port(struct kref *kre + + static void remove_port_data(struct port *port) + { +- struct port_buffer *buf; +- + spin_lock_irq(&port->inbuf_lock); + /* Remove unused data this port might have received. */ + discard_port_data(port); + spin_unlock_irq(&port->inbuf_lock); + +- /* Remove buffers we queued up for the Host to send us data in. */ +- do { +- spin_lock_irq(&port->inbuf_lock); +- buf = virtqueue_detach_unused_buf(port->in_vq); +- spin_unlock_irq(&port->inbuf_lock); +- if (buf) +- free_buf(buf, true); +- } while (buf); +- + spin_lock_irq(&port->outvq_lock); + reclaim_consumed_buffers(port); + spin_unlock_irq(&port->outvq_lock); +- +- /* Free pending buffers from the out-queue. */ +- do { +- spin_lock_irq(&port->outvq_lock); +- buf = virtqueue_detach_unused_buf(port->out_vq); +- spin_unlock_irq(&port->outvq_lock); +- if (buf) +- free_buf(buf, true); +- } while (buf); + } + + /* +@@ -1783,13 +1760,24 @@ static void control_work_handler(struct + spin_unlock(&portdev->c_ivq_lock); + } + ++static void flush_bufs(struct virtqueue *vq, bool can_sleep) ++{ ++ struct port_buffer *buf; ++ unsigned int len; ++ ++ while ((buf = virtqueue_get_buf(vq, &len))) ++ free_buf(buf, can_sleep); ++} ++ + static void out_intr(struct virtqueue *vq) + { + struct port *port; + + port = find_port_by_vq(vq->vdev->priv, vq); +- if (!port) ++ if (!port) { ++ flush_bufs(vq, false); + return; ++ } + + wake_up_interruptible(&port->waitqueue); + } +@@ -1800,8 +1788,10 @@ static void in_intr(struct virtqueue *vq + unsigned long flags; + + port = find_port_by_vq(vq->vdev->priv, vq); +- if (!port) ++ if (!port) { ++ flush_bufs(vq, false); + return; ++ } + + spin_lock_irqsave(&port->inbuf_lock, flags); + port->inbuf = get_inbuf(port); +@@ -1976,6 +1966,15 @@ static const struct file_operations port + + static void remove_vqs(struct ports_device *portdev) + { ++ struct virtqueue *vq; ++ ++ virtio_device_for_each_vq(portdev->vdev, vq) { ++ struct port_buffer *buf; ++ ++ flush_bufs(vq, true); ++ while ((buf = virtqueue_detach_unused_buf(vq))) ++ free_buf(buf, true); ++ } + portdev->vdev->config->del_vqs(portdev->vdev); + kfree(portdev->in_vqs); + kfree(portdev->out_vqs);