From: Greg Kroah-Hartman Date: Mon, 30 May 2016 20:19:21 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v3.14.71~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d17e0a7e7da0766fa834b2c942453642422d5133;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: serial-samsung-reorder-the-sequence-of-clock-control-when-call-s3c24xx_serial_set_termios.patch tty-vt-return-error-when-con_startup-fails.patch usb-serial-io_edgeport-fix-memory-leaks-in-attach-error-path.patch usb-serial-io_edgeport-fix-memory-leaks-in-probe-error-path.patch usb-serial-keyspan-fix-use-after-free-in-probe-error-path.patch usb-serial-mxuport-fix-use-after-free-in-probe-error-path.patch usb-serial-option-add-support-for-cinterion-ph8-and-ahxx.patch usb-serial-quatech2-fix-use-after-free-in-probe-error-path.patch --- diff --git a/queue-3.14/serial-samsung-reorder-the-sequence-of-clock-control-when-call-s3c24xx_serial_set_termios.patch b/queue-3.14/serial-samsung-reorder-the-sequence-of-clock-control-when-call-s3c24xx_serial_set_termios.patch new file mode 100644 index 00000000000..efd23f1bb26 --- /dev/null +++ b/queue-3.14/serial-samsung-reorder-the-sequence-of-clock-control-when-call-s3c24xx_serial_set_termios.patch @@ -0,0 +1,43 @@ +From b8995f527aac143e83d3900ff39357651ea4e0f6 Mon Sep 17 00:00:00 2001 +From: Chanwoo Choi +Date: Thu, 21 Apr 2016 18:58:31 +0900 +Subject: serial: samsung: Reorder the sequence of clock control when call s3c24xx_serial_set_termios() + +From: Chanwoo Choi + +commit b8995f527aac143e83d3900ff39357651ea4e0f6 upstream. + +This patch fixes the broken serial log when changing the clock source +of uart device. Before disabling the original clock source, this patch +enables the new clock source to protect the clock off state for a split second. + +Signed-off-by: Chanwoo Choi +Reviewed-by: Marek Szyprowski +Signed-off-by: Greg Kroah-Hartman +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Krzysztof Kozlowski + +--- + drivers/tty/serial/samsung.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -734,6 +734,8 @@ static void s3c24xx_serial_set_termios(s + /* check to see if we need to change clock source */ + + if (ourport->baudclk != clk) { ++ clk_prepare_enable(clk); ++ + s3c24xx_serial_setsource(port, clk_sel); + + if (!IS_ERR(ourport->baudclk)) { +@@ -741,8 +743,6 @@ static void s3c24xx_serial_set_termios(s + ourport->baudclk = ERR_PTR(-EINVAL); + } + +- clk_prepare_enable(clk); +- + ourport->baudclk = clk; + ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0; + } diff --git a/queue-3.14/series b/queue-3.14/series index dac95dfcd86..0ddc891d5c0 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -10,3 +10,11 @@ mmc-mmc-fix-partition-switch-timeout-for-some-emmcs.patch acpi-osi-fix-an-issue-that-acpi_osi-cannot-disable-acpica-internal-strings.patch mmc-longer-timeout-for-long-read-time-quirk.patch bluetooth-vhci-purge-unhandled-skbs.patch +usb-serial-mxuport-fix-use-after-free-in-probe-error-path.patch +usb-serial-keyspan-fix-use-after-free-in-probe-error-path.patch +usb-serial-quatech2-fix-use-after-free-in-probe-error-path.patch +usb-serial-io_edgeport-fix-memory-leaks-in-attach-error-path.patch +usb-serial-io_edgeport-fix-memory-leaks-in-probe-error-path.patch +usb-serial-option-add-support-for-cinterion-ph8-and-ahxx.patch +tty-vt-return-error-when-con_startup-fails.patch +serial-samsung-reorder-the-sequence-of-clock-control-when-call-s3c24xx_serial_set_termios.patch diff --git a/queue-3.14/tty-vt-return-error-when-con_startup-fails.patch b/queue-3.14/tty-vt-return-error-when-con_startup-fails.patch new file mode 100644 index 00000000000..0d7741f5e53 --- /dev/null +++ b/queue-3.14/tty-vt-return-error-when-con_startup-fails.patch @@ -0,0 +1,39 @@ +From 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Tue, 3 May 2016 17:05:54 +0200 +Subject: tty: vt, return error when con_startup fails + +From: Jiri Slaby + +commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 upstream. + +When csw->con_startup() fails in do_register_con_driver, we return no +error (i.e. 0). This was changed back in 2006 by commit 3e795de763. +Before that we used to return -ENODEV. + +So fix the return value to be -ENODEV in that case again. + +Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console") +Signed-off-by: Jiri Slaby +Reported-by: "Dan Carpenter" +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/vt.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -3512,9 +3512,10 @@ static int do_register_con_driver(const + goto err; + + desc = csw->con_startup(); +- +- if (!desc) ++ if (!desc) { ++ retval = -ENODEV; + goto err; ++ } + + retval = -EINVAL; + diff --git a/queue-3.14/usb-serial-io_edgeport-fix-memory-leaks-in-attach-error-path.patch b/queue-3.14/usb-serial-io_edgeport-fix-memory-leaks-in-attach-error-path.patch new file mode 100644 index 00000000000..afe7c475696 --- /dev/null +++ b/queue-3.14/usb-serial-io_edgeport-fix-memory-leaks-in-attach-error-path.patch @@ -0,0 +1,91 @@ +From c5c0c55598cefc826d6cfb0a417eeaee3631715c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 8 May 2016 20:07:56 +0200 +Subject: USB: serial: io_edgeport: fix memory leaks in attach error path + +From: Johan Hovold + +commit c5c0c55598cefc826d6cfb0a417eeaee3631715c upstream. + +Private data, URBs and buffers allocated for Epic devices during +attach were never released on errors (e.g. missing endpoints). + +Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver") +Signed-off-by: Johan Hovold +Acked-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/io_edgeport.c | 39 ++++++++++++++++++++++++++++----------- + 1 file changed, 28 insertions(+), 11 deletions(-) + +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2856,14 +2856,16 @@ static int edge_startup(struct usb_seria + /* not set up yet, so do it now */ + edge_serial->interrupt_read_urb = + usb_alloc_urb(0, GFP_KERNEL); +- if (!edge_serial->interrupt_read_urb) +- return -ENOMEM; ++ if (!edge_serial->interrupt_read_urb) { ++ response = -ENOMEM; ++ break; ++ } + + edge_serial->interrupt_in_buffer = + kmalloc(buffer_size, GFP_KERNEL); + if (!edge_serial->interrupt_in_buffer) { +- usb_free_urb(edge_serial->interrupt_read_urb); +- return -ENOMEM; ++ response = -ENOMEM; ++ break; + } + edge_serial->interrupt_in_endpoint = + endpoint->bEndpointAddress; +@@ -2891,14 +2893,16 @@ static int edge_startup(struct usb_seria + /* not set up yet, so do it now */ + edge_serial->read_urb = + usb_alloc_urb(0, GFP_KERNEL); +- if (!edge_serial->read_urb) +- return -ENOMEM; ++ if (!edge_serial->read_urb) { ++ response = -ENOMEM; ++ break; ++ } + + edge_serial->bulk_in_buffer = + kmalloc(buffer_size, GFP_KERNEL); + if (!edge_serial->bulk_in_buffer) { +- usb_free_urb(edge_serial->read_urb); +- return -ENOMEM; ++ response = -ENOMEM; ++ break; + } + edge_serial->bulk_in_endpoint = + endpoint->bEndpointAddress; +@@ -2924,9 +2928,22 @@ static int edge_startup(struct usb_seria + } + } + +- if (!interrupt_in_found || !bulk_in_found || !bulk_out_found) { +- dev_err(ddev, "Error - the proper endpoints were not found!\n"); +- return -ENODEV; ++ if (response || !interrupt_in_found || !bulk_in_found || ++ !bulk_out_found) { ++ if (!response) { ++ dev_err(ddev, "expected endpoints not found\n"); ++ response = -ENODEV; ++ } ++ ++ usb_free_urb(edge_serial->interrupt_read_urb); ++ kfree(edge_serial->interrupt_in_buffer); ++ ++ usb_free_urb(edge_serial->read_urb); ++ kfree(edge_serial->bulk_in_buffer); ++ ++ kfree(edge_serial); ++ ++ return response; + } + + /* start interrupt read for this edgeport this interrupt will diff --git a/queue-3.14/usb-serial-io_edgeport-fix-memory-leaks-in-probe-error-path.patch b/queue-3.14/usb-serial-io_edgeport-fix-memory-leaks-in-probe-error-path.patch new file mode 100644 index 00000000000..fb6060ca123 --- /dev/null +++ b/queue-3.14/usb-serial-io_edgeport-fix-memory-leaks-in-probe-error-path.patch @@ -0,0 +1,62 @@ +From c8d62957d450cc1a22ce3242908709fe367ddc8e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 8 May 2016 20:07:57 +0200 +Subject: USB: serial: io_edgeport: fix memory leaks in probe error path + +From: Johan Hovold + +commit c8d62957d450cc1a22ce3242908709fe367ddc8e upstream. + +URBs and buffers allocated in attach for Epic devices would never be +deallocated in case of a later probe error (e.g. failure to allocate +minor numbers) as disconnect is then never called. + +Fix by moving deallocation to release and making sure that the +URBs are first unlinked. + +Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect, +release") +Signed-off-by: Johan Hovold +Acked-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/io_edgeport.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2966,16 +2966,9 @@ static void edge_disconnect(struct usb_s + { + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); + +- /* stop reads and writes on all ports */ +- /* free up our endpoint stuff */ + if (edge_serial->is_epic) { + usb_kill_urb(edge_serial->interrupt_read_urb); +- usb_free_urb(edge_serial->interrupt_read_urb); +- kfree(edge_serial->interrupt_in_buffer); +- + usb_kill_urb(edge_serial->read_urb); +- usb_free_urb(edge_serial->read_urb); +- kfree(edge_serial->bulk_in_buffer); + } + } + +@@ -2988,6 +2981,16 @@ static void edge_release(struct usb_seri + { + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); + ++ if (edge_serial->is_epic) { ++ usb_kill_urb(edge_serial->interrupt_read_urb); ++ usb_free_urb(edge_serial->interrupt_read_urb); ++ kfree(edge_serial->interrupt_in_buffer); ++ ++ usb_kill_urb(edge_serial->read_urb); ++ usb_free_urb(edge_serial->read_urb); ++ kfree(edge_serial->bulk_in_buffer); ++ } ++ + kfree(edge_serial); + } + diff --git a/queue-3.14/usb-serial-keyspan-fix-use-after-free-in-probe-error-path.patch b/queue-3.14/usb-serial-keyspan-fix-use-after-free-in-probe-error-path.patch new file mode 100644 index 00000000000..917bb4adc31 --- /dev/null +++ b/queue-3.14/usb-serial-keyspan-fix-use-after-free-in-probe-error-path.patch @@ -0,0 +1,41 @@ +From 35be1a71d70775e7bd7e45fa6d2897342ff4c9d2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 8 May 2016 20:07:58 +0200 +Subject: USB: serial: keyspan: fix use-after-free in probe error path + +From: Johan Hovold + +commit 35be1a71d70775e7bd7e45fa6d2897342ff4c9d2 upstream. + +The interface instat and indat URBs were submitted in attach, but never +unlinked in release before deallocating the corresponding transfer +buffers. + +In the case of a late probe error (e.g. due to failed minor allocation), +disconnect would not have been called before release, causing the +buffers to be freed while the URBs are still in use. We'd also end up +with active URBs for an unbound interface. + +Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect, +release") +Signed-off-by: Johan Hovold +Acked-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/keyspan.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2406,6 +2406,10 @@ static void keyspan_release(struct usb_s + + s_priv = usb_get_serial_data(serial); + ++ /* Make sure to unlink the URBs submitted in attach. */ ++ usb_kill_urb(s_priv->instat_urb); ++ usb_kill_urb(s_priv->indat_urb); ++ + usb_free_urb(s_priv->instat_urb); + usb_free_urb(s_priv->indat_urb); + usb_free_urb(s_priv->glocont_urb); diff --git a/queue-3.14/usb-serial-mxuport-fix-use-after-free-in-probe-error-path.patch b/queue-3.14/usb-serial-mxuport-fix-use-after-free-in-probe-error-path.patch new file mode 100644 index 00000000000..53a5178baec --- /dev/null +++ b/queue-3.14/usb-serial-mxuport-fix-use-after-free-in-probe-error-path.patch @@ -0,0 +1,54 @@ +From 9e45284984096314994777f27e1446dfbfd2f0d7 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 8 May 2016 20:08:01 +0200 +Subject: USB: serial: mxuport: fix use-after-free in probe error path + +From: Johan Hovold + +commit 9e45284984096314994777f27e1446dfbfd2f0d7 upstream. + +The interface read and event URBs are submitted in attach, but were +never explicitly unlinked by the driver. Instead the URBs would have +been killed by usb-serial core on disconnect. + +In case of a late probe error (e.g. due to failed minor allocation), +disconnect is never called and we could end up with active URBs for an +unbound interface. This in turn could lead to deallocated memory being +dereferenced in the completion callbacks. + +Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX +driver") +Signed-off-by: Johan Hovold +Acked-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mxuport.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/usb/serial/mxuport.c ++++ b/drivers/usb/serial/mxuport.c +@@ -1263,6 +1263,15 @@ static int mxuport_attach(struct usb_ser + return 0; + } + ++static void mxuport_release(struct usb_serial *serial) ++{ ++ struct usb_serial_port *port0 = serial->port[0]; ++ struct usb_serial_port *port1 = serial->port[1]; ++ ++ usb_serial_generic_close(port1); ++ usb_serial_generic_close(port0); ++} ++ + static int mxuport_open(struct tty_struct *tty, struct usb_serial_port *port) + { + struct mxuport_port *mxport = usb_get_serial_port_data(port); +@@ -1365,6 +1374,7 @@ static struct usb_serial_driver mxuport_ + .probe = mxuport_probe, + .port_probe = mxuport_port_probe, + .attach = mxuport_attach, ++ .release = mxuport_release, + .calc_num_ports = mxuport_calc_num_ports, + .open = mxuport_open, + .close = mxuport_close, diff --git a/queue-3.14/usb-serial-option-add-support-for-cinterion-ph8-and-ahxx.patch b/queue-3.14/usb-serial-option-add-support-for-cinterion-ph8-and-ahxx.patch new file mode 100644 index 00000000000..b1106f1e8e6 --- /dev/null +++ b/queue-3.14/usb-serial-option-add-support-for-cinterion-ph8-and-ahxx.patch @@ -0,0 +1,79 @@ +From 444f94e9e625f6ec6bbe2cb232a6451c637f35a3 Mon Sep 17 00:00:00 2001 +From: Schemmel Hans-Christoph +Date: Fri, 29 Apr 2016 08:51:06 +0000 +Subject: USB: serial: option: add support for Cinterion PH8 and AHxx + +From: Schemmel Hans-Christoph + +commit 444f94e9e625f6ec6bbe2cb232a6451c637f35a3 upstream. + +Added support for Gemalto's Cinterion PH8 and AHxx products +with 2 RmNet Interfaces and products with 1 RmNet + 1 USB Audio interface. + +In addition some minor renaming and formatting. + +Signed-off-by: Hans-Christoph Schemmel +[johan: sort current entries and trim trailing whitespace ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -375,18 +375,22 @@ static void option_instat_callback(struc + #define HAIER_PRODUCT_CE81B 0x10f8 + #define HAIER_PRODUCT_CE100 0x2009 + +-/* Cinterion (formerly Siemens) products */ +-#define SIEMENS_VENDOR_ID 0x0681 +-#define CINTERION_VENDOR_ID 0x1e2d ++/* Gemalto's Cinterion products (formerly Siemens) */ ++#define SIEMENS_VENDOR_ID 0x0681 ++#define CINTERION_VENDOR_ID 0x1e2d ++#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 + #define CINTERION_PRODUCT_HC25_MDM 0x0047 +-#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 ++#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ + #define CINTERION_PRODUCT_HC28_MDM 0x004C +-#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ + #define CINTERION_PRODUCT_EU3_E 0x0051 + #define CINTERION_PRODUCT_EU3_P 0x0052 + #define CINTERION_PRODUCT_PH8 0x0053 + #define CINTERION_PRODUCT_AHXX 0x0055 + #define CINTERION_PRODUCT_PLXX 0x0060 ++#define CINTERION_PRODUCT_PH8_2RMNET 0x0082 ++#define CINTERION_PRODUCT_PH8_AUDIO 0x0083 ++#define CINTERION_PRODUCT_AHXX_2RMNET 0x0084 ++#define CINTERION_PRODUCT_AHXX_AUDIO 0x0085 + + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -641,6 +645,10 @@ static const struct option_blacklist_inf + .reserved = BIT(1) | BIT(2) | BIT(3), + }; + ++static const struct option_blacklist_info cinterion_rmnet2_blacklist = { ++ .reserved = BIT(4) | BIT(5), ++}; ++ + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -1712,7 +1720,13 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, +- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_2RMNET, 0xff), ++ .driver_info = (kernel_ulong_t)&cinterion_rmnet2_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_AUDIO, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, ++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, diff --git a/queue-3.14/usb-serial-quatech2-fix-use-after-free-in-probe-error-path.patch b/queue-3.14/usb-serial-quatech2-fix-use-after-free-in-probe-error-path.patch new file mode 100644 index 00000000000..7129d2cca9b --- /dev/null +++ b/queue-3.14/usb-serial-quatech2-fix-use-after-free-in-probe-error-path.patch @@ -0,0 +1,36 @@ +From 028c49f5e02a257c94129cd815f7c8485f51d4ef Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 8 May 2016 20:08:02 +0200 +Subject: USB: serial: quatech2: fix use-after-free in probe error path + +From: Johan Hovold + +commit 028c49f5e02a257c94129cd815f7c8485f51d4ef upstream. + +The interface read URB is submitted in attach, but was only unlinked by +the driver at disconnect. + +In case of a late probe error (e.g. due to failed minor allocation), +disconnect is never called and we would end up with active URBs for an +unbound interface. This in turn could lead to deallocated memory being +dereferenced in the completion callback. + +Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver") +Signed-off-by: Johan Hovold +Acked-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/quatech2.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/quatech2.c ++++ b/drivers/usb/serial/quatech2.c +@@ -141,6 +141,7 @@ static void qt2_release(struct usb_seria + + serial_priv = usb_get_serial_data(serial); + ++ usb_kill_urb(serial_priv->read_urb); + usb_free_urb(serial_priv->read_urb); + kfree(serial_priv->read_buffer); + kfree(serial_priv);