From: Greg Kroah-Hartman Date: Mon, 23 Sep 2013 22:25:22 +0000 (-0700) Subject: 3.11-stable patches X-Git-Tag: v3.0.97~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f1bf1cbdd69ee7e24da470d32738015fa755d52a;p=thirdparty%2Fkernel%2Fstable-queue.git 3.11-stable patches added patches: acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch pci-acpi-fix-_osc-ordering-to-allow-pcie-hotplug-use-when-available.patch rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch usb-don-t-fail-port-power-resume-on-device-disconnect.patch usb-ehci-mxc-check-for-pdata-before-dereferencing.patch usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch usb-handle-lpm-errors-during-device-suspend-correctly.patch usb-mos7720-fix-big-endian-control-requests.patch usb-mos7720-use-gfp_atomic-under-spinlock.patch --- diff --git a/queue-3.11/acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch b/queue-3.11/acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch new file mode 100644 index 00000000000..e8c02423114 --- /dev/null +++ b/queue-3.11/acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch @@ -0,0 +1,47 @@ +From af65cfe9aeae03e0682bebdf4db94582d75562dd Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Mon, 2 Sep 2013 13:30:25 +0300 +Subject: ACPI / LPSS: don't crash if a device has no MMIO resources + +From: Mika Westerberg + +commit af65cfe9aeae03e0682bebdf4db94582d75562dd upstream. + +Intel LPSS devices that are enumerated from ACPI have both MMIO and IRQ +resources returned in their _CRS method. However, Apple Macbook Air with +Haswell has LPSS devices enumerated from PCI bus instead and _CRS method +returns only an interrupt number (but the device has _HID set that causes +the scan handler to match it). + +The current ACPI / LPSS code sets pdata->dev_desc only when MMIO resource +is found for the device and in case of Macbook Air it is never found. That +leads to a NULL pointer dereference in register_device_clock(). + +Correct this by always setting the pdata->dev_desc. + +Reported-and-tested-by: Imre Kaloz +Signed-off-by: Mika Westerberg +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpi_lpss.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -257,12 +257,13 @@ static int acpi_lpss_create_device(struc + pdata->mmio_size = resource_size(&rentry->res); + pdata->mmio_base = ioremap(rentry->res.start, + pdata->mmio_size); +- pdata->dev_desc = dev_desc; + break; + } + + acpi_dev_free_resource_list(&resource_list); + ++ pdata->dev_desc = dev_desc; ++ + if (dev_desc->clk_required) { + ret = register_device_clock(adev, pdata); + if (ret) { diff --git a/queue-3.11/pci-acpi-fix-_osc-ordering-to-allow-pcie-hotplug-use-when-available.patch b/queue-3.11/pci-acpi-fix-_osc-ordering-to-allow-pcie-hotplug-use-when-available.patch new file mode 100644 index 00000000000..26cdce3d942 --- /dev/null +++ b/queue-3.11/pci-acpi-fix-_osc-ordering-to-allow-pcie-hotplug-use-when-available.patch @@ -0,0 +1,154 @@ +From 3dc48af310709b85d07c8b0d3aa8f1ead02829d3 Mon Sep 17 00:00:00 2001 +From: Neil Horman +Date: Thu, 29 Aug 2013 16:17:05 -0400 +Subject: PCI/ACPI: Fix _OSC ordering to allow PCIe hotplug use when available + +From: Neil Horman + +commit 3dc48af310709b85d07c8b0d3aa8f1ead02829d3 upstream. + +This fixes the problem of acpiphp claiming slots that should be managed +by pciehp, which may keep ExpressCard slots from working. + +The acpiphp driver claims PCIe slots unless the BIOS has granted us +control of PCIe native hotplug via _OSC. Prior to v3.10, the acpiphp +.add method (add_bridge()) was always called *after* we had requested +native hotplug control with _OSC. + +But after 3b63aaa70e ("PCI: acpiphp: Do not use ACPI PCI subdriver +mechanism"), which appeared in v3.10, acpiphp initialization is done +during the bus scan via the pcibios_add_bus() hook, and this happens +*before* we request native hotplug control. + +Therefore, acpiphp doesn't know yet whether the BIOS will grant control, +and it claims slots that we should be handling with native hotplug. + +This patch requests native hotplug control earlier, so we know whether +the BIOS granted it to us before we initialize acpiphp. + +To avoid reintroducing the ASPM issue fixed by b8178f130e ('Revert +"PCI/ACPI: Request _OSC control before scanning PCI root bus"'), we run +_OSC earlier but defer the actual ASPM calls until after the bus scan is +complete. + +Tested successfully by myself. + +[bhelgaas: changelog, mark for stable] +Reference: https://bugzilla.kernel.org/show_bug.cgi?id=60736 +Signed-off-by: Neil Horman +Signed-off-by: Bjorn Helgaas +Acked-by: Yinghai Lu +CC: Len Brown +CC: "Rafael J. Wysocki" +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/pci_root.c | 62 +++++++++++++++++++++++++++++------------------- + 1 file changed, 38 insertions(+), 24 deletions(-) + +--- a/drivers/acpi/pci_root.c ++++ b/drivers/acpi/pci_root.c +@@ -378,6 +378,7 @@ static int acpi_pci_root_add(struct acpi + struct acpi_pci_root *root; + u32 flags, base_flags; + acpi_handle handle = device->handle; ++ bool no_aspm = false, clear_aspm = false; + + root = kzalloc(sizeof(struct acpi_pci_root), GFP_KERNEL); + if (!root) +@@ -437,27 +438,6 @@ static int acpi_pci_root_add(struct acpi + flags = base_flags = OSC_PCI_SEGMENT_GROUPS_SUPPORT; + acpi_pci_osc_support(root, flags); + +- /* +- * TBD: Need PCI interface for enumeration/configuration of roots. +- */ +- +- /* +- * Scan the Root Bridge +- * -------------------- +- * Must do this prior to any attempt to bind the root device, as the +- * PCI namespace does not get created until this call is made (and +- * thus the root bridge's pci_dev does not exist). +- */ +- root->bus = pci_acpi_scan_root(root); +- if (!root->bus) { +- dev_err(&device->dev, +- "Bus %04x:%02x not present in PCI namespace\n", +- root->segment, (unsigned int)root->secondary.start); +- result = -ENODEV; +- goto end; +- } +- +- /* Indicate support for various _OSC capabilities. */ + if (pci_ext_cfg_avail()) + flags |= OSC_EXT_PCI_CONFIG_SUPPORT; + if (pcie_aspm_support_enabled()) { +@@ -471,7 +451,7 @@ static int acpi_pci_root_add(struct acpi + if (ACPI_FAILURE(status)) { + dev_info(&device->dev, "ACPI _OSC support " + "notification failed, disabling PCIe ASPM\n"); +- pcie_no_aspm(); ++ no_aspm = true; + flags = base_flags; + } + } +@@ -503,7 +483,7 @@ static int acpi_pci_root_add(struct acpi + * We have ASPM control, but the FADT indicates + * that it's unsupported. Clear it. + */ +- pcie_clear_aspm(root->bus); ++ clear_aspm = true; + } + } else { + dev_info(&device->dev, +@@ -512,7 +492,14 @@ static int acpi_pci_root_add(struct acpi + acpi_format_exception(status), flags); + dev_info(&device->dev, + "ACPI _OSC control for PCIe not granted, disabling ASPM\n"); +- pcie_no_aspm(); ++ /* ++ * We want to disable ASPM here, but aspm_disabled ++ * needs to remain in its state from boot so that we ++ * properly handle PCIe 1.1 devices. So we set this ++ * flag here, to defer the action until after the ACPI ++ * root scan. ++ */ ++ no_aspm = true; + } + } else { + dev_info(&device->dev, +@@ -520,6 +507,33 @@ static int acpi_pci_root_add(struct acpi + "(_OSC support mask: 0x%02x)\n", flags); + } + ++ /* ++ * TBD: Need PCI interface for enumeration/configuration of roots. ++ */ ++ ++ /* ++ * Scan the Root Bridge ++ * -------------------- ++ * Must do this prior to any attempt to bind the root device, as the ++ * PCI namespace does not get created until this call is made (and ++ * thus the root bridge's pci_dev does not exist). ++ */ ++ root->bus = pci_acpi_scan_root(root); ++ if (!root->bus) { ++ dev_err(&device->dev, ++ "Bus %04x:%02x not present in PCI namespace\n", ++ root->segment, (unsigned int)root->secondary.start); ++ result = -ENODEV; ++ goto end; ++ } ++ ++ if (clear_aspm) { ++ dev_info(&device->dev, "Disabling ASPM (FADT indicates it is unsupported)\n"); ++ pcie_clear_aspm(root->bus); ++ } ++ if (no_aspm) ++ pcie_no_aspm(); ++ + pci_acpi_add_bus_pm_notifier(device, root->bus); + if (device->wakeup.flags.run_wake) + device_set_run_wake(root->bus->bridge, true); diff --git a/queue-3.11/rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch b/queue-3.11/rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch new file mode 100644 index 00000000000..fc85e3fd14c --- /dev/null +++ b/queue-3.11/rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch @@ -0,0 +1,68 @@ +From c34ac00caefbe49d40058ae7200bd58725cebb45 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 28 Jun 2013 10:34:48 -0700 +Subject: rculist: list_first_or_null_rcu() should use list_entry_rcu() + +From: Tejun Heo + +commit c34ac00caefbe49d40058ae7200bd58725cebb45 upstream. + +list_first_or_null() should test whether the list is empty and return +pointer to the first entry if not in a RCU safe manner. It's broken +in several ways. + +* It compares __kernel @__ptr with __rcu @__next triggering the + following sparse warning. + + net/core/dev.c:4331:17: error: incompatible types in comparison expression (different address spaces) + +* It doesn't perform rcu_dereference*() and computes the entry address + using container_of() directly from the __rcu pointer which is + inconsitent with other rculist interface. As a result, all three + in-kernel users - net/core/dev.c, macvlan, cgroup - are buggy. They + dereference the pointer w/o going through read barrier. + +* While ->next dereference passes through list_next_rcu(), the + compiler is still free to fetch ->next more than once and thus + nullify the "__ptr != __next" condition check. + +Fix it by making list_first_or_null_rcu() dereference ->next directly +using ACCESS_ONCE() and then use list_entry_rcu() on it like other +rculist accessors. + +v2: Paul pointed out that the compiler may fetch the pointer more than + once nullifying the condition check. ACCESS_ONCE() added on + ->next dereference. + +v3: Restored () around macro param which was accidentally removed. + Spotted by Paul. + +Signed-off-by: Tejun Heo +Reported-by: Fengguang Wu +Cc: Dipankar Sarma +Cc: "Paul E. McKenney" +Cc: "David S. Miller" +Cc: Li Zefan +Cc: Patrick McHardy +Signed-off-by: Paul E. McKenney +Reviewed-by: Josh Triplett +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/rculist.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/include/linux/rculist.h ++++ b/include/linux/rculist.h +@@ -267,8 +267,9 @@ static inline void list_splice_init_rcu( + */ + #define list_first_or_null_rcu(ptr, type, member) \ + ({struct list_head *__ptr = (ptr); \ +- struct list_head __rcu *__next = list_next_rcu(__ptr); \ +- likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \ ++ struct list_head *__next = ACCESS_ONCE(__ptr->next); \ ++ likely(__ptr != __next) ? \ ++ list_entry_rcu(__next, type, member) : NULL; \ + }) + + /** diff --git a/queue-3.11/series b/queue-3.11/series index 5d04072e106..0ee6e0212eb 100644 --- a/queue-3.11/series +++ b/queue-3.11/series @@ -33,3 +33,16 @@ cifs-fix-missing-lease-break.patch usb-ohci-allow-runtime-pm-without-system-sleep.patch regmap-debugfs-fix-continued-read-from-registers-file.patch staging-comedi-dt282x-dt282x_ai_insn_read-always-fails.patch +pci-acpi-fix-_osc-ordering-to-allow-pcie-hotplug-use-when-available.patch +acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch +usb-mos7720-use-gfp_atomic-under-spinlock.patch +usb-mos7720-fix-big-endian-control-requests.patch +usb-ehci-mxc-check-for-pdata-before-dereferencing.patch +usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch +usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch +usb-don-t-fail-port-power-resume-on-device-disconnect.patch +usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch +usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch +usb-handle-lpm-errors-during-device-suspend-correctly.patch +usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch +rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch diff --git a/queue-3.11/usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch b/queue-3.11/usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch new file mode 100644 index 00000000000..6f6ee21f630 --- /dev/null +++ b/queue-3.11/usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch @@ -0,0 +1,63 @@ +From 6dd433e6cf2475ce8abec1b467720858c24450eb Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 6 Aug 2013 14:22:59 +0200 +Subject: USB: cdc-wdm: fix race between interrupt handler and tasklet + +From: Oliver Neukum + +commit 6dd433e6cf2475ce8abec1b467720858c24450eb upstream. + +Both could want to submit the same URB. Some checks of the flag +intended to prevent that were missing. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-wdm.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -209,6 +209,7 @@ skip_error: + static void wdm_int_callback(struct urb *urb) + { + int rv = 0; ++ int responding; + int status = urb->status; + struct wdm_device *desc; + struct usb_cdc_notification *dr; +@@ -262,8 +263,8 @@ static void wdm_int_callback(struct urb + + spin_lock(&desc->iuspin); + clear_bit(WDM_READ, &desc->flags); +- set_bit(WDM_RESPONDING, &desc->flags); +- if (!test_bit(WDM_DISCONNECTING, &desc->flags) ++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags); ++ if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags) + && !test_bit(WDM_SUSPENDING, &desc->flags)) { + rv = usb_submit_urb(desc->response, GFP_ATOMIC); + dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d", +@@ -685,16 +686,20 @@ static void wdm_rxwork(struct work_struc + { + struct wdm_device *desc = container_of(work, struct wdm_device, rxwork); + unsigned long flags; +- int rv; ++ int rv = 0; ++ int responding; + + spin_lock_irqsave(&desc->iuspin, flags); + if (test_bit(WDM_DISCONNECTING, &desc->flags)) { + spin_unlock_irqrestore(&desc->iuspin, flags); + } else { ++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irqrestore(&desc->iuspin, flags); +- rv = usb_submit_urb(desc->response, GFP_KERNEL); ++ if (!responding) ++ rv = usb_submit_urb(desc->response, GFP_KERNEL); + if (rv < 0 && rv != -EPERM) { + spin_lock_irqsave(&desc->iuspin, flags); ++ clear_bit(WDM_RESPONDING, &desc->flags); + if (!test_bit(WDM_DISCONNECTING, &desc->flags)) + schedule_work(&desc->rxwork); + spin_unlock_irqrestore(&desc->iuspin, flags); diff --git a/queue-3.11/usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch b/queue-3.11/usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch new file mode 100644 index 00000000000..9156194eb0c --- /dev/null +++ b/queue-3.11/usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch @@ -0,0 +1,33 @@ +From b4f17a488ae2e09bfcf95c0e0b4219c246f1116a Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sat, 3 Aug 2013 16:37:48 +0200 +Subject: usb: config->desc.bLength may not exceed amount of data returned by the device + +From: Hans de Goede + +commit b4f17a488ae2e09bfcf95c0e0b4219c246f1116a upstream. + +While reading the config parsing code I noticed this check is missing, without +this check config->desc.wTotalLength can end up with a value larger then the +dev->rawdescriptors length for the config, and when userspace then tries to +get the rawdescriptors bad things may happen. + +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/config.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -424,7 +424,8 @@ static int usb_parse_configuration(struc + + memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); + if (config->desc.bDescriptorType != USB_DT_CONFIG || +- config->desc.bLength < USB_DT_CONFIG_SIZE) { ++ config->desc.bLength < USB_DT_CONFIG_SIZE || ++ config->desc.bLength > size) { + dev_err(ddev, "invalid descriptor for config index %d: " + "type = 0x%X, length = %d\n", cfgidx, + config->desc.bDescriptorType, config->desc.bLength); diff --git a/queue-3.11/usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch b/queue-3.11/usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch new file mode 100644 index 00000000000..11fc2cdc203 --- /dev/null +++ b/queue-3.11/usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch @@ -0,0 +1,53 @@ +From 98a4f1ff7bea8002ab79d6776e30d27932e88244 Mon Sep 17 00:00:00 2001 +From: Lan Tianyu +Date: Wed, 3 Jul 2013 22:17:54 +0800 +Subject: usb: don't check pm qos NO_POWER_OFF flag in usb_port_suspend() + +From: Lan Tianyu + +commit 98a4f1ff7bea8002ab79d6776e30d27932e88244 upstream. + +The pm qos NO_POWER_OFF flag is checked twice during usb device suspend +to see if the usb port power off condition is met. This is redundant and +also will prevent the port from being powered off if the NO_POWER_OFF +flag is changed to 1 from 0 after the device was already suspended. + +More detail in the following link. + http://marc.info/?l=linux-usb&m=136543949130865&w=2 + +This patch should be backported to kernels as old as 3.7, that +contain the commit f7ac7787ad361e31a7972e2854ed8dc2eedfac3b "usb/acpi: +Use ACPI methods to power off ports." + +Signed-off-by: Lan Tianyu +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3043,19 +3043,9 @@ int usb_port_suspend(struct usb_device * + usb_set_device_state(udev, USB_STATE_SUSPENDED); + } + +- /* +- * Check whether current status meets the requirement of +- * usb port power off mechanism +- */ + if (status == 0 && !udev->do_remote_wakeup && udev->persist_enabled) { +- enum pm_qos_flags_status pm_qos_stat; +- +- pm_qos_stat = dev_pm_qos_flags(&port_dev->dev, +- PM_QOS_FLAG_NO_POWER_OFF); +- if (pm_qos_stat != PM_QOS_FLAGS_ALL) { +- pm_runtime_put_sync(&port_dev->dev); +- port_dev->did_runtime_put = true; +- } ++ pm_runtime_put_sync(&port_dev->dev); ++ port_dev->did_runtime_put = true; + } + + usb_mark_last_busy(hub->hdev); diff --git a/queue-3.11/usb-don-t-fail-port-power-resume-on-device-disconnect.patch b/queue-3.11/usb-don-t-fail-port-power-resume-on-device-disconnect.patch new file mode 100644 index 00000000000..afb84287ddf --- /dev/null +++ b/queue-3.11/usb-don-t-fail-port-power-resume-on-device-disconnect.patch @@ -0,0 +1,74 @@ +From d49dad3e11638f66be4e16573ffaa8c46a09e3b3 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Mon, 5 Aug 2013 18:58:15 -0700 +Subject: usb: Don't fail port power resume on device disconnect. + +From: Sarah Sharp + +commit d49dad3e11638f66be4e16573ffaa8c46a09e3b3 upstream. + +Userspace can tell the kernel to power off any USB port, including ones +that are visible and connectible to users. When an attached USB device +goes into suspend, the port will be powered off if the +pm_qos_no_port_poweroff file for its port is set to 0, the device does +not have remote wakeup enabled, and the device is marked as persistent. + +If the user disconnects the USB device while the port is powered off, +the current code does not handle that properly. If you disconnect a +device, and then run `lsusb -v -s` for the device, the device disconnect +does not get handled by the USB core. The runtime resume of the port +fails, because hub_port_debounce_be_connected() returns -ETIMEDOUT. + +This means the port resume fails and khubd doesn't handle the USB device +disconnect. This leaves the device listed in lsusb, and the port's +runtime_status will be permanently marked as "error". + +Fix this by ignoring the return value of hub_port_debounce_be_connected. +Users can disconnect USB devices while the ports are powered off, and we +must be able to handle that. + +This patch should be backported to kernels as old as 3.9, that +contain the commit ad493e5e580546e6c3024b76a41535476da1546a "usb: add +usb port auto power off mechanism" + +Signed-off-by: Sarah Sharp +Cc: Lan Tianyu +Cc: Alan Stern +Cc: Rafael J. Wysocki +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/port.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +--- a/drivers/usb/core/port.c ++++ b/drivers/usb/core/port.c +@@ -89,22 +89,19 @@ static int usb_port_runtime_resume(struc + retval = usb_hub_set_port_power(hdev, hub, port1, true); + if (port_dev->child && !retval) { + /* +- * Wait for usb hub port to be reconnected in order to make +- * the resume procedure successful. ++ * Attempt to wait for usb hub port to be reconnected in order ++ * to make the resume procedure successful. The device may have ++ * disconnected while the port was powered off, so ignore the ++ * return status. + */ + retval = hub_port_debounce_be_connected(hub, port1); +- if (retval < 0) { ++ if (retval < 0) + dev_dbg(&port_dev->dev, "can't get reconnection after setting port power on, status %d\n", + retval); +- goto out; +- } + usb_clear_port_feature(hdev, port1, USB_PORT_FEAT_C_ENABLE); +- +- /* Set return value to 0 if debounce successful */ + retval = 0; + } + +-out: + clear_bit(port1, hub->busy_bits); + usb_autopm_put_interface(intf); + return retval; diff --git a/queue-3.11/usb-ehci-mxc-check-for-pdata-before-dereferencing.patch b/queue-3.11/usb-ehci-mxc-check-for-pdata-before-dereferencing.patch new file mode 100644 index 00000000000..6f6ede443f2 --- /dev/null +++ b/queue-3.11/usb-ehci-mxc-check-for-pdata-before-dereferencing.patch @@ -0,0 +1,34 @@ +From f375fc520d4df0cd9fcb570f33c103c6c0311f9e Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Wed, 21 Aug 2013 11:17:21 +0200 +Subject: usb: ehci-mxc: check for pdata before dereferencing + +From: Daniel Mack + +commit f375fc520d4df0cd9fcb570f33c103c6c0311f9e upstream. + +Commit 7e8d5cd93fac ("USB: Add EHCI support for MX27 and MX31 based +boards") introduced code that could potentially lead to a NULL pointer +dereference on driver removal. + +Fix this by checking for the value of pdata before dereferencing it. + +Signed-off-by: Daniel Mack +Reported-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-mxc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/ehci-mxc.c ++++ b/drivers/usb/host/ehci-mxc.c +@@ -184,7 +184,7 @@ static int ehci_mxc_drv_remove(struct pl + if (pdata && pdata->exit) + pdata->exit(pdev); + +- if (pdata->otg) ++ if (pdata && pdata->otg) + usb_phy_shutdown(pdata->otg); + + clk_disable_unprepare(priv->usbclk); diff --git a/queue-3.11/usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch b/queue-3.11/usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch new file mode 100644 index 00000000000..96716cc5b1f --- /dev/null +++ b/queue-3.11/usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch @@ -0,0 +1,38 @@ +From 9d8924297cd9c256c23c02abae40202563452453 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 30 Aug 2013 10:46:00 -0400 +Subject: USB: fix build error when CONFIG_PM_SLEEP isn't enabled + +From: Alan Stern + +commit 9d8924297cd9c256c23c02abae40202563452453 upstream. + +This patch fixes a build error that occurs when CONFIG_PM is enabled +and CONFIG_PM_SLEEP isn't: + +>> drivers/usb/host/ohci-pci.c:294:10: error: 'usb_hcd_pci_pm_ops' undeclared here (not in a function) + .pm = &usb_hcd_pci_pm_ops + +Since the usb_hcd_pci_pm_ops structure is defined and used when +CONFIG_PM is enabled, its declaration should not be protected by +CONFIG_PM_SLEEP. + +Signed-off-by: Alan Stern +Reported-by: kbuild test robot +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/usb/hcd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -411,7 +411,7 @@ extern int usb_hcd_pci_probe(struct pci_ + extern void usb_hcd_pci_remove(struct pci_dev *dev); + extern void usb_hcd_pci_shutdown(struct pci_dev *dev); + +-#ifdef CONFIG_PM_SLEEP ++#ifdef CONFIG_PM + extern const struct dev_pm_ops usb_hcd_pci_pm_ops; + #endif + #endif /* CONFIG_PCI */ diff --git a/queue-3.11/usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch b/queue-3.11/usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch new file mode 100644 index 00000000000..7c1504029a3 --- /dev/null +++ b/queue-3.11/usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch @@ -0,0 +1,42 @@ +From ebe864a6cb8e087ede047fa1fa6b6d06fcb9a9e4 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Mon, 29 Apr 2013 22:18:01 +0200 +Subject: usb: gadget: uvc: Fix error handling in uvc_queue_buffer() + +From: Laurent Pinchart + +commit ebe864a6cb8e087ede047fa1fa6b6d06fcb9a9e4 upstream. + +The conversion to videobuf2 failed to check the return value of +vb2_qbuf(). Fix it. + +Reported-by: Michael Grzeschik +Signed-off-by: Laurent Pinchart +Tested-By: Michael Grzeschik +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/uvc_queue.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/uvc_queue.c ++++ b/drivers/usb/gadget/uvc_queue.c +@@ -193,12 +193,16 @@ static int uvc_queue_buffer(struct uvc_v + + mutex_lock(&queue->mutex); + ret = vb2_qbuf(&queue->queue, buf); ++ if (ret < 0) ++ goto done; ++ + spin_lock_irqsave(&queue->irqlock, flags); + ret = (queue->flags & UVC_QUEUE_PAUSED) != 0; + queue->flags &= ~UVC_QUEUE_PAUSED; + spin_unlock_irqrestore(&queue->irqlock, flags); +- mutex_unlock(&queue->mutex); + ++done: ++ mutex_unlock(&queue->mutex); + return ret; + } + diff --git a/queue-3.11/usb-handle-lpm-errors-during-device-suspend-correctly.patch b/queue-3.11/usb-handle-lpm-errors-during-device-suspend-correctly.patch new file mode 100644 index 00000000000..c9a48ebe6c7 --- /dev/null +++ b/queue-3.11/usb-handle-lpm-errors-during-device-suspend-correctly.patch @@ -0,0 +1,150 @@ +From aa5ceae24bf8dff1d6fe87c6c4b08e69c6d33550 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 30 Jul 2013 15:39:02 -0400 +Subject: USB: handle LPM errors during device suspend correctly + +From: Alan Stern + +commit aa5ceae24bf8dff1d6fe87c6c4b08e69c6d33550 upstream. + +The hub driver's usb_port_suspend() routine doesn't handle errors +related to Link Power Management properly. It always returns failure, +it doesn't try to clean up the wakeup setting, (in the case of system +sleep) it doesn't try to go ahead with the port suspend regardless, +and it doesn't try to apply the new power-off mechanism. + +This patch fixes these problems. + +Note: Sarah fixed this patch to apply against 3.11, since the original +commit (4fae6f0fa86f92e6bc7429371b1e177ad0aaac66 "USB: handle LPM errors +during device suspend correctly") called usb_disable_remote_wakeup, +which won't be added until 3.12. + +This patch should be backported to kernels as old as 3.5, that +contain the commit 8306095fd2c1100e8244c09bf560f97aca5a311d "USB: +Disable USB 3.0 LPM in critical sections.". There will be merge +conflicts, since LTM wasn't added until 3.6. + +Signed-off-by: Alan Stern +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 71 ++++++++++++++++++++++++++----------------------- + 1 file changed, 38 insertions(+), 33 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2918,7 +2918,6 @@ int usb_port_suspend(struct usb_device * + { + struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent); + struct usb_port *port_dev = hub->ports[udev->portnum - 1]; +- enum pm_qos_flags_status pm_qos_stat; + int port1 = udev->portnum; + int status; + bool really_suspend = true; +@@ -2956,7 +2955,7 @@ int usb_port_suspend(struct usb_device * + status); + /* bail if autosuspend is requested */ + if (PMSG_IS_AUTO(msg)) +- return status; ++ goto err_wakeup; + } + } + +@@ -2965,14 +2964,16 @@ int usb_port_suspend(struct usb_device * + usb_set_usb2_hardware_lpm(udev, 0); + + if (usb_disable_ltm(udev)) { +- dev_err(&udev->dev, "%s Failed to disable LTM before suspend\n.", +- __func__); +- return -ENOMEM; ++ dev_err(&udev->dev, "Failed to disable LTM before suspend\n."); ++ status = -ENOMEM; ++ if (PMSG_IS_AUTO(msg)) ++ goto err_ltm; + } + if (usb_unlocked_disable_lpm(udev)) { +- dev_err(&udev->dev, "%s Failed to disable LPM before suspend\n.", +- __func__); +- return -ENOMEM; ++ dev_err(&udev->dev, "Failed to disable LPM before suspend\n."); ++ status = -ENOMEM; ++ if (PMSG_IS_AUTO(msg)) ++ goto err_lpm3; + } + + /* see 7.1.7.6 */ +@@ -3000,28 +3001,31 @@ int usb_port_suspend(struct usb_device * + if (status) { + dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n", + port1, status); +- /* paranoia: "should not happen" */ +- if (udev->do_remote_wakeup) { +- if (!hub_is_superspeed(hub->hdev)) { +- (void) usb_control_msg(udev, +- usb_sndctrlpipe(udev, 0), +- USB_REQ_CLEAR_FEATURE, +- USB_RECIP_DEVICE, +- USB_DEVICE_REMOTE_WAKEUP, 0, +- NULL, 0, +- USB_CTRL_SET_TIMEOUT); +- } else +- (void) usb_disable_function_remotewakeup(udev); +- +- } + ++ /* Try to enable USB3 LPM and LTM again */ ++ usb_unlocked_enable_lpm(udev); ++ err_lpm3: ++ usb_enable_ltm(udev); ++ err_ltm: + /* Try to enable USB2 hardware LPM again */ + if (udev->usb2_hw_lpm_capable == 1) + usb_set_usb2_hardware_lpm(udev, 1); + +- /* Try to enable USB3 LTM and LPM again */ +- usb_enable_ltm(udev); +- usb_unlocked_enable_lpm(udev); ++ if (udev->do_remote_wakeup) { ++ if (udev->speed < USB_SPEED_SUPER) ++ usb_control_msg(udev, usb_sndctrlpipe(udev, 0), ++ USB_REQ_CLEAR_FEATURE, ++ USB_RECIP_DEVICE, ++ USB_DEVICE_REMOTE_WAKEUP, 0, ++ NULL, 0, USB_CTRL_SET_TIMEOUT); ++ else ++ usb_control_msg(udev, usb_sndctrlpipe(udev, 0), ++ USB_REQ_CLEAR_FEATURE, ++ USB_RECIP_INTERFACE, ++ USB_INTRF_FUNC_SUSPEND, 0, ++ NULL, 0, USB_CTRL_SET_TIMEOUT); ++ } ++ err_wakeup: + + /* System sleep transitions should never fail */ + if (!PMSG_IS_AUTO(msg)) +@@ -3043,14 +3047,15 @@ int usb_port_suspend(struct usb_device * + * Check whether current status meets the requirement of + * usb port power off mechanism + */ +- pm_qos_stat = dev_pm_qos_flags(&port_dev->dev, +- PM_QOS_FLAG_NO_POWER_OFF); +- if (!udev->do_remote_wakeup +- && pm_qos_stat != PM_QOS_FLAGS_ALL +- && udev->persist_enabled +- && !status) { +- pm_runtime_put_sync(&port_dev->dev); +- port_dev->did_runtime_put = true; ++ if (status == 0 && !udev->do_remote_wakeup && udev->persist_enabled) { ++ enum pm_qos_flags_status pm_qos_stat; ++ ++ pm_qos_stat = dev_pm_qos_flags(&port_dev->dev, ++ PM_QOS_FLAG_NO_POWER_OFF); ++ if (pm_qos_stat != PM_QOS_FLAGS_ALL) { ++ pm_runtime_put_sync(&port_dev->dev); ++ port_dev->did_runtime_put = true; ++ } + } + + usb_mark_last_busy(hub->hdev); diff --git a/queue-3.11/usb-mos7720-fix-big-endian-control-requests.patch b/queue-3.11/usb-mos7720-fix-big-endian-control-requests.patch new file mode 100644 index 00000000000..b998b93864b --- /dev/null +++ b/queue-3.11/usb-mos7720-fix-big-endian-control-requests.patch @@ -0,0 +1,33 @@ +From 3b716caf190ccc6f2a09387210e0e6a26c1d81a4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 19 Aug 2013 13:05:45 +0200 +Subject: USB: mos7720: fix big-endian control requests + +From: Johan Hovold + +commit 3b716caf190ccc6f2a09387210e0e6a26c1d81a4 upstream. + +Fix endianess bugs in parallel-port code which caused corrupt +control-requests to be issued on big-endian machines. + +Reported-by: kbuild test robot +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7720.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -382,8 +382,8 @@ static int write_parport_reg_nonblock(st + } + urbtrack->setup->bRequestType = (__u8)0x40; + urbtrack->setup->bRequest = (__u8)0x0e; +- urbtrack->setup->wValue = get_reg_value(reg, dummy); +- urbtrack->setup->wIndex = get_reg_index(reg); ++ urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy)); ++ urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg)); + urbtrack->setup->wLength = 0; + usb_fill_control_urb(urbtrack->urb, usbdev, + usb_sndctrlpipe(usbdev, 0), diff --git a/queue-3.11/usb-mos7720-use-gfp_atomic-under-spinlock.patch b/queue-3.11/usb-mos7720-use-gfp_atomic-under-spinlock.patch new file mode 100644 index 00000000000..bbd12357b4e --- /dev/null +++ b/queue-3.11/usb-mos7720-use-gfp_atomic-under-spinlock.patch @@ -0,0 +1,31 @@ +From d0bd9a41186e076ea543c397ad8a67a6cf604b55 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 16 Aug 2013 10:16:59 +0300 +Subject: USB: mos7720: use GFP_ATOMIC under spinlock + +From: Dan Carpenter + +commit d0bd9a41186e076ea543c397ad8a67a6cf604b55 upstream. + +The write_parport_reg_nonblock() function shouldn't sleep because it's +called with spinlocks held. + +Signed-off-by: Dan Carpenter +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7720.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -374,7 +374,7 @@ static int write_parport_reg_nonblock(st + kfree(urbtrack); + return -ENOMEM; + } +- urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL); ++ urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC); + if (!urbtrack->setup) { + usb_free_urb(urbtrack->urb); + kfree(urbtrack);