From: Greg Kroah-Hartman Date: Sun, 19 Nov 2017 11:50:55 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v3.18.83~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=aab9a0dddc8ba8c464059463e1ce51157d0fff88;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: usb-add-delay-init-quirk-for-corsair-k70-lux-keyboards.patch usb-serial-garmin_gps-fix-i-o-after-failed-probe-and-remove.patch usb-serial-garmin_gps-fix-memory-leak-on-probe-errors.patch usb-serial-qcserial-add-pid-vid-for-sierra-wireless-em7355-fw-update.patch usb-usbfs-compute-urb-actual_length-for-isochronous.patch --- diff --git a/queue-4.4/series b/queue-4.4/series index a20234442d9..9ac92b32c81 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -52,3 +52,8 @@ revert-crypto-xts-add-ecb-dependency.patch revert-uapi-fix-linux-rds.h-userspace-compilation-errors.patch uapi-fix-linux-rds.h-userspace-compilation-error.patch uapi-fix-linux-rds.h-userspace-compilation-errors.patch +usb-usbfs-compute-urb-actual_length-for-isochronous.patch +usb-add-delay-init-quirk-for-corsair-k70-lux-keyboards.patch +usb-serial-qcserial-add-pid-vid-for-sierra-wireless-em7355-fw-update.patch +usb-serial-garmin_gps-fix-i-o-after-failed-probe-and-remove.patch +usb-serial-garmin_gps-fix-memory-leak-on-probe-errors.patch diff --git a/queue-4.4/usb-add-delay-init-quirk-for-corsair-k70-lux-keyboards.patch b/queue-4.4/usb-add-delay-init-quirk-for-corsair-k70-lux-keyboards.patch new file mode 100644 index 00000000000..64ea49fd8a1 --- /dev/null +++ b/queue-4.4/usb-add-delay-init-quirk-for-corsair-k70-lux-keyboards.patch @@ -0,0 +1,33 @@ +From a0fea6027f19c62727315aba1a7fae75a9caa842 Mon Sep 17 00:00:00 2001 +From: Bernhard Rosenkraenzer +Date: Fri, 3 Nov 2017 16:46:02 +0100 +Subject: USB: Add delay-init quirk for Corsair K70 LUX keyboards + +From: Bernhard Rosenkraenzer + +commit a0fea6027f19c62727315aba1a7fae75a9caa842 upstream. + +Without this patch, K70 LUX keyboards don't work, saying +usb 3-3: unable to read config index 0 descriptor/all +usb 3-3: can't read configurations, error -110 +usb usb3-port3: unable to enumerate USB device + +Signed-off-by: Bernhard Rosenkraenzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -221,6 +221,9 @@ static const struct usb_device_id usb_qu + /* Corsair Strafe RGB */ + { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT }, + ++ /* Corsair K70 LUX */ ++ { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, ++ + /* MIDI keyboard WORLDE MINI */ + { USB_DEVICE(0x1c75, 0x0204), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, diff --git a/queue-4.4/usb-serial-garmin_gps-fix-i-o-after-failed-probe-and-remove.patch b/queue-4.4/usb-serial-garmin_gps-fix-i-o-after-failed-probe-and-remove.patch new file mode 100644 index 00000000000..4767951f7bc --- /dev/null +++ b/queue-4.4/usb-serial-garmin_gps-fix-i-o-after-failed-probe-and-remove.patch @@ -0,0 +1,105 @@ +From 19a565d9af6e0d828bd0d521d3bafd5017f4ce52 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 11 Oct 2017 14:02:57 +0200 +Subject: USB: serial: garmin_gps: fix I/O after failed probe and remove + +From: Johan Hovold + +commit 19a565d9af6e0d828bd0d521d3bafd5017f4ce52 upstream. + +Make sure to stop any submitted interrupt and bulk-out URBs before +returning after failed probe and when the port is being unbound to avoid +later NULL-pointer dereferences in the completion callbacks. + +Also fix up the related and broken I/O cancellation on failed open and +on close. (Note that port->write_urb was never submitted.) + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/garmin_gps.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/garmin_gps.c ++++ b/drivers/usb/serial/garmin_gps.c +@@ -138,6 +138,7 @@ struct garmin_data { + __u8 privpkt[4*6]; + spinlock_t lock; + struct list_head pktlist; ++ struct usb_anchor write_urbs; + }; + + +@@ -906,7 +907,7 @@ static int garmin_init_session(struct us + sizeof(GARMIN_START_SESSION_REQ), 0); + + if (status < 0) +- break; ++ goto err_kill_urbs; + } + + if (status > 0) +@@ -914,6 +915,12 @@ static int garmin_init_session(struct us + } + + return status; ++ ++err_kill_urbs: ++ usb_kill_anchored_urbs(&garmin_data_p->write_urbs); ++ usb_kill_urb(port->interrupt_in_urb); ++ ++ return status; + } + + +@@ -931,7 +938,6 @@ static int garmin_open(struct tty_struct + spin_unlock_irqrestore(&garmin_data_p->lock, flags); + + /* shutdown any bulk reads that might be going on */ +- usb_kill_urb(port->write_urb); + usb_kill_urb(port->read_urb); + + if (garmin_data_p->state == STATE_RESET) +@@ -954,7 +960,7 @@ static void garmin_close(struct usb_seri + + /* shutdown our urbs */ + usb_kill_urb(port->read_urb); +- usb_kill_urb(port->write_urb); ++ usb_kill_anchored_urbs(&garmin_data_p->write_urbs); + + /* keep reset state so we know that we must start a new session */ + if (garmin_data_p->state != STATE_RESET) +@@ -1038,12 +1044,14 @@ static int garmin_write_bulk(struct usb_ + } + + /* send it down the pipe */ ++ usb_anchor_urb(urb, &garmin_data_p->write_urbs); + status = usb_submit_urb(urb, GFP_ATOMIC); + if (status) { + dev_err(&port->dev, + "%s - usb_submit_urb(write bulk) failed with status = %d\n", + __func__, status); + count = status; ++ usb_unanchor_urb(urb); + kfree(buffer); + } + +@@ -1402,6 +1410,7 @@ static int garmin_port_probe(struct usb_ + garmin_data_p->state = 0; + garmin_data_p->flags = 0; + garmin_data_p->count = 0; ++ init_usb_anchor(&garmin_data_p->write_urbs); + usb_set_serial_port_data(port, garmin_data_p); + + status = garmin_init_session(port); +@@ -1414,6 +1423,7 @@ static int garmin_port_remove(struct usb + { + struct garmin_data *garmin_data_p = usb_get_serial_port_data(port); + ++ usb_kill_anchored_urbs(&garmin_data_p->write_urbs); + usb_kill_urb(port->interrupt_in_urb); + del_timer_sync(&garmin_data_p->timer); + kfree(garmin_data_p); diff --git a/queue-4.4/usb-serial-garmin_gps-fix-memory-leak-on-probe-errors.patch b/queue-4.4/usb-serial-garmin_gps-fix-memory-leak-on-probe-errors.patch new file mode 100644 index 00000000000..0439d2a51e1 --- /dev/null +++ b/queue-4.4/usb-serial-garmin_gps-fix-memory-leak-on-probe-errors.patch @@ -0,0 +1,36 @@ +From 74d471b598444b7f2d964930f7234779c80960a0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 11 Oct 2017 14:02:58 +0200 +Subject: USB: serial: garmin_gps: fix memory leak on probe errors + +From: Johan Hovold + +commit 74d471b598444b7f2d964930f7234779c80960a0 upstream. + +Make sure to free the port private data before returning after a failed +probe attempt. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/garmin_gps.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/garmin_gps.c ++++ b/drivers/usb/serial/garmin_gps.c +@@ -1414,6 +1414,12 @@ static int garmin_port_probe(struct usb_ + usb_set_serial_port_data(port, garmin_data_p); + + status = garmin_init_session(port); ++ if (status) ++ goto err_free; ++ ++ return 0; ++err_free: ++ kfree(garmin_data_p); + + return status; + } diff --git a/queue-4.4/usb-serial-qcserial-add-pid-vid-for-sierra-wireless-em7355-fw-update.patch b/queue-4.4/usb-serial-qcserial-add-pid-vid-for-sierra-wireless-em7355-fw-update.patch new file mode 100644 index 00000000000..7c49d52be99 --- /dev/null +++ b/queue-4.4/usb-serial-qcserial-add-pid-vid-for-sierra-wireless-em7355-fw-update.patch @@ -0,0 +1,30 @@ +From 771394a54148f18926ca86414e51c69eda27d0cd Mon Sep 17 00:00:00 2001 +From: Douglas Fischer +Date: Sun, 29 Oct 2017 23:29:55 +0000 +Subject: USB: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update + +From: Douglas Fischer + +commit 771394a54148f18926ca86414e51c69eda27d0cd upstream. + +Add USB PID/VID for Sierra Wireless EM7355 LTE modem QDL firmware update +mode. + +Signed-off-by: Douglas Fischer +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/qcserial.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -148,6 +148,7 @@ static const struct usb_device_id id_tab + {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */ + {DEVICE_SWI(0x1199, 0x68c0)}, /* Sierra Wireless MC7304/MC7354 */ + {DEVICE_SWI(0x1199, 0x901c)}, /* Sierra Wireless EM7700 */ ++ {DEVICE_SWI(0x1199, 0x901e)}, /* Sierra Wireless EM7355 QDL */ + {DEVICE_SWI(0x1199, 0x901f)}, /* Sierra Wireless EM7355 */ + {DEVICE_SWI(0x1199, 0x9040)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9041)}, /* Sierra Wireless MC7305/MC7355 */ diff --git a/queue-4.4/usb-usbfs-compute-urb-actual_length-for-isochronous.patch b/queue-4.4/usb-usbfs-compute-urb-actual_length-for-isochronous.patch new file mode 100644 index 00000000000..5592ea73f48 --- /dev/null +++ b/queue-4.4/usb-usbfs-compute-urb-actual_length-for-isochronous.patch @@ -0,0 +1,69 @@ +From 2ef47001b3ee3ded579b7532ebdcf8680e4d8c54 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 8 Nov 2017 12:23:17 -0500 +Subject: USB: usbfs: compute urb->actual_length for isochronous + +From: Alan Stern + +commit 2ef47001b3ee3ded579b7532ebdcf8680e4d8c54 upstream. + +The USB kerneldoc says that the actual_length field "is read in +non-iso completion functions", but the usbfs driver uses it for all +URB types in processcompl(). Since not all of the host controller +drivers set actual_length for isochronous URBs, programs using usbfs +with some host controllers don't work properly. For example, Minas +reports that a USB camera controlled by libusb doesn't work properly +with a dwc2 controller. + +It doesn't seem worthwhile to change the HCDs and the documentation, +since the in-kernel USB class drivers evidently don't rely on +actual_length for isochronous transfers. The easiest solution is for +usbfs to calculate the actual_length value for itself, by adding up +the lengths of the individual packets in an isochronous transfer. + +Signed-off-by: Alan Stern +CC: Minas Harutyunyan +Reported-and-tested-by: wlf +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1653,6 +1653,18 @@ static int proc_unlinkurb(struct usb_dev + return 0; + } + ++static void compute_isochronous_actual_length(struct urb *urb) ++{ ++ unsigned int i; ++ ++ if (urb->number_of_packets > 0) { ++ urb->actual_length = 0; ++ for (i = 0; i < urb->number_of_packets; i++) ++ urb->actual_length += ++ urb->iso_frame_desc[i].actual_length; ++ } ++} ++ + static int processcompl(struct async *as, void __user * __user *arg) + { + struct urb *urb = as->urb; +@@ -1660,6 +1672,7 @@ static int processcompl(struct async *as + void __user *addr = as->userurb; + unsigned int i; + ++ compute_isochronous_actual_length(urb); + if (as->userbuffer && urb->actual_length) { + if (copy_urb_data_to_user(as->userbuffer, urb)) + goto err_out; +@@ -1829,6 +1842,7 @@ static int processcompl_compat(struct as + void __user *addr = as->userurb; + unsigned int i; + ++ compute_isochronous_actual_length(urb); + if (as->userbuffer && urb->actual_length) { + if (copy_urb_data_to_user(as->userbuffer, urb)) + return -EFAULT;