From: Greg Kroah-Hartman Date: Fri, 7 Jul 2017 09:50:58 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.9.37~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a439a951e7f51a6809bf04d0da6570eccdefe0a2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: add-usb-quirk-for-hvr-950q-to-avoid-intermittent-device-resets.patch drm-virtio-don-t-leak-bo-on-drm_gem_object_init-failure.patch media-entity-fix-stream-count-check.patch usb-core-fix-device-node-leak.patch usb-dwc3-replace-p-with-pk.patch usb-fix-typo-in-the-definition-of-endpointrequest.patch usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch usb-usbip-set-buffer-pointers-to-null-after-free.patch --- diff --git a/queue-4.9/add-usb-quirk-for-hvr-950q-to-avoid-intermittent-device-resets.patch b/queue-4.9/add-usb-quirk-for-hvr-950q-to-avoid-intermittent-device-resets.patch new file mode 100644 index 00000000000..4ebd3603cb0 --- /dev/null +++ b/queue-4.9/add-usb-quirk-for-hvr-950q-to-avoid-intermittent-device-resets.patch @@ -0,0 +1,40 @@ +From 6836796de4019944f4ba4c99a360e8250fd2e735 Mon Sep 17 00:00:00 2001 +From: Devin Heitmueller +Date: Tue, 27 Jun 2017 13:08:51 -0400 +Subject: Add USB quirk for HVR-950q to avoid intermittent device resets + +From: Devin Heitmueller + +commit 6836796de4019944f4ba4c99a360e8250fd2e735 upstream. + +The USB core and sysfs will attempt to enumerate certain parameters +which are unsupported by the au0828 - causing inconsistent behavior +and sometimes causing the chip to reset. Avoid making these calls. + +This problem manifested as intermittent cases where the au8522 would +be reset on analog video startup, in particular when starting up ALSA +audio streaming in parallel - the sysfs entries created by +snd-usb-audio on streaming startup would result in unsupported control +messages being sent during tuning which would put the chip into an +unknown state. + +Signed-off-by: Devin Heitmueller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -223,6 +223,10 @@ static const struct usb_device_id usb_qu + /* Blackmagic Design UltraStudio SDI */ + { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* Hauppauge HVR-950q */ ++ { USB_DEVICE(0x2040, 0x7200), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-4.9/drm-virtio-don-t-leak-bo-on-drm_gem_object_init-failure.patch b/queue-4.9/drm-virtio-don-t-leak-bo-on-drm_gem_object_init-failure.patch new file mode 100644 index 00000000000..406d16fb850 --- /dev/null +++ b/queue-4.9/drm-virtio-don-t-leak-bo-on-drm_gem_object_init-failure.patch @@ -0,0 +1,35 @@ +From 385aee965b4e4c36551c362a334378d2985b722a Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Thu, 6 Apr 2017 17:59:40 +0200 +Subject: drm/virtio: don't leak bo on drm_gem_object_init failure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gerd Hoffmann + +commit 385aee965b4e4c36551c362a334378d2985b722a upstream. + +Reported-by: 李强 +Signed-off-by: Gerd Hoffmann +Link: http://patchwork.freedesktop.org/patch/msgid/20170406155941.458-1-kraxel@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/virtio/virtgpu_object.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/virtio/virtgpu_object.c ++++ b/drivers/gpu/drm/virtio/virtgpu_object.c +@@ -81,8 +81,10 @@ int virtio_gpu_object_create(struct virt + return -ENOMEM; + size = roundup(size, PAGE_SIZE); + ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size); +- if (ret != 0) ++ if (ret != 0) { ++ kfree(bo); + return ret; ++ } + bo->dumb = false; + virtio_gpu_init_ttm_placement(bo, pinned); + diff --git a/queue-4.9/media-entity-fix-stream-count-check.patch b/queue-4.9/media-entity-fix-stream-count-check.patch new file mode 100644 index 00000000000..f7a8e336bff --- /dev/null +++ b/queue-4.9/media-entity-fix-stream-count-check.patch @@ -0,0 +1,35 @@ +From 41387a59c8fd55975c6a26cc12fc5c9ca61fcc0f Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Wed, 20 Jul 2016 08:32:49 -0300 +Subject: [media] media: entity: Fix stream count check + +From: Sakari Ailus + +commit 41387a59c8fd55975c6a26cc12fc5c9ca61fcc0f upstream. + +There's a sanity check for the stream count remaining positive or zero on +error path, but instead of performing the check on the traversed entity it +is performed on the entity where traversal ends. Fix this. + +Fixes: commit 3801bc7d1b8d ("[media] media: Media Controller fix to not let stream_count go negative") + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/media-entity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/media-entity.c ++++ b/drivers/media/media-entity.c +@@ -468,7 +468,7 @@ error: + + while ((entity_err = media_entity_graph_walk_next(graph))) { + /* don't let the stream_count go negative */ +- if (entity->stream_count > 0) { ++ if (entity_err->stream_count > 0) { + entity_err->stream_count--; + if (entity_err->stream_count == 0) + entity_err->pipe = NULL; diff --git a/queue-4.9/series b/queue-4.9/series index 679a738a5b0..84c72b612c1 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -3,3 +3,11 @@ fs-completely-ignore-unknown-open-flags.patch driver-core-platform-fix-race-condition-with-driver_override.patch ceph-choose-readdir-frag-based-on-previous-readdir-reply.patch tracing-kprobes-allow-to-create-probe-with-a-module-name-starting-with-a-digit.patch +media-entity-fix-stream-count-check.patch +drm-virtio-don-t-leak-bo-on-drm_gem_object_init-failure.patch +usb-dwc3-replace-p-with-pk.patch +usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch +add-usb-quirk-for-hvr-950q-to-avoid-intermittent-device-resets.patch +usb-usbip-set-buffer-pointers-to-null-after-free.patch +usb-fix-typo-in-the-definition-of-endpointrequest.patch +usb-core-fix-device-node-leak.patch diff --git a/queue-4.9/usb-core-fix-device-node-leak.patch b/queue-4.9/usb-core-fix-device-node-leak.patch new file mode 100644 index 00000000000..efdd89c6830 --- /dev/null +++ b/queue-4.9/usb-core-fix-device-node-leak.patch @@ -0,0 +1,35 @@ +From e271b2c909a22a2c13b2d5f77f2ce0091b74540c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 6 Jun 2017 17:58:58 +0200 +Subject: USB: core: fix device node leak + +From: Johan Hovold + +commit e271b2c909a22a2c13b2d5f77f2ce0091b74540c upstream. + +Make sure to release any OF device-node reference taken when creating +the USB device. + +Note that we currently do not hold a reference to the root hub +device-tree node (i.e. the parent controller node). + +Fixes: 69bec7259853 ("USB: core: let USB device know device node") +Acked-by: Peter Chen +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -279,6 +279,8 @@ static void usb_release_dev(struct devic + + usb_destroy_configuration(udev); + usb_release_bos_descriptor(udev); ++ if (udev->parent) ++ of_node_put(dev->of_node); + usb_put_hcd(hcd); + kfree(udev->product); + kfree(udev->manufacturer); diff --git a/queue-4.9/usb-dwc3-replace-p-with-pk.patch b/queue-4.9/usb-dwc3-replace-p-with-pk.patch new file mode 100644 index 00000000000..5e36958c490 --- /dev/null +++ b/queue-4.9/usb-dwc3-replace-p-with-pk.patch @@ -0,0 +1,56 @@ +From 04fb365c453e14ff9e8a28f1c46050d920a27a4a Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Wed, 17 May 2017 15:57:45 +0300 +Subject: usb: dwc3: replace %p with %pK + +From: Felipe Balbi + +commit 04fb365c453e14ff9e8a28f1c46050d920a27a4a upstream. + +%p will leak kernel pointers, so let's not expose the information on +dmesg and instead use %pK. %pK will only show the actual addresses if +explicitly enabled under /proc/sys/kernel/kptr_restrict. + +Acked-by: Greg Kroah-Hartman +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/dwc3-st.c | 2 +- + drivers/usb/dwc3/gadget.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-st.c ++++ b/drivers/usb/dwc3/dwc3-st.c +@@ -231,7 +231,7 @@ static int st_dwc3_probe(struct platform + + dwc3_data->syscfg_reg_off = res->start; + +- dev_vdbg(&pdev->dev, "glue-logic addr 0x%p, syscfg-reg offset 0x%x\n", ++ dev_vdbg(&pdev->dev, "glue-logic addr 0x%pK, syscfg-reg offset 0x%x\n", + dwc3_data->glue_base, dwc3_data->syscfg_reg_off); + + dwc3_data->rstc_pwrdn = +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1069,9 +1069,9 @@ static int __dwc3_gadget_ep_queue(struct + return -ESHUTDOWN; + } + +- if (WARN(req->dep != dep, "request %p belongs to '%s'\n", ++ if (WARN(req->dep != dep, "request %pK belongs to '%s'\n", + &req->request, req->dep->name)) { +- dwc3_trace(trace_dwc3_gadget, "request %p belongs to '%s'", ++ dwc3_trace(trace_dwc3_gadget, "request %pK belongs to '%s'", + &req->request, req->dep->name); + return -EINVAL; + } +@@ -1212,7 +1212,7 @@ static int dwc3_gadget_ep_dequeue(struct + dwc3_stop_active_transfer(dwc, dep->number, true); + goto out1; + } +- dev_err(dwc->dev, "request %p was not queued to %s\n", ++ dev_err(dwc->dev, "request %pK was not queued to %s\n", + request, ep->name); + ret = -EINVAL; + goto out0; diff --git a/queue-4.9/usb-fix-typo-in-the-definition-of-endpointrequest.patch b/queue-4.9/usb-fix-typo-in-the-definition-of-endpointrequest.patch new file mode 100644 index 00000000000..da6300686ff --- /dev/null +++ b/queue-4.9/usb-fix-typo-in-the-definition-of-endpointrequest.patch @@ -0,0 +1,34 @@ +From 7cf916bd639bd26db7214f2205bccdb4b9306256 Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Tue, 13 Jun 2017 16:01:13 +1000 +Subject: usb: Fix typo in the definition of Endpoint[out]Request + +From: Benjamin Herrenschmidt + +commit 7cf916bd639bd26db7214f2205bccdb4b9306256 upstream. + +The current definition is wrong. This breaks my upcoming +Aspeed virtual hub driver. + +Signed-off-by: Benjamin Herrenschmidt +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/usb/hcd.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -561,9 +561,9 @@ extern void usb_ep0_reinit(struct usb_de + ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) + + #define EndpointRequest \ +- ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) ++ ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8) + #define EndpointOutRequest \ +- ((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) ++ ((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8) + + /* class requests from the USB 2.0 hub spec, table 11-15 */ + /* GetBusState and SetHubDescriptor are optional, omitted */ diff --git a/queue-4.9/usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch b/queue-4.9/usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch new file mode 100644 index 00000000000..b88e0e9da37 --- /dev/null +++ b/queue-4.9/usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch @@ -0,0 +1,30 @@ +From fd90f73a9925f248d696bde1cfc836d9fda5570d Mon Sep 17 00:00:00 2001 +From: Jeremie Rapin +Date: Wed, 28 Jun 2017 18:23:25 +0200 +Subject: USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick + +From: Jeremie Rapin + +commit fd90f73a9925f248d696bde1cfc836d9fda5570d upstream. + +Added the USB serial device ID for the CEL ZigBee EM3588 +radio stick. + +Signed-off-by: Jeremie Rapin +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -135,6 +135,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ + { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ + { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ ++ { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/queue-4.9/usb-usbip-set-buffer-pointers-to-null-after-free.patch b/queue-4.9/usb-usbip-set-buffer-pointers-to-null-after-free.patch new file mode 100644 index 00000000000..ac3458fa47b --- /dev/null +++ b/queue-4.9/usb-usbip-set-buffer-pointers-to-null-after-free.patch @@ -0,0 +1,53 @@ +From b3b51417d0af63fb9a06662dc292200aed9ea53f Mon Sep 17 00:00:00 2001 +From: Michael Grzeschik +Date: Mon, 22 May 2017 13:02:44 +0200 +Subject: usb: usbip: set buffer pointers to NULL after free + +From: Michael Grzeschik + +commit b3b51417d0af63fb9a06662dc292200aed9ea53f upstream. + +The usbip stack dynamically allocates the transfer_buffer and +setup_packet of each urb that got generated by the tcp to usb stub code. +As these pointers are always used only once we will set them to NULL +after use. This is done likewise to the free_urb code in vudc_dev.c. +This patch fixes double kfree situations where the usbip remote side +added the URB_FREE_BUFFER. + +Signed-off-by: Michael Grzeschik +Acked-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/usbip/stub_main.c | 4 ++++ + drivers/usb/usbip/stub_tx.c | 4 ++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/usb/usbip/stub_main.c ++++ b/drivers/usb/usbip/stub_main.c +@@ -262,7 +262,11 @@ void stub_device_cleanup_urbs(struct stu + kmem_cache_free(stub_priv_cache, priv); + + kfree(urb->transfer_buffer); ++ urb->transfer_buffer = NULL; ++ + kfree(urb->setup_packet); ++ urb->setup_packet = NULL; ++ + usb_free_urb(urb); + } + } +--- a/drivers/usb/usbip/stub_tx.c ++++ b/drivers/usb/usbip/stub_tx.c +@@ -28,7 +28,11 @@ static void stub_free_priv_and_urb(struc + struct urb *urb = priv->urb; + + kfree(urb->setup_packet); ++ urb->setup_packet = NULL; ++ + kfree(urb->transfer_buffer); ++ urb->transfer_buffer = NULL; ++ + list_del(&priv->list); + kmem_cache_free(stub_priv_cache, priv); + usb_free_urb(urb);