From: Greg Kroah-Hartman Date: Fri, 27 Jun 2014 21:55:06 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.4.96~52 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6c0d4664bffed9eb4af6b9ffb903a862e7b3380e;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: usb-usb_wwan-fix-race-between-write-and-resume.patch usb-usb_wwan-fix-urb-leak-in-write-error-path.patch --- diff --git a/queue-3.4/series b/queue-3.4/series index f2818fc4ec8..08d28efe087 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -15,3 +15,5 @@ mm-vmscan-clear-kswapd-s-special-reclaim-powers-before-exiting.patch s390-lowcore-reserve-96-bytes-for-irb-in-lowcore.patch ext4-fix-wrong-assert-in-ext4_mb_normalize_request.patch matroxfb-perform-a-dummy-read-of-m_status.patch +usb-usb_wwan-fix-urb-leak-in-write-error-path.patch +usb-usb_wwan-fix-race-between-write-and-resume.patch diff --git a/queue-3.4/usb-usb_wwan-fix-race-between-write-and-resume.patch b/queue-3.4/usb-usb_wwan-fix-race-between-write-and-resume.patch new file mode 100644 index 00000000000..467ef7dfd3a --- /dev/null +++ b/queue-3.4/usb-usb_wwan-fix-race-between-write-and-resume.patch @@ -0,0 +1,63 @@ +From d9e93c08d8d985e5ef89436ebc9f4aad7e31559f Mon Sep 17 00:00:00 2001 +From: xiao jin +Date: Mon, 26 May 2014 19:23:14 +0200 +Subject: USB: usb_wwan: fix race between write and resume + +From: xiao jin + +commit d9e93c08d8d985e5ef89436ebc9f4aad7e31559f upstream. + +We find a race between write and resume. usb_wwan_resume run play_delayed() +and spin_unlock, but intfdata->suspended still is not set to zero. +At this time usb_wwan_write is called and anchor the urb to delay +list. Then resume keep running but the delayed urb have no chance +to be commit until next resume. If the time of next resume is far +away, tty will be blocked in tty_wait_until_sent during time. The +race also can lead to writes being reordered. + +This patch put play_Delayed and intfdata->suspended together in the +spinlock, it's to avoid the write race during resume. + +Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the +option driver") + +Signed-off-by: xiao jin +Signed-off-by: Zhang, Qi1 +Reviewed-by: David Cohen +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index 47ad7550c5a6..112693a4100b 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -660,17 +660,15 @@ int usb_wwan_resume(struct usb_serial *serial) + } + } + ++ spin_lock_irq(&intfdata->susp_lock); + for (i = 0; i < serial->num_ports; i++) { + /* walk all ports */ + port = serial->port[i]; + portdata = usb_get_serial_port_data(port); + + /* skip closed ports */ +- spin_lock_irq(&intfdata->susp_lock); +- if (!portdata || !portdata->opened) { +- spin_unlock_irq(&intfdata->susp_lock); ++ if (!portdata || !portdata->opened) + continue; +- } + + for (j = 0; j < N_IN_URB; j++) { + urb = portdata->in_urbs[j]; +@@ -683,9 +681,7 @@ int usb_wwan_resume(struct usb_serial *serial) + } + } + play_delayed(port); +- spin_unlock_irq(&intfdata->susp_lock); + } +- spin_lock_irq(&intfdata->susp_lock); + intfdata->suspended = 0; + spin_unlock_irq(&intfdata->susp_lock); + err_out: diff --git a/queue-3.4/usb-usb_wwan-fix-urb-leak-in-write-error-path.patch b/queue-3.4/usb-usb_wwan-fix-urb-leak-in-write-error-path.patch new file mode 100644 index 00000000000..cfe3f183eca --- /dev/null +++ b/queue-3.4/usb-usb_wwan-fix-urb-leak-in-write-error-path.patch @@ -0,0 +1,48 @@ +From db0904737947d509844e171c9863ecc5b4534005 Mon Sep 17 00:00:00 2001 +From: xiao jin +Date: Mon, 26 May 2014 19:23:13 +0200 +Subject: USB: usb_wwan: fix urb leak in write error path + +From: xiao jin + +commit db0904737947d509844e171c9863ecc5b4534005 upstream. + +When enable usb serial for modem data, sometimes the tty is blocked +in tty_wait_until_sent because portdata->out_busy always is set and +have no chance to be cleared. + +We find a bug in write error path. usb_wwan_write set portdata->out_busy +firstly, then try autopm async with error. No out urb submit and no +usb_wwan_outdat_callback to this write, portdata->out_busy can't be +cleared. + +This patch clear portdata->out_busy if usb_wwan_write try autopm async +with error. + +Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the +option driver") + +Signed-off-by: xiao jin +Signed-off-by: Zhang, Qi1 +Reviewed-by: David Cohen +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb_wwan.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -236,8 +236,10 @@ int usb_wwan_write(struct tty_struct *tt + usb_pipeendpoint(this_urb->pipe), i); + + err = usb_autopm_get_interface_async(port->serial->interface); +- if (err < 0) ++ if (err < 0) { ++ clear_bit(i, &portdata->out_busy); + break; ++ } + + /* send the data */ + memcpy(this_urb->transfer_buffer, buf, todo);