From: Sasha Levin Date: Wed, 3 Jul 2019 18:13:19 +0000 (-0400) Subject: fixes for 4.9 X-Git-Tag: v5.1.17~47 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=60a73506b5c817af5fc3d37981b365e23a0afb6c;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/asoc-cs4265-readable-register-too-low.patch b/queue-4.9/asoc-cs4265-readable-register-too-low.patch new file mode 100644 index 00000000000..27402ed331e --- /dev/null +++ b/queue-4.9/asoc-cs4265-readable-register-too-low.patch @@ -0,0 +1,43 @@ +From 3f9afd31590bbfcbfa0263fa2d046c7e01dfcda1 Mon Sep 17 00:00:00 2001 +From: Matt Flax +Date: Wed, 8 May 2019 16:33:13 +1000 +Subject: ASoC : cs4265 : readable register too low + +[ Upstream commit f3df05c805983427319eddc2411a2105ee1757cf ] + +The cs4265_readable_register function stopped short of the maximum +register. + +An example bug is taken from : +https://github.com/Audio-Injector/Ultra/issues/25 + +Where alsactl store fails with : +Cannot read control '2,0,0,C Data Buffer,0': Input/output error + +This patch fixes the bug by setting the cs4265 to have readable +registers up to the maximum hardware register CS4265_MAX_REGISTER. + +Signed-off-by: Matt Flax +Reviewed-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs4265.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c +index 6e8eb1f5a041..bed64723e5d9 100644 +--- a/sound/soc/codecs/cs4265.c ++++ b/sound/soc/codecs/cs4265.c +@@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = { + static bool cs4265_readable_register(struct device *dev, unsigned int reg) + { + switch (reg) { +- case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2: ++ case CS4265_CHIP_ID ... CS4265_MAX_REGISTER: + return true; + default: + return false; +-- +2.20.1 + diff --git a/queue-4.9/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch b/queue-4.9/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch new file mode 100644 index 00000000000..2637e19692e --- /dev/null +++ b/queue-4.9/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch @@ -0,0 +1,56 @@ +From f9a56b6f963b285490174e539a2c08cff333c2d3 Mon Sep 17 00:00:00 2001 +From: Yu-Hsuan Hsu +Date: Tue, 4 Jun 2019 18:49:09 +0800 +Subject: ASoC: max98090: remove 24-bit format support if RJ is 0 + +[ Upstream commit 5628c8979642a076f91ee86c3bae5ad251639af0 ] + +The supported formats are S16_LE and S24_LE now. However, by datasheet +of max98090, S24_LE is only supported when it is in the right justified +mode. We should remove 24-bit format if it is not in that mode to avoid +triggering error. + +Signed-off-by: Yu-Hsuan Hsu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 3e65dc74eb33..e7aef841f87d 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1924,6 +1924,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090, + return 0; + } + ++static int max98090_dai_startup(struct snd_pcm_substream *substream, ++ struct snd_soc_dai *dai) ++{ ++ struct snd_soc_component *component = dai->component; ++ struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component); ++ unsigned int fmt = max98090->dai_fmt; ++ ++ /* Remove 24-bit format support if it is not in right justified mode. */ ++ if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) { ++ substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16); ++ } ++ return 0; ++} ++ + static int max98090_dai_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, + struct snd_soc_dai *dai) +@@ -2331,6 +2346,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect); + #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE) + + static const struct snd_soc_dai_ops max98090_dai_ops = { ++ .startup = max98090_dai_startup, + .set_sysclk = max98090_dai_set_sysclk, + .set_fmt = max98090_dai_set_fmt, + .set_tdm_slot = max98090_set_tdm_slot, +-- +2.20.1 + diff --git a/queue-4.9/asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch b/queue-4.9/asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch new file mode 100644 index 00000000000..7bbe0e076fe --- /dev/null +++ b/queue-4.9/asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch @@ -0,0 +1,47 @@ +From 1afe0acad3eb1f391145441d8e80ae9d69ccd204 Mon Sep 17 00:00:00 2001 +From: Libin Yang +Date: Wed, 8 May 2019 10:32:41 +0800 +Subject: ASoC: soc-pcm: BE dai needs prepare when pause release after resume + +[ Upstream commit 5087a8f17df868601cd7568299e91c28086d2b45 ] + +If playback/capture is paused and system enters S3, after system returns +from suspend, BE dai needs to call prepare() callback when playback/capture +is released from pause if RESUME_INFO flag is not set. + +Currently, the dpcm_be_dai_prepare() function will block calling prepare() +if the pcm is in SND_SOC_DPCM_STATE_PAUSED state. This will cause the +following test case fail if the pcm uses BE: + +playback -> pause -> S3 suspend -> S3 resume -> pause release + +The playback may exit abnormally when pause is released because the BE dai +prepare() is not called. + +This patch allows dpcm_be_dai_prepare() to call dai prepare() callback in +SND_SOC_DPCM_STATE_PAUSED state. + +Signed-off-by: Libin Yang +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 1dbcdc99dbe3..1d00f6e894ef 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -2247,7 +2247,8 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) + + if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) && + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) && +- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND)) ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) && ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED)) + continue; + + dev_dbg(be->dev, "ASoC: prepare BE %s\n", +-- +2.20.1 + diff --git a/queue-4.9/drm-mediatek-fix-unbind-functions.patch b/queue-4.9/drm-mediatek-fix-unbind-functions.patch new file mode 100644 index 00000000000..d726cfbfc35 --- /dev/null +++ b/queue-4.9/drm-mediatek-fix-unbind-functions.patch @@ -0,0 +1,34 @@ +From 7ca8a99c4ec7bce0231d4b0b796b83f03b1206b0 Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Wed, 29 May 2019 18:25:52 +0800 +Subject: drm/mediatek: fix unbind functions + +[ Upstream commit 8fd7a37b191f93737f6280a9b5de65f98acc12c9 ] + +detatch panel in mtk_dsi_destroy_conn_enc(), since .bind will try to +attach it again. + +Fixes: 2e54c14e310f ("drm/mediatek: Add DSI sub driver") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index eaa5a2240c0c..bdbf358697cd 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -720,6 +720,8 @@ static void mtk_dsi_destroy_conn_enc(struct mtk_dsi *dsi) + /* Skip connector cleanup if creation was delegated to the bridge */ + if (dsi->conn.dev) + drm_connector_cleanup(&dsi->conn); ++ if (dsi->panel) ++ drm_panel_detach(dsi->panel); + } + + static void mtk_dsi_ddp_start(struct mtk_ddp_comp *comp) +-- +2.20.1 + diff --git a/queue-4.9/mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch b/queue-4.9/mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch new file mode 100644 index 00000000000..9f4ecc0388e --- /dev/null +++ b/queue-4.9/mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch @@ -0,0 +1,45 @@ +From 8c4de77ad6ac402f4ee654088918e7593cbc7291 Mon Sep 17 00:00:00 2001 +From: swkhack +Date: Thu, 13 Jun 2019 15:56:08 -0700 +Subject: mm/mlock.c: change count_mm_mlocked_page_nr return type + +[ Upstream commit 0874bb49bb21bf24deda853e8bf61b8325e24bcb ] + +On a 64-bit machine the value of "vma->vm_end - vma->vm_start" may be +negative when using 32 bit ints and the "count >> PAGE_SHIFT"'s result +will be wrong. So change the local variable and return value to +unsigned long to fix the problem. + +Link: http://lkml.kernel.org/r/20190513023701.83056-1-swkhack@gmail.com +Fixes: 0cf2f6f6dc60 ("mm: mlock: check against vma for actual mlock() size") +Signed-off-by: swkhack +Acked-by: Michal Hocko +Reviewed-by: Andrew Morton +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/mlock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mm/mlock.c b/mm/mlock.c +index f0505692a5f4..3e7fe404bfb8 100644 +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -630,11 +630,11 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, + * is also counted. + * Return value: previously mlocked page counts + */ +-static int count_mm_mlocked_page_nr(struct mm_struct *mm, ++static unsigned long count_mm_mlocked_page_nr(struct mm_struct *mm, + unsigned long start, size_t len) + { + struct vm_area_struct *vma; +- int count = 0; ++ unsigned long count = 0; + + if (mm == NULL) + mm = current->mm; +-- +2.20.1 + diff --git a/queue-4.9/scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch b/queue-4.9/scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch new file mode 100644 index 00000000000..55720aa31e1 --- /dev/null +++ b/queue-4.9/scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch @@ -0,0 +1,48 @@ +From 9cbff68ebd1d099349998df7e3227db96fcda126 Mon Sep 17 00:00:00 2001 +From: Manuel Traut +Date: Thu, 13 Jun 2019 15:55:52 -0700 +Subject: scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE + +[ Upstream commit c04e32e911653442fc834be6e92e072aeebe01a1 ] + +At least for ARM64 kernels compiled with the crosstoolchain from +Debian/stretch or with the toolchain from kernel.org the line number is +not decoded correctly by 'decode_stacktrace.sh': + + $ echo "[ 136.513051] f1+0x0/0xc [kcrash]" | \ + CROSS_COMPILE=/opt/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux- \ + ./scripts/decode_stacktrace.sh /scratch/linux-arm64/vmlinux \ + /scratch/linux-arm64 \ + /nfs/debian/lib/modules/4.20.0-devel + [ 136.513051] f1 (/linux/drivers/staging/kcrash/kcrash.c:68) kcrash + +If addr2line from the toolchain is used the decoded line number is correct: + + [ 136.513051] f1 (/linux/drivers/staging/kcrash/kcrash.c:57) kcrash + +Link: http://lkml.kernel.org/r/20190527083425.3763-1-manut@linutronix.de +Signed-off-by: Manuel Traut +Acked-by: Konstantin Khlebnikov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/decode_stacktrace.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh +index edde8250195c..381acfc4c59d 100755 +--- a/scripts/decode_stacktrace.sh ++++ b/scripts/decode_stacktrace.sh +@@ -65,7 +65,7 @@ parse_symbol() { + if [[ "${cache[$module,$address]+isset}" == "isset" ]]; then + local code=${cache[$module,$address]} + else +- local code=$(addr2line -i -e "$objfile" "$address") ++ local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address") + cache[$module,$address]=$code + fi + +-- +2.20.1 + diff --git a/queue-4.9/scsi-hpsa-correct-ioaccel2-chaining.patch b/queue-4.9/scsi-hpsa-correct-ioaccel2-chaining.patch new file mode 100644 index 00000000000..4e4a2bf0819 --- /dev/null +++ b/queue-4.9/scsi-hpsa-correct-ioaccel2-chaining.patch @@ -0,0 +1,64 @@ +From bd2f1f56c03d6ca6a53baff49b858eb3e642f3b5 Mon Sep 17 00:00:00 2001 +From: Don Brace +Date: Mon, 3 Jun 2019 16:43:29 -0500 +Subject: scsi: hpsa: correct ioaccel2 chaining + +[ Upstream commit 625d7d3518875c4d303c652a198feaa13d9f52d9 ] + +- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_LAST_SG for + the last s/g element. + +- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_CHAIN when + chaining. + +Reviewed-by: Bader Ali - Saleh +Reviewed-by: Scott Teel +Reviewed-by: Matt Perricone +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 7 ++++++- + drivers/scsi/hpsa_cmd.h | 1 + + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 0b8db8a74d50..9f98c7211ec2 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -4815,7 +4815,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, + curr_sg->reserved[0] = 0; + curr_sg->reserved[1] = 0; + curr_sg->reserved[2] = 0; +- curr_sg->chain_indicator = 0x80; ++ curr_sg->chain_indicator = IOACCEL2_CHAIN; + + curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex]; + } +@@ -4832,6 +4832,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, + curr_sg++; + } + ++ /* ++ * Set the last s/g element bit ++ */ ++ (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG; ++ + switch (cmd->sc_data_direction) { + case DMA_TO_DEVICE: + cp->direction &= ~IOACCEL2_DIRECTION_MASK; +diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h +index 5961705eef76..39bcbec93c60 100644 +--- a/drivers/scsi/hpsa_cmd.h ++++ b/drivers/scsi/hpsa_cmd.h +@@ -516,6 +516,7 @@ struct ioaccel2_sg_element { + u8 reserved[3]; + u8 chain_indicator; + #define IOACCEL2_CHAIN 0x80 ++#define IOACCEL2_LAST_SG 0x40 + }; + + /* +-- +2.20.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 00961617391..ad2ed2d367e 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -63,3 +63,13 @@ bpf-udp-avoid-calling-reuseport-s-bpf_prog-from-udp_gro.patch bpf-udp-ipv6-avoid-running-reuseport-s-bpf_prog-from-__udp6_lib_err.patch tipc-pass-tunnel-dev-as-null-to-udp_tunnel-6-_xmit_skb.patch bluetooth-fix-faulty-expression-for-minimum-encryption-key-size-check.patch +asoc-cs4265-readable-register-too-low.patch +asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch +spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch +drm-mediatek-fix-unbind-functions.patch +asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch +usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch +usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch +scsi-hpsa-correct-ioaccel2-chaining.patch +scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch +mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch diff --git a/queue-4.9/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch b/queue-4.9/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch new file mode 100644 index 00000000000..e5d465dd61e --- /dev/null +++ b/queue-4.9/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch @@ -0,0 +1,86 @@ +From 745d4164462b3ea113e1b233217a95702916a874 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Thu, 16 May 2019 15:56:56 +0800 +Subject: spi: bitbang: Fix NULL pointer dereference in spi_unregister_master + +[ Upstream commit 5caaf29af5ca82d5da8bc1d0ad07d9e664ccf1d8 ] + +If spi_register_master fails in spi_bitbang_start +because device_add failure, We should return the +error code other than 0, otherwise calling +spi_bitbang_stop may trigger NULL pointer dereference +like this: + +BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0 +Read of size 8 at addr 0000000000000000 by task syz-executor.0/3661 + +CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +Call Trace: + dump_stack+0xa9/0x10e + ? __list_del_entry_valid+0x45/0xd0 + ? __list_del_entry_valid+0x45/0xd0 + __kasan_report+0x171/0x18d + ? __list_del_entry_valid+0x45/0xd0 + kasan_report+0xe/0x20 + __list_del_entry_valid+0x45/0xd0 + spi_unregister_controller+0x99/0x1b0 + spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp] + ? 0xffffffffc1128000 + ? klist_next+0x131/0x1e0 + ? driver_detach+0x40/0x40 [parport] + port_check+0x3b/0x50 [parport] + bus_for_each_dev+0x115/0x180 + ? subsys_dev_iter_exit+0x20/0x20 + __parport_register_driver+0x1f0/0x210 [parport] + ? 0xffffffffc1150000 + do_one_initcall+0xb9/0x3b5 + ? perf_trace_initcall_level+0x270/0x270 + ? kasan_unpoison_shadow+0x30/0x40 + ? kasan_unpoison_shadow+0x30/0x40 + do_init_module+0xe0/0x330 + load_module+0x38eb/0x4270 + ? module_frob_arch_sections+0x20/0x20 + ? kernel_read_file+0x188/0x3f0 + ? find_held_lock+0x6d/0xd0 + ? fput_many+0x1a/0xe0 + ? __do_sys_finit_module+0x162/0x190 + __do_sys_finit_module+0x162/0x190 + ? __ia32_sys_init_module+0x40/0x40 + ? __mutex_unlock_slowpath+0xb4/0x3f0 + ? wait_for_completion+0x240/0x240 + ? vfs_write+0x160/0x2a0 + ? lockdep_hardirqs_off+0xb5/0x100 + ? mark_held_locks+0x1a/0x90 + ? do_syscall_64+0x14/0x2a0 + do_syscall_64+0x72/0x2a0 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Reported-by: Hulk Robot +Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to master") +Signed-off-by: YueHaibing +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Axel Lin +Reviewed-by: Mukesh Ojha +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bitbang.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c +index 3aa9e6e3dac8..4ef54436b9d4 100644 +--- a/drivers/spi/spi-bitbang.c ++++ b/drivers/spi/spi-bitbang.c +@@ -392,7 +392,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang) + if (ret) + spi_master_put(master); + +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(spi_bitbang_start); + +-- +2.20.1 + diff --git a/queue-4.9/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch b/queue-4.9/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch new file mode 100644 index 00000000000..099d41a6893 --- /dev/null +++ b/queue-4.9/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch @@ -0,0 +1,51 @@ +From 15f9078a6288ba5626e72675b15682af5ba21e5c Mon Sep 17 00:00:00 2001 +From: Young Xiao <92siuyang@gmail.com> +Date: Tue, 28 May 2019 20:17:54 +0800 +Subject: usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i] + +[ Upstream commit 62fd0e0a24abeebe2c19fce49dd5716d9b62042d ] + +There is no deallocation of fusb300->ep[i] elements, allocated at +fusb300_probe. + +The patch adds deallocation of fusb300->ep array elements. + +Signed-off-by: Young Xiao <92siuyang@gmail.com> +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fusb300_udc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c +index 948845c90e47..351012c498c5 100644 +--- a/drivers/usb/gadget/udc/fusb300_udc.c ++++ b/drivers/usb/gadget/udc/fusb300_udc.c +@@ -1345,12 +1345,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = { + static int fusb300_remove(struct platform_device *pdev) + { + struct fusb300 *fusb300 = platform_get_drvdata(pdev); ++ int i; + + usb_del_gadget_udc(&fusb300->gadget); + iounmap(fusb300->reg); + free_irq(platform_get_irq(pdev, 0), fusb300); + + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); ++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) ++ kfree(fusb300->ep[i]); + kfree(fusb300); + + return 0; +@@ -1494,6 +1497,8 @@ clean_up: + if (fusb300->ep0_req) + fusb300_free_request(&fusb300->ep[0]->ep, + fusb300->ep0_req); ++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) ++ kfree(fusb300->ep[i]); + kfree(fusb300); + } + if (reg) +-- +2.20.1 + diff --git a/queue-4.9/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch b/queue-4.9/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch new file mode 100644 index 00000000000..86cdefd3876 --- /dev/null +++ b/queue-4.9/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch @@ -0,0 +1,39 @@ +From 089128149d32fbc4fb257ad5e78c19f726fb541c Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Wed, 22 May 2019 14:07:36 +0200 +Subject: usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC + +[ Upstream commit fbc318afadd6e7ae2252d6158cf7d0c5a2132f7d ] + +Gadget drivers may queue request in interrupt context. This would lead to +a descriptor allocation in that context. In that case we would hit +BUG_ON(in_interrupt()) in __get_vm_area_node. + +Also remove the unnecessary cast. + +Acked-by: Sylvain Lemieux +Tested-by: James Grant +Signed-off-by: Alexandre Belloni +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/lpc32xx_udc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c +index 8f32b5ee7734..6df1aded4503 100644 +--- a/drivers/usb/gadget/udc/lpc32xx_udc.c ++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c +@@ -935,8 +935,7 @@ static struct lpc32xx_usbd_dd_gad *udc_dd_alloc(struct lpc32xx_udc *udc) + dma_addr_t dma; + struct lpc32xx_usbd_dd_gad *dd; + +- dd = (struct lpc32xx_usbd_dd_gad *) dma_pool_alloc( +- udc->dd_cache, (GFP_KERNEL | GFP_DMA), &dma); ++ dd = dma_pool_alloc(udc->dd_cache, GFP_ATOMIC | GFP_DMA, &dma); + if (dd) + dd->this_dma = dma; + +-- +2.20.1 +