From: Greg Kroah-Hartman Date: Fri, 27 Jun 2014 21:55:20 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.4.96~51 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8dec565dc0ea95963d2308465850140f48daa30e;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: usb-usb_wwan-fix-race-between-write-and-resume.patch usb-usb_wwan-fix-urb-leak-in-write-error-path.patch --- diff --git a/queue-3.10/series b/queue-3.10/series index a81ca22f3f5..094447a8470 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -24,3 +24,5 @@ s390-lowcore-reserve-96-bytes-for-irb-in-lowcore.patch ext4-fix-zeroing-of-page-during-writeback.patch ext4-fix-wrong-assert-in-ext4_mb_normalize_request.patch matroxfb-perform-a-dummy-read-of-m_status.patch +usb-usb_wwan-fix-urb-leak-in-write-error-path.patch +usb-usb_wwan-fix-race-between-write-and-resume.patch diff --git a/queue-3.10/usb-usb_wwan-fix-race-between-write-and-resume.patch b/queue-3.10/usb-usb_wwan-fix-race-between-write-and-resume.patch new file mode 100644 index 00000000000..6ea9191cdf7 --- /dev/null +++ b/queue-3.10/usb-usb_wwan-fix-race-between-write-and-resume.patch @@ -0,0 +1,65 @@ +From d9e93c08d8d985e5ef89436ebc9f4aad7e31559f Mon Sep 17 00:00:00 2001 +From: xiao jin +Date: Mon, 26 May 2014 19:23:14 +0200 +Subject: USB: usb_wwan: fix race between write and resume + +From: xiao jin + +commit d9e93c08d8d985e5ef89436ebc9f4aad7e31559f upstream. + +We find a race between write and resume. usb_wwan_resume run play_delayed() +and spin_unlock, but intfdata->suspended still is not set to zero. +At this time usb_wwan_write is called and anchor the urb to delay +list. Then resume keep running but the delayed urb have no chance +to be commit until next resume. If the time of next resume is far +away, tty will be blocked in tty_wait_until_sent during time. The +race also can lead to writes being reordered. + +This patch put play_Delayed and intfdata->suspended together in the +spinlock, it's to avoid the write race during resume. + +Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the +option driver") + +Signed-off-by: xiao jin +Signed-off-by: Zhang, Qi1 +Reviewed-by: David Cohen +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb_wwan.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -664,17 +664,15 @@ int usb_wwan_resume(struct usb_serial *s + } + } + ++ spin_lock_irq(&intfdata->susp_lock); + for (i = 0; i < serial->num_ports; i++) { + /* walk all ports */ + port = serial->port[i]; + portdata = usb_get_serial_port_data(port); + + /* skip closed ports */ +- spin_lock_irq(&intfdata->susp_lock); +- if (!portdata || !portdata->opened) { +- spin_unlock_irq(&intfdata->susp_lock); ++ if (!portdata || !portdata->opened) + continue; +- } + + for (j = 0; j < N_IN_URB; j++) { + urb = portdata->in_urbs[j]; +@@ -687,9 +685,7 @@ int usb_wwan_resume(struct usb_serial *s + } + } + play_delayed(port); +- spin_unlock_irq(&intfdata->susp_lock); + } +- spin_lock_irq(&intfdata->susp_lock); + intfdata->suspended = 0; + spin_unlock_irq(&intfdata->susp_lock); + err_out: diff --git a/queue-3.10/usb-usb_wwan-fix-urb-leak-in-write-error-path.patch b/queue-3.10/usb-usb_wwan-fix-urb-leak-in-write-error-path.patch new file mode 100644 index 00000000000..37f60bf708b --- /dev/null +++ b/queue-3.10/usb-usb_wwan-fix-urb-leak-in-write-error-path.patch @@ -0,0 +1,48 @@ +From db0904737947d509844e171c9863ecc5b4534005 Mon Sep 17 00:00:00 2001 +From: xiao jin +Date: Mon, 26 May 2014 19:23:13 +0200 +Subject: USB: usb_wwan: fix urb leak in write error path + +From: xiao jin + +commit db0904737947d509844e171c9863ecc5b4534005 upstream. + +When enable usb serial for modem data, sometimes the tty is blocked +in tty_wait_until_sent because portdata->out_busy always is set and +have no chance to be cleared. + +We find a bug in write error path. usb_wwan_write set portdata->out_busy +firstly, then try autopm async with error. No out urb submit and no +usb_wwan_outdat_callback to this write, portdata->out_busy can't be +cleared. + +This patch clear portdata->out_busy if usb_wwan_write try autopm async +with error. + +Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the +option driver") + +Signed-off-by: xiao jin +Signed-off-by: Zhang, Qi1 +Reviewed-by: David Cohen +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb_wwan.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -228,8 +228,10 @@ int usb_wwan_write(struct tty_struct *tt + usb_pipeendpoint(this_urb->pipe), i); + + err = usb_autopm_get_interface_async(port->serial->interface); +- if (err < 0) ++ if (err < 0) { ++ clear_bit(i, &portdata->out_busy); + break; ++ } + + /* send the data */ + memcpy(this_urb->transfer_buffer, buf, todo);