From: Greg Kroah-Hartman Date: Wed, 3 Sep 2014 21:58:22 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.10.54~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bdeb767285269b89369204557dd6bb890247c05b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: arm-omap2-hwmod-rearm-wake-up-interrupts-for-dt-when-musb-is-idled.patch jbd2-fix-infinite-loop-when-recovering-corrupt-journal-blocks.patch nfsd-decrease-nfsd_users-in-nfsd_startup_generic-fail.patch nfsv3-fix-another-acl-regression.patch nfsv4-fix-problems-with-close-in-the-presence-of-a-delegation.patch staging-speakup-update-__speakup_paste_selection-tty-ab-usage-to-match-vt.patch svcrdma-select-nfsv4.1-backchannel-transport-based-on-forward-channel.patch usb-ftdi_sio-add-basic-micro-atom-nano-usb2serial-pid.patch usb-ftdi_sio-added-pid-for-new-ekey-device.patch usb-hub-prevent-hub-autosuspend-if-usbcore.autosuspend-is-1.patch usb-whiteheat-added-bounds-checking-for-bulk-command-response.patch usb-xhci-amd-chipset-also-needs-short-tx-quirk.patch vm_is_stack-use-for_each_thread-rather-then-buggy-while_each_thread.patch xhci-treat-not-finding-the-event_seg-on-comp_stop-the-same-as-comp_stop_inval.patch --- diff --git a/queue-3.10/arm-omap2-hwmod-rearm-wake-up-interrupts-for-dt-when-musb-is-idled.patch b/queue-3.10/arm-omap2-hwmod-rearm-wake-up-interrupts-for-dt-when-musb-is-idled.patch new file mode 100644 index 00000000000..e52085dcd5b --- /dev/null +++ b/queue-3.10/arm-omap2-hwmod-rearm-wake-up-interrupts-for-dt-when-musb-is-idled.patch @@ -0,0 +1,59 @@ +From cc824534d4fef0e46e4486d5c1e10d3c6b1ebadc Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 25 Aug 2014 16:15:35 -0700 +Subject: ARM: OMAP2+: hwmod: Rearm wake-up interrupts for DT when MUSB is idled + +From: Tony Lindgren + +commit cc824534d4fef0e46e4486d5c1e10d3c6b1ebadc upstream. + +Looks like MUSB cable removal can cause wake-up interrupts to +stop working for device tree based booting at least for UART3 +even as nothing is dynamically remuxed. This can be fixed by +calling reconfigure_io_chain() for device tree based booting +in hwmod code. Note that we already do that for legacy booting +if the legacy mux is configured. + +My guess is that this is related to UART3 and MUSB ULPI +hsusb0_data0 and hsusb0_data1 support for Carkit mode that +somehow affect the configured IO chain for UART3 and require +rearming the wake-up interrupts. + +In general, for device tree based booting, pinctrl-single +calls the rearm hook that in turn calls reconfigure_io_chain +so calling reconfigure_io_chain should not be needed from the +hwmod code for other events. + +So let's limit the hwmod rearming of iochain only to +HWMOD_FORCE_MSTANDBY where MUSB is currently the only user +of it. If we see other devices needing similar changes we can +add more checks for it. + +Cc: Paul Walmsley +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/omap_hwmod.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -2177,6 +2177,8 @@ static int _enable(struct omap_hwmod *oh + oh->mux->pads_dynamic))) { + omap_hwmod_mux(oh->mux, _HWMOD_STATE_ENABLED); + _reconfigure_io_chain(); ++ } else if (oh->flags & HWMOD_FORCE_MSTANDBY) { ++ _reconfigure_io_chain(); + } + + _add_initiator_dep(oh, mpu_oh); +@@ -2283,6 +2285,8 @@ static int _idle(struct omap_hwmod *oh) + if (oh->mux && oh->mux->pads_dynamic) { + omap_hwmod_mux(oh->mux, _HWMOD_STATE_IDLE); + _reconfigure_io_chain(); ++ } else if (oh->flags & HWMOD_FORCE_MSTANDBY) { ++ _reconfigure_io_chain(); + } + + oh->_state = _HWMOD_STATE_IDLE; diff --git a/queue-3.10/jbd2-fix-infinite-loop-when-recovering-corrupt-journal-blocks.patch b/queue-3.10/jbd2-fix-infinite-loop-when-recovering-corrupt-journal-blocks.patch new file mode 100644 index 00000000000..d3b573994fe --- /dev/null +++ b/queue-3.10/jbd2-fix-infinite-loop-when-recovering-corrupt-journal-blocks.patch @@ -0,0 +1,52 @@ +From 022eaa7517017efe4f6538750c2b59a804dc7df7 Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Wed, 27 Aug 2014 18:40:05 -0400 +Subject: jbd2: fix infinite loop when recovering corrupt journal blocks + +From: "Darrick J. Wong" + +commit 022eaa7517017efe4f6538750c2b59a804dc7df7 upstream. + +When recovering the journal, don't fall into an infinite loop if we +encounter a corrupt journal block. Instead, just skip the block and +return an error, which fails the mount and thus forces the user to run +a full filesystem fsck. + +Signed-off-by: Darrick J. Wong +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/recovery.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/fs/jbd2/recovery.c ++++ b/fs/jbd2/recovery.c +@@ -427,6 +427,7 @@ static int do_one_pass(journal_t *journa + int tag_bytes = journal_tag_bytes(journal); + __u32 crc32_sum = ~0; /* Transactional Checksums */ + int descr_csum_size = 0; ++ int block_error = 0; + + /* + * First thing is to establish what we expect to find in the log +@@ -599,7 +600,8 @@ static int do_one_pass(journal_t *journa + "checksum recovering " + "block %llu in log\n", + blocknr); +- continue; ++ block_error = 1; ++ goto skip_write; + } + + /* Find a buffer for the new +@@ -798,7 +800,8 @@ static int do_one_pass(journal_t *journa + success = -EIO; + } + } +- ++ if (block_error && success == 0) ++ success = -EIO; + return success; + + failed: diff --git a/queue-3.10/nfsd-decrease-nfsd_users-in-nfsd_startup_generic-fail.patch b/queue-3.10/nfsd-decrease-nfsd_users-in-nfsd_startup_generic-fail.patch new file mode 100644 index 00000000000..27270301ecc --- /dev/null +++ b/queue-3.10/nfsd-decrease-nfsd_users-in-nfsd_startup_generic-fail.patch @@ -0,0 +1,46 @@ +From d9499a95716db0d4bc9b67e88fd162133e7d6b08 Mon Sep 17 00:00:00 2001 +From: Kinglong Mee +Date: Wed, 30 Jul 2014 21:26:05 +0800 +Subject: NFSD: Decrease nfsd_users in nfsd_startup_generic fail + +From: Kinglong Mee + +commit d9499a95716db0d4bc9b67e88fd162133e7d6b08 upstream. + +A memory allocation failure could cause nfsd_startup_generic to fail, in +which case nfsd_users wouldn't be incorrectly left elevated. + +After nfsd restarts nfsd_startup_generic will then succeed without doing +anything--the first consequence is likely nfs4_start_net finding a bad +laundry_wq and crashing. + +Signed-off-by: Kinglong Mee +Fixes: 4539f14981ce "nfsd: replace boolean nfsd_up flag by users counter" +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfssvc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -220,7 +220,8 @@ static int nfsd_startup_generic(int nrse + */ + ret = nfsd_racache_init(2*nrservs); + if (ret) +- return ret; ++ goto dec_users; ++ + ret = nfs4_state_start(); + if (ret) + goto out_racache; +@@ -228,6 +229,8 @@ static int nfsd_startup_generic(int nrse + + out_racache: + nfsd_racache_shutdown(); ++dec_users: ++ nfsd_users--; + return ret; + } + diff --git a/queue-3.10/nfsv3-fix-another-acl-regression.patch b/queue-3.10/nfsv3-fix-another-acl-regression.patch new file mode 100644 index 00000000000..ed4dbec4678 --- /dev/null +++ b/queue-3.10/nfsv3-fix-another-acl-regression.patch @@ -0,0 +1,37 @@ +From f87d928f6d98644d39809a013a22f981d39017cf Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sun, 24 Aug 2014 14:46:48 -0400 +Subject: NFSv3: Fix another acl regression + +From: Trond Myklebust + +commit f87d928f6d98644d39809a013a22f981d39017cf upstream. + +When creating a new object on the NFS server, we should not be sending +posix setacl requests unless the preceding posix_acl_create returned a +non-trivial acl. Doing so, causes Solaris servers in particular to +return an EINVAL. + +Fixes: 013cdf1088d72 (nfs: use generic posix ACL infrastructure,,,) +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1132786 +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs3acl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/nfs/nfs3acl.c ++++ b/fs/nfs/nfs3acl.c +@@ -305,7 +305,10 @@ static int nfs3_proc_setacls(struct inod + .rpc_argp = &args, + .rpc_resp = &fattr, + }; +- int status; ++ int status = 0; ++ ++ if (acl == NULL && (!S_ISDIR(inode->i_mode) || dfacl == NULL)) ++ goto out; + + status = -EOPNOTSUPP; + if (!nfs_server_capable(inode, NFS_CAP_ACLS)) diff --git a/queue-3.10/nfsv4-fix-problems-with-close-in-the-presence-of-a-delegation.patch b/queue-3.10/nfsv4-fix-problems-with-close-in-the-presence-of-a-delegation.patch new file mode 100644 index 00000000000..9022c611d6f --- /dev/null +++ b/queue-3.10/nfsv4-fix-problems-with-close-in-the-presence-of-a-delegation.patch @@ -0,0 +1,63 @@ +From aee7af356e151494d5014f57b33460b162f181b5 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Mon, 25 Aug 2014 22:33:12 -0400 +Subject: NFSv4: Fix problems with close in the presence of a delegation + +From: Trond Myklebust + +commit aee7af356e151494d5014f57b33460b162f181b5 upstream. + +In the presence of delegations, we can no longer assume that the +state->n_rdwr, state->n_rdonly, state->n_wronly reflect the open +stateid share mode, and so we need to calculate the initial value +for calldata->arg.fmode using the state->flags. + +Reported-by: James Drews +Fixes: 88069f77e1ac5 (NFSv41: Fix a potential state leakage when...) +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4proc.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2287,6 +2287,7 @@ static void nfs4_close_prepare(struct rp + struct nfs4_closedata *calldata = data; + struct nfs4_state *state = calldata->state; + struct inode *inode = calldata->inode; ++ bool is_rdonly, is_wronly, is_rdwr; + int call_close = 0; + + dprintk("%s: begin!\n", __func__); +@@ -2294,18 +2295,24 @@ static void nfs4_close_prepare(struct rp + goto out_wait; + + task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE]; +- calldata->arg.fmode = FMODE_READ|FMODE_WRITE; + spin_lock(&state->owner->so_lock); ++ is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags); ++ is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags); ++ is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags); ++ /* Calculate the current open share mode */ ++ calldata->arg.fmode = 0; ++ if (is_rdonly || is_rdwr) ++ calldata->arg.fmode |= FMODE_READ; ++ if (is_wronly || is_rdwr) ++ calldata->arg.fmode |= FMODE_WRITE; + /* Calculate the change in open mode */ + if (state->n_rdwr == 0) { + if (state->n_rdonly == 0) { +- call_close |= test_bit(NFS_O_RDONLY_STATE, &state->flags); +- call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags); ++ call_close |= is_rdonly || is_rdwr; + calldata->arg.fmode &= ~FMODE_READ; + } + if (state->n_wronly == 0) { +- call_close |= test_bit(NFS_O_WRONLY_STATE, &state->flags); +- call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags); ++ call_close |= is_wronly || is_rdwr; + calldata->arg.fmode &= ~FMODE_WRITE; + } + } diff --git a/queue-3.10/series b/queue-3.10/series index b7273002484..ca2139d0a68 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -39,3 +39,17 @@ hpsa-fix-bad-enomem-return-value-in-hpsa_big_passthru_ioctl.patch btrfs-fix-csum-tree-corruption-duplicate-and-outdated-checksums.patch mei-reset-client-state-on-queued-connect-request.patch mei-nfc-fix-memory-leak-in-error-path.patch +jbd2-fix-infinite-loop-when-recovering-corrupt-journal-blocks.patch +staging-speakup-update-__speakup_paste_selection-tty-ab-usage-to-match-vt.patch +xhci-treat-not-finding-the-event_seg-on-comp_stop-the-same-as-comp_stop_inval.patch +usb-xhci-amd-chipset-also-needs-short-tx-quirk.patch +arm-omap2-hwmod-rearm-wake-up-interrupts-for-dt-when-musb-is-idled.patch +usb-ftdi_sio-add-basic-micro-atom-nano-usb2serial-pid.patch +usb-ftdi_sio-added-pid-for-new-ekey-device.patch +usb-whiteheat-added-bounds-checking-for-bulk-command-response.patch +usb-hub-prevent-hub-autosuspend-if-usbcore.autosuspend-is-1.patch +nfsd-decrease-nfsd_users-in-nfsd_startup_generic-fail.patch +svcrdma-select-nfsv4.1-backchannel-transport-based-on-forward-channel.patch +nfsv3-fix-another-acl-regression.patch +nfsv4-fix-problems-with-close-in-the-presence-of-a-delegation.patch +vm_is_stack-use-for_each_thread-rather-then-buggy-while_each_thread.patch diff --git a/queue-3.10/staging-speakup-update-__speakup_paste_selection-tty-ab-usage-to-match-vt.patch b/queue-3.10/staging-speakup-update-__speakup_paste_selection-tty-ab-usage-to-match-vt.patch new file mode 100644 index 00000000000..a14b1653713 --- /dev/null +++ b/queue-3.10/staging-speakup-update-__speakup_paste_selection-tty-ab-usage-to-match-vt.patch @@ -0,0 +1,70 @@ +From 28a821c306889b9f2c3fff49abedc9b2c743eb73 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Mon, 19 May 2014 01:03:06 +0100 +Subject: Staging: speakup: Update __speakup_paste_selection() tty (ab)usage to match vt + +From: Ben Hutchings + +commit 28a821c306889b9f2c3fff49abedc9b2c743eb73 upstream. + +This function is largely a duplicate of paste_selection() in +drivers/tty/vt/selection.c, but with its own selection state. The +speakup selection mechanism should really be merged with vt. + +For now, apply the changes from 'TTY: vt, fix paste_selection ldisc +handling', 'tty: Make ldisc input flow control concurrency-friendly', +and 'tty: Fix unsafe vt paste_selection()'. + +References: https://bugs.debian.org/735202 +References: https://bugs.debian.org/744015 +Reported-by: Paul Gevers +Reported-and-tested-by: Jarek Czekalski +Signed-off-by: Ben Hutchings +[bwh: Backported to 3.10: + - Only apply the changes from 'TTY: vt, fix paste_selection ldisc handling' + - Add the same FIXME comment as vt's paste_selection() has in this version] +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/speakup/selection.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/staging/speakup/selection.c ++++ b/drivers/staging/speakup/selection.c +@@ -5,6 +5,7 @@ + #include /* for dev_warn */ + #include + #include ++#include + #include + + #include "speakup.h" +@@ -135,8 +136,12 @@ static void __speakup_paste_selection(st + struct tty_struct *tty = xchg(&spw->tty, NULL); + struct vc_data *vc = (struct vc_data *) tty->driver_data; + int pasted = 0, count; ++ struct tty_ldisc *ld; + DECLARE_WAITQUEUE(wait, current); + ++ ld = tty_ldisc_ref_wait(tty); ++ ++ /* FIXME: this is completely unsafe */ + add_wait_queue(&vc->paste_wait, &wait); + while (sel_buffer && sel_buffer_lth > pasted) { + set_current_state(TASK_INTERRUPTIBLE); +@@ -146,12 +151,13 @@ static void __speakup_paste_selection(st + } + count = sel_buffer_lth - pasted; + count = min_t(int, count, tty->receive_room); +- tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted, +- NULL, count); ++ ld->ops->receive_buf(tty, sel_buffer + pasted, NULL, count); + pasted += count; + } + remove_wait_queue(&vc->paste_wait, &wait); + current->state = TASK_RUNNING; ++ ++ tty_ldisc_deref(ld); + tty_kref_put(tty); + } + diff --git a/queue-3.10/svcrdma-select-nfsv4.1-backchannel-transport-based-on-forward-channel.patch b/queue-3.10/svcrdma-select-nfsv4.1-backchannel-transport-based-on-forward-channel.patch new file mode 100644 index 00000000000..e34b2d3b945 --- /dev/null +++ b/queue-3.10/svcrdma-select-nfsv4.1-backchannel-transport-based-on-forward-channel.patch @@ -0,0 +1,93 @@ +From 3c45ddf823d679a820adddd53b52c6699c9a05ac Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Wed, 16 Jul 2014 15:38:32 -0400 +Subject: svcrdma: Select NFSv4.1 backchannel transport based on forward channel + +From: Chuck Lever + +commit 3c45ddf823d679a820adddd53b52c6699c9a05ac upstream. + +The current code always selects XPRT_TRANSPORT_BC_TCP for the back +channel, even when the forward channel was not TCP (eg, RDMA). When +a 4.1 mount is attempted with RDMA, the server panics in the TCP BC +code when trying to send CB_NULL. + +Instead, construct the transport protocol number from the forward +channel transport or'd with XPRT_TRANSPORT_BC. Transports that do +not support bi-directional RPC will not have registered a "BC" +transport, causing create_backchannel_client() to fail immediately. + +Fixes: https://bugzilla.linux-nfs.org/show_bug.cgi?id=265 +Signed-off-by: Chuck Lever +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4callback.c | 3 ++- + include/linux/sunrpc/svc_xprt.h | 1 + + net/sunrpc/svcsock.c | 2 ++ + net/sunrpc/xprt.c | 2 +- + net/sunrpc/xprtrdma/svc_rdma_transport.c | 1 + + 5 files changed, 7 insertions(+), 2 deletions(-) + +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -672,7 +672,8 @@ static int setup_callback_client(struct + clp->cl_cb_session = ses; + args.bc_xprt = conn->cb_xprt; + args.prognumber = clp->cl_cb_session->se_cb_prog; +- args.protocol = XPRT_TRANSPORT_BC_TCP; ++ args.protocol = conn->cb_xprt->xpt_class->xcl_ident | ++ XPRT_TRANSPORT_BC; + args.authflavor = ses->se_cb_sec.flavor; + } + /* Create RPC client */ +--- a/include/linux/sunrpc/svc_xprt.h ++++ b/include/linux/sunrpc/svc_xprt.h +@@ -32,6 +32,7 @@ struct svc_xprt_class { + struct svc_xprt_ops *xcl_ops; + struct list_head xcl_list; + u32 xcl_max_payload; ++ int xcl_ident; + }; + + /* +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -683,6 +683,7 @@ static struct svc_xprt_class svc_udp_cla + .xcl_owner = THIS_MODULE, + .xcl_ops = &svc_udp_ops, + .xcl_max_payload = RPCSVC_MAXPAYLOAD_UDP, ++ .xcl_ident = XPRT_TRANSPORT_UDP, + }; + + static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv) +@@ -1275,6 +1276,7 @@ static struct svc_xprt_class svc_tcp_cla + .xcl_owner = THIS_MODULE, + .xcl_ops = &svc_tcp_ops, + .xcl_max_payload = RPCSVC_MAXPAYLOAD_TCP, ++ .xcl_ident = XPRT_TRANSPORT_TCP, + }; + + void svc_init_xprt_sock(void) +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -1290,7 +1290,7 @@ struct rpc_xprt *xprt_create_transport(s + } + } + spin_unlock(&xprt_list_lock); +- printk(KERN_ERR "RPC: transport (%d) not supported\n", args->ident); ++ dprintk("RPC: transport (%d) not supported\n", args->ident); + return ERR_PTR(-EIO); + + found: +--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c +@@ -89,6 +89,7 @@ struct svc_xprt_class svc_rdma_class = { + .xcl_owner = THIS_MODULE, + .xcl_ops = &svc_rdma_ops, + .xcl_max_payload = RPCSVC_MAXPAYLOAD_TCP, ++ .xcl_ident = XPRT_TRANSPORT_RDMA, + }; + + struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt) diff --git a/queue-3.10/usb-ftdi_sio-add-basic-micro-atom-nano-usb2serial-pid.patch b/queue-3.10/usb-ftdi_sio-add-basic-micro-atom-nano-usb2serial-pid.patch new file mode 100644 index 00000000000..d9589d209b5 --- /dev/null +++ b/queue-3.10/usb-ftdi_sio-add-basic-micro-atom-nano-usb2serial-pid.patch @@ -0,0 +1,42 @@ +From 6552cc7f09261db2aeaae389aa2c05a74b3a93b4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 13 Aug 2014 17:56:52 +0200 +Subject: USB: ftdi_sio: add Basic Micro ATOM Nano USB2Serial PID + +From: Johan Hovold + +commit 6552cc7f09261db2aeaae389aa2c05a74b3a93b4 upstream. + +Add device id for Basic Micro ATOM Nano USB2Serial adapters. + +Reported-by: Nicolas Alt +Tested-by: Nicolas Alt +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 2 ++ + 2 files changed, 3 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -154,6 +154,7 @@ static struct usb_device_id id_table_com + { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_BM_ATOM_NANO_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -42,6 +42,8 @@ + /* www.candapter.com Ewert Energy Systems CANdapter device */ + #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */ + ++#define FTDI_BM_ATOM_NANO_PID 0xa559 /* Basic Micro ATOM Nano USB2Serial */ ++ + /* + * Texas Instruments XDS100v2 JTAG / BeagleBone A3 + * http://processors.wiki.ti.com/index.php/XDS100 diff --git a/queue-3.10/usb-ftdi_sio-added-pid-for-new-ekey-device.patch b/queue-3.10/usb-ftdi_sio-added-pid-for-new-ekey-device.patch new file mode 100644 index 00000000000..32b8d121f6b --- /dev/null +++ b/queue-3.10/usb-ftdi_sio-added-pid-for-new-ekey-device.patch @@ -0,0 +1,46 @@ +From 646907f5bfb0782c731ae9ff6fb63471a3566132 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ja=C5=A1a=20Bartelj?= +Date: Sat, 16 Aug 2014 12:44:27 +0200 +Subject: USB: ftdi_sio: Added PID for new ekey device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jaša Bartelj + +commit 646907f5bfb0782c731ae9ff6fb63471a3566132 upstream. + +Added support to the ftdi_sio driver for ekey Converter USB which +uses an FT232BM chip. + +Signed-off-by: Jaša Bartelj +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 5 +++++ + 2 files changed, 7 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -951,6 +951,8 @@ static struct usb_device_id id_table_com + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) }, + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) }, + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) }, ++ /* ekey Devices */ ++ { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) }, + /* Infineon Devices */ + { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) }, + { }, /* Optional parameter entry */ +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1380,3 +1380,8 @@ + #define BRAINBOXES_US_160_6_PID 0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */ + #define BRAINBOXES_US_160_7_PID 0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */ + #define BRAINBOXES_US_160_8_PID 0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */ ++ ++/* ++ * ekey biometric systems GmbH (http://ekey.net/) ++ */ ++#define FTDI_EKEY_CONV_USB_PID 0xCB08 /* Converter USB */ diff --git a/queue-3.10/usb-hub-prevent-hub-autosuspend-if-usbcore.autosuspend-is-1.patch b/queue-3.10/usb-hub-prevent-hub-autosuspend-if-usbcore.autosuspend-is-1.patch new file mode 100644 index 00000000000..645cd78453b --- /dev/null +++ b/queue-3.10/usb-hub-prevent-hub-autosuspend-if-usbcore.autosuspend-is-1.patch @@ -0,0 +1,43 @@ +From bdd405d2a5287bdb9b04670ea255e1f122138e66 Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Mon, 4 Aug 2014 12:44:46 +0300 +Subject: usb: hub: Prevent hub autosuspend if usbcore.autosuspend is -1 + +From: Roger Quadros + +commit bdd405d2a5287bdb9b04670ea255e1f122138e66 upstream. + +If user specifies that USB autosuspend must be disabled by module +parameter "usbcore.autosuspend=-1" then we must prevent +autosuspend of USB hub devices as well. + +commit 596d789a211d introduced in v3.8 changed the original behaivour +and stopped respecting the usbcore.autosuspend parameter for hubs. + +Fixes: 596d789a211d "USB: set hub's default autosuspend delay as 0" + +Signed-off-by: Roger Quadros +Tested-by: Michael Welling +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1699,8 +1699,12 @@ static int hub_probe(struct usb_interfac + * - Change autosuspend delay of hub can avoid unnecessary auto + * suspend timer for hub, also may decrease power consumption + * of USB bus. ++ * ++ * - If user has indicated to prevent autosuspend by passing ++ * usbcore.autosuspend = -1 then keep autosuspend disabled. + */ +- pm_runtime_set_autosuspend_delay(&hdev->dev, 0); ++ if (hdev->dev.power.autosuspend_delay >= 0) ++ pm_runtime_set_autosuspend_delay(&hdev->dev, 0); + + /* + * Hubs have proper suspend/resume support, except for root hubs diff --git a/queue-3.10/usb-whiteheat-added-bounds-checking-for-bulk-command-response.patch b/queue-3.10/usb-whiteheat-added-bounds-checking-for-bulk-command-response.patch new file mode 100644 index 00000000000..745875b7c5b --- /dev/null +++ b/queue-3.10/usb-whiteheat-added-bounds-checking-for-bulk-command-response.patch @@ -0,0 +1,45 @@ +From 6817ae225cd650fb1c3295d769298c38b1eba818 Mon Sep 17 00:00:00 2001 +From: James Forshaw +Date: Sat, 23 Aug 2014 14:39:48 -0700 +Subject: USB: whiteheat: Added bounds checking for bulk command response + +From: James Forshaw + +commit 6817ae225cd650fb1c3295d769298c38b1eba818 upstream. + +This patch fixes a potential security issue in the whiteheat USB driver +which might allow a local attacker to cause kernel memory corrpution. This +is due to an unchecked memcpy into a fixed size buffer (of 64 bytes). On +EHCI and XHCI busses it's possible to craft responses greater than 64 +bytes leading a buffer overflow. + +Signed-off-by: James Forshaw +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/whiteheat.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/whiteheat.c ++++ b/drivers/usb/serial/whiteheat.c +@@ -521,6 +521,10 @@ static void command_port_read_callback(s + dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__); + return; + } ++ if (!urb->actual_length) { ++ dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__); ++ return; ++ } + if (status) { + dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status); + if (status != -ENOENT) +@@ -541,7 +545,8 @@ static void command_port_read_callback(s + /* These are unsolicited reports from the firmware, hence no + waiting command to wakeup */ + dev_dbg(&urb->dev->dev, "%s - event received\n", __func__); +- } else if (data[0] == WHITEHEAT_GET_DTR_RTS) { ++ } else if ((data[0] == WHITEHEAT_GET_DTR_RTS) && ++ (urb->actual_length - 1 <= sizeof(command_info->result_buffer))) { + memcpy(command_info->result_buffer, &data[1], + urb->actual_length - 1); + command_info->command_finished = WHITEHEAT_CMD_COMPLETE; diff --git a/queue-3.10/usb-xhci-amd-chipset-also-needs-short-tx-quirk.patch b/queue-3.10/usb-xhci-amd-chipset-also-needs-short-tx-quirk.patch new file mode 100644 index 00000000000..882dc9323ac --- /dev/null +++ b/queue-3.10/usb-xhci-amd-chipset-also-needs-short-tx-quirk.patch @@ -0,0 +1,48 @@ +From 2597fe99bb0259387111d0431691f5daac84f5a5 Mon Sep 17 00:00:00 2001 +From: Huang Rui +Date: Tue, 19 Aug 2014 15:17:57 +0300 +Subject: usb: xhci: amd chipset also needs short TX quirk + +From: Huang Rui + +commit 2597fe99bb0259387111d0431691f5daac84f5a5 upstream. + +AMD xHC also needs short tx quirk after tested on most of chipset +generations. That's because there is the same incorrect behavior like +Fresco Logic host. Please see below message with on USB webcam +attached on xHC host: + +[ 139.262944] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? +[ 139.266934] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? +[ 139.270913] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? +[ 139.274937] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? +[ 139.278914] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? +[ 139.282936] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? +[ 139.286915] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? +[ 139.290938] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? +[ 139.294913] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? +[ 139.298917] xhci_hcd 0000:00:10.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? + +Reported-by: Arindam Nath +Tested-by: Shriraj-Rai P +Signed-off-by: Huang Rui +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -87,6 +87,10 @@ static void xhci_pci_quirks(struct devic + /* AMD PLL quirk */ + if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info()) + xhci->quirks |= XHCI_AMD_PLL_FIX; ++ ++ if (pdev->vendor == PCI_VENDOR_ID_AMD) ++ xhci->quirks |= XHCI_TRUST_TX_LENGTH; ++ + if (pdev->vendor == PCI_VENDOR_ID_INTEL) { + xhci->quirks |= XHCI_LPM_SUPPORT; + xhci->quirks |= XHCI_INTEL_HOST; diff --git a/queue-3.10/vm_is_stack-use-for_each_thread-rather-then-buggy-while_each_thread.patch b/queue-3.10/vm_is_stack-use-for_each_thread-rather-then-buggy-while_each_thread.patch new file mode 100644 index 00000000000..b0ac2925139 --- /dev/null +++ b/queue-3.10/vm_is_stack-use-for_each_thread-rather-then-buggy-while_each_thread.patch @@ -0,0 +1,50 @@ +From 4449a51a7c281602d3a385044ab928322a122a02 Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Fri, 8 Aug 2014 14:19:17 -0700 +Subject: vm_is_stack: use for_each_thread() rather then buggy while_each_thread() + +From: Oleg Nesterov + +commit 4449a51a7c281602d3a385044ab928322a122a02 upstream. + +Aleksei hit the soft lockup during reading /proc/PID/smaps. David +investigated the problem and suggested the right fix. + +while_each_thread() is racy and should die, this patch updates +vm_is_stack(). + +Signed-off-by: Oleg Nesterov +Reported-by: Aleksei Besogonov +Tested-by: Aleksei Besogonov +Suggested-by: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/util.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/mm/util.c ++++ b/mm/util.c +@@ -272,17 +272,14 @@ pid_t vm_is_stack(struct task_struct *ta + + if (in_group) { + struct task_struct *t; +- rcu_read_lock(); +- if (!pid_alive(task)) +- goto done; + +- t = task; +- do { ++ rcu_read_lock(); ++ for_each_thread(task, t) { + if (vm_is_stack_for_task(t, vma)) { + ret = t->pid; + goto done; + } +- } while_each_thread(task, t); ++ } + done: + rcu_read_unlock(); + } diff --git a/queue-3.10/xhci-treat-not-finding-the-event_seg-on-comp_stop-the-same-as-comp_stop_inval.patch b/queue-3.10/xhci-treat-not-finding-the-event_seg-on-comp_stop-the-same-as-comp_stop_inval.patch new file mode 100644 index 00000000000..71a2e271fe5 --- /dev/null +++ b/queue-3.10/xhci-treat-not-finding-the-event_seg-on-comp_stop-the-same-as-comp_stop_inval.patch @@ -0,0 +1,42 @@ +From 9a54886342e227433aebc9d374f8ae268a836475 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 19 Aug 2014 15:17:56 +0300 +Subject: xhci: Treat not finding the event_seg on COMP_STOP the same as COMP_STOP_INVAL + +From: Hans de Goede + +commit 9a54886342e227433aebc9d374f8ae268a836475 upstream. + +When using a Renesas uPD720231 chipset usb-3 uas to sata bridge with a 120G +Crucial M500 ssd, model string: Crucial_ CT120M500SSD1, together with a +the integrated Intel xhci controller on a Haswell laptop: + +00:14.0 USB controller [0c03]: Intel Corporation 8 Series USB xHCI HC [8086:9c31] (rev 04) + +The following error gets logged to dmesg: + +xhci error: Transfer event TRB DMA ptr not part of current TD + +Treating COMP_STOP the same as COMP_STOP_INVAL when no event_seg gets found +fixes this. + +Signed-off-by: Hans de Goede +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2532,7 +2532,8 @@ static int handle_tx_event(struct xhci_h + * last TRB of the previous TD. The command completion handle + * will take care the rest. + */ +- if (!event_seg && trb_comp_code == COMP_STOP_INVAL) { ++ if (!event_seg && (trb_comp_code == COMP_STOP || ++ trb_comp_code == COMP_STOP_INVAL)) { + ret = 0; + goto cleanup; + }