From: Greg Kroah-Hartman Date: Wed, 16 Sep 2015 18:30:44 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v3.10.89~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9ea79e947b2f952d02937a9e12ca73d36577dfc6;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch usb-ftdi_sio-added-custom-pid-for-customware-products.patch usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch usb-symbolserial-use-usb_get_serial_port_data.patch --- diff --git a/queue-3.14/series b/queue-3.14/series index fc81378d750..6a04b15cd8a 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -9,3 +9,7 @@ iio-adis16480-fix-scale-factors.patch staging-comedi-adl_pci7x3x-fix-digital-output-on-pci-7230.patch clk-versatile-off-by-one-in-clk_sp810_timerclken_of_get.patch pci-fix-ti816x-class-code-quirk.patch +usb-symbolserial-use-usb_get_serial_port_data.patch +usb-ftdi_sio-added-custom-pid-for-customware-products.patch +usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch +usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch diff --git a/queue-3.14/usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch b/queue-3.14/usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch new file mode 100644 index 00000000000..9bb1717590f --- /dev/null +++ b/queue-3.14/usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch @@ -0,0 +1,58 @@ +From b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e Mon Sep 17 00:00:00 2001 +From: Kishon Vijay Abraham I +Date: Mon, 27 Jul 2015 12:25:27 +0530 +Subject: usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes + +From: Kishon Vijay Abraham I + +commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream. + +DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and +the size of bounce buffer is 512 bytes. However if the host initiates OUT +transfers of size more than 512 bytes (and non max packet aligned), the +driver throws a WARN dump but still programs the TRB to receive more than +512 bytes. This will cause bounce buffer to overflow and corrupt the +adjacent memory locations which can be fatal. + +Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE +(512) bytes. + +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/ep0.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -793,6 +793,11 @@ static void dwc3_ep0_complete_data(struc + unsigned maxp = ep0->endpoint.maxpacket; + + transfer_size += (maxp - (transfer_size % maxp)); ++ ++ /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */ ++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) ++ transfer_size = DWC3_EP0_BOUNCE_SIZE; ++ + transferred = min_t(u32, ur->length, + transfer_size - length); + memcpy(ur->buf, dwc->ep0_bounce, transferred); +@@ -905,11 +910,14 @@ static void __dwc3_ep0_do_control_data(s + return; + } + +- WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE); +- + maxpacket = dep->endpoint.maxpacket; + transfer_size = roundup(req->request.length, maxpacket); + ++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) { ++ dev_WARN(dwc->dev, "bounce buf can't handle req len\n"); ++ transfer_size = DWC3_EP0_BOUNCE_SIZE; ++ } ++ + dwc->ep0_bounced = true; + + /* diff --git a/queue-3.14/usb-ftdi_sio-added-custom-pid-for-customware-products.patch b/queue-3.14/usb-ftdi_sio-added-custom-pid-for-customware-products.patch new file mode 100644 index 00000000000..3ad63cc43a2 --- /dev/null +++ b/queue-3.14/usb-ftdi_sio-added-custom-pid-for-customware-products.patch @@ -0,0 +1,51 @@ +From 1fb8dc36384ae1140ee6ccc470de74397606a9d5 Mon Sep 17 00:00:00 2001 +From: Matthijs Kooijman +Date: Tue, 18 Aug 2015 10:33:56 +0200 +Subject: USB: ftdi_sio: Added custom PID for CustomWare products + +From: Matthijs Kooijman + +commit 1fb8dc36384ae1140ee6ccc470de74397606a9d5 upstream. + +CustomWare uses the FTDI VID with custom PIDs for their ShipModul MiniPlex +products. + +Signed-off-by: Matthijs Kooijman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 4 ++++ + drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++ + 2 files changed, 12 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -618,6 +618,10 @@ static const struct usb_device_id id_tab + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2WI_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX3_PID) }, + /* + * ELV devices: + */ +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -568,6 +568,14 @@ + */ + #define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */ + ++/* ++ * CustomWare / ShipModul NMEA multiplexers product ids (FTDI_VID) ++ */ ++#define FTDI_CUSTOMWARE_MINIPLEX_PID 0xfd48 /* MiniPlex first generation NMEA Multiplexer */ ++#define FTDI_CUSTOMWARE_MINIPLEX2_PID 0xfd49 /* MiniPlex-USB and MiniPlex-2 series */ ++#define FTDI_CUSTOMWARE_MINIPLEX2WI_PID 0xfd4a /* MiniPlex-2Wi */ ++#define FTDI_CUSTOMWARE_MINIPLEX3_PID 0xfd4b /* MiniPlex-3 series */ ++ + + /********************************/ + /** third-party VID/PID combos **/ diff --git a/queue-3.14/usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch b/queue-3.14/usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch new file mode 100644 index 00000000000..67707230721 --- /dev/null +++ b/queue-3.14/usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch @@ -0,0 +1,58 @@ +From 0521cfd06e1ebcd575e7ae36aab068b38df23850 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Mon, 17 Aug 2015 10:23:03 +0800 +Subject: usb: host: ehci-sys: delete useless bus_to_hcd conversion + +From: Peter Chen + +commit 0521cfd06e1ebcd575e7ae36aab068b38df23850 upstream. + +The ehci platform device's drvdata is the pointer of struct usb_hcd +already, so we doesn't need to call bus_to_hcd conversion again. + +Signed-off-by: Peter Chen +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sysfs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/ehci-sysfs.c ++++ b/drivers/usb/host/ehci-sysfs.c +@@ -29,7 +29,7 @@ static ssize_t show_companion(struct dev + int count = PAGE_SIZE; + char *ptr = buf; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + nports = HCS_N_PORTS(ehci->hcs_params); + + for (index = 0; index < nports; ++index) { +@@ -54,7 +54,7 @@ static ssize_t store_companion(struct de + struct ehci_hcd *ehci; + int portnum, new_owner; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + new_owner = PORT_OWNER; /* Owned by companion */ + if (sscanf(buf, "%d", &portnum) != 1) + return -EINVAL; +@@ -85,7 +85,7 @@ static ssize_t show_uframe_periodic_max( + struct ehci_hcd *ehci; + int n; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + n = scnprintf(buf, PAGE_SIZE, "%d\n", ehci->uframe_periodic_max); + return n; + } +@@ -101,7 +101,7 @@ static ssize_t store_uframe_periodic_max + unsigned long flags; + ssize_t ret; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + if (kstrtouint(buf, 0, &uframe_periodic_max) < 0) + return -EINVAL; + diff --git a/queue-3.14/usb-symbolserial-use-usb_get_serial_port_data.patch b/queue-3.14/usb-symbolserial-use-usb_get_serial_port_data.patch new file mode 100644 index 00000000000..d0fe0d43850 --- /dev/null +++ b/queue-3.14/usb-symbolserial-use-usb_get_serial_port_data.patch @@ -0,0 +1,52 @@ +From 951d3793bbfc0a441d791d820183aa3085c83ea9 Mon Sep 17 00:00:00 2001 +From: Philipp Hachtmann +Date: Mon, 17 Aug 2015 17:31:46 +0200 +Subject: USB: symbolserial: Use usb_get_serial_port_data + +From: Philipp Hachtmann + +commit 951d3793bbfc0a441d791d820183aa3085c83ea9 upstream. + +The driver used usb_get_serial_data(port->serial) which compiled but resulted +in a NULL pointer being returned (and subsequently used). I did not go deeper +into this but I guess this is a regression. + +Signed-off-by: Philipp Hachtmann +Fixes: a85796ee5149 ("USB: symbolserial: move private-data allocation to +port_probe") +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/symbolserial.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/symbolserial.c ++++ b/drivers/usb/serial/symbolserial.c +@@ -96,7 +96,7 @@ exit: + + static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port) + { +- struct symbol_private *priv = usb_get_serial_data(port->serial); ++ struct symbol_private *priv = usb_get_serial_port_data(port); + unsigned long flags; + int result = 0; + +@@ -122,7 +122,7 @@ static void symbol_close(struct usb_seri + static void symbol_throttle(struct tty_struct *tty) + { + struct usb_serial_port *port = tty->driver_data; +- struct symbol_private *priv = usb_get_serial_data(port->serial); ++ struct symbol_private *priv = usb_get_serial_port_data(port); + + spin_lock_irq(&priv->lock); + priv->throttled = true; +@@ -132,7 +132,7 @@ static void symbol_throttle(struct tty_s + static void symbol_unthrottle(struct tty_struct *tty) + { + struct usb_serial_port *port = tty->driver_data; +- struct symbol_private *priv = usb_get_serial_data(port->serial); ++ struct symbol_private *priv = usb_get_serial_port_data(port); + int result; + bool was_throttled; +