From: Greg Kroah-Hartman Date: Mon, 10 Nov 2014 05:18:27 +0000 (+0900) Subject: 3.17-stable patches X-Git-Tag: v3.10.60~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=92ed8b237467dcd8417ca03998a7cb56ffc97487;p=thirdparty%2Fkernel%2Fstable-queue.git 3.17-stable patches added patches: alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch ima-check-xattr-value-length-and-type-in-the-ima_inode_setxattr.patch usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch usb-gadget-udc-core-fix-kernel-oops-with-soft-connect.patch usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch usb-opticon-fix-non-atomic-allocation-in-write-path.patch usb-remove-references-to-non-existent-plat_s5p-symbol.patch usb-storage-handle-a-skipped-data-phase.patch --- diff --git a/queue-3.17/alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch b/queue-3.17/alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch new file mode 100644 index 00000000000..26fa9dc787e --- /dev/null +++ b/queue-3.17/alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch @@ -0,0 +1,103 @@ +From 0725dda207e95ff25f1aa01432250323e0ec49d6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 5 Nov 2014 15:08:49 +0100 +Subject: ALSA: usb-audio: Fix device_del() sysfs warnings at disconnect + +From: Takashi Iwai + +commit 0725dda207e95ff25f1aa01432250323e0ec49d6 upstream. + +Some USB-audio devices show weird sysfs warnings at disconnecting the +devices, e.g. + usb 1-3: USB disconnect, device number 3 + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 973 at fs/sysfs/group.c:216 device_del+0x39/0x180() + sysfs group ffffffff8183df40 not found for kobject 'midiC1D0' + Call Trace: + [] ? dump_stack+0x49/0x71 + [] ? warn_slowpath_common+0x82/0xb0 + [] ? warn_slowpath_fmt+0x45/0x50 + [] ? device_del+0x39/0x180 + [] ? device_unregister+0x9/0x20 + [] ? device_destroy+0x34/0x40 + [] ? snd_unregister_device+0x7f/0xd0 [snd] + [] ? snd_rawmidi_dev_disconnect+0xce/0x100 [snd_rawmidi] + [] ? snd_device_disconnect+0x62/0x90 [snd] + [] ? snd_device_disconnect_all+0x3c/0x60 [snd] + [] ? snd_card_disconnect+0x124/0x1a0 [snd] + [] ? usb_audio_disconnect+0x88/0x1c0 [snd_usb_audio] + [] ? usb_unbind_interface+0x5e/0x1b0 [usbcore] + [] ? __device_release_driver+0x79/0xf0 + [] ? device_release_driver+0x25/0x40 + [] ? bus_remove_device+0xf1/0x130 + [] ? device_del+0x109/0x180 + [] ? usb_disable_device+0x95/0x1f0 [usbcore] + [] ? usb_disconnect+0x8f/0x190 [usbcore] + [] ? hub_thread+0x539/0x13a0 [usbcore] + [] ? sched_clock_local+0x15/0x80 + [] ? sched_clock_cpu+0xb8/0xd0 + [] ? bit_waitqueue+0xb0/0xb0 + [] ? usb_port_resume+0x430/0x430 [usbcore] + [] ? usb_port_resume+0x430/0x430 [usbcore] + [] ? kthread+0xce/0xf0 + [] ? kthread_create_on_node+0x1c0/0x1c0 + [] ? ret_from_fork+0x7c/0xb0 + [] ? kthread_create_on_node+0x1c0/0x1c0 + ---[ end trace 40b1928d1136b91e ]--- + +This comes from the fact that usb-audio driver may receive the +disconnect callback multiple times, per each usb interface. When a +device has both audio and midi interfaces, it gets called twice, and +currently the driver tries to release resources at the last call. +At this point, the first parent interface has been already deleted, +thus deleting a child of the first parent hits such a warning. + +For fixing this problem, we need to call snd_card_disconnect() and +cancel pending operations at the very first disconnect while the +release of the whole objects waits until the last disconnect call. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=80931 +Reported-and-tested-by: Tomas Gayoso +Reported-and-tested-by: Chris J Arges +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -591,18 +591,19 @@ static void snd_usb_audio_disconnect(str + { + struct snd_card *card; + struct list_head *p; ++ bool was_shutdown; + + if (chip == (void *)-1L) + return; + + card = chip->card; + down_write(&chip->shutdown_rwsem); ++ was_shutdown = chip->shutdown; + chip->shutdown = 1; + up_write(&chip->shutdown_rwsem); + + mutex_lock(®ister_mutex); +- chip->num_interfaces--; +- if (chip->num_interfaces <= 0) { ++ if (!was_shutdown) { + struct snd_usb_endpoint *ep; + + snd_card_disconnect(card); +@@ -622,6 +623,10 @@ static void snd_usb_audio_disconnect(str + list_for_each(p, &chip->mixer_list) { + snd_usb_mixer_disconnect(p); + } ++ } ++ ++ chip->num_interfaces--; ++ if (chip->num_interfaces <= 0) { + usb_chip[chip->index] = NULL; + mutex_unlock(®ister_mutex); + snd_card_free_when_closed(card); diff --git a/queue-3.17/ima-check-xattr-value-length-and-type-in-the-ima_inode_setxattr.patch b/queue-3.17/ima-check-xattr-value-length-and-type-in-the-ima_inode_setxattr.patch new file mode 100644 index 00000000000..0bdf39f8e8d --- /dev/null +++ b/queue-3.17/ima-check-xattr-value-length-and-type-in-the-ima_inode_setxattr.patch @@ -0,0 +1,90 @@ +From a48fda9de94500a3152a56b723d0a64ae236547c Mon Sep 17 00:00:00 2001 +From: Dmitry Kasatkin +Date: Tue, 28 Oct 2014 13:31:22 +0200 +Subject: ima: check xattr value length and type in the ima_inode_setxattr() + +From: Dmitry Kasatkin + +commit a48fda9de94500a3152a56b723d0a64ae236547c upstream. + +ima_inode_setxattr() can be called with no value. Function does not +check the length so that following command can be used to produce +kernel oops: setfattr -n security.ima FOO. This patch fixes it. + +Changes in v3: +* for stable reverted "allow setting hash only in fix or log mode" + It will be a separate patch. + +Changes in v2: +* testing validity of xattr type +* allow setting hash only in fix or log mode (Mimi) + +[ 261.562522] BUG: unable to handle kernel NULL pointer dereference at (null) +[ 261.564109] IP: [] ima_inode_setxattr+0x3e/0x5a +[ 261.564109] PGD 3112f067 PUD 42965067 PMD 0 +[ 261.564109] Oops: 0000 [#1] SMP +[ 261.564109] Modules linked in: bridge stp llc evdev serio_raw i2c_piix4 button fuse +[ 261.564109] CPU: 0 PID: 3299 Comm: setxattr Not tainted 3.16.0-kds+ #2924 +[ 261.564109] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 +[ 261.564109] task: ffff8800428c2430 ti: ffff880042be0000 task.ti: ffff880042be0000 +[ 261.564109] RIP: 0010:[] [] ima_inode_setxattr+0x3e/0x5a +[ 261.564109] RSP: 0018:ffff880042be3d50 EFLAGS: 00010246 +[ 261.564109] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000015 +[ 261.564109] RDX: 0000001500000000 RSI: 0000000000000000 RDI: ffff8800375cc600 +[ 261.564109] RBP: ffff880042be3d68 R08: 0000000000000000 R09: 00000000004d6256 +[ 261.564109] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88002149ba00 +[ 261.564109] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +[ 261.564109] FS: 00007f6c1e219740(0000) GS:ffff88005da00000(0000) knlGS:0000000000000000 +[ 261.564109] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 261.564109] CR2: 0000000000000000 CR3: 000000003b35a000 CR4: 00000000000006f0 +[ 261.564109] Stack: +[ 261.564109] ffff88002149ba00 ffff880042be3df8 0000000000000000 ffff880042be3d98 +[ 261.564109] ffffffff812a101b ffff88002149ba00 ffff880042be3df8 0000000000000000 +[ 261.564109] 0000000000000000 ffff880042be3de0 ffffffff8116d08a ffff880042be3dc8 +[ 261.564109] Call Trace: +[ 261.564109] [] security_inode_setxattr+0x48/0x6a +[ 261.564109] [] vfs_setxattr+0x6b/0x9f +[ 261.564109] [] setxattr+0x122/0x16c +[ 261.564109] [] ? mnt_want_write+0x21/0x45 +[ 261.564109] [] ? __sb_start_write+0x10f/0x143 +[ 261.564109] [] ? mnt_want_write+0x21/0x45 +[ 261.564109] [] ? __mnt_want_write+0x48/0x4f +[ 261.564109] [] SyS_setxattr+0x6e/0xb0 +[ 261.564109] [] system_call_fastpath+0x16/0x1b +[ 261.564109] Code: 48 89 f7 48 c7 c6 58 36 81 81 53 31 db e8 73 27 04 00 85 c0 75 28 bf 15 00 00 00 e8 8a a5 d9 ff 84 c0 75 05 83 cb ff eb 15 31 f6 <41> 80 7d 00 03 49 8b 7c 24 68 40 0f 94 c6 e8 e1 f9 ff ff 89 d8 +[ 261.564109] RIP [] ima_inode_setxattr+0x3e/0x5a +[ 261.564109] RSP +[ 261.564109] CR2: 0000000000000000 +[ 261.599998] ---[ end trace 39a89a3fc267e652 ]--- + +Reported-by: Jan Kara +Signed-off-by: Dmitry Kasatkin +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_appraise.c | 2 ++ + security/integrity/integrity.h | 1 + + 2 files changed, 3 insertions(+) + +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -378,6 +378,8 @@ int ima_inode_setxattr(struct dentry *de + result = ima_protect_xattr(dentry, xattr_name, xattr_value, + xattr_value_len); + if (result == 1) { ++ if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST)) ++ return -EINVAL; + ima_reset_appraise_flags(dentry->d_inode, + (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0); + result = 0; +--- a/security/integrity/integrity.h ++++ b/security/integrity/integrity.h +@@ -61,6 +61,7 @@ enum evm_ima_xattr_type { + EVM_XATTR_HMAC, + EVM_IMA_XATTR_DIGSIG, + IMA_XATTR_DIGEST_NG, ++ IMA_XATTR_LAST + }; + + struct evm_ima_xattr_data { diff --git a/queue-3.17/series b/queue-3.17/series index 0688828b666..fa1a66ec89e 100644 --- a/queue-3.17/series +++ b/queue-3.17/series @@ -229,3 +229,11 @@ hid-usbhid-fix-pixart-optical-mouse.patch hid-usbhid-add-another-mouse-that-needs-quirk_always_poll.patch hid-usbhid-enable-always-poll-quirk-for-elan-touchscreen-009b.patch hid-usbhid-enable-always-poll-quirk-for-elan-touchscreen-016f.patch +usb-gadget-udc-core-fix-kernel-oops-with-soft-connect.patch +alsa-usb-audio-fix-device_del-sysfs-warnings-at-disconnect.patch +usb-storage-handle-a-skipped-data-phase.patch +usb-opticon-fix-non-atomic-allocation-in-write-path.patch +usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch +usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch +usb-remove-references-to-non-existent-plat_s5p-symbol.patch +ima-check-xattr-value-length-and-type-in-the-ima_inode_setxattr.patch diff --git a/queue-3.17/usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch b/queue-3.17/usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch new file mode 100644 index 00000000000..e3f7d4d821b --- /dev/null +++ b/queue-3.17/usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch @@ -0,0 +1,76 @@ +From 90a646c770c50cc206ceba0d7b50453c46c13c36 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 1 Oct 2014 11:29:14 +0200 +Subject: usb: Do not allow usb_alloc_streams on unconfigured devices + +From: Hans de Goede + +commit 90a646c770c50cc206ceba0d7b50453c46c13c36 upstream. + +This commit fixes the following oops: + +[10238.622067] scsi host3: uas_eh_bus_reset_handler start +[10240.766164] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd +[10245.779365] usb 3-4: device descriptor read/8, error -110 +[10245.883331] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd +[10250.897603] usb 3-4: device descriptor read/8, error -110 +[10251.058200] BUG: unable to handle kernel NULL pointer dereference at 0000000000000040 +[10251.058244] IP: [] xhci_check_streams_endpoint+0x91/0x140 + +[10251.059473] Call Trace: +[10251.059487] [] xhci_calculate_streams_and_bitmask+0xbc/0x130 +[10251.059520] [] xhci_alloc_streams+0x10f/0x5a0 +[10251.059548] [] ? check_preempt_curr+0x75/0xa0 +[10251.059575] [] ? ttwu_do_wakeup+0x2c/0x100 +[10251.059601] [] ? ttwu_do_activate.constprop.111+0x66/0x70 +[10251.059635] [] usb_alloc_streams+0xab/0xf0 +[10251.059662] [] uas_configure_endpoints+0x128/0x150 [uas] +[10251.059694] [] uas_post_reset+0x3c/0xb0 [uas] +[10251.059722] [] usb_reset_device+0x1b9/0x2a0 +[10251.059749] [] uas_eh_bus_reset_handler+0xb2/0x190 [uas] +[10251.059781] [] scsi_try_bus_reset+0x53/0x110 +[10251.059808] [] scsi_eh_bus_reset+0xf7/0x270 + + +The problem is the following call sequence (simplified): + +1) usb_reset_device +2) usb_reset_and_verify_device +2) hub_port_init +3) hub_port_finish_reset +3) xhci_discover_or_reset_device + This frees xhci->devs[slot_id]->eps[ep_index].ring for all eps but 0 +4) usb_get_device_descriptor + This fails +5) hub_port_init fails +6) usb_reset_and_verify_device fails, does not restore device config +7) uas_post_reset +8) xhci_alloc_streams + NULL deref on the free-ed ring + +This commit fixes this by not allowing usb_alloc_streams to continue if +the device is not configured. + +Note that we do allow usb_free_streams to continue after a (logical) +disconnect, as it is necessary to explicitly free the streams at the xhci +controller level. + +Signed-off-by: Hans de Goede +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2057,6 +2057,8 @@ int usb_alloc_streams(struct usb_interfa + return -EINVAL; + if (dev->speed != USB_SPEED_SUPER) + return -EINVAL; ++ if (dev->state < USB_STATE_CONFIGURED) ++ return -ENODEV; + + for (i = 0; i < num_eps; i++) { + /* Streams only apply to bulk endpoints. */ diff --git a/queue-3.17/usb-gadget-udc-core-fix-kernel-oops-with-soft-connect.patch b/queue-3.17/usb-gadget-udc-core-fix-kernel-oops-with-soft-connect.patch new file mode 100644 index 00000000000..734ddedd313 --- /dev/null +++ b/queue-3.17/usb-gadget-udc-core-fix-kernel-oops-with-soft-connect.patch @@ -0,0 +1,77 @@ +From bfa6b18c680450c17512c741ed1d818695747621 Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Fri, 17 Oct 2014 11:10:25 -0500 +Subject: usb: gadget: udc: core: fix kernel oops with soft-connect + +From: Felipe Balbi + +commit bfa6b18c680450c17512c741ed1d818695747621 upstream. + +Currently, there's no guarantee that udc->driver +will be valid when using soft_connect sysfs +interface. In fact, we can very easily trigger +a NULL pointer dereference by trying to disconnect +when a gadget driver isn't loaded. + +Fix this bug: + +~# echo disconnect > soft_connect +[ 33.685743] Unable to handle kernel NULL pointer dereference at virtual address 00000014 +[ 33.694221] pgd = ed0cc000 +[ 33.697174] [00000014] *pgd=ae351831, *pte=00000000, *ppte=00000000 +[ 33.703766] Internal error: Oops: 17 [#1] SMP ARM +[ 33.708697] Modules linked in: xhci_plat_hcd xhci_hcd snd_soc_davinci_mcasp snd_soc_tlv320aic3x snd_soc_edma snd_soc_omap snd_soc_evm snd_soc_core dwc3 snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd lis3lv02d_i2c matrix_keypad lis3lv02d dwc3_omap input_polldev soundcore +[ 33.734372] CPU: 0 PID: 1457 Comm: bash Not tainted 3.17.0-09740-ga93416e-dirty #345 +[ 33.742457] task: ee71ce00 ti: ee68a000 task.ti: ee68a000 +[ 33.748116] PC is at usb_udc_softconn_store+0xa4/0xec +[ 33.753416] LR is at mark_held_locks+0x78/0x90 +[ 33.758057] pc : [] lr : [] psr: 20000013 +[ 33.758057] sp : ee68bec8 ip : c0c00008 fp : ee68bee4 +[ 33.770050] r10: ee6b394c r9 : ee68bf80 r8 : ee6062c0 +[ 33.775508] r7 : 00000000 r6 : ee6062c0 r5 : 0000000b r4 : ee739408 +[ 33.782346] r3 : 00000000 r2 : 00000000 r1 : ee71d390 r0 : ee664170 +[ 33.789168] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user +[ 33.796636] Control: 10c5387d Table: ad0cc059 DAC: 00000015 +[ 33.802638] Process bash (pid: 1457, stack limit = 0xee68a248) +[ 33.808740] Stack: (0xee68bec8 to 0xee68c000) +[ 33.813299] bec0: 0000000b c0411284 ee6062c0 00000000 ee68bef4 ee68bee8 +[ 33.821862] bee0: c04112ac c04df090 ee68bf14 ee68bef8 c01c2868 c0411290 0000000b ee6b3940 +[ 33.830419] bf00: 00000000 00000000 ee68bf4c ee68bf18 c01c1a24 c01c2818 00000000 00000000 +[ 33.838990] bf20: ee61b940 ee2f47c0 0000000b 000ce408 ee68bf80 c000f304 ee68a000 00000000 +[ 33.847544] bf40: ee68bf7c ee68bf50 c0152dd8 c01c1960 ee68bf7c c0170af8 ee68bf7c ee2f47c0 +[ 33.856099] bf60: ee2f47c0 000ce408 0000000b c000f304 ee68bfa4 ee68bf80 c0153330 c0152d34 +[ 33.864653] bf80: 00000000 00000000 0000000b 000ce408 b6e7fb50 00000004 00000000 ee68bfa8 +[ 33.873204] bfa0: c000f080 c01532e8 0000000b 000ce408 00000001 000ce408 0000000b 00000000 +[ 33.881763] bfc0: 0000000b 000ce408 b6e7fb50 00000004 0000000b 00000000 000c5758 00000000 +[ 33.890319] bfe0: 00000000 bec2c924 b6de422d b6e1d226 40000030 00000001 75716d2f 00657565 +[ 33.898890] [] (usb_udc_softconn_store) from [] (dev_attr_store+0x28/0x34) +[ 33.907920] [] (dev_attr_store) from [] (sysfs_kf_write+0x5c/0x60) +[ 33.916200] [] (sysfs_kf_write) from [] (kernfs_fop_write+0xd0/0x194) +[ 33.924773] [] (kernfs_fop_write) from [] (vfs_write+0xb0/0x1bc) +[ 33.932874] [] (vfs_write) from [] (SyS_write+0x54/0xb0) +[ 33.940247] [] (SyS_write) from [] (ret_fast_syscall+0x0/0x48) +[ 33.948160] Code: e1a01007 e12fff33 e5140004 e5143008 (e5933014) +[ 33.954625] ---[ end trace f849bead94eab7ea ]--- + +Fixes: 2ccea03 (usb: gadget: introduce UDC Class) +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/udc-core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/gadget/udc/udc-core.c ++++ b/drivers/usb/gadget/udc/udc-core.c +@@ -458,6 +458,11 @@ static ssize_t usb_udc_softconn_store(st + { + struct usb_udc *udc = container_of(dev, struct usb_udc, dev); + ++ if (!udc->driver) { ++ dev_err(dev, "soft-connect without a gadget driver\n"); ++ return -EOPNOTSUPP; ++ } ++ + if (sysfs_streq(buf, "connect")) { + usb_gadget_udc_start(udc->gadget, udc->driver); + usb_gadget_connect(udc->gadget); diff --git a/queue-3.17/usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch b/queue-3.17/usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch new file mode 100644 index 00000000000..33bc893c306 --- /dev/null +++ b/queue-3.17/usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch @@ -0,0 +1,41 @@ +From 191252837626fca0de694c18bb2aa64c118eda89 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 29 Oct 2014 09:07:30 +0100 +Subject: USB: kobil_sct: fix non-atomic allocation in write path + +From: Johan Hovold + +commit 191252837626fca0de694c18bb2aa64c118eda89 upstream. + +Write may be called from interrupt context so make sure to use +GFP_ATOMIC for all allocations in write. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/kobil_sct.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/kobil_sct.c ++++ b/drivers/usb/serial/kobil_sct.c +@@ -335,7 +335,8 @@ static int kobil_write(struct tty_struct + port->interrupt_out_urb->transfer_buffer_length = length; + + priv->cur_pos = priv->cur_pos + length; +- result = usb_submit_urb(port->interrupt_out_urb, GFP_NOIO); ++ result = usb_submit_urb(port->interrupt_out_urb, ++ GFP_ATOMIC); + dev_dbg(&port->dev, "%s - Send write URB returns: %i\n", __func__, result); + todo = priv->filled - priv->cur_pos; + +@@ -350,7 +351,7 @@ static int kobil_write(struct tty_struct + if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID || + priv->device_type == KOBIL_ADAPTER_K_PRODUCT_ID) { + result = usb_submit_urb(port->interrupt_in_urb, +- GFP_NOIO); ++ GFP_ATOMIC); + dev_dbg(&port->dev, "%s - Send read URB returns: %i\n", __func__, result); + } + } diff --git a/queue-3.17/usb-opticon-fix-non-atomic-allocation-in-write-path.patch b/queue-3.17/usb-opticon-fix-non-atomic-allocation-in-write-path.patch new file mode 100644 index 00000000000..903855b612b --- /dev/null +++ b/queue-3.17/usb-opticon-fix-non-atomic-allocation-in-write-path.patch @@ -0,0 +1,31 @@ +From e681286de221af78fc85db9222b6a203148c005a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 29 Oct 2014 09:07:31 +0100 +Subject: USB: opticon: fix non-atomic allocation in write path + +From: Johan Hovold + +commit e681286de221af78fc85db9222b6a203148c005a upstream. + +Write may be called from interrupt context so make sure to use +GFP_ATOMIC for all allocations in write. + +Fixes: 0d930e51cfe6 ("USB: opticon: Add Opticon OPN2001 write support") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/opticon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/opticon.c ++++ b/drivers/usb/serial/opticon.c +@@ -215,7 +215,7 @@ static int opticon_write(struct tty_stru + + /* The connected devices do not have a bulk write endpoint, + * to transmit data to de barcode device the control endpoint is used */ +- dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO); ++ dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC); + if (!dr) { + count = -ENOMEM; + goto error_no_dr; diff --git a/queue-3.17/usb-remove-references-to-non-existent-plat_s5p-symbol.patch b/queue-3.17/usb-remove-references-to-non-existent-plat_s5p-symbol.patch new file mode 100644 index 00000000000..9379fff1f6b --- /dev/null +++ b/queue-3.17/usb-remove-references-to-non-existent-plat_s5p-symbol.patch @@ -0,0 +1,43 @@ +From cd6e245a2d061a8367e37aaece32cf3fc922de80 Mon Sep 17 00:00:00 2001 +From: Sylwester Nawrocki +Date: Tue, 7 Oct 2014 11:12:07 +0200 +Subject: usb: Remove references to non-existent PLAT_S5P symbol + +From: Sylwester Nawrocki + +commit cd6e245a2d061a8367e37aaece32cf3fc922de80 upstream. + +The PLAT_S5P Kconfig symbol was removed in commit d78c16ccde96 +("ARM: SAMSUNG: Remove remaining legacy code"). There are still +some references left, fix that by replacing them with ARCH_S5PV210. + +Fixes: d78c16ccde96 ("ARM: SAMSUNG: Remove remaining legacy code") +Reported-by: Paul Bolle +Acked-by: Jingoo Han +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/Kconfig ++++ b/drivers/usb/host/Kconfig +@@ -220,7 +220,7 @@ config USB_EHCI_SH + + config USB_EHCI_EXYNOS + tristate "EHCI support for Samsung S5P/EXYNOS SoC Series" +- depends on PLAT_S5P || ARCH_EXYNOS ++ depends on ARCH_S5PV210 || ARCH_EXYNOS + help + Enable support for the Samsung Exynos SOC's on-chip EHCI controller. + +@@ -527,7 +527,7 @@ config USB_OHCI_SH + + config USB_OHCI_EXYNOS + tristate "OHCI support for Samsung S5P/EXYNOS SoC Series" +- depends on PLAT_S5P || ARCH_EXYNOS ++ depends on ARCH_S5PV210 || ARCH_EXYNOS + help + Enable support for the Samsung Exynos SOC's on-chip OHCI controller. + diff --git a/queue-3.17/usb-storage-handle-a-skipped-data-phase.patch b/queue-3.17/usb-storage-handle-a-skipped-data-phase.patch new file mode 100644 index 00000000000..6d488841fe8 --- /dev/null +++ b/queue-3.17/usb-storage-handle-a-skipped-data-phase.patch @@ -0,0 +1,81 @@ +From 93c9bf4d1838d5851a18ca398b0ad66397f05056 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 31 Oct 2014 14:49:47 -0400 +Subject: usb-storage: handle a skipped data phase + +From: Alan Stern + +commit 93c9bf4d1838d5851a18ca398b0ad66397f05056 upstream. + +Sometimes mass-storage devices using the Bulk-only transport will +mistakenly skip the data phase of a command. Rather than sending the +data expected by the host or sending a zero-length packet, they go +directly to the status phase and send the CSW. + +This causes problems for usb-storage, for obvious reasons. The driver +will interpret the CSW as a short data transfer and will wait to +receive a CSW. The device won't have anything left to send, so the +command eventually times out. + +The SCSI layer doesn't retry commands after they time out (this is a +relatively recent change). Therefore we should do our best to detect +a skipped data phase and handle it promptly. + +This patch adds code to do that. If usb-storage receives a short +13-byte data transfer from the device, and if the first four bytes of +the data match the CSW signature, the driver will set the residue to +the full transfer length and interpret the data as a CSW. + +This fixes Bugzilla #86611. + +Signed-off-by: Alan Stern +CC: Matthew Dharm +Tested-by: Paul Osmialowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/transport.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -1118,6 +1118,31 @@ int usb_stor_Bulk_transport(struct scsi_ + */ + if (result == USB_STOR_XFER_LONG) + fake_sense = 1; ++ ++ /* ++ * Sometimes a device will mistakenly skip the data phase ++ * and go directly to the status phase without sending a ++ * zero-length packet. If we get a 13-byte response here, ++ * check whether it really is a CSW. ++ */ ++ if (result == USB_STOR_XFER_SHORT && ++ srb->sc_data_direction == DMA_FROM_DEVICE && ++ transfer_length - scsi_get_resid(srb) == ++ US_BULK_CS_WRAP_LEN) { ++ struct scatterlist *sg = NULL; ++ unsigned int offset = 0; ++ ++ if (usb_stor_access_xfer_buf((unsigned char *) bcs, ++ US_BULK_CS_WRAP_LEN, srb, &sg, ++ &offset, FROM_XFER_BUF) == ++ US_BULK_CS_WRAP_LEN && ++ bcs->Signature == ++ cpu_to_le32(US_BULK_CS_SIGN)) { ++ usb_stor_dbg(us, "Device skipped data phase\n"); ++ scsi_set_resid(srb, transfer_length); ++ goto skipped_data_phase; ++ } ++ } + } + + /* See flow chart on pg 15 of the Bulk Only Transport spec for +@@ -1153,6 +1178,7 @@ int usb_stor_Bulk_transport(struct scsi_ + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; + ++ skipped_data_phase: + /* check bulk status */ + residue = le32_to_cpu(bcs->Residue); + usb_stor_dbg(us, "Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n",