* Patch "USB: serial: io_ti: fix div-by-zero in set_termios" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:39 UTC (permalink / raw)
To: johan, gregkh; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
USB: serial: io_ti: fix div-by-zero in set_termios
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 6aeb75e6adfaed16e58780309613a578fe1ee90b Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 11 May 2017 11:41:21 +0200
Subject: USB: serial: io_ti: fix div-by-zero in set_termios
From: Johan Hovold <johan@kernel.org>
commit 6aeb75e6adfaed16e58780309613a578fe1ee90b upstream.
Fix a division-by-zero in set_termios when debugging is enabled and a
high-enough speed has been requested so that the divisor value becomes
zero.
Instead of just fixing the offending debug statement, cap the baud rate
at the base as a zero divisor value also appears to crash the firmware.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/io_ti.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2210,8 +2210,11 @@ static void change_port_settings(struct
if (!baud) {
/* pick a default, any default... */
baud = 9600;
- } else
+ } else {
+ /* Avoid a zero divisor. */
+ baud = min(baud, 461550);
tty_encode_baud_rate(tty, baud, baud);
+ }
edge_port->baud_rate = baud;
config->wBaudRate = (__u16)((461550L + baud/2) / baud);
Patches currently in stable-queue which might be from johan@kernel.org are
queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-3.18/usb-serial-option-add-telit-me910-support.patch
queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-3.18/of-fdt-add-missing-allocation-failure-check.patch
queue-3.18/usbvision-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-3.18/mceusb-fix-null-deref-at-probe.patch
queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch
^ permalink raw reply
* Patch "usb: musb: tusb6010_omap: Do not reset the other direction's packet size" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:39 UTC (permalink / raw)
To: peter.ujfalusi, b-liu, gregkh, tony; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: musb: tusb6010_omap: Do not reset the other direction's packet size
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-musb-tusb6010_omap-do-not-reset-the-other-direction-s-packet-size.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 6df2b42f7c040d57d9ecb67244e04e905ab87ac6 Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
Date: Wed, 17 May 2017 11:23:11 -0500
Subject: usb: musb: tusb6010_omap: Do not reset the other direction's packet size
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit 6df2b42f7c040d57d9ecb67244e04e905ab87ac6 upstream.
We have one register for each EP to set the maximum packet size for both
TX and RX.
If for example an RX programming would happen before the previous TX
transfer finishes we would reset the TX packet side.
To fix this issue, only modify the TX or RX part of the register.
Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/musb/tusb6010_omap.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -220,6 +220,7 @@ static int tusb_omap_dma_program(struct
u32 dma_remaining;
int src_burst, dst_burst;
u16 csr;
+ u32 psize;
int ch;
s8 dmareq;
s8 sync_dev;
@@ -391,15 +392,19 @@ static int tusb_omap_dma_program(struct
if (chdat->tx) {
/* Send transfer_packet_sz packets at a time */
- musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
- chdat->transfer_packet_sz);
+ psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+ psize &= ~0x7ff;
+ psize |= chdat->transfer_packet_sz;
+ musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
musb_writel(ep_conf, TUSB_EP_TX_OFFSET,
TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
} else {
/* Receive transfer_packet_sz packets at a time */
- musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
- chdat->transfer_packet_sz << 16);
+ psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+ psize &= ~(0x7ff << 16);
+ psize |= (chdat->transfer_packet_sz << 16);
+ musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
musb_writel(ep_conf, TUSB_EP_RX_OFFSET,
TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
Patches currently in stable-queue which might be from peter.ujfalusi@ti.com are
queue-3.18/usb-musb-tusb6010_omap-do-not-reset-the-other-direction-s-packet-size.patch
^ permalink raw reply
* Patch "USB: hub: fix non-SS hub-descriptor handling" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:39 UTC (permalink / raw)
To: johan, gregkh, stern; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
USB: hub: fix non-SS hub-descriptor handling
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-hub-fix-non-ss-hub-descriptor-handling.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From bec444cd1c94c48df409a35ad4e5b143c245c3f7 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 10 May 2017 18:18:28 +0200
Subject: USB: hub: fix non-SS hub-descriptor handling
From: Johan Hovold <johan@kernel.org>
commit bec444cd1c94c48df409a35ad4e5b143c245c3f7 upstream.
Add missing sanity check on the non-SuperSpeed hub-descriptor length in
order to avoid parsing and leaking two bytes of uninitialised slab data
through sysfs removable-attributes (or a compound-device debug
statement).
Note that we only make sure that the DeviceRemovable field is always
present (and specifically ignore the unused PortPwrCtrlMask field) in
order to continue support any hubs with non-compliant descriptors. As a
further safeguard, the descriptor buffer is also cleared.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -359,7 +359,8 @@ static void usb_set_lpm_parameters(struc
}
/* USB 2.0 spec Section 11.24.4.5 */
-static int get_hub_descriptor(struct usb_device *hdev, void *data)
+static int get_hub_descriptor(struct usb_device *hdev,
+ struct usb_hub_descriptor *desc)
{
int i, ret, size;
unsigned dtype;
@@ -375,12 +376,16 @@ static int get_hub_descriptor(struct usb
for (i = 0; i < 3; i++) {
ret = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
- dtype << 8, 0, data, size,
+ dtype << 8, 0, desc, size,
USB_CTRL_GET_TIMEOUT);
if (hub_is_superspeed(hdev)) {
if (ret == size)
return ret;
- } else if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2)) {
+ } else if (ret >= USB_DT_HUB_NONVAR_SIZE + 2) {
+ /* Make sure we have the DeviceRemovable field. */
+ size = USB_DT_HUB_NONVAR_SIZE + desc->bNbrPorts / 8 + 1;
+ if (ret < size)
+ return -EMSGSIZE;
return ret;
}
}
@@ -1327,7 +1332,7 @@ static int hub_configure(struct usb_hub
}
mutex_init(&hub->status_mutex);
- hub->descriptor = kmalloc(sizeof(*hub->descriptor), GFP_KERNEL);
+ hub->descriptor = kzalloc(sizeof(*hub->descriptor), GFP_KERNEL);
if (!hub->descriptor) {
ret = -ENOMEM;
goto fail;
Patches currently in stable-queue which might be from johan@kernel.org are
queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-3.18/usb-serial-option-add-telit-me910-support.patch
queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-3.18/of-fdt-add-missing-allocation-failure-check.patch
queue-3.18/usbvision-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-3.18/mceusb-fix-null-deref-at-probe.patch
queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch
^ permalink raw reply
* Patch "USB: iowarrior: fix info ioctl on big-endian hosts" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:39 UTC (permalink / raw)
To: johan, gregkh; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
USB: iowarrior: fix info ioctl on big-endian hosts
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From dd5ca753fa92fb736b1395db892bd29f78e6d408 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 11 May 2017 11:36:02 +0200
Subject: USB: iowarrior: fix info ioctl on big-endian hosts
From: Johan Hovold <johan@kernel.org>
commit dd5ca753fa92fb736b1395db892bd29f78e6d408 upstream.
Drop erroneous le16_to_cpu when returning the USB device speed which is
already in host byte order.
Found using sparse:
warning: cast to restricted __le16
Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/iowarrior.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -557,7 +557,7 @@ static long iowarrior_ioctl(struct file
info.revision = le16_to_cpu(dev->udev->descriptor.bcdDevice);
/* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */
- info.speed = le16_to_cpu(dev->udev->speed);
+ info.speed = dev->udev->speed;
info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber;
info.report_size = dev->report_size;
Patches currently in stable-queue which might be from johan@kernel.org are
queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-3.18/usb-serial-option-add-telit-me910-support.patch
queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-3.18/of-fdt-add-missing-allocation-failure-check.patch
queue-3.18/usbvision-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-3.18/mceusb-fix-null-deref-at-probe.patch
queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch
^ permalink raw reply
* Patch "USB: hub: fix SS hub-descriptor handling" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:39 UTC (permalink / raw)
To: johan, John.Youn, gregkh, stern; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
USB: hub: fix SS hub-descriptor handling
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-hub-fix-ss-hub-descriptor-handling.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 2c25a2c818023df64463aac3288a9f969491e507 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 10 May 2017 18:18:27 +0200
Subject: USB: hub: fix SS hub-descriptor handling
From: Johan Hovold <johan@kernel.org>
commit 2c25a2c818023df64463aac3288a9f969491e507 upstream.
A SuperSpeed hub descriptor does not have any variable-length fields so
bail out when reading a short descriptor.
This avoids parsing and leaking two bytes of uninitialised slab data
through sysfs removable-attributes.
Fixes: dbe79bbe9dcb ("USB 3.0 Hub Changes")
Cc: John Youn <John.Youn@synopsys.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -377,8 +377,12 @@ static int get_hub_descriptor(struct usb
USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
dtype << 8, 0, data, size,
USB_CTRL_GET_TIMEOUT);
- if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2))
+ if (hub_is_superspeed(hdev)) {
+ if (ret == size)
+ return ret;
+ } else if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2)) {
return ret;
+ }
}
return -EINVAL;
}
@@ -1331,7 +1335,7 @@ static int hub_configure(struct usb_hub
/* Request the entire hub descriptor.
* hub->descriptor can handle USB_MAXCHILDREN ports,
- * but the hub can/will return fewer bytes here.
+ * but a (non-SS) hub can/will return fewer bytes here.
*/
ret = get_hub_descriptor(hdev, hub->descriptor);
if (ret < 0) {
Patches currently in stable-queue which might be from johan@kernel.org are
queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-3.18/usb-serial-option-add-telit-me910-support.patch
queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-3.18/of-fdt-add-missing-allocation-failure-check.patch
queue-3.18/usbvision-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-3.18/mceusb-fix-null-deref-at-probe.patch
queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch
^ permalink raw reply
* Patch "tty: Prevent ldisc drivers from re-using stale tty fields" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:39 UTC (permalink / raw)
To: peter, amit.pundir, gregkh, sasha.levin, tilman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
tty: Prevent ldisc drivers from re-using stale tty fields
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
tty-prevent-ldisc-drivers-from-re-using-stale-tty-fields.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From dd42bf1197144ede075a9d4793123f7689e164bc Mon Sep 17 00:00:00 2001
From: Peter Hurley <peter@hurleysoftware.com>
Date: Fri, 27 Nov 2015 14:30:21 -0500
Subject: tty: Prevent ldisc drivers from re-using stale tty fields
From: Peter Hurley <peter@hurleysoftware.com>
commit dd42bf1197144ede075a9d4793123f7689e164bc upstream.
Line discipline drivers may mistakenly misuse ldisc-related fields
when initializing. For example, a failure to initialize tty->receive_room
in the N_GIGASET_M101 line discipline was recently found and fixed [1].
Now, the N_X25 line discipline has been discovered accessing the previous
line discipline's already-freed private data [2].
Harden the ldisc interface against misuse by initializing revelant
tty fields before instancing the new line discipline.
[1]
commit fd98e9419d8d622a4de91f76b306af6aa627aa9c
Author: Tilman Schmidt <tilman@imap.cc>
Date: Tue Jul 14 00:37:13 2015 +0200
isdn/gigaset: reset tty->receive_room when attaching ser_gigaset
[2] Report from Sasha Levin <sasha.levin@oracle.com>
[ 634.336761] ==================================================================
[ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
[ 634.339558] Read of size 4 by task syzkaller_execu/8981
[ 634.340359] =============================================================================
[ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
...
[ 634.405018] Call Trace:
[ 634.405277] dump_stack (lib/dump_stack.c:52)
[ 634.405775] print_trailer (mm/slub.c:655)
[ 634.406361] object_err (mm/slub.c:662)
[ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
[ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
[ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
[ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
[ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
[ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
[ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
[ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
[ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
Cc: Tilman Schmidt <tilman@imap.cc>
Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/tty_ldisc.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -414,6 +414,10 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush);
* they are not on hot paths so a little discipline won't do
* any harm.
*
+ * The line discipline-related tty_struct fields are reset to
+ * prevent the ldisc driver from re-using stale information for
+ * the new ldisc instance.
+ *
* Locking: takes termios_rwsem
*/
@@ -422,6 +426,9 @@ static void tty_set_termios_ldisc(struct
down_write(&tty->termios_rwsem);
tty->termios.c_line = num;
up_write(&tty->termios_rwsem);
+
+ tty->disc_data = NULL;
+ tty->receive_room = 0;
}
/**
Patches currently in stable-queue which might be from peter@hurleysoftware.com are
queue-3.18/tty-prevent-ldisc-drivers-from-re-using-stale-tty-fields.patch
^ permalink raw reply
* Patch "net: irda: irda-usb: fix firmware name on big-endian hosts" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:39 UTC (permalink / raw)
To: johan, davem, gregkh, nfedchik; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
net: irda: irda-usb: fix firmware name on big-endian hosts
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 75cf067953d5ee543b3bda90bbfcbee5e1f94ae8 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 12 May 2017 12:11:13 +0200
Subject: net: irda: irda-usb: fix firmware name on big-endian hosts
From: Johan Hovold <johan@kernel.org>
commit 75cf067953d5ee543b3bda90bbfcbee5e1f94ae8 upstream.
Add missing endianness conversion when using the USB device-descriptor
bcdDevice field to construct a firmware file name.
Fixes: 8ef80aef118e ("[IRDA]: irda-usb.c: STIR421x cleanups")
Cc: Nick Fedchik <nfedchik@atlantic-link.com.ua>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/irda/irda-usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1082,7 +1082,7 @@ static int stir421x_patch_device(struct
* are "42101001.sb" or "42101002.sb"
*/
sprintf(stir421x_fw_name, "4210%4X.sb",
- self->usbdev->descriptor.bcdDevice);
+ le16_to_cpu(self->usbdev->descriptor.bcdDevice));
ret = request_firmware(&fw, stir421x_fw_name, &self->usbdev->dev);
if (ret < 0)
return ret;
Patches currently in stable-queue which might be from johan@kernel.org are
queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-3.18/usb-serial-option-add-telit-me910-support.patch
queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-3.18/of-fdt-add-missing-allocation-failure-check.patch
queue-3.18/usbvision-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-3.18/mceusb-fix-null-deref-at-probe.patch
queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch
^ permalink raw reply
* Patch "[media] ttusb2: limit messages to buffer size" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:39 UTC (permalink / raw)
To: amilburn, gregkh, mchehab; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] ttusb2: limit messages to buffer size
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ttusb2-limit-messages-to-buffer-size.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From a12b8ab8c5ff7ccd7b107a564743507c850a441d Mon Sep 17 00:00:00 2001
From: Alyssa Milburn <amilburn@zall.org>
Date: Sat, 1 Apr 2017 14:34:32 -0300
Subject: [media] ttusb2: limit messages to buffer size
From: Alyssa Milburn <amilburn@zall.org>
commit a12b8ab8c5ff7ccd7b107a564743507c850a441d upstream.
Otherwise ttusb2_i2c_xfer can read or write beyond the end of static and
heap buffers.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb/ttusb2.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/drivers/media/usb/dvb-usb/ttusb2.c
+++ b/drivers/media/usb/dvb-usb/ttusb2.c
@@ -78,6 +78,9 @@ static int ttusb2_msg(struct dvb_usb_dev
u8 *s, *r = NULL;
int ret = 0;
+ if (4 + rlen > 64)
+ return -EIO;
+
s = kzalloc(wlen+4, GFP_KERNEL);
if (!s)
return -ENOMEM;
@@ -381,6 +384,22 @@ static int ttusb2_i2c_xfer(struct i2c_ad
write_read = i+1 < num && (msg[i+1].flags & I2C_M_RD);
read = msg[i].flags & I2C_M_RD;
+ if (3 + msg[i].len > sizeof(obuf)) {
+ err("i2c wr len=%d too high", msg[i].len);
+ break;
+ }
+ if (write_read) {
+ if (3 + msg[i+1].len > sizeof(ibuf)) {
+ err("i2c rd len=%d too high", msg[i+1].len);
+ break;
+ }
+ } else if (read) {
+ if (3 + msg[i].len > sizeof(ibuf)) {
+ err("i2c rd len=%d too high", msg[i].len);
+ break;
+ }
+ }
+
obuf[0] = (msg[i].addr << 1) | (write_read | read);
if (read)
obuf[1] = 0;
Patches currently in stable-queue which might be from amilburn@zall.org are
queue-3.18/ttusb2-limit-messages-to-buffer-size.patch
^ permalink raw reply
* Patch "[media] mceusb: fix NULL-deref at probe" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:39 UTC (permalink / raw)
To: johan, gregkh, mchehab, sean; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] mceusb: fix NULL-deref at probe
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
mceusb-fix-null-deref-at-probe.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 03eb2a557ed552e920a0942b774aaf931596eec1 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 7 Mar 2017 15:14:13 -0300
Subject: [media] mceusb: fix NULL-deref at probe
From: Johan Hovold <johan@kernel.org>
commit 03eb2a557ed552e920a0942b774aaf931596eec1 upstream.
Make sure to check for the required out endpoint to avoid dereferencing
a NULL-pointer in mce_request_packet should a malicious device lack such
an endpoint. Note that this path is hit during probe.
Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/mceusb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -1321,8 +1321,8 @@ static int mceusb_dev_probe(struct usb_i
}
}
}
- if (ep_in == NULL) {
- dev_dbg(&intf->dev, "inbound and/or endpoint not found");
+ if (!ep_in || !ep_out) {
+ dev_dbg(&intf->dev, "required endpoints not found\n");
return -ENODEV;
}
Patches currently in stable-queue which might be from johan@kernel.org are
queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-3.18/usb-serial-option-add-telit-me910-support.patch
queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-3.18/of-fdt-add-missing-allocation-failure-check.patch
queue-3.18/usbvision-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-3.18/mceusb-fix-null-deref-at-probe.patch
queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch
^ permalink raw reply
* FAILED: patch "[PATCH] [media] dvb-usb-firmware: don't do DMA on stack" failed to apply to 4.11-stable tree
From: gregkh @ 2017-05-23 12:33 UTC (permalink / raw)
To: stefan.bruens, mchehab; +Cc: stable
The patch below does not apply to the 4.11-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f9fa0f2bebaa629aff839b7b992298b1fce453d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stefan=20Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
Date: Sun, 12 Feb 2017 13:02:13 -0200
Subject: [PATCH] [media] dvb-usb-firmware: don't do DMA on stack
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The buffer allocation for the firmware data was changed in
commit 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
but the same applies for the reset value.
Fixes: 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
index ab9866024ec7..04033efe7ad5 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
@@ -36,16 +36,18 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
{
struct hexline *hx;
- u8 reset;
- int ret,pos=0;
+ u8 *buf;
+ int ret, pos = 0;
+ u16 cpu_cs_register = cypress[type].cpu_cs_register;
- hx = kmalloc(sizeof(*hx), GFP_KERNEL);
- if (!hx)
+ buf = kmalloc(sizeof(*hx), GFP_KERNEL);
+ if (!buf)
return -ENOMEM;
+ hx = (struct hexline *)buf;
/* stop the CPU */
- reset = 1;
- if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
+ buf[0] = 1;
+ if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)
err("could not stop the USB controller CPU.");
while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
@@ -61,21 +63,21 @@ int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw
}
if (ret < 0) {
err("firmware download failed at %d with %d",pos,ret);
- kfree(hx);
+ kfree(buf);
return ret;
}
if (ret == 0) {
/* restart the CPU */
- reset = 0;
- if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
+ buf[0] = 0;
+ if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {
err("could not restart the USB controller CPU.");
ret = -EINVAL;
}
} else
ret = -EIO;
- kfree(hx);
+ kfree(buf);
return ret;
}
^ permalink raw reply related
* Patch "xhci: remove GFP_DMA flag from allocation" has been added to the 4.9-stable tree
From: gregkh @ 2017-05-23 12:15 UTC (permalink / raw)
To: matthias.lange, gregkh, mathias.nyman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
xhci: remove GFP_DMA flag from allocation
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xhci-remove-gfp_dma-flag-from-allocation.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 5db851cf20857c5504b146046e97cb7781f2a743 Mon Sep 17 00:00:00 2001
From: Matthias Lange <matthias.lange@kernkonzept.com>
Date: Wed, 17 May 2017 18:32:04 +0300
Subject: xhci: remove GFP_DMA flag from allocation
From: Matthias Lange <matthias.lange@kernkonzept.com>
commit 5db851cf20857c5504b146046e97cb7781f2a743 upstream.
There is no reason to restrict allocations to the first 16MB ISA DMA
addresses.
It is causing problems in a virtualization setup with enabled IOMMU
(x86_64). The result is that USB is not working in the VM.
Signed-off-by: Matthias Lange <matthias.lange@kernkonzept.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -56,7 +56,7 @@ static struct xhci_segment *xhci_segment
}
if (max_packet) {
- seg->bounce_buf = kzalloc(max_packet, flags | GFP_DMA);
+ seg->bounce_buf = kzalloc(max_packet, flags);
if (!seg->bounce_buf) {
dma_pool_free(xhci->segment_pool, seg->trbs, dma);
kfree(seg);
Patches currently in stable-queue which might be from matthias.lange@kernkonzept.com are
queue-4.9/xhci-remove-gfp_dma-flag-from-allocation.patch
^ permalink raw reply
* Patch "usb: host: xhci-plat: propagate return value of platform_get_irq()" has been added to the 4.9-stable tree
From: gregkh @ 2017-05-23 12:15 UTC (permalink / raw)
To: thomas.petazzoni, gregkh, mathias.nyman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: host: xhci-plat: propagate return value of platform_get_irq()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 4b148d5144d64ee135b8924350cb0b3a7fd21150 Mon Sep 17 00:00:00 2001
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Date: Wed, 17 May 2017 18:32:06 +0300
Subject: usb: host: xhci-plat: propagate return value of platform_get_irq()
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit 4b148d5144d64ee135b8924350cb0b3a7fd21150 upstream.
platform_get_irq() returns an error code, but the xhci-plat driver
ignores it and always returns -ENODEV. This is not correct, and
prevents -EPROBE_DEFER from being propagated properly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-plat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -153,7 +153,7 @@ static int xhci_plat_probe(struct platfo
irq = platform_get_irq(pdev, 0);
if (irq < 0)
- return -ENODEV;
+ return irq;
/* Try to set 64-bit DMA first */
if (WARN_ON(!pdev->dev.dma_mask))
Patches currently in stable-queue which might be from thomas.petazzoni@free-electrons.com are
queue-4.9/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
^ permalink raw reply
* Patch "xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton" has been added to the 4.9-stable tree
From: gregkh @ 2017-05-23 12:15 UTC (permalink / raw)
To: mathias.nyman, gregkh; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From a0c16630d35a874e82bdf2088f58ecaca1024315 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Wed, 17 May 2017 18:32:00 +0300
Subject: xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit a0c16630d35a874e82bdf2088f58ecaca1024315 upstream.
Intel Denverton microserver is Atom based and need the PME and CAS quirks
as well.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -52,6 +52,7 @@
#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8
#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8
#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8
+#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0
static const char hcd_name[] = "xhci_hcd";
@@ -166,7 +167,8 @@ static void xhci_pci_quirks(struct devic
pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) {
+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) {
xhci->quirks |= XHCI_PME_STUCK_QUIRK;
}
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
@@ -175,7 +177,8 @@ static void xhci_pci_quirks(struct devic
}
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
(pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI))
xhci->quirks |= XHCI_MISSING_CAS;
if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Patches currently in stable-queue which might be from mathias.nyman@linux.intel.com are
queue-4.9/xhci-remove-gfp_dma-flag-from-allocation.patch
queue-4.9/xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch
queue-4.9/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
queue-4.9/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
^ permalink raw reply
* Patch "usb: host: xhci-mem: allocate zeroed Scratchpad Buffer" has been added to the 4.9-stable tree
From: gregkh @ 2017-05-23 12:15 UTC (permalink / raw)
To: peter.chen, gregkh, mathias.nyman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 7480d912d549f414e0ce39331870899e89a5598c Mon Sep 17 00:00:00 2001
From: Peter Chen <peter.chen@nxp.com>
Date: Wed, 17 May 2017 18:32:01 +0300
Subject: usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
From: Peter Chen <peter.chen@nxp.com>
commit 7480d912d549f414e0ce39331870899e89a5598c upstream.
According to xHCI ch4.20 Scratchpad Buffers, the Scratchpad
Buffer needs to be zeroed.
...
The following operations take place to allocate
Scratchpad Buffers to the xHC:
...
b. Software clears the Scratchpad Buffer to '0'
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1721,7 +1721,7 @@ static int scratchpad_alloc(struct xhci_
xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma);
for (i = 0; i < num_sp; i++) {
dma_addr_t dma;
- void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma,
+ void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma,
flags);
if (!buf)
goto fail_sp5;
Patches currently in stable-queue which might be from peter.chen@nxp.com are
queue-4.9/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
^ permalink raw reply
* Patch "xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton" has been added to the 4.4-stable tree
From: gregkh @ 2017-05-23 12:15 UTC (permalink / raw)
To: mathias.nyman, gregkh; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From a0c16630d35a874e82bdf2088f58ecaca1024315 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Wed, 17 May 2017 18:32:00 +0300
Subject: xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit a0c16630d35a874e82bdf2088f58ecaca1024315 upstream.
Intel Denverton microserver is Atom based and need the PME and CAS quirks
as well.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -52,6 +52,7 @@
#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8
#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8
#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8
+#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0
static const char hcd_name[] = "xhci_hcd";
@@ -167,12 +168,14 @@ static void xhci_pci_quirks(struct devic
pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) {
+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) {
xhci->quirks |= XHCI_PME_STUCK_QUIRK;
}
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
(pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI))
xhci->quirks |= XHCI_MISSING_CAS;
if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Patches currently in stable-queue which might be from mathias.nyman@linux.intel.com are
queue-4.4/xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch
queue-4.4/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
queue-4.4/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
^ permalink raw reply
* Patch "usb: host: xhci-plat: propagate return value of platform_get_irq()" has been added to the 4.4-stable tree
From: gregkh @ 2017-05-23 12:15 UTC (permalink / raw)
To: thomas.petazzoni, gregkh, mathias.nyman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: host: xhci-plat: propagate return value of platform_get_irq()
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 4b148d5144d64ee135b8924350cb0b3a7fd21150 Mon Sep 17 00:00:00 2001
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Date: Wed, 17 May 2017 18:32:06 +0300
Subject: usb: host: xhci-plat: propagate return value of platform_get_irq()
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit 4b148d5144d64ee135b8924350cb0b3a7fd21150 upstream.
platform_get_irq() returns an error code, but the xhci-plat driver
ignores it and always returns -ENODEV. This is not correct, and
prevents -EPROBE_DEFER from being propagated properly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-plat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -92,7 +92,7 @@ static int xhci_plat_probe(struct platfo
irq = platform_get_irq(pdev, 0);
if (irq < 0)
- return -ENODEV;
+ return irq;
/* Try to set 64-bit DMA first */
if (WARN_ON(!pdev->dev.dma_mask))
Patches currently in stable-queue which might be from thomas.petazzoni@free-electrons.com are
queue-4.4/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
^ permalink raw reply
* Patch "usb: host: xhci-mem: allocate zeroed Scratchpad Buffer" has been added to the 4.4-stable tree
From: gregkh @ 2017-05-23 12:15 UTC (permalink / raw)
To: peter.chen, gregkh, mathias.nyman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 7480d912d549f414e0ce39331870899e89a5598c Mon Sep 17 00:00:00 2001
From: Peter Chen <peter.chen@nxp.com>
Date: Wed, 17 May 2017 18:32:01 +0300
Subject: usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
From: Peter Chen <peter.chen@nxp.com>
commit 7480d912d549f414e0ce39331870899e89a5598c upstream.
According to xHCI ch4.20 Scratchpad Buffers, the Scratchpad
Buffer needs to be zeroed.
...
The following operations take place to allocate
Scratchpad Buffers to the xHC:
...
b. Software clears the Scratchpad Buffer to '0'
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1709,7 +1709,7 @@ static int scratchpad_alloc(struct xhci_
xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma);
for (i = 0; i < num_sp; i++) {
dma_addr_t dma;
- void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma,
+ void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma,
flags);
if (!buf)
goto fail_sp5;
Patches currently in stable-queue which might be from peter.chen@nxp.com are
queue-4.4/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
^ permalink raw reply
* Patch "xhci: remove GFP_DMA flag from allocation" has been added to the 4.11-stable tree
From: gregkh @ 2017-05-23 12:14 UTC (permalink / raw)
To: matthias.lange, gregkh, mathias.nyman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
xhci: remove GFP_DMA flag from allocation
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xhci-remove-gfp_dma-flag-from-allocation.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 5db851cf20857c5504b146046e97cb7781f2a743 Mon Sep 17 00:00:00 2001
From: Matthias Lange <matthias.lange@kernkonzept.com>
Date: Wed, 17 May 2017 18:32:04 +0300
Subject: xhci: remove GFP_DMA flag from allocation
From: Matthias Lange <matthias.lange@kernkonzept.com>
commit 5db851cf20857c5504b146046e97cb7781f2a743 upstream.
There is no reason to restrict allocations to the first 16MB ISA DMA
addresses.
It is causing problems in a virtualization setup with enabled IOMMU
(x86_64). The result is that USB is not working in the VM.
Signed-off-by: Matthias Lange <matthias.lange@kernkonzept.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -56,7 +56,7 @@ static struct xhci_segment *xhci_segment
}
if (max_packet) {
- seg->bounce_buf = kzalloc(max_packet, flags | GFP_DMA);
+ seg->bounce_buf = kzalloc(max_packet, flags);
if (!seg->bounce_buf) {
dma_pool_free(xhci->segment_pool, seg->trbs, dma);
kfree(seg);
Patches currently in stable-queue which might be from matthias.lange@kernkonzept.com are
queue-4.11/xhci-remove-gfp_dma-flag-from-allocation.patch
^ permalink raw reply
* Patch "xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton" has been added to the 4.11-stable tree
From: gregkh @ 2017-05-23 12:14 UTC (permalink / raw)
To: mathias.nyman, gregkh; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From a0c16630d35a874e82bdf2088f58ecaca1024315 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Wed, 17 May 2017 18:32:00 +0300
Subject: xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit a0c16630d35a874e82bdf2088f58ecaca1024315 upstream.
Intel Denverton microserver is Atom based and need the PME and CAS quirks
as well.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -52,6 +52,7 @@
#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8
#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8
#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8
+#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0
static const char hcd_name[] = "xhci_hcd";
@@ -166,7 +167,8 @@ static void xhci_pci_quirks(struct devic
pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) {
+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) {
xhci->quirks |= XHCI_PME_STUCK_QUIRK;
}
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
@@ -175,7 +177,8 @@ static void xhci_pci_quirks(struct devic
}
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
(pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI))
xhci->quirks |= XHCI_MISSING_CAS;
if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Patches currently in stable-queue which might be from mathias.nyman@linux.intel.com are
queue-4.11/xhci-remove-gfp_dma-flag-from-allocation.patch
queue-4.11/xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch
queue-4.11/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
queue-4.11/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
queue-4.11/xhci-fix-command-ring-stop-regression-in-4.11.patch
queue-4.11/usb-xhci-fix-lock-inversion-problem.patch
^ permalink raw reply
* Patch "xhci: Fix command ring stop regression in 4.11" has been added to the 4.11-stable tree
From: gregkh @ 2017-05-23 12:14 UTC (permalink / raw)
To: mathias.nyman, gregkh; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
xhci: Fix command ring stop regression in 4.11
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xhci-fix-command-ring-stop-regression-in-4.11.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 604d02a2a66ab7f93fd3b2bde3698c29ef057b65 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Wed, 17 May 2017 18:32:05 +0300
Subject: xhci: Fix command ring stop regression in 4.11
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit 604d02a2a66ab7f93fd3b2bde3698c29ef057b65 upstream.
In 4.11 TRB completion codes were renamed to match spec.
Completion codes for command ring stopped and endpoint stopped
were mixed, leading to failures while handling a stopped command ring.
Use the correct completion code for command ring stopped events.
Fixes: 0b7c105a04ca ("usb: host: xhci: rename completion codes to match spec")
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-hub.c | 2 +-
drivers/usb/host/xhci-ring.c | 8 ++++----
drivers/usb/host/xhci.c | 8 ++++----
3 files changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -421,7 +421,7 @@ static int xhci_stop_device(struct xhci_
wait_for_completion(cmd->completion);
if (cmd->status == COMP_COMMAND_ABORTED ||
- cmd->status == COMP_STOPPED) {
+ cmd->status == COMP_COMMAND_RING_STOPPED) {
xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n");
ret = -ETIME;
}
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -321,7 +321,7 @@ static void xhci_handle_stopped_cmd_ring
if (i_cmd->status != COMP_COMMAND_ABORTED)
continue;
- i_cmd->status = COMP_STOPPED;
+ i_cmd->status = COMP_COMMAND_RING_STOPPED;
xhci_dbg(xhci, "Turn aborted command %p to no-op\n",
i_cmd->command_trb);
@@ -1342,7 +1342,7 @@ static void handle_cmd_completion(struct
cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
/* If CMD ring stopped we own the trbs between enqueue and dequeue */
- if (cmd_comp_code == COMP_STOPPED) {
+ if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) {
complete_all(&xhci->cmd_ring_stop_completion);
return;
}
@@ -1397,8 +1397,8 @@ static void handle_cmd_completion(struct
break;
case TRB_CMD_NOOP:
/* Is this an aborted command turned to NO-OP? */
- if (cmd->status == COMP_STOPPED)
- cmd_comp_code = COMP_STOPPED;
+ if (cmd->status == COMP_COMMAND_RING_STOPPED)
+ cmd_comp_code = COMP_COMMAND_RING_STOPPED;
break;
case TRB_RESET_EP:
WARN_ON(slot_id != TRB_TO_SLOT_ID(
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1805,7 +1805,7 @@ static int xhci_configure_endpoint_resul
switch (*cmd_status) {
case COMP_COMMAND_ABORTED:
- case COMP_STOPPED:
+ case COMP_COMMAND_RING_STOPPED:
xhci_warn(xhci, "Timeout while waiting for configure endpoint command\n");
ret = -ETIME;
break;
@@ -1856,7 +1856,7 @@ static int xhci_evaluate_context_result(
switch (*cmd_status) {
case COMP_COMMAND_ABORTED:
- case COMP_STOPPED:
+ case COMP_COMMAND_RING_STOPPED:
xhci_warn(xhci, "Timeout while waiting for evaluate context command\n");
ret = -ETIME;
break;
@@ -3478,7 +3478,7 @@ int xhci_discover_or_reset_device(struct
ret = reset_device_cmd->status;
switch (ret) {
case COMP_COMMAND_ABORTED:
- case COMP_STOPPED:
+ case COMP_COMMAND_RING_STOPPED:
xhci_warn(xhci, "Timeout waiting for reset device command\n");
ret = -ETIME;
goto command_cleanup;
@@ -3845,7 +3845,7 @@ static int xhci_setup_device(struct usb_
*/
switch (command->status) {
case COMP_COMMAND_ABORTED:
- case COMP_STOPPED:
+ case COMP_COMMAND_RING_STOPPED:
xhci_warn(xhci, "Timeout while waiting for setup device command\n");
ret = -ETIME;
break;
Patches currently in stable-queue which might be from mathias.nyman@linux.intel.com are
queue-4.11/xhci-remove-gfp_dma-flag-from-allocation.patch
queue-4.11/xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch
queue-4.11/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
queue-4.11/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
queue-4.11/xhci-fix-command-ring-stop-regression-in-4.11.patch
queue-4.11/usb-xhci-fix-lock-inversion-problem.patch
^ permalink raw reply
* Patch "USB: xhci: fix lock-inversion problem" has been added to the 4.11-stable tree
From: gregkh @ 2017-05-23 12:14 UTC (permalink / raw)
To: stern; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
USB: xhci: fix lock-inversion problem
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-xhci-fix-lock-inversion-problem.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 63aea0dbab90a2461faaae357cbc8cfd6c8de9fe Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Wed, 17 May 2017 18:32:03 +0300
Subject: USB: xhci: fix lock-inversion problem
From: Alan Stern <stern@rowland.harvard.edu>
commit 63aea0dbab90a2461faaae357cbc8cfd6c8de9fe upstream.
With threaded interrupts, bottom-half handlers are called with
interrupts enabled. Therefore they can't safely use spin_lock(); they
have to use spin_lock_irqsave(). Lockdep warns about a violation
occurring in xhci_irq():
=========================================================
[ INFO: possible irq lock inversion dependency detected ]
4.11.0-rc8-dbg+ #1 Not tainted
---------------------------------------------------------
swapper/7/0 just changed the state of lock:
(&(&ehci->lock)->rlock){-.-...}, at: [<ffffffffa0130a69>]
ehci_hrtimer_func+0x29/0xc0 [ehci_hcd]
but this lock took another, HARDIRQ-unsafe lock in the past:
(hcd_urb_list_lock){+.....}
and interrupts could create inverse lock ordering between them.
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hcd_urb_list_lock);
local_irq_disable();
lock(&(&ehci->lock)->rlock);
lock(hcd_urb_list_lock);
<Interrupt>
lock(&(&ehci->lock)->rlock);
*** DEADLOCK ***
no locks held by swapper/7/0.
the shortest dependencies between 2nd lock and 1st lock:
-> (hcd_urb_list_lock){+.....} ops: 252 {
HARDIRQ-ON-W at:
__lock_acquire+0x602/0x1280
lock_acquire+0xd5/0x1c0
_raw_spin_lock+0x2f/0x40
usb_hcd_unlink_urb_from_ep+0x1b/0x60 [usbcore]
xhci_giveback_urb_in_irq.isra.45+0x70/0x1b0 [xhci_hcd]
finish_td.constprop.60+0x1d8/0x2e0 [xhci_hcd]
xhci_irq+0xdd6/0x1fa0 [xhci_hcd]
usb_hcd_irq+0x26/0x40 [usbcore]
irq_forced_thread_fn+0x2f/0x70
irq_thread+0x149/0x1d0
kthread+0x113/0x150
ret_from_fork+0x2e/0x40
This patch fixes the problem.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2616,11 +2616,12 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
union xhci_trb *event_ring_deq;
irqreturn_t ret = IRQ_NONE;
+ unsigned long flags;
dma_addr_t deq;
u64 temp_64;
u32 status;
- spin_lock(&xhci->lock);
+ spin_lock_irqsave(&xhci->lock, flags);
/* Check if the xHC generated the interrupt, or the irq is shared */
status = readl(&xhci->op_regs->status);
if (status == 0xffffffff) {
@@ -2695,7 +2696,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd
ret = IRQ_HANDLED;
out:
- spin_unlock(&xhci->lock);
+ spin_unlock_irqrestore(&xhci->lock, flags);
return ret;
}
Patches currently in stable-queue which might be from stern@rowland.harvard.edu are
queue-4.11/ohci-pci-add-qemu-quirk.patch
queue-4.11/usb-ene_usb6250-fix-dma-to-the-stack.patch
queue-4.11/usb-xhci-fix-lock-inversion-problem.patch
^ permalink raw reply
* Patch "usb: host: xhci-plat: propagate return value of platform_get_irq()" has been added to the 4.11-stable tree
From: gregkh @ 2017-05-23 12:14 UTC (permalink / raw)
To: thomas.petazzoni, gregkh, mathias.nyman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: host: xhci-plat: propagate return value of platform_get_irq()
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 4b148d5144d64ee135b8924350cb0b3a7fd21150 Mon Sep 17 00:00:00 2001
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Date: Wed, 17 May 2017 18:32:06 +0300
Subject: usb: host: xhci-plat: propagate return value of platform_get_irq()
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit 4b148d5144d64ee135b8924350cb0b3a7fd21150 upstream.
platform_get_irq() returns an error code, but the xhci-plat driver
ignores it and always returns -ENODEV. This is not correct, and
prevents -EPROBE_DEFER from being propagated properly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-plat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -162,7 +162,7 @@ static int xhci_plat_probe(struct platfo
irq = platform_get_irq(pdev, 0);
if (irq < 0)
- return -ENODEV;
+ return irq;
/* Try to set 64-bit DMA first */
if (!pdev->dev.dma_mask)
Patches currently in stable-queue which might be from thomas.petazzoni@free-electrons.com are
queue-4.11/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
^ permalink raw reply
* Patch "usb: host: xhci-mem: allocate zeroed Scratchpad Buffer" has been added to the 4.11-stable tree
From: gregkh @ 2017-05-23 12:14 UTC (permalink / raw)
To: peter.chen, gregkh, mathias.nyman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 7480d912d549f414e0ce39331870899e89a5598c Mon Sep 17 00:00:00 2001
From: Peter Chen <peter.chen@nxp.com>
Date: Wed, 17 May 2017 18:32:01 +0300
Subject: usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
From: Peter Chen <peter.chen@nxp.com>
commit 7480d912d549f414e0ce39331870899e89a5598c upstream.
According to xHCI ch4.20 Scratchpad Buffers, the Scratchpad
Buffer needs to be zeroed.
...
The following operations take place to allocate
Scratchpad Buffers to the xHC:
...
b. Software clears the Scratchpad Buffer to '0'
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1729,7 +1729,7 @@ static int scratchpad_alloc(struct xhci_
xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma);
for (i = 0; i < num_sp; i++) {
dma_addr_t dma;
- void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma,
+ void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma,
flags);
if (!buf)
goto fail_sp5;
Patches currently in stable-queue which might be from peter.chen@nxp.com are
queue-4.11/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
^ permalink raw reply
* Patch "usb: host: xhci-plat: propagate return value of platform_get_irq()" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:13 UTC (permalink / raw)
To: thomas.petazzoni, gregkh, mathias.nyman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: host: xhci-plat: propagate return value of platform_get_irq()
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 4b148d5144d64ee135b8924350cb0b3a7fd21150 Mon Sep 17 00:00:00 2001
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Date: Wed, 17 May 2017 18:32:06 +0300
Subject: usb: host: xhci-plat: propagate return value of platform_get_irq()
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit 4b148d5144d64ee135b8924350cb0b3a7fd21150 upstream.
platform_get_irq() returns an error code, but the xhci-plat driver
ignores it and always returns -ENODEV. This is not correct, and
prevents -EPROBE_DEFER from being propagated properly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-plat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -81,7 +81,7 @@ static int xhci_plat_probe(struct platfo
irq = platform_get_irq(pdev, 0);
if (irq < 0)
- return -ENODEV;
+ return irq;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res)
Patches currently in stable-queue which might be from thomas.petazzoni@free-electrons.com are
queue-3.18/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch
^ permalink raw reply
* Patch "usb: host: xhci-mem: allocate zeroed Scratchpad Buffer" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 12:13 UTC (permalink / raw)
To: peter.chen, gregkh, mathias.nyman; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 7480d912d549f414e0ce39331870899e89a5598c Mon Sep 17 00:00:00 2001
From: Peter Chen <peter.chen@nxp.com>
Date: Wed, 17 May 2017 18:32:01 +0300
Subject: usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
From: Peter Chen <peter.chen@nxp.com>
commit 7480d912d549f414e0ce39331870899e89a5598c upstream.
According to xHCI ch4.20 Scratchpad Buffers, the Scratchpad
Buffer needs to be zeroed.
...
The following operations take place to allocate
Scratchpad Buffers to the xHC:
...
b. Software clears the Scratchpad Buffer to '0'
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1676,7 +1676,7 @@ static int scratchpad_alloc(struct xhci_
xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma);
for (i = 0; i < num_sp; i++) {
dma_addr_t dma;
- void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma,
+ void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma,
flags);
if (!buf)
goto fail_sp5;
Patches currently in stable-queue which might be from peter.chen@nxp.com are
queue-3.18/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox