3.10-stable patches

added patches:
	usb-usb_wwan-fix-race-between-write-and-resume.patch
	usb-usb_wwan-fix-urb-leak-in-write-error-path.patch

diff --git a/queue-3.10/series b/queue-3.10/series
index a81ca22f3f5678c2b645a07a7fba1fe97e9a040e..094447a84700bfdfd001eec9b04ae46f4893b6bc 100644 (file)
--- a/queue-3.10/series
+++ b/queue-3.10/series
@@ -24,3 +24,5 @@ s390-lowcore-reserve-96-bytes-for-irb-in-lowcore.patch
 ext4-fix-zeroing-of-page-during-writeback.patch
 ext4-fix-wrong-assert-in-ext4_mb_normalize_request.patch
 matroxfb-perform-a-dummy-read-of-m_status.patch
+usb-usb_wwan-fix-urb-leak-in-write-error-path.patch
+usb-usb_wwan-fix-race-between-write-and-resume.patch

diff --git a/queue-3.10/usb-usb_wwan-fix-race-between-write-and-resume.patch b/queue-3.10/usb-usb_wwan-fix-race-between-write-and-resume.patch
new file mode 100644 (file)
index 0000000..6ea9191
--- /dev/null
+++ b/queue-3.10/usb-usb_wwan-fix-race-between-write-and-resume.patch
@@ -0,0 +1,65 @@
+From d9e93c08d8d985e5ef89436ebc9f4aad7e31559f Mon Sep 17 00:00:00 2001
+From: xiao jin <jin.xiao@intel.com>
+Date: Mon, 26 May 2014 19:23:14 +0200
+Subject: USB: usb_wwan: fix race between write and resume
+
+From: xiao jin <jin.xiao@intel.com>
+
+commit d9e93c08d8d985e5ef89436ebc9f4aad7e31559f upstream.
+
+We find a race between write and resume. usb_wwan_resume run play_delayed()
+and spin_unlock, but intfdata->suspended still is not set to zero.
+At this time usb_wwan_write is called and anchor the urb to delay
+list. Then resume keep running but the delayed urb have no chance
+to be commit until next resume. If the time of next resume is far
+away, tty will be blocked in tty_wait_until_sent during time. The
+race also can lead to writes being reordered.
+
+This patch put play_Delayed and intfdata->suspended together in the
+spinlock, it's to avoid the write race during resume.
+
+Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the
+option driver")
+
+Signed-off-by: xiao jin <jin.xiao@intel.com>
+Signed-off-by: Zhang, Qi1 <qi1.zhang@intel.com>
+Reviewed-by: David Cohen <david.a.cohen@linux.intel.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/usb_wwan.c |    8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -664,17 +664,15 @@ int usb_wwan_resume(struct usb_serial *s
+               }
+       }
+ 
++      spin_lock_irq(&intfdata->susp_lock);
+       for (i = 0; i < serial->num_ports; i++) {
+               /* walk all ports */
+               port = serial->port[i];
+               portdata = usb_get_serial_port_data(port);
+ 
+               /* skip closed ports */
+-              spin_lock_irq(&intfdata->susp_lock);
+-              if (!portdata || !portdata->opened) {
+-                      spin_unlock_irq(&intfdata->susp_lock);
++              if (!portdata || !portdata->opened)
+                       continue;
+-              }
+ 
+               for (j = 0; j < N_IN_URB; j++) {
+                       urb = portdata->in_urbs[j];
+@@ -687,9 +685,7 @@ int usb_wwan_resume(struct usb_serial *s
+                       }
+               }
+               play_delayed(port);
+-              spin_unlock_irq(&intfdata->susp_lock);
+       }
+-      spin_lock_irq(&intfdata->susp_lock);
+       intfdata->suspended = 0;
+       spin_unlock_irq(&intfdata->susp_lock);
+ err_out:

diff --git a/queue-3.10/usb-usb_wwan-fix-urb-leak-in-write-error-path.patch b/queue-3.10/usb-usb_wwan-fix-urb-leak-in-write-error-path.patch
new file mode 100644 (file)
index 0000000..37f60bf
--- /dev/null
+++ b/queue-3.10/usb-usb_wwan-fix-urb-leak-in-write-error-path.patch
@@ -0,0 +1,48 @@
+From db0904737947d509844e171c9863ecc5b4534005 Mon Sep 17 00:00:00 2001
+From: xiao jin <jin.xiao@intel.com>
+Date: Mon, 26 May 2014 19:23:13 +0200
+Subject: USB: usb_wwan: fix urb leak in write error path
+
+From: xiao jin <jin.xiao@intel.com>
+
+commit db0904737947d509844e171c9863ecc5b4534005 upstream.
+
+When enable usb serial for modem data, sometimes the tty is blocked
+in tty_wait_until_sent because portdata->out_busy always is set and
+have no chance to be cleared.
+
+We find a bug in write error path. usb_wwan_write set portdata->out_busy
+firstly, then try autopm async with error. No out urb submit and no
+usb_wwan_outdat_callback to this write, portdata->out_busy can't be
+cleared.
+
+This patch clear portdata->out_busy if usb_wwan_write try autopm async
+with error.
+
+Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the
+option driver")
+
+Signed-off-by: xiao jin <jin.xiao@intel.com>
+Signed-off-by: Zhang, Qi1 <qi1.zhang@intel.com>
+Reviewed-by: David Cohen <david.a.cohen@linux.intel.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/usb_wwan.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -228,8 +228,10 @@ int usb_wwan_write(struct tty_struct *tt
+                       usb_pipeendpoint(this_urb->pipe), i);
+ 
+               err = usb_autopm_get_interface_async(port->serial->interface);
+-              if (err < 0)
++              if (err < 0) {
++                      clear_bit(i, &portdata->out_busy);
+                       break;
++              }
+ 
+               /* send the data */
+               memcpy(this_urb->transfer_buffer, buf, todo);