From 95da4531b9ea664fb2b6dd64a772ec00497da29b Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 10 Dec 2017 18:06:51 +0100 Subject: [PATCH] 4.14-stable patches added patches: can-ems_usb-cancel-urb-on-epipe-and-eproto.patch can-esd_usb2-cancel-urb-on-epipe-and-eproto.patch can-flexcan-fix-vf610-state-transition-issue.patch can-kvaser_usb-cancel-urb-on-epipe-and-eproto.patch can-kvaser_usb-fix-comparison-bug-in-kvaser_usb_read_bulk_callback.patch can-kvaser_usb-free-buf-in-error-paths.patch can-kvaser_usb-ratelimit-errors-if-incomplete-messages-are-received.patch can-mcba_usb-cancel-urb-on-eproto.patch can-mcba_usb-fix-device-disconnect-bug.patch can-peak-pci-fix-potential-bug-when-probe-fails.patch can-peak-pcie_fd-fix-potential-bug-in-restarting-tx-queue.patch can-ti_hecc-fix-napi-poll-return-value-for-repoll.patch can-usb_8dev-cancel-urb-on-epipe-and-eproto.patch serdev-ttyport-add-missing-receive_buf-sanity-checks.patch serdev-ttyport-fix-null-deref-on-hangup.patch serdev-ttyport-fix-tty-locking-in-close.patch usb-f_fs-force-reserved1-1-in-os_desc_ext_compat.patch usb-gadget-core-fix-udc_set_speed-speed-handling.patch usb-gadget-udc-renesas_usb3-fix-number-of-the-pipes.patch --- ...s_usb-cancel-urb-on-epipe-and-eproto.patch | 36 ++++++++++++ ..._usb2-cancel-urb-on-epipe-and-eproto.patch | 36 ++++++++++++ ...can-fix-vf610-state-transition-issue.patch | 41 ++++++++++++++ ...r_usb-cancel-urb-on-epipe-and-eproto.patch | 36 ++++++++++++ ...bug-in-kvaser_usb_read_bulk_callback.patch | 38 +++++++++++++ ...n-kvaser_usb-free-buf-in-error-paths.patch | 37 ++++++++++++ ...-if-incomplete-messages-are-received.patch | 43 ++++++++++++++ .../can-mcba_usb-cancel-urb-on-eproto.patch | 34 +++++++++++ ...n-mcba_usb-fix-device-disconnect-bug.patch | 40 +++++++++++++ ...i-fix-potential-bug-when-probe-fails.patch | 53 ++++++++++++++++++ ...potential-bug-in-restarting-tx-queue.patch | 48 ++++++++++++++++ ...ix-napi-poll-return-value-for-repoll.patch | 36 ++++++++++++ ..._8dev-cancel-urb-on-epipe-and-eproto.patch | 36 ++++++++++++ ...dd-missing-receive_buf-sanity-checks.patch | 56 +++++++++++++++++++ ...dev-ttyport-fix-null-deref-on-hangup.patch | 44 +++++++++++++++ ...dev-ttyport-fix-tty-locking-in-close.patch | 36 ++++++++++++ ...ce-reserved1-1-in-os_desc_ext_compat.patch | 56 +++++++++++++++++++ ...ore-fix-udc_set_speed-speed-handling.patch | 47 ++++++++++++++++ ...renesas_usb3-fix-number-of-the-pipes.patch | 35 ++++++++++++ 19 files changed, 788 insertions(+) create mode 100644 queue-4.14/can-ems_usb-cancel-urb-on-epipe-and-eproto.patch create mode 100644 queue-4.14/can-esd_usb2-cancel-urb-on-epipe-and-eproto.patch create mode 100644 queue-4.14/can-flexcan-fix-vf610-state-transition-issue.patch create mode 100644 queue-4.14/can-kvaser_usb-cancel-urb-on-epipe-and-eproto.patch create mode 100644 queue-4.14/can-kvaser_usb-fix-comparison-bug-in-kvaser_usb_read_bulk_callback.patch create mode 100644 queue-4.14/can-kvaser_usb-free-buf-in-error-paths.patch create mode 100644 queue-4.14/can-kvaser_usb-ratelimit-errors-if-incomplete-messages-are-received.patch create mode 100644 queue-4.14/can-mcba_usb-cancel-urb-on-eproto.patch create mode 100644 queue-4.14/can-mcba_usb-fix-device-disconnect-bug.patch create mode 100644 queue-4.14/can-peak-pci-fix-potential-bug-when-probe-fails.patch create mode 100644 queue-4.14/can-peak-pcie_fd-fix-potential-bug-in-restarting-tx-queue.patch create mode 100644 queue-4.14/can-ti_hecc-fix-napi-poll-return-value-for-repoll.patch create mode 100644 queue-4.14/can-usb_8dev-cancel-urb-on-epipe-and-eproto.patch create mode 100644 queue-4.14/serdev-ttyport-add-missing-receive_buf-sanity-checks.patch create mode 100644 queue-4.14/serdev-ttyport-fix-null-deref-on-hangup.patch create mode 100644 queue-4.14/serdev-ttyport-fix-tty-locking-in-close.patch create mode 100644 queue-4.14/usb-f_fs-force-reserved1-1-in-os_desc_ext_compat.patch create mode 100644 queue-4.14/usb-gadget-core-fix-udc_set_speed-speed-handling.patch create mode 100644 queue-4.14/usb-gadget-udc-renesas_usb3-fix-number-of-the-pipes.patch diff --git a/queue-4.14/can-ems_usb-cancel-urb-on-epipe-and-eproto.patch b/queue-4.14/can-ems_usb-cancel-urb-on-epipe-and-eproto.patch new file mode 100644 index 00000000000..dbd6e407656 --- /dev/null +++ b/queue-4.14/can-ems_usb-cancel-urb-on-epipe-and-eproto.patch @@ -0,0 +1,36 @@ +From bd352e1adfe0d02d3ea7c8e3fb19183dc317e679 Mon Sep 17 00:00:00 2001 +From: Martin Kelly +Date: Tue, 5 Dec 2017 11:15:47 -0800 +Subject: can: ems_usb: cancel urb on -EPIPE and -EPROTO + +From: Martin Kelly + +commit bd352e1adfe0d02d3ea7c8e3fb19183dc317e679 upstream. + +In mcba_usb, we have observed that when you unplug the device, the driver will +endlessly resubmit failing URBs, which can cause CPU stalls. This issue +is fixed in mcba_usb by catching the codes seen on device disconnect +(-EPIPE and -EPROTO). + +This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it +in the same way. + +Signed-off-by: Martin Kelly +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/ems_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -288,6 +288,8 @@ static void ems_usb_read_interrupt_callb + + case -ECONNRESET: /* unlink */ + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + diff --git a/queue-4.14/can-esd_usb2-cancel-urb-on-epipe-and-eproto.patch b/queue-4.14/can-esd_usb2-cancel-urb-on-epipe-and-eproto.patch new file mode 100644 index 00000000000..6ebab9606e2 --- /dev/null +++ b/queue-4.14/can-esd_usb2-cancel-urb-on-epipe-and-eproto.patch @@ -0,0 +1,36 @@ +From 7a31ced3de06e9878e4f9c3abe8f87d9344d8144 Mon Sep 17 00:00:00 2001 +From: Martin Kelly +Date: Tue, 5 Dec 2017 11:15:48 -0800 +Subject: can: esd_usb2: cancel urb on -EPIPE and -EPROTO + +From: Martin Kelly + +commit 7a31ced3de06e9878e4f9c3abe8f87d9344d8144 upstream. + +In mcba_usb, we have observed that when you unplug the device, the driver will +endlessly resubmit failing URBs, which can cause CPU stalls. This issue +is fixed in mcba_usb by catching the codes seen on device disconnect +(-EPIPE and -EPROTO). + +This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it +in the same way. + +Signed-off-by: Martin Kelly +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/esd_usb2.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/can/usb/esd_usb2.c ++++ b/drivers/net/can/usb/esd_usb2.c +@@ -393,6 +393,8 @@ static void esd_usb2_read_bulk_callback( + break; + + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + diff --git a/queue-4.14/can-flexcan-fix-vf610-state-transition-issue.patch b/queue-4.14/can-flexcan-fix-vf610-state-transition-issue.patch new file mode 100644 index 00000000000..ccfeaeb31f2 --- /dev/null +++ b/queue-4.14/can-flexcan-fix-vf610-state-transition-issue.patch @@ -0,0 +1,41 @@ +From 29c64b17a0bc72232acc45e9533221d88a262efb Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Mon, 27 Nov 2017 09:18:21 +0100 +Subject: can: flexcan: fix VF610 state transition issue + +From: Marc Kleine-Budde + +commit 29c64b17a0bc72232acc45e9533221d88a262efb upstream. + +Enable FLEXCAN_QUIRK_BROKEN_PERR_STATE for VF610 to report correct state +transitions. + +Tested-by: Mirza Krak +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -189,7 +189,7 @@ + * MX35 FlexCAN2 03.00.00.00 no no ? no no + * MX53 FlexCAN2 03.00.00.00 yes no no no no + * MX6s FlexCAN3 10.00.12.00 yes yes no no yes +- * VF610 FlexCAN3 ? no yes ? yes yes? ++ * VF610 FlexCAN3 ? no yes no yes yes? + * + * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected. + */ +@@ -297,7 +297,8 @@ static const struct flexcan_devtype_data + + static const struct flexcan_devtype_data fsl_vf610_devtype_data = { + .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS | +- FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_OFF_TIMESTAMP, ++ FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_OFF_TIMESTAMP | ++ FLEXCAN_QUIRK_BROKEN_PERR_STATE, + }; + + static const struct can_bittiming_const flexcan_bittiming_const = { diff --git a/queue-4.14/can-kvaser_usb-cancel-urb-on-epipe-and-eproto.patch b/queue-4.14/can-kvaser_usb-cancel-urb-on-epipe-and-eproto.patch new file mode 100644 index 00000000000..37019c419f9 --- /dev/null +++ b/queue-4.14/can-kvaser_usb-cancel-urb-on-epipe-and-eproto.patch @@ -0,0 +1,36 @@ +From 6aa8d5945502baf4687d80de59b7ac865e9e666b Mon Sep 17 00:00:00 2001 +From: Martin Kelly +Date: Tue, 5 Dec 2017 11:15:49 -0800 +Subject: can: kvaser_usb: cancel urb on -EPIPE and -EPROTO + +From: Martin Kelly + +commit 6aa8d5945502baf4687d80de59b7ac865e9e666b upstream. + +In mcba_usb, we have observed that when you unplug the device, the driver will +endlessly resubmit failing URBs, which can cause CPU stalls. This issue +is fixed in mcba_usb by catching the codes seen on device disconnect +(-EPIPE and -EPROTO). + +This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it +in the same way. + +Signed-off-by: Martin Kelly +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -1326,6 +1326,8 @@ static void kvaser_usb_read_bulk_callbac + case 0: + break; + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + default: diff --git a/queue-4.14/can-kvaser_usb-fix-comparison-bug-in-kvaser_usb_read_bulk_callback.patch b/queue-4.14/can-kvaser_usb-fix-comparison-bug-in-kvaser_usb_read_bulk_callback.patch new file mode 100644 index 00000000000..c9a8cd0d054 --- /dev/null +++ b/queue-4.14/can-kvaser_usb-fix-comparison-bug-in-kvaser_usb_read_bulk_callback.patch @@ -0,0 +1,38 @@ +From e84f44eb5523401faeb9cc1c97895b68e3cfb78d Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Tue, 21 Nov 2017 08:22:27 +0100 +Subject: can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() + +From: Jimmy Assarsson + +commit e84f44eb5523401faeb9cc1c97895b68e3cfb78d upstream. + +The conditon in the while-loop becomes true when actual_length is less than +2 (MSG_HEADER_LEN). In best case we end up with a former, already +dispatched msg, that got msg->len greater than actual_length. This will +result in a "Format error" error printout. + +Problem seen when unplugging a Kvaser USB device connected to a vbox guest. + +warning: comparison between signed and unsigned integer expressions +[-Wsign-compare] + +Signed-off-by: Jimmy Assarsson +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -1334,7 +1334,7 @@ static void kvaser_usb_read_bulk_callbac + goto resubmit_urb; + } + +- while (pos <= urb->actual_length - MSG_HEADER_LEN) { ++ while (pos <= (int)(urb->actual_length - MSG_HEADER_LEN)) { + msg = urb->transfer_buffer + pos; + + /* The Kvaser firmware can only read and write messages that diff --git a/queue-4.14/can-kvaser_usb-free-buf-in-error-paths.patch b/queue-4.14/can-kvaser_usb-free-buf-in-error-paths.patch new file mode 100644 index 00000000000..c6b5c75669c --- /dev/null +++ b/queue-4.14/can-kvaser_usb-free-buf-in-error-paths.patch @@ -0,0 +1,37 @@ +From 435019b48033138581a6171093b181fc6b4d3d30 Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Tue, 21 Nov 2017 08:22:26 +0100 +Subject: can: kvaser_usb: free buf in error paths + +From: Jimmy Assarsson + +commit 435019b48033138581a6171093b181fc6b4d3d30 upstream. + +The allocated buffer was not freed if usb_submit_urb() failed. + +Signed-off-by: Jimmy Assarsson +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -813,6 +813,7 @@ static int kvaser_usb_simple_msg_async(s + if (err) { + netdev_err(netdev, "Error transmitting URB\n"); + usb_unanchor_urb(urb); ++ kfree(buf); + usb_free_urb(urb); + return err; + } +@@ -1768,6 +1769,7 @@ static netdev_tx_t kvaser_usb_start_xmit + spin_unlock_irqrestore(&priv->tx_contexts_lock, flags); + + usb_unanchor_urb(urb); ++ kfree(buf); + + stats->tx_dropped++; + diff --git a/queue-4.14/can-kvaser_usb-ratelimit-errors-if-incomplete-messages-are-received.patch b/queue-4.14/can-kvaser_usb-ratelimit-errors-if-incomplete-messages-are-received.patch new file mode 100644 index 00000000000..1c82c34b2fe --- /dev/null +++ b/queue-4.14/can-kvaser_usb-ratelimit-errors-if-incomplete-messages-are-received.patch @@ -0,0 +1,43 @@ +From 8bd13bd522ff7dfa0eb371921aeb417155f7a3be Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Tue, 21 Nov 2017 08:22:28 +0100 +Subject: can: kvaser_usb: ratelimit errors if incomplete messages are received + +From: Jimmy Assarsson + +commit 8bd13bd522ff7dfa0eb371921aeb417155f7a3be upstream. + +Avoid flooding the kernel log with "Formate error", if incomplete message +are received. + +Signed-off-by: Jimmy Assarsson +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -609,8 +609,8 @@ static int kvaser_usb_wait_msg(const str + } + + if (pos + tmp->len > actual_len) { +- dev_err(dev->udev->dev.parent, +- "Format error\n"); ++ dev_err_ratelimited(dev->udev->dev.parent, ++ "Format error\n"); + break; + } + +@@ -1353,7 +1353,8 @@ static void kvaser_usb_read_bulk_callbac + } + + if (pos + msg->len > urb->actual_length) { +- dev_err(dev->udev->dev.parent, "Format error\n"); ++ dev_err_ratelimited(dev->udev->dev.parent, ++ "Format error\n"); + break; + } + diff --git a/queue-4.14/can-mcba_usb-cancel-urb-on-eproto.patch b/queue-4.14/can-mcba_usb-cancel-urb-on-eproto.patch new file mode 100644 index 00000000000..e24354ff667 --- /dev/null +++ b/queue-4.14/can-mcba_usb-cancel-urb-on-eproto.patch @@ -0,0 +1,34 @@ +From c7f33023308f3142433b7379718af5f0c2c322a6 Mon Sep 17 00:00:00 2001 +From: Martin Kelly +Date: Tue, 5 Dec 2017 10:34:03 -0800 +Subject: can: mcba_usb: cancel urb on -EPROTO + +From: Martin Kelly + +commit c7f33023308f3142433b7379718af5f0c2c322a6 upstream. + +When we unplug the device, we can see both -EPIPE and -EPROTO depending +on exact timing and what system we run on. If we continue to resubmit +URBs, they will immediately fail, and they can cause stalls, especially +on slower CPUs. + +Fix this by not resubmitting on -EPROTO, as we already do on -EPIPE. + +Signed-off-by: Martin Kelly +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/mcba_usb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -593,6 +593,7 @@ static void mcba_usb_read_bulk_callback( + + case -ENOENT: + case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + diff --git a/queue-4.14/can-mcba_usb-fix-device-disconnect-bug.patch b/queue-4.14/can-mcba_usb-fix-device-disconnect-bug.patch new file mode 100644 index 00000000000..86884e57b30 --- /dev/null +++ b/queue-4.14/can-mcba_usb-fix-device-disconnect-bug.patch @@ -0,0 +1,40 @@ +From 1cb35a33a28394fd711bb26ddf3a564f4e9d9125 Mon Sep 17 00:00:00 2001 +From: Martin Kelly +Date: Mon, 27 Nov 2017 15:49:16 -0800 +Subject: can: mcba_usb: fix device disconnect bug + +From: Martin Kelly + +commit 1cb35a33a28394fd711bb26ddf3a564f4e9d9125 upstream. + +Currently, when you disconnect the device, the driver infinitely +resubmits all URBs, so you see: + +Rx URB aborted (-32) + +in an infinite loop. + +Fix this by catching -EPIPE (what we get in urb->status when the device +disconnects) and not resubmitting. + +With this patch, I can plug and unplug many times and the driver +recovers correctly. + +Signed-off-by: Martin Kelly +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/mcba_usb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -592,6 +592,7 @@ static void mcba_usb_read_bulk_callback( + break; + + case -ENOENT: ++ case -EPIPE: + case -ESHUTDOWN: + return; + diff --git a/queue-4.14/can-peak-pci-fix-potential-bug-when-probe-fails.patch b/queue-4.14/can-peak-pci-fix-potential-bug-when-probe-fails.patch new file mode 100644 index 00000000000..8c64f1b5371 --- /dev/null +++ b/queue-4.14/can-peak-pci-fix-potential-bug-when-probe-fails.patch @@ -0,0 +1,53 @@ +From 5c2cb02edf79ad79d9b8d07c6d52243a948c4c9f Mon Sep 17 00:00:00 2001 +From: Stephane Grosjean +Date: Thu, 23 Nov 2017 15:44:35 +0100 +Subject: can: peak/pci: fix potential bug when probe() fails + +From: Stephane Grosjean + +commit 5c2cb02edf79ad79d9b8d07c6d52243a948c4c9f upstream. + +PCI/PCIe drivers for PEAK-System CAN/CAN-FD interfaces do some access to the +PCI config during probing. In case one of these accesses fails, a POSITIVE +PCIBIOS_xxx error code is returned back. This POSITIVE error code MUST be +converted into a NEGATIVE errno for the probe() function to indicate it +failed. Using the pcibios_err_to_errno() function, we make sure that the +return code will always be negative. + +Signed-off-by: Stephane Grosjean +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/peak_canfd/peak_pciefd_main.c | 5 ++++- + drivers/net/can/sja1000/peak_pci.c | 5 ++++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c ++++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c +@@ -825,7 +825,10 @@ err_release_regions: + err_disable_pci: + pci_disable_device(pdev); + +- return err; ++ /* pci_xxx_config_word() return positive PCIBIOS_xxx error codes while ++ * the probe() function must return a negative errno in case of failure ++ * (err is unchanged if negative) */ ++ return pcibios_err_to_errno(err); + } + + /* free the board structure object, as well as its resources: */ +--- a/drivers/net/can/sja1000/peak_pci.c ++++ b/drivers/net/can/sja1000/peak_pci.c +@@ -717,7 +717,10 @@ failure_release_regions: + failure_disable_pci: + pci_disable_device(pdev); + +- return err; ++ /* pci_xxx_config_word() return positive PCIBIOS_xxx error codes while ++ * the probe() function must return a negative errno in case of failure ++ * (err is unchanged if negative) */ ++ return pcibios_err_to_errno(err); + } + + static void peak_pci_remove(struct pci_dev *pdev) diff --git a/queue-4.14/can-peak-pcie_fd-fix-potential-bug-in-restarting-tx-queue.patch b/queue-4.14/can-peak-pcie_fd-fix-potential-bug-in-restarting-tx-queue.patch new file mode 100644 index 00000000000..15934905f96 --- /dev/null +++ b/queue-4.14/can-peak-pcie_fd-fix-potential-bug-in-restarting-tx-queue.patch @@ -0,0 +1,48 @@ +From 91785de6f94b58c3fb6664609e3682f011bd28d2 Mon Sep 17 00:00:00 2001 +From: Stephane Grosjean +Date: Thu, 7 Dec 2017 16:13:43 +0100 +Subject: can: peak/pcie_fd: fix potential bug in restarting tx queue + +From: Stephane Grosjean + +commit 91785de6f94b58c3fb6664609e3682f011bd28d2 upstream. + +Don't rely on can_get_echo_skb() return value to wake the network tx +queue up: can_get_echo_skb() returns 0 if the echo array slot was not +occupied, but also when the DLC of the released echo frame was 0. + +Signed-off-by: Stephane Grosjean +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/peak_canfd/peak_canfd.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/drivers/net/can/peak_canfd/peak_canfd.c ++++ b/drivers/net/can/peak_canfd/peak_canfd.c +@@ -258,21 +258,18 @@ static int pucan_handle_can_rx(struct pe + /* if this frame is an echo, */ + if ((rx_msg_flags & PUCAN_MSG_LOOPED_BACK) && + !(rx_msg_flags & PUCAN_MSG_SELF_RECEIVE)) { +- int n; + unsigned long flags; + + spin_lock_irqsave(&priv->echo_lock, flags); +- n = can_get_echo_skb(priv->ndev, msg->client); ++ can_get_echo_skb(priv->ndev, msg->client); + spin_unlock_irqrestore(&priv->echo_lock, flags); + + /* count bytes of the echo instead of skb */ + stats->tx_bytes += cf_len; + stats->tx_packets++; + +- if (n) { +- /* restart tx queue only if a slot is free */ +- netif_wake_queue(priv->ndev); +- } ++ /* restart tx queue (a slot is free) */ ++ netif_wake_queue(priv->ndev); + + return 0; + } diff --git a/queue-4.14/can-ti_hecc-fix-napi-poll-return-value-for-repoll.patch b/queue-4.14/can-ti_hecc-fix-napi-poll-return-value-for-repoll.patch new file mode 100644 index 00000000000..70215664f4f --- /dev/null +++ b/queue-4.14/can-ti_hecc-fix-napi-poll-return-value-for-repoll.patch @@ -0,0 +1,36 @@ +From f6c23b174c3c96616514827407769cbcfc8005cf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Oliver=20St=C3=A4bler?= +Date: Mon, 20 Nov 2017 14:45:15 +0100 +Subject: can: ti_hecc: Fix napi poll return value for repoll +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Oliver Stäbler + +commit f6c23b174c3c96616514827407769cbcfc8005cf upstream. + +After commit d75b1ade567f ("net: less interrupt masking in NAPI") napi +repoll is done only when work_done == budget. +So we need to return budget if there are still packets to receive. + +Signed-off-by: Oliver Stäbler +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/ti_hecc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/can/ti_hecc.c ++++ b/drivers/net/can/ti_hecc.c +@@ -637,6 +637,9 @@ static int ti_hecc_rx_poll(struct napi_s + mbx_mask = hecc_read(priv, HECC_CANMIM); + mbx_mask |= HECC_TX_MBOX_MASK; + hecc_write(priv, HECC_CANMIM, mbx_mask); ++ } else { ++ /* repoll is done only if whole budget is used */ ++ num_pkts = quota; + } + + return num_pkts; diff --git a/queue-4.14/can-usb_8dev-cancel-urb-on-epipe-and-eproto.patch b/queue-4.14/can-usb_8dev-cancel-urb-on-epipe-and-eproto.patch new file mode 100644 index 00000000000..732592dcfdc --- /dev/null +++ b/queue-4.14/can-usb_8dev-cancel-urb-on-epipe-and-eproto.patch @@ -0,0 +1,36 @@ +From 12147edc434c9e4c7c2f5fee2e5519b2e5ac34ce Mon Sep 17 00:00:00 2001 +From: Martin Kelly +Date: Tue, 5 Dec 2017 11:15:50 -0800 +Subject: can: usb_8dev: cancel urb on -EPIPE and -EPROTO + +From: Martin Kelly + +commit 12147edc434c9e4c7c2f5fee2e5519b2e5ac34ce upstream. + +In mcba_usb, we have observed that when you unplug the device, the driver will +endlessly resubmit failing URBs, which can cause CPU stalls. This issue +is fixed in mcba_usb by catching the codes seen on device disconnect +(-EPIPE and -EPROTO). + +This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it +in the same way. + +Signed-off-by: Martin Kelly +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/usb_8dev.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/can/usb/usb_8dev.c ++++ b/drivers/net/can/usb/usb_8dev.c +@@ -524,6 +524,8 @@ static void usb_8dev_read_bulk_callback( + break; + + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + diff --git a/queue-4.14/serdev-ttyport-add-missing-receive_buf-sanity-checks.patch b/queue-4.14/serdev-ttyport-add-missing-receive_buf-sanity-checks.patch new file mode 100644 index 00000000000..06feea8836a --- /dev/null +++ b/queue-4.14/serdev-ttyport-add-missing-receive_buf-sanity-checks.patch @@ -0,0 +1,56 @@ +From eb281683621b71ab9710d9dccbbef0c2e1769c97 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 3 Nov 2017 15:30:52 +0100 +Subject: serdev: ttyport: add missing receive_buf sanity checks + +From: Johan Hovold + +commit eb281683621b71ab9710d9dccbbef0c2e1769c97 upstream. + +The receive_buf tty-port callback should return the number of bytes +accepted and must specifically never return a negative errno (or a value +larger than the buffer size) to the tty layer. + +A serdev driver not providing a receive_buf callback would currently +cause the flush_to_ldisc() worker to spin in a tight loop when the tty +buffer pointers are incremented with -EINVAL (-22) after data has been +received. + +A serdev driver occasionally returning a negative errno (or a too large +byte count) could cause information leaks or crashes when accessing +memory outside the tty buffers in consecutive callbacks. + +Fixes: cd6484e1830b ("serdev: Introduce new bus for serial attached devices") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serdev/serdev-ttyport.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serdev/serdev-ttyport.c ++++ b/drivers/tty/serdev/serdev-ttyport.c +@@ -35,11 +35,22 @@ static int ttyport_receive_buf(struct tt + { + struct serdev_controller *ctrl = port->client_data; + struct serport *serport = serdev_controller_get_drvdata(ctrl); ++ int ret; + + if (!test_bit(SERPORT_ACTIVE, &serport->flags)) + return 0; + +- return serdev_controller_receive_buf(ctrl, cp, count); ++ ret = serdev_controller_receive_buf(ctrl, cp, count); ++ ++ dev_WARN_ONCE(&ctrl->dev, ret < 0 || ret > count, ++ "receive_buf returns %d (count = %zu)\n", ++ ret, count); ++ if (ret < 0) ++ return 0; ++ else if (ret > count) ++ return count; ++ ++ return ret; + } + + static void ttyport_write_wakeup(struct tty_port *port) diff --git a/queue-4.14/serdev-ttyport-fix-null-deref-on-hangup.patch b/queue-4.14/serdev-ttyport-fix-null-deref-on-hangup.patch new file mode 100644 index 00000000000..baa1384a1da --- /dev/null +++ b/queue-4.14/serdev-ttyport-fix-null-deref-on-hangup.patch @@ -0,0 +1,44 @@ +From 8bcd4e6a8decac251d55c4377e2e67f052777ce0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 3 Nov 2017 15:30:55 +0100 +Subject: serdev: ttyport: fix NULL-deref on hangup + +From: Johan Hovold + +commit 8bcd4e6a8decac251d55c4377e2e67f052777ce0 upstream. + +Make sure to use a properly refcounted tty_struct in write_wake up to +avoid dereferencing a NULL-pointer when a port is being hung up. + +Fixes: bed35c6dfa6a ("serdev: add a tty port controller driver") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serdev/serdev-ttyport.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serdev/serdev-ttyport.c ++++ b/drivers/tty/serdev/serdev-ttyport.c +@@ -57,12 +57,19 @@ static void ttyport_write_wakeup(struct + { + struct serdev_controller *ctrl = port->client_data; + struct serport *serport = serdev_controller_get_drvdata(ctrl); ++ struct tty_struct *tty; + +- if (test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &port->tty->flags) && ++ tty = tty_port_tty_get(port); ++ if (!tty) ++ return; ++ ++ if (test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && + test_bit(SERPORT_ACTIVE, &serport->flags)) + serdev_controller_write_wakeup(ctrl); + +- wake_up_interruptible_poll(&port->tty->write_wait, POLLOUT); ++ wake_up_interruptible_poll(&tty->write_wait, POLLOUT); ++ ++ tty_kref_put(tty); + } + + static const struct tty_port_client_operations client_ops = { diff --git a/queue-4.14/serdev-ttyport-fix-tty-locking-in-close.patch b/queue-4.14/serdev-ttyport-fix-tty-locking-in-close.patch new file mode 100644 index 00000000000..74ef0c9c473 --- /dev/null +++ b/queue-4.14/serdev-ttyport-fix-tty-locking-in-close.patch @@ -0,0 +1,36 @@ +From 90dbad8cd6efccbdce109d5ef0724f8434a6cdde Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 3 Nov 2017 15:30:56 +0100 +Subject: serdev: ttyport: fix tty locking in close + +From: Johan Hovold + +commit 90dbad8cd6efccbdce109d5ef0724f8434a6cdde upstream. + +Make sure to hold the tty lock as required when calling tty-driver +close() (e.g. to avoid racing with hangup()). + +Note that the serport active flag is currently set under the lock at +controller open, but really isn't protected by it. + +Fixes: cd6484e1830b ("serdev: Introduce new bus for serial attached devices") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serdev/serdev-ttyport.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/tty/serdev/serdev-ttyport.c ++++ b/drivers/tty/serdev/serdev-ttyport.c +@@ -149,8 +149,10 @@ static void ttyport_close(struct serdev_ + + clear_bit(SERPORT_ACTIVE, &serport->flags); + ++ tty_lock(tty); + if (tty->ops->close) + tty->ops->close(tty, NULL); ++ tty_unlock(tty); + + tty_release_struct(tty, serport->tty_idx); + } diff --git a/queue-4.14/usb-f_fs-force-reserved1-1-in-os_desc_ext_compat.patch b/queue-4.14/usb-f_fs-force-reserved1-1-in-os_desc_ext_compat.patch new file mode 100644 index 00000000000..73547e60095 --- /dev/null +++ b/queue-4.14/usb-f_fs-force-reserved1-1-in-os_desc_ext_compat.patch @@ -0,0 +1,56 @@ +From a3acc696085e112733d191a77b106e67a4fa110b Mon Sep 17 00:00:00 2001 +From: John Keeping +Date: Mon, 27 Nov 2017 18:15:40 +0000 +Subject: usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT + +From: John Keeping + +commit a3acc696085e112733d191a77b106e67a4fa110b upstream. + +The specification says that the Reserved1 field in OS_DESC_EXT_COMPAT +must have the value "1", but when this feature was first implemented we +rejected any non-zero values. + +This was adjusted to accept all non-zero values (while now rejecting +zero) in commit 53642399aa71 ("usb: gadget: f_fs: Fix wrong check on +reserved1 of OS_DESC_EXT_COMPAT"), but that breaks any userspace +programs that worked previously by returning EINVAL when Reserved1 == 0 +which was previously the only value that succeeded! + +If we just set the field to "1" ourselves, both old and new userspace +programs continue to work correctly and, as a bonus, old programs are +now compliant with the specification without having to fix anything +themselves. + +Fixes: 53642399aa71 ("usb: gadget: f_fs: Fix wrong check on reserved1 of OS_DESC_EXT_COMPAT") +Signed-off-by: John Keeping +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -2286,9 +2286,18 @@ static int __ffs_data_do_os_desc(enum ff + int i; + + if (len < sizeof(*d) || +- d->bFirstInterfaceNumber >= ffs->interfaces_count || +- !d->Reserved1) ++ d->bFirstInterfaceNumber >= ffs->interfaces_count) + return -EINVAL; ++ if (d->Reserved1 != 1) { ++ /* ++ * According to the spec, Reserved1 must be set to 1 ++ * but older kernels incorrectly rejected non-zero ++ * values. We fix it here to avoid returning EINVAL ++ * in response to values we used to accept. ++ */ ++ pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n"); ++ d->Reserved1 = 1; ++ } + for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i) + if (d->Reserved2[i]) + return -EINVAL; diff --git a/queue-4.14/usb-gadget-core-fix-udc_set_speed-speed-handling.patch b/queue-4.14/usb-gadget-core-fix-udc_set_speed-speed-handling.patch new file mode 100644 index 00000000000..2ab0ca87aeb --- /dev/null +++ b/queue-4.14/usb-gadget-core-fix-udc_set_speed-speed-handling.patch @@ -0,0 +1,47 @@ +From a4f0927ef588cf62bb864707261482c874352942 Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Tue, 31 Oct 2017 15:56:29 +0200 +Subject: usb: gadget: core: Fix ->udc_set_speed() speed handling + +From: Roger Quadros + +commit a4f0927ef588cf62bb864707261482c874352942 upstream. + +Currently UDC core calls ->udc_set_speed() with the speed parameter +containing the maximum speed supported by the gadget function +driver. This might very well be more than that supported by the +UDC controller driver. + +Select the lesser of the 2 speeds so both UDC and gadget function +driver are operating within limits. + +This fixes PHY Erratic errors and 2 second enumeration delay on +TI's AM437x platforms. + +Fixes: 6099eca796ae ("usb: gadget: core: introduce ->udc_set_speed() method") +Reported-by: Dylan Howey +Signed-off-by: Roger Quadros +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/core.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -1080,8 +1080,12 @@ static inline void usb_gadget_udc_stop(s + static inline void usb_gadget_udc_set_speed(struct usb_udc *udc, + enum usb_device_speed speed) + { +- if (udc->gadget->ops->udc_set_speed) +- udc->gadget->ops->udc_set_speed(udc->gadget, speed); ++ if (udc->gadget->ops->udc_set_speed) { ++ enum usb_device_speed s; ++ ++ s = min(speed, udc->gadget->max_speed); ++ udc->gadget->ops->udc_set_speed(udc->gadget, s); ++ } + } + + /** diff --git a/queue-4.14/usb-gadget-udc-renesas_usb3-fix-number-of-the-pipes.patch b/queue-4.14/usb-gadget-udc-renesas_usb3-fix-number-of-the-pipes.patch new file mode 100644 index 00000000000..416fb647b96 --- /dev/null +++ b/queue-4.14/usb-gadget-udc-renesas_usb3-fix-number-of-the-pipes.patch @@ -0,0 +1,35 @@ +From a58204ab91ad8cae4d8474aa0ba5d1fc504860c9 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Mon, 13 Nov 2017 17:59:18 +0900 +Subject: usb: gadget: udc: renesas_usb3: fix number of the pipes + +From: Yoshihiro Shimoda + +commit a58204ab91ad8cae4d8474aa0ba5d1fc504860c9 upstream. + +This controller on R-Car Gen3 has 6 pipes that included PIPE 0 for +control actually. But, the datasheet has error in writing as it has +31 pipes. (However, the previous code defined 30 pipes wrongly...) + +Anyway, this patch fixes it. + +Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/renesas_usb3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -254,7 +254,7 @@ + #define USB3_EP0_SS_MAX_PACKET_SIZE 512 + #define USB3_EP0_HSFS_MAX_PACKET_SIZE 64 + #define USB3_EP0_BUF_SIZE 8 +-#define USB3_MAX_NUM_PIPES 30 ++#define USB3_MAX_NUM_PIPES 6 /* This includes PIPE 0 */ + #define USB3_WAIT_US 3 + #define USB3_DMA_NUM_SETTING_AREA 4 + /* -- 2.47.3