From: Greg Kroah-Hartman Date: Sun, 30 Sep 2018 15:39:02 +0000 (-0700) Subject: 4.4-stable patches X-Git-Tag: v4.18.12~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=857085cb0f34cdb56667859c284fc37bae878de0;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch usb-remove-lpm-management-from-usb_driver_claim_interface.patch usb-usbdevfs-restore-warning-for-nonsensical-flags.patch usb-usbdevfs-sanitize-flags-more.patch --- diff --git a/queue-4.4/ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch b/queue-4.4/ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch new file mode 100644 index 00000000000..4e910a0d238 --- /dev/null +++ b/queue-4.4/ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch @@ -0,0 +1,45 @@ +From ee92efe41cf358f4b99e73509f2bfd4733609f26 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 17 Sep 2018 18:10:05 -0700 +Subject: IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop + +From: Bart Van Assche + +commit ee92efe41cf358f4b99e73509f2bfd4733609f26 upstream. + +Use different loop variables for the inner and outer loop. This avoids +that an infinite loop occurs if there are more RDMA channels than +target->req_ring_size. + +Fixes: d92c0da71a35 ("IB/srp: Add multichannel support") +Cc: +Signed-off-by: Bart Van Assche +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/srp/ib_srp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -2594,7 +2594,7 @@ static int srp_reset_device(struct scsi_ + { + struct srp_target_port *target = host_to_target(scmnd->device->host); + struct srp_rdma_ch *ch; +- int i; ++ int i, j; + u8 status; + + shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n"); +@@ -2608,8 +2608,8 @@ static int srp_reset_device(struct scsi_ + + for (i = 0; i < target->ch_count; i++) { + ch = &target->ch[i]; +- for (i = 0; i < target->req_ring_size; ++i) { +- struct srp_request *req = &ch->req_ring[i]; ++ for (j = 0; j < target->req_ring_size; ++j) { ++ struct srp_request *req = &ch->req_ring[j]; + + srp_finish_req(ch, req, scmnd->device, DID_RESET << 16); + } diff --git a/queue-4.4/input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch b/queue-4.4/input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch new file mode 100644 index 00000000000..39f35722563 --- /dev/null +++ b/queue-4.4/input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch @@ -0,0 +1,31 @@ +From 91a97507323e1ad4bfc10f4a5922e67cdaf8b3cd Mon Sep 17 00:00:00 2001 +From: Aaron Ma +Date: Tue, 18 Sep 2018 09:32:22 -0700 +Subject: Input: elantech - enable middle button of touchpad on ThinkPad P72 + +From: Aaron Ma + +commit 91a97507323e1ad4bfc10f4a5922e67cdaf8b3cd upstream. + +Adding 2 new touchpad IDs to support middle button support. + +Cc: stable@vger.kernel.org +Signed-off-by: Aaron Ma +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/elantech.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1180,6 +1180,8 @@ static const struct dmi_system_id elante + static const char * const middle_button_pnp_ids[] = { + "LEN2131", /* ThinkPad P52 w/ NFC */ + "LEN2132", /* ThinkPad P52 */ ++ "LEN2133", /* ThinkPad P72 w/ NFC */ ++ "LEN2134", /* ThinkPad P72 */ + NULL + }; + diff --git a/queue-4.4/revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch b/queue-4.4/revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch new file mode 100644 index 00000000000..48e25637332 --- /dev/null +++ b/queue-4.4/revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch @@ -0,0 +1,35 @@ +From e871db8d78df1c411032cbb3acfdf8930509360e Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Tue, 11 Sep 2018 10:00:44 +0200 +Subject: Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" + +From: Sebastian Andrzej Siewior + +commit e871db8d78df1c411032cbb3acfdf8930509360e upstream. + +This reverts commit 6e22e3af7bb3a7b9dc53cb4687659f6e63fca427. + +The bug the patch describes to, has been already fixed in commit +2df6948428542 ("USB: cdc-wdm: don't enable interrupts in USB-giveback") +so need to this, revert it. + +Fixes: 6e22e3af7bb3 ("usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()") +Cc: stable +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-wdm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -453,7 +453,7 @@ static int clear_wdm_read_flag(struct wd + + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); +- rv = usb_submit_urb(desc->response, GFP_ATOMIC); ++ rv = usb_submit_urb(desc->response, GFP_KERNEL); + spin_lock_irq(&desc->iuspin); + if (rv) { + dev_err(&desc->intf->dev, diff --git a/queue-4.4/scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch b/queue-4.4/scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch new file mode 100644 index 00000000000..5400878b9a6 --- /dev/null +++ b/queue-4.4/scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch @@ -0,0 +1,64 @@ +From 8c39e2699f8acb2e29782a834e56306da24937fe Mon Sep 17 00:00:00 2001 +From: Vincent Pelletier +Date: Sun, 9 Sep 2018 04:09:27 +0000 +Subject: scsi: target: iscsi: Use bin2hex instead of a re-implementation + +From: Vincent Pelletier + +commit 8c39e2699f8acb2e29782a834e56306da24937fe upstream. + +Signed-off-by: Vincent Pelletier +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +[plr.vincent@gmail.com: hunk context change for 4.4 and 4.9, no code change] +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_auth.c | 15 +++------------ + 1 file changed, 3 insertions(+), 12 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -26,15 +26,6 @@ + #include "iscsi_target_nego.h" + #include "iscsi_target_auth.h" + +-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len) +-{ +- int i; +- +- for (i = 0; i < src_len; i++) { +- sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff); +- } +-} +- + static void chap_gen_challenge( + struct iscsi_conn *conn, + int caller, +@@ -47,7 +38,7 @@ static void chap_gen_challenge( + memset(challenge_asciihex, 0, CHAP_CHALLENGE_LENGTH * 2 + 1); + + get_random_bytes(chap->challenge, CHAP_CHALLENGE_LENGTH); +- chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge, ++ bin2hex(challenge_asciihex, chap->challenge, + CHAP_CHALLENGE_LENGTH); + /* + * Set CHAP_C, and copy the generated challenge into c_str. +@@ -287,7 +278,7 @@ static int chap_server_compute_md5( + } + crypto_free_hash(tfm); + +- chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE); ++ bin2hex(response, server_digest, MD5_SIGNATURE_SIZE); + pr_debug("[server] MD5 Server Digest: %s\n", response); + + if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) { +@@ -431,7 +422,7 @@ static int chap_server_compute_md5( + /* + * Convert response from binary hex to ascii hext. + */ +- chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE); ++ bin2hex(response, digest, MD5_SIGNATURE_SIZE); + *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s", + response); + *nr_out_len += 1; diff --git a/queue-4.4/series b/queue-4.4/series index 9dbccf4f1ee..c8c8cbdc2d1 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -52,3 +52,10 @@ usb-fix-error-handling-in-usb_driver_claim_interface.patch usb-handle-null-config-in-usb_find_alt_setting.patch slub-make-cpu_partial-unsigned-int.patch media-uvcvideo-support-realtek-s-uvc-1.5-device.patch +usb-usbdevfs-sanitize-flags-more.patch +usb-usbdevfs-restore-warning-for-nonsensical-flags.patch +revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch +usb-remove-lpm-management-from-usb_driver_claim_interface.patch +input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch +ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch +scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch diff --git a/queue-4.4/usb-remove-lpm-management-from-usb_driver_claim_interface.patch b/queue-4.4/usb-remove-lpm-management-from-usb_driver_claim_interface.patch new file mode 100644 index 00000000000..b560706aebb --- /dev/null +++ b/queue-4.4/usb-remove-lpm-management-from-usb_driver_claim_interface.patch @@ -0,0 +1,76 @@ +From c183813fcee44a249339b7c46e1ad271ca1870aa Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 10 Sep 2018 13:58:51 -0400 +Subject: USB: remove LPM management from usb_driver_claim_interface() + +From: Alan Stern + +commit c183813fcee44a249339b7c46e1ad271ca1870aa upstream. + +usb_driver_claim_interface() disables and re-enables Link Power +Management, but it shouldn't do either one, for the reasons listed +below. This patch removes the two LPM-related function calls from the +routine. + +The reason for disabling LPM in the analogous function +usb_probe_interface() is so that drivers won't have to deal with +unwanted LPM transitions in their probe routine. But +usb_driver_claim_interface() doesn't call the driver's probe routine +(or any other callbacks), so that reason doesn't apply here. + +Furthermore, no driver other than usbfs will ever call +usb_driver_claim_interface() unless it is already bound to another +interface in the same device, which means disabling LPM here would be +redundant. usbfs doesn't interact with LPM at all. + +Lastly, the error return from usb_unlocked_disable_lpm() isn't handled +properly; the code doesn't clean up its earlier actions before +returning. + +Signed-off-by: Alan Stern +Fixes: 8306095fd2c1 ("USB: Disable USB 3.0 LPM in critical sections.") +CC: +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/driver.c | 15 --------------- + 1 file changed, 15 deletions(-) + +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -509,7 +509,6 @@ int usb_driver_claim_interface(struct us + struct device *dev; + struct usb_device *udev; + int retval = 0; +- int lpm_disable_error = -ENODEV; + + if (!iface) + return -ENODEV; +@@ -530,16 +529,6 @@ int usb_driver_claim_interface(struct us + + iface->condition = USB_INTERFACE_BOUND; + +- /* See the comment about disabling LPM in usb_probe_interface(). */ +- if (driver->disable_hub_initiated_lpm) { +- lpm_disable_error = usb_unlocked_disable_lpm(udev); +- if (lpm_disable_error) { +- dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.", +- __func__, driver->name); +- return -ENOMEM; +- } +- } +- + /* Claimed interfaces are initially inactive (suspended) and + * runtime-PM-enabled, but only if the driver has autosuspend + * support. Otherwise they are marked active, to prevent the +@@ -558,10 +547,6 @@ int usb_driver_claim_interface(struct us + if (device_is_registered(dev)) + retval = device_bind_driver(dev); + +- /* Attempt to re-enable USB3 LPM, if the disable was successful. */ +- if (!lpm_disable_error) +- usb_unlocked_enable_lpm(udev); +- + if (retval) { + dev->driver = NULL; + usb_set_intfdata(iface, NULL); diff --git a/queue-4.4/usb-usbdevfs-restore-warning-for-nonsensical-flags.patch b/queue-4.4/usb-usbdevfs-restore-warning-for-nonsensical-flags.patch new file mode 100644 index 00000000000..272bbee1dd7 --- /dev/null +++ b/queue-4.4/usb-usbdevfs-restore-warning-for-nonsensical-flags.patch @@ -0,0 +1,35 @@ +From 81e0403b26d94360abd1f6a57311337973bc82cd Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 5 Sep 2018 12:07:03 +0200 +Subject: USB: usbdevfs: restore warning for nonsensical flags + +From: Oliver Neukum + +commit 81e0403b26d94360abd1f6a57311337973bc82cd upstream. + +If we filter flags before they reach the core we need to generate our +own warnings. + +Signed-off-by: Oliver Neukum +Fixes: 0cb54a3e47cb ("USB: debugging code shouldn't alter control flow") +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1535,6 +1535,11 @@ static int proc_do_submiturb(struct usb_ + u |= URB_NO_INTERRUPT; + as->urb->transfer_flags = u; + ++ if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK) ++ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n"); ++ if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET) ++ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n"); ++ + as->urb->transfer_buffer_length = uurb->buffer_length; + as->urb->setup_packet = (unsigned char *)dr; + dr = NULL; diff --git a/queue-4.4/usb-usbdevfs-sanitize-flags-more.patch b/queue-4.4/usb-usbdevfs-sanitize-flags-more.patch new file mode 100644 index 00000000000..7a520f155b8 --- /dev/null +++ b/queue-4.4/usb-usbdevfs-sanitize-flags-more.patch @@ -0,0 +1,88 @@ +From 7a68d9fb851012829c29e770621905529bd9490b Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 5 Sep 2018 12:07:02 +0200 +Subject: USB: usbdevfs: sanitize flags more + +From: Oliver Neukum + +commit 7a68d9fb851012829c29e770621905529bd9490b upstream. + +Requesting a ZERO_PACKET or not is sensible only for output. +In the input direction the device decides. +Likewise accepting short packets makes sense only for input. + +This allows operation with panic_on_warn without opening up +a local DOS. + +Signed-off-by: Oliver Neukum +Reported-by: syzbot+843efa30c8821bd69f53@syzkaller.appspotmail.com +Fixes: 0cb54a3e47cb ("USB: debugging code shouldn't alter control flow") +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1289,10 +1289,13 @@ static int proc_do_submiturb(struct usb_ + struct async *as = NULL; + struct usb_ctrlrequest *dr = NULL; + unsigned int u, totlen, isofrmlen; +- int i, ret, is_in, num_sgs = 0, ifnum = -1; ++ int i, ret, num_sgs = 0, ifnum = -1; + int number_of_packets = 0; + unsigned int stream_id = 0; + void *buf; ++ bool is_in; ++ bool allow_short = false; ++ bool allow_zero = false; + unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | + USBDEVFS_URB_BULK_CONTINUATION | + USBDEVFS_URB_NO_FSBR | +@@ -1326,6 +1329,8 @@ static int proc_do_submiturb(struct usb_ + u = 0; + switch (uurb->type) { + case USBDEVFS_URB_TYPE_CONTROL: ++ if (is_in) ++ allow_short = true; + if (!usb_endpoint_xfer_control(&ep->desc)) + return -EINVAL; + /* min 8 byte setup packet */ +@@ -1366,6 +1371,10 @@ static int proc_do_submiturb(struct usb_ + break; + + case USBDEVFS_URB_TYPE_BULK: ++ if (!is_in) ++ allow_zero = true; ++ else ++ allow_short = true; + switch (usb_endpoint_type(&ep->desc)) { + case USB_ENDPOINT_XFER_CONTROL: + case USB_ENDPOINT_XFER_ISOC: +@@ -1386,6 +1395,10 @@ static int proc_do_submiturb(struct usb_ + if (!usb_endpoint_xfer_int(&ep->desc)) + return -EINVAL; + interrupt_urb: ++ if (!is_in) ++ allow_zero = true; ++ else ++ allow_short = true; + break; + + case USBDEVFS_URB_TYPE_ISO: +@@ -1512,11 +1525,11 @@ static int proc_do_submiturb(struct usb_ + u = (is_in ? URB_DIR_IN : URB_DIR_OUT); + if (uurb->flags & USBDEVFS_URB_ISO_ASAP) + u |= URB_ISO_ASAP; +- if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in) ++ if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK) + u |= URB_SHORT_NOT_OK; + if (uurb->flags & USBDEVFS_URB_NO_FSBR) + u |= URB_NO_FSBR; +- if (uurb->flags & USBDEVFS_URB_ZERO_PACKET) ++ if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET) + u |= URB_ZERO_PACKET; + if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT) + u |= URB_NO_INTERRUPT;