From: Greg Kroah-Hartman Date: Fri, 16 Mar 2018 13:33:06 +0000 (+0100) Subject: 3.18-stable patches X-Git-Tag: v3.18.100~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=be823b213aaec407dbf5b9102f8416fa2d0a2a53;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch serial-8250_pci-add-brainboxes-uc-260-4-port-serial-device.patch serial-sh-sci-prevent-lockup-on-full-tty-buffers.patch staging-android-ashmem-fix-lockdep-issue-during-llseek.patch tty-serial-atmel-add-new-version-check-for-usart.patch uas-fix-comparison-for-error-code.patch usb-quirks-add-control-message-delay-for-1b1c-1b20.patch usb-usbmon-read-text-within-supplied-buffer-size.patch usb-usbmon-remove-assignment-from-is_err-argument.patch --- diff --git a/queue-3.18/fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch b/queue-3.18/fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch new file mode 100644 index 00000000000..64eb4702cfd --- /dev/null +++ b/queue-3.18/fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch @@ -0,0 +1,40 @@ +From gregkh@linuxfoundation.org Fri Mar 16 14:27:34 2018 +From: Greg Kroah-Hartman +Date: Tue, 13 Mar 2018 10:56:00 +0100 +Subject: fixup: sctp: verify size of a new chunk in _sctp_make_chunk() +To: Ben Hutchings +Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, Alexey Kodanev , Marcelo Ricardo Leitner , Neil Horman , "David S. Miller" +Message-ID: <20180313095600.GA5131@kroah.com> +Content-Disposition: inline + +From: Greg Kroah-Hartman + +Ben writes: +> > + int chunklen; +> > + +> > + chunklen = sizeof(*chunk_hdr) + paylen; +> +> I think this length still needs to be rounded up (with WORD_ROUND here, +> instead of SCTP_PAD4 upstream). + +So here's a fix for this problem. + + +Reported-by: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman + +--- + net/sctp/sm_make_chunk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -1369,7 +1369,7 @@ static struct sctp_chunk *_sctp_make_chu + struct sock *sk; + int chunklen; + +- chunklen = sizeof(*chunk_hdr) + paylen; ++ chunklen = WORD_ROUND(sizeof(*chunk_hdr) + paylen); + if (chunklen > SCTP_MAX_CHUNK_LEN) + goto nodata; + diff --git a/queue-3.18/serial-8250_pci-add-brainboxes-uc-260-4-port-serial-device.patch b/queue-3.18/serial-8250_pci-add-brainboxes-uc-260-4-port-serial-device.patch new file mode 100644 index 00000000000..45b6c9ffecb --- /dev/null +++ b/queue-3.18/serial-8250_pci-add-brainboxes-uc-260-4-port-serial-device.patch @@ -0,0 +1,41 @@ +From 9f2068f35729948bde84d87a40d135015911345d Mon Sep 17 00:00:00 2001 +From: Nikola Ciprich +Date: Tue, 13 Feb 2018 15:04:46 +0100 +Subject: serial: 8250_pci: Add Brainboxes UC-260 4 port serial device + +From: Nikola Ciprich + +commit 9f2068f35729948bde84d87a40d135015911345d upstream. + +Add PCI ids for two variants of Brainboxes UC-260 quad port +PCI serial cards. + +Suggested-by: Andy Shevchenko +Signed-off-by: Nikola Ciprich +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_pci.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -4982,6 +4982,17 @@ static struct pci_device_id serial_pci_t + PCI_ANY_ID, PCI_ANY_ID, 0, 0, /* 135a.0dc0 */ + pbn_b2_4_115200 }, + /* ++ * BrainBoxes UC-260 ++ */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x0D21, ++ PCI_ANY_ID, PCI_ANY_ID, ++ PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, ++ pbn_b2_4_115200 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0E34, ++ PCI_ANY_ID, PCI_ANY_ID, ++ PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, ++ pbn_b2_4_115200 }, ++ /* + * Perle PCI-RAS cards + */ + { PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9030, diff --git a/queue-3.18/serial-sh-sci-prevent-lockup-on-full-tty-buffers.patch b/queue-3.18/serial-sh-sci-prevent-lockup-on-full-tty-buffers.patch new file mode 100644 index 00000000000..06553a3bfcc --- /dev/null +++ b/queue-3.18/serial-sh-sci-prevent-lockup-on-full-tty-buffers.patch @@ -0,0 +1,49 @@ +From 7842055bfce4bf0170d0f61df8b2add8399697be Mon Sep 17 00:00:00 2001 +From: Ulrich Hecht +Date: Thu, 15 Feb 2018 13:02:27 +0100 +Subject: serial: sh-sci: prevent lockup on full TTY buffers + +From: Ulrich Hecht + +commit 7842055bfce4bf0170d0f61df8b2add8399697be upstream. + +When the TTY buffers fill up to the configured maximum, a system lockup +occurs: + +[ 598.820128] INFO: rcu_preempt detected stalls on CPUs/tasks: +[ 598.825796] 0-...!: (1 GPs behind) idle=5a6/2/0 softirq=1974/1974 fqs=1 +[ 598.832577] (detected by 3, t=62517 jiffies, g=296, c=295, q=126) +[ 598.838755] Task dump for CPU 0: +[ 598.841977] swapper/0 R running task 0 0 0 0x00000022 +[ 598.849023] Call trace: +[ 598.851476] __switch_to+0x98/0xb0 +[ 598.854870] (null) + +This can be prevented by doing a dummy read of the RX data register. + +This issue affects both HSCIF and SCIF ports. Reported for R-Car H3 ES2.0; +reproduced and fixed on H3 ES1.1. Probably affects other R-Car platforms +as well. + +Reported-by: Yoshihiro Shimoda +Signed-off-by: Ulrich Hecht +Reviewed-by: Geert Uytterhoeven +Cc: stable +Tested-by: Nguyen Viet Dung +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/sh-sci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -736,6 +736,8 @@ static void sci_receive_chars(struct uar + /* Tell the rest of the system the news. New characters! */ + tty_flip_buffer_push(tport); + } else { ++ /* TTY buffers full; read from RX reg to prevent lockup */ ++ serial_port_in(port, SCxRDR); + serial_port_in(port, SCxSR); /* dummy read */ + serial_port_out(port, SCxSR, SCxSR_RDxF_CLEAR(port)); + } diff --git a/queue-3.18/series b/queue-3.18/series index a112b9b7a6f..1c8e8177e37 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -14,3 +14,12 @@ ubi-fix-race-condition-between-ubi-volume-creation-and-udev.patch scripts-recordmcount-break-hardlinks.patch x86-module-detect-and-skip-invalid-relocations.patch x86-treat-r_x86_64_plt32-as-r_x86_64_pc32.patch +serial-sh-sci-prevent-lockup-on-full-tty-buffers.patch +tty-serial-atmel-add-new-version-check-for-usart.patch +uas-fix-comparison-for-error-code.patch +staging-android-ashmem-fix-lockdep-issue-during-llseek.patch +usb-quirks-add-control-message-delay-for-1b1c-1b20.patch +usb-usbmon-remove-assignment-from-is_err-argument.patch +usb-usbmon-read-text-within-supplied-buffer-size.patch +serial-8250_pci-add-brainboxes-uc-260-4-port-serial-device.patch +fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch diff --git a/queue-3.18/staging-android-ashmem-fix-lockdep-issue-during-llseek.patch b/queue-3.18/staging-android-ashmem-fix-lockdep-issue-during-llseek.patch new file mode 100644 index 00000000000..0eb5e5c2b2b --- /dev/null +++ b/queue-3.18/staging-android-ashmem-fix-lockdep-issue-during-llseek.patch @@ -0,0 +1,88 @@ +From cb57469c9573f6018cd1302953dd45d6e05aba7b Mon Sep 17 00:00:00 2001 +From: Joel Fernandes +Date: Fri, 16 Feb 2018 11:02:01 -0800 +Subject: staging: android: ashmem: Fix lockdep issue during llseek + +From: Joel Fernandes + +commit cb57469c9573f6018cd1302953dd45d6e05aba7b upstream. + +ashmem_mutex create a chain of dependencies like so: + +(1) +mmap syscall -> + mmap_sem -> (acquired) + ashmem_mmap + ashmem_mutex (try to acquire) + (block) + +(2) +llseek syscall -> + ashmem_llseek -> + ashmem_mutex -> (acquired) + inode_lock -> + inode->i_rwsem (try to acquire) + (block) + +(3) +getdents -> + iterate_dir -> + inode_lock -> + inode->i_rwsem (acquired) + copy_to_user -> + mmap_sem (try to acquire) + +There is a lock ordering created between mmap_sem and inode->i_rwsem +causing a lockdep splat [2] during a syzcaller test, this patch fixes +the issue by unlocking the mutex earlier. Functionally that's Ok since +we don't need to protect vfs_llseek. + +[1] https://patchwork.kernel.org/patch/10185031/ +[2] https://lkml.org/lkml/2018/1/10/48 + +Acked-by: Todd Kjos +Cc: Arve Hjonnevag +Cc: stable@vger.kernel.org +Reported-by: syzbot+8ec30bb7bf1a981a2012@syzkaller.appspotmail.com +Signed-off-by: Joel Fernandes +Acked-by: Greg Hackmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/android/ashmem.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -330,24 +330,23 @@ static loff_t ashmem_llseek(struct file + mutex_lock(&ashmem_mutex); + + if (asma->size == 0) { +- ret = -EINVAL; +- goto out; ++ mutex_unlock(&ashmem_mutex); ++ return -EINVAL; + } + + if (!asma->file) { +- ret = -EBADF; +- goto out; ++ mutex_unlock(&ashmem_mutex); ++ return -EBADF; + } + ++ mutex_unlock(&ashmem_mutex); ++ + ret = vfs_llseek(asma->file, offset, origin); + if (ret < 0) +- goto out; ++ return ret; + + /** Copy f_pos from backing file, since f_ops->llseek() sets it */ + file->f_pos = asma->file->f_pos; +- +-out: +- mutex_unlock(&ashmem_mutex); + return ret; + } + diff --git a/queue-3.18/tty-serial-atmel-add-new-version-check-for-usart.patch b/queue-3.18/tty-serial-atmel-add-new-version-check-for-usart.patch new file mode 100644 index 00000000000..542e92778a4 --- /dev/null +++ b/queue-3.18/tty-serial-atmel-add-new-version-check-for-usart.patch @@ -0,0 +1,33 @@ +From fd63a8903a2c40425a9811c3371dd4d0f42c0ad3 Mon Sep 17 00:00:00 2001 +From: Jonas Danielsson +Date: Mon, 29 Jan 2018 12:39:15 +0100 +Subject: tty/serial: atmel: add new version check for usart + +From: Jonas Danielsson + +commit fd63a8903a2c40425a9811c3371dd4d0f42c0ad3 upstream. + +On our at91sam9260 based board the usart0 and usart1 ports report +their versions (ATMEL_US_VERSION) as 0x10302. This version is not +included in the current checks in the driver. + +Signed-off-by: Jonas Danielsson +Acked-by: Richard Genoud +Acked-by: Nicolas Ferre +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1643,6 +1643,7 @@ static void atmel_get_ip_name(struct uar + switch (version) { + case 0x302: + case 0x10213: ++ case 0x10302: + dev_dbg(port->dev, "This version is usart\n"); + atmel_port->is_usart = true; + break; diff --git a/queue-3.18/uas-fix-comparison-for-error-code.patch b/queue-3.18/uas-fix-comparison-for-error-code.patch new file mode 100644 index 00000000000..ed5076b12b3 --- /dev/null +++ b/queue-3.18/uas-fix-comparison-for-error-code.patch @@ -0,0 +1,32 @@ +From 9a513c905bb95bef79d96feb08621c1ec8d8c4bb Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 6 Mar 2018 15:04:24 +0100 +Subject: uas: fix comparison for error code + +From: Oliver Neukum + +commit 9a513c905bb95bef79d96feb08621c1ec8d8c4bb upstream. + +A typo broke the comparison. + +Fixes: cbeef22fd611 ("usb: uas: unconditionally bring back host after reset") +Signed-off-by: Oliver Neukum +CC: stable@kernel.org +Acked-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/uas.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -1067,7 +1067,7 @@ static int uas_post_reset(struct usb_int + return 0; + + err = uas_configure_endpoints(devinfo); +- if (err && err != ENODEV) ++ if (err && err != -ENODEV) + shost_printk(KERN_ERR, shost, + "%s: alloc streams error %d after reset", + __func__, err); diff --git a/queue-3.18/usb-quirks-add-control-message-delay-for-1b1c-1b20.patch b/queue-3.18/usb-quirks-add-control-message-delay-for-1b1c-1b20.patch new file mode 100644 index 00000000000..a8e0bf2d05b --- /dev/null +++ b/queue-3.18/usb-quirks-add-control-message-delay-for-1b1c-1b20.patch @@ -0,0 +1,85 @@ +From cb88a0588717ba6c756cb5972d75766b273a6817 Mon Sep 17 00:00:00 2001 +From: Danilo Krummrich +Date: Tue, 6 Mar 2018 09:38:49 +0100 +Subject: usb: quirks: add control message delay for 1b1c:1b20 + +From: Danilo Krummrich + +commit cb88a0588717ba6c756cb5972d75766b273a6817 upstream. + +Corsair Strafe RGB keyboard does not respond to usb control messages +sometimes and hence generates timeouts. + +Commit de3af5bf259d ("usb: quirks: add delay init quirk for Corsair +Strafe RGB keyboard") tried to fix those timeouts by adding +USB_QUIRK_DELAY_INIT. + +Unfortunately, even with this quirk timeouts of usb_control_msg() +can still be seen, but with a lower frequency (approx. 1 out of 15): + +[ 29.103520] usb 1-8: string descriptor 0 read error: -110 +[ 34.363097] usb 1-8: can't set config #1, error -110 + +Adding further delays to different locations where usb control +messages are issued just moves the timeouts to other locations, +e.g.: + +[ 35.400533] usbhid 1-8:1.0: can't add hid device: -110 +[ 35.401014] usbhid: probe of 1-8:1.0 failed with error -110 + +The only way to reliably avoid those issues is having a pause after +each usb control message. In approx. 200 boot cycles no more timeouts +were seen. + +Addionaly, keep USB_QUIRK_DELAY_INIT as it turned out to be necessary +to have the delay in hub_port_connect() after hub_port_init(). + +The overall boot time seems not to be influenced by these additional +delays, even on fast machines and lightweight distributions. + +Fixes: de3af5bf259d ("usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard") +Cc: stable@vger.kernel.org +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/message.c | 4 ++++ + drivers/usb/core/quirks.c | 3 ++- + include/linux/usb/quirks.h | 3 +++ + 3 files changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -147,6 +147,10 @@ int usb_control_msg(struct usb_device *d + + ret = usb_internal_control_msg(dev, pipe, dr, data, size, timeout); + ++ /* Linger a bit, prior to the next control message. */ ++ if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG) ++ msleep(200); ++ + kfree(dr); + + return ret; +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -219,7 +219,8 @@ static const struct usb_device_id usb_qu + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + + /* Corsair Strafe RGB */ +- { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT | ++ USB_QUIRK_DELAY_CTRL_MSG }, + + /* Corsair K70 LUX */ + { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, +--- a/include/linux/usb/quirks.h ++++ b/include/linux/usb/quirks.h +@@ -56,4 +56,7 @@ + */ + #define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL BIT(11) + ++/* Device needs a pause after every control message. */ ++#define USB_QUIRK_DELAY_CTRL_MSG BIT(13) ++ + #endif /* __LINUX_USB_QUIRKS_H */ diff --git a/queue-3.18/usb-usbmon-read-text-within-supplied-buffer-size.patch b/queue-3.18/usb-usbmon-read-text-within-supplied-buffer-size.patch new file mode 100644 index 00000000000..38ba9930049 --- /dev/null +++ b/queue-3.18/usb-usbmon-read-text-within-supplied-buffer-size.patch @@ -0,0 +1,183 @@ +From a5f596830e27e15f7a0ecd6be55e433d776986d8 Mon Sep 17 00:00:00 2001 +From: Pete Zaitcev +Date: Fri, 9 Mar 2018 00:21:14 -0600 +Subject: usb: usbmon: Read text within supplied buffer size + +From: Pete Zaitcev + +commit a5f596830e27e15f7a0ecd6be55e433d776986d8 upstream. + +This change fixes buffer overflows and silent data corruption with the +usbmon device driver text file read operations. + +Signed-off-by: Fredrik Noring +Signed-off-by: Pete Zaitcev +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/mon/mon_text.c | 124 +++++++++++++++++++++++++++------------------ + 1 file changed, 77 insertions(+), 47 deletions(-) + +--- a/drivers/usb/mon/mon_text.c ++++ b/drivers/usb/mon/mon_text.c +@@ -82,6 +82,8 @@ struct mon_reader_text { + + wait_queue_head_t wait; + int printf_size; ++ size_t printf_offset; ++ size_t printf_togo; + char *printf_buf; + struct mutex printf_lock; + +@@ -373,75 +375,103 @@ err_alloc: + return rc; + } + +-/* +- * For simplicity, we read one record in one system call and throw out +- * what does not fit. This means that the following does not work: +- * dd if=/dbg/usbmon/0t bs=10 +- * Also, we do not allow seeks and do not bother advancing the offset. +- */ ++static ssize_t mon_text_copy_to_user(struct mon_reader_text *rp, ++ char __user * const buf, const size_t nbytes) ++{ ++ const size_t togo = min(nbytes, rp->printf_togo); ++ ++ if (copy_to_user(buf, &rp->printf_buf[rp->printf_offset], togo)) ++ return -EFAULT; ++ rp->printf_togo -= togo; ++ rp->printf_offset += togo; ++ return togo; ++} ++ ++/* ppos is not advanced since the llseek operation is not permitted. */ + static ssize_t mon_text_read_t(struct file *file, char __user *buf, +- size_t nbytes, loff_t *ppos) ++ size_t nbytes, loff_t *ppos) + { + struct mon_reader_text *rp = file->private_data; + struct mon_event_text *ep; + struct mon_text_ptr ptr; ++ ssize_t ret; + +- ep = mon_text_read_wait(rp, file); +- if (IS_ERR(ep)) +- return PTR_ERR(ep); + mutex_lock(&rp->printf_lock); +- ptr.cnt = 0; +- ptr.pbuf = rp->printf_buf; +- ptr.limit = rp->printf_size; +- +- mon_text_read_head_t(rp, &ptr, ep); +- mon_text_read_statset(rp, &ptr, ep); +- ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, +- " %d", ep->length); +- mon_text_read_data(rp, &ptr, ep); + +- if (copy_to_user(buf, rp->printf_buf, ptr.cnt)) +- ptr.cnt = -EFAULT; ++ if (rp->printf_togo == 0) { ++ ++ ep = mon_text_read_wait(rp, file); ++ if (IS_ERR(ep)) { ++ mutex_unlock(&rp->printf_lock); ++ return PTR_ERR(ep); ++ } ++ ptr.cnt = 0; ++ ptr.pbuf = rp->printf_buf; ++ ptr.limit = rp->printf_size; ++ ++ mon_text_read_head_t(rp, &ptr, ep); ++ mon_text_read_statset(rp, &ptr, ep); ++ ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, ++ " %d", ep->length); ++ mon_text_read_data(rp, &ptr, ep); ++ ++ rp->printf_togo = ptr.cnt; ++ rp->printf_offset = 0; ++ ++ kmem_cache_free(rp->e_slab, ep); ++ } ++ ++ ret = mon_text_copy_to_user(rp, buf, nbytes); + mutex_unlock(&rp->printf_lock); +- kmem_cache_free(rp->e_slab, ep); +- return ptr.cnt; ++ return ret; + } + ++/* ppos is not advanced since the llseek operation is not permitted. */ + static ssize_t mon_text_read_u(struct file *file, char __user *buf, +- size_t nbytes, loff_t *ppos) ++ size_t nbytes, loff_t *ppos) + { + struct mon_reader_text *rp = file->private_data; + struct mon_event_text *ep; + struct mon_text_ptr ptr; ++ ssize_t ret; + +- ep = mon_text_read_wait(rp, file); +- if (IS_ERR(ep)) +- return PTR_ERR(ep); + mutex_lock(&rp->printf_lock); +- ptr.cnt = 0; +- ptr.pbuf = rp->printf_buf; +- ptr.limit = rp->printf_size; + +- mon_text_read_head_u(rp, &ptr, ep); +- if (ep->type == 'E') { +- mon_text_read_statset(rp, &ptr, ep); +- } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) { +- mon_text_read_isostat(rp, &ptr, ep); +- mon_text_read_isodesc(rp, &ptr, ep); +- } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) { +- mon_text_read_intstat(rp, &ptr, ep); +- } else { +- mon_text_read_statset(rp, &ptr, ep); ++ if (rp->printf_togo == 0) { ++ ++ ep = mon_text_read_wait(rp, file); ++ if (IS_ERR(ep)) { ++ mutex_unlock(&rp->printf_lock); ++ return PTR_ERR(ep); ++ } ++ ptr.cnt = 0; ++ ptr.pbuf = rp->printf_buf; ++ ptr.limit = rp->printf_size; ++ ++ mon_text_read_head_u(rp, &ptr, ep); ++ if (ep->type == 'E') { ++ mon_text_read_statset(rp, &ptr, ep); ++ } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) { ++ mon_text_read_isostat(rp, &ptr, ep); ++ mon_text_read_isodesc(rp, &ptr, ep); ++ } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) { ++ mon_text_read_intstat(rp, &ptr, ep); ++ } else { ++ mon_text_read_statset(rp, &ptr, ep); ++ } ++ ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, ++ " %d", ep->length); ++ mon_text_read_data(rp, &ptr, ep); ++ ++ rp->printf_togo = ptr.cnt; ++ rp->printf_offset = 0; ++ ++ kmem_cache_free(rp->e_slab, ep); + } +- ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, +- " %d", ep->length); +- mon_text_read_data(rp, &ptr, ep); + +- if (copy_to_user(buf, rp->printf_buf, ptr.cnt)) +- ptr.cnt = -EFAULT; ++ ret = mon_text_copy_to_user(rp, buf, nbytes); + mutex_unlock(&rp->printf_lock); +- kmem_cache_free(rp->e_slab, ep); +- return ptr.cnt; ++ return ret; + } + + static struct mon_event_text *mon_text_read_wait(struct mon_reader_text *rp, diff --git a/queue-3.18/usb-usbmon-remove-assignment-from-is_err-argument.patch b/queue-3.18/usb-usbmon-remove-assignment-from-is_err-argument.patch new file mode 100644 index 00000000000..2c7c295f102 --- /dev/null +++ b/queue-3.18/usb-usbmon-remove-assignment-from-is_err-argument.patch @@ -0,0 +1,55 @@ +From 46c236dc7d1212d7417e6fb0317f91c44c719322 Mon Sep 17 00:00:00 2001 +From: Julia Lawall +Date: Sat, 26 Dec 2015 22:57:44 +0100 +Subject: USB: usbmon: remove assignment from IS_ERR argument + +From: Julia Lawall + +commit 46c236dc7d1212d7417e6fb0317f91c44c719322 upstream. + +The semantic patch that makes this change is as follows: +(http://coccinelle.lip6.fr/) + +// +@@ +expression e1,e2; +statement S1,S2; +@@ + ++e1 = e2; +if (IS_ERR( + e1 +- = e2 + )) S1 else S2 +// + +Signed-off-by: Julia Lawall +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/mon/mon_text.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/mon/mon_text.c ++++ b/drivers/usb/mon/mon_text.c +@@ -386,7 +386,8 @@ static ssize_t mon_text_read_t(struct fi + struct mon_event_text *ep; + struct mon_text_ptr ptr; + +- if (IS_ERR(ep = mon_text_read_wait(rp, file))) ++ ep = mon_text_read_wait(rp, file); ++ if (IS_ERR(ep)) + return PTR_ERR(ep); + mutex_lock(&rp->printf_lock); + ptr.cnt = 0; +@@ -413,7 +414,8 @@ static ssize_t mon_text_read_u(struct fi + struct mon_event_text *ep; + struct mon_text_ptr ptr; + +- if (IS_ERR(ep = mon_text_read_wait(rp, file))) ++ ep = mon_text_read_wait(rp, file); ++ if (IS_ERR(ep)) + return PTR_ERR(ep); + mutex_lock(&rp->printf_lock); + ptr.cnt = 0;