linux-toradex.git, branch v4.9.68

Linux 4.9.68

2017-12-09T21:01:57+00:00

xen-netfront: avoid crashing on resume after a failure in talk_to_netback()

2017-12-09T21:01:57+00:00

commit d86b5672b1adb98b4cdd6fbf0224bbfb03db6e2e upstream.

Unavoidable crashes in netfront_resume() and netback_changed() after a
previous fail in talk_to_netback() (e.g. when we fail to read MAC from
xenstore) were discovered. The failure path in talk_to_netback() does
unregister/free for netdev but we don't reset drvdata and we try accessing
it after resume.

Fix the bug by removing the whole xen device completely with
device_unregister(), this guarantees we won't have any calls into netfront
after a failure.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: David S. Miller 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

usb: host: fix incorrect updating of offset

2017-12-09T21:01:57+00:00

commit 1d5a31582ef046d3b233f0da1a68ae26519b2f0a upstream.

The variable temp is incorrectly being updated, instead it should
be offset otherwise the loop just reads the same capability value
and loops forever.  Thanks to Alan Stern for pointing out the
correct fix to my original fix.  Fix also cleans up clang warning:

drivers/usb/host/ehci-dbg.c:840:4: warning: Value stored to 'temp'
is never read

Fixes: d49d43174400 ("USB: misc ehci updates")
Signed-off-by: Colin Ian King 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: Filter flags passed in from user space

2017-12-09T21:01:57+00:00

commit 446f666da9f019ce2ffd03800995487e79a91462 upstream.

USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints.
Improve sanity checking.

Reported-by: Andrey Konovalov 
Signed-off-by: Oliver Neukum 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: devio: Prevent integer overflow in proc_do_submiturb()

2017-12-09T21:01:57+00:00

commit 57999d1107c1e60c2ca7088f2ac0f819e2f554b3 upstream.

There used to be an integer overflow check in proc_do_submiturb() but
we removed it.  It turns out that it's still required.  The
uurb->buffer_length variable is a signed integer and it's controlled by
the user.  It can lead to an integer overflow when we do:

	num_sgs = DIV_ROUND_UP(uurb->buffer_length, USB_SG_SIZE);

If we strip away the macro then that line looks like this:

	num_sgs = (uurb->buffer_length + USB_SG_SIZE - 1) / USB_SG_SIZE;
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
It's the first addition which can overflow.

Fixes: 1129d270cbfb ("USB: Increase usbfs transfer limit")
Signed-off-by: Dan Carpenter 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: Increase usbfs transfer limit

2017-12-09T21:01:57+00:00

commit 1129d270cbfbb7e2b1ec3dede4a13930bdd10e41 upstream.

Promote a variable keeping track of USB transfer memory usage to a
wider data type and allow for higher bandwidth transfers from a large
number of USB devices connected to a single host.

Signed-off-by: Mateusz Berezecki 
Signed-off-by: Greg Kroah-Hartman

USB: core: Add type-specific length check of BOS descriptors

2017-12-09T21:01:56+00:00

commit 81cf4a45360f70528f1f64ba018d61cb5767249a upstream.

As most of BOS descriptors are longer in length than their header
'struct usb_dev_cap_header', comparing solely with it is not sufficient
to avoid out-of-bounds access to BOS descriptors.

This patch adds descriptor type specific length check in
usb_get_bos_descriptor() to fix the issue.

Signed-off-by: Masakazu Mokuno 
Signed-off-by: Greg Kroah-Hartman

usb: xhci: fix panic in xhci_free_virt_devices_depth_first

2017-12-09T21:01:56+00:00

commit 80e457699a8dbdd70f2d26911e46f538645c55fc upstream.

Check vdev->real_port 0 to avoid panic
[    9.261347] [] xhci_free_virt_devices_depth_first+0x58/0x108
[    9.261352] [] xhci_mem_cleanup+0x1bc/0x570
[    9.261355] [] xhci_stop+0x140/0x1c8
[    9.261365] [] usb_remove_hcd+0xfc/0x1d0
[    9.261369] [] xhci_plat_remove+0x6c/0xa8
[    9.261377] [] platform_drv_remove+0x2c/0x70
[    9.261384] [] __device_release_driver+0x80/0x108
[    9.261387] [] device_release_driver+0x2c/0x40
[    9.261392] [] bus_remove_device+0xe0/0x120
[    9.261396] [] device_del+0x114/0x210
[    9.261399] [] platform_device_del+0x30/0xa0
[    9.261403] [] dwc3_otg_work+0x204/0x488
[    9.261407] [] event_work+0x304/0x5b8
[    9.261414] [] process_one_work+0x148/0x490
[    9.261417] [] worker_thread+0x50/0x4a0
[    9.261421] [] kthread+0xe8/0x100
[    9.261427] [] ret_from_fork+0x10/0x50

The problem can occur if xhci_plat_remove() is called shortly after
xhci_plat_probe(). While xhci_free_virt_devices_depth_first been
called before the device has been setup and get real_port initialized.
The problem occurred on Hikey960 and was reproduced by Guenter Roeck
on Kevin with chromeos-4.4.

Fixes: ee8665e28e8d ("xhci: free xhci virtual devices with leaf nodes first")
Cc: Guenter Roeck 
Reviewed-by: Guenter Roeck 
Tested-by: Guenter Roeck 
Signed-off-by: Fan Ning 
Signed-off-by: Li Rui 
Signed-off-by: yangdi 
Signed-off-by: Yu Chen 
Signed-off-by: Mathias Nyman 
Signed-off-by: Greg Kroah-Hartman

usb: hub: Cycle HUB power when initialization fails

2017-12-09T21:01:56+00:00

commit 973593a960ddac0f14f0d8877d2d0abe0afda795 upstream.

Sometimes the USB device gets confused about the state of the initialization and
the connection fails. In particular, the device thinks that it's already set up
and running while the host thinks the device still needs to be configured. To
work around this issue, power-cycle the hub's output to issue a sort of "reset"
to the device. This makes the device restart its state machine and then the
initialization succeeds.

This fixes problems where the kernel reports a list of errors like this:

usb 1-1.3: device not accepting address 19, error -71

The end result is a non-functioning device. After this patch, the sequence
becomes like this:

usb 1-1.3: new high-speed USB device number 18 using ci_hdrc
usb 1-1.3: device not accepting address 18, error -71
usb 1-1.3: new high-speed USB device number 19 using ci_hdrc
usb 1-1.3: device not accepting address 19, error -71
usb 1-1-port3: attempt power cycle
usb 1-1.3: new high-speed USB device number 21 using ci_hdrc
usb-storage 1-1.3:1.2: USB Mass Storage device detected

Signed-off-by: Mike Looijmans 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

dma-buf: Update kerneldoc for sync_file_create

2017-12-09T21:01:56+00:00

commit 24a367348a017555f982a9ee137070a7a821fa97 upstream.

This was missed when adding a dma_fence_get call. While at it also
remove the kerneldoc for the static inline helper - no point
documenting internals down to every detail.

Fixes: 30cd85dd6edc ("dma-buf/sync_file: hold reference to fence when creating sync_file")
Cc: Gustavo Padovan 
Cc: Sean Paul 
Cc: linux-doc@vger.kernel.org
Cc: Jonathan Corbet 
Cc: Sumit Semwal 
Signed-off-by: Daniel Vetter 
Reviewed-by: Gustavo Padovan 
Signed-off-by: Sumit Semwal 
Link: http://patchwork.freedesktop.org/patch/msgid/20161209185309.1682-3-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman