1. 09 Sep, 2017 21 commits
    • Horia Geantă's avatar
      crypto: caam/qi - fix compilation with CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y · 224aec7e
      Horia Geantă authored
      commit 1ed289f7 upstream.
      
      caam/qi driver fails to compile when CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y.
      Fix it by making the offending local per_cpu variable global.
      
      Fixes: 67c2315d ("crypto: caam - add Queue Interface (QI) backend support")
      Reported-by: default avatarkbuild test robot <fengguang.wu@intel.com>
      Signed-off-by: default avatarHoria Geantă <horia.geanta@nxp.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      224aec7e
    • Christian Brauner's avatar
      binder: free memory on error · 5f9463ea
      Christian Brauner authored
      commit 22eb9476 upstream.
      
      On binder_init() the devices string is duplicated and smashed into individual
      device names which are passed along. However, the original duplicated string
      wasn't freed in case binder_init() failed. Let's free it on error.
      Signed-off-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5f9463ea
    • Jason Gerecke's avatar
      HID: wacom: Do not completely map WACOM_HID_WD_TOUCHRINGSTATUS usage · 8d898335
      Jason Gerecke authored
      commit 8d411cbf upstream.
      
      The WACOM_HID_WD_TOUCHRINGSTATUS usage is a single bit which tells us
      whether the touchring is currently in use or not. Because we need to
      reset the axis value to 0 when the finger is removed, we call
      'wacom_map_usage' to ensure that the required type/code values are
      associated with the usage. The 'wacom_map_usage' also sets up the axis
      range and resolution, however, which is not desired in this particular
      case.
      
      Although xf86-input-wacom doesn't do really do anything with the ring's
      range or resolution, the libinput driver (for Wayland environments)
      uses these values to provide proper angle indications to userspace.
      
      Fixes: 60a22186 ("HID: wacom: generic: add support for touchring")
      Signed-off-by: default avatarJason Gerecke <jason.gerecke@wacom.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      8d898335
    • Christophe JAILLET's avatar
      driver core: bus: Fix a potential double free · 5beb744c
      Christophe JAILLET authored
      commit 0f9b011d upstream.
      
      The .release function of driver_ktype is 'driver_release()'.
      This function frees the container_of this kobject.
      
      So, this memory must not be freed explicitly in the error handling path of
      'bus_add_driver()'. Otherwise a double free will occur.
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5beb744c
    • Akinobu Mita's avatar
      iio: adc: ti-ads1015: add adequate wait time to get correct conversion · 51a39e2b
      Akinobu Mita authored
      commit 4744d4e2 upstream.
      
      This driver assumes that the device is operating in the continuous
      conversion mode which performs the conversion continuously.  So this driver
      inserts a wait time before reading the conversion register if the
      configuration is changed from a previous request.
      
      Currently, the wait time is only the period required for a single
      conversion that is calculated as the reciprocal of the sampling frequency.
      However we also need to wait for the the previous conversion to complete.
      Otherwise we probably get the conversion result for the previous
      configuration when the sampling frequency is lower.
      
      Cc: Daniel Baluta <daniel.baluta@gmail.com>
      Signed-off-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
      Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      51a39e2b
    • Akinobu Mita's avatar
      iio: adc: ti-ads1015: don't return invalid value from buffer setup callbacks · d9320af3
      Akinobu Mita authored
      commit a6fe5e52 upstream.
      
      pm_runtime_get_sync() and pm_runtime_put_autosuspend() return 0 on
      success, 1 if the device's runtime PM status was already requested status
      or error code on failure.  So a positive return value doesn't indicate an
      error condition.
      
      However, any non-zero return values from buffer preenable and postdisable
      callbacks are recognized as an error and this driver reuses the return
      value from pm_runtime_get_sync() and pm_runtime_put_autosuspend() in
      these callbacks.  This change fixes the false error detections.
      
      Cc: Daniel Baluta <daniel.baluta@gmail.com>
      Signed-off-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
      Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d9320af3
    • Akinobu Mita's avatar
      iio: adc: ti-ads1015: avoid getting stale result after runtime resume · 1c68b99a
      Akinobu Mita authored
      commit 73e3e3fc upstream.
      
      This driver assumes that the device is operating in the continuous
      conversion mode which performs the conversion continuously.  So this driver
      doesn't insert a wait time before reading the conversion register if the
      configuration is not changed from a previous request.
      
      This assumption is broken if the device is runtime suspended and entered
      a power-down state.  The forthcoming request causes reading a stale result
      from the conversion register as the device is runtime resumed just before.
      
      Fix it by adding a flag to detect that condition and insert a necessary
      wait time.
      
      Cc: Daniel Baluta <daniel.baluta@gmail.com>
      Signed-off-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
      Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1c68b99a
    • Akinobu Mita's avatar
      iio: adc: ti-ads1015: enable conversion when CONFIG_PM is not set · 86b6c05f
      Akinobu Mita authored
      commit e8245c68 upstream.
      
      The ADS1015 device have two operating modes, continuous conversion mode
      and single-shot mode.  This driver assumes that the continuous conversion
      mode is selected by runtime resume callback when the ADC result is
      requested.
      
      If CONFIG_PM is disabled, the device is always in the default single-shot
      mode and no one begins a single conversion.  So the conversion register
      doesn't contain valid ADC result.  Fix it by changing the continuous mode
      in probe function.
      
      Cc: Daniel Baluta <daniel.baluta@gmail.com>
      Signed-off-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
      Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      86b6c05f
    • Akinobu Mita's avatar
      iio: adc: ti-ads1015: fix scale information for ADS1115 · dac6ce35
      Akinobu Mita authored
      commit 8d0e8e79 upstream.
      
      The ti-ads1015 driver supports ADS1015 and ADS1115 devices.  The same
      scale information is used for both devices in this driver, however they
      have actually different values and the ADS1115's one is not correct.
      
      These devices have the same full-scale input voltage range for each PGA
      selection.  So instead of adding another hardcoded scale information,
      compute a correct scale on demand from each device's resolution.
      
      Cc: Daniel Baluta <daniel.baluta@gmail.com>
      Signed-off-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
      Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      dac6ce35
    • Akinobu Mita's avatar
      iio: adc: ti-ads1015: fix incorrect data rate setting update · cc06f5a9
      Akinobu Mita authored
      commit 0d106b74 upstream.
      
      The ti-ads1015 driver has eight iio voltage channels and each iio channel
      can hold own sampling frequency information.
      
      The ADS1015 device only have a single config register which contains an
      input multiplexer selection, PGA and data rate settings.  So the driver
      should load the correct settings when the input multiplexer selection is
      changed.
      
      However, regardless of which channlel is currently selected, changing any
      iio channel's sampling frequency information immediately overwrites the
      current data rate setting in the config register.
      
      It breaks the current data rate setting if the different channel's sampling
      frequency information is changed because the data rate setting is not
      reloaded when the input multiplexer is switched.
      
      This removes the unexpected config register update and correctly load the
      data rate setting before getting adc result.
      
      Cc: Daniel Baluta <daniel.baluta@gmail.com>
      Signed-off-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
      Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      cc06f5a9
    • Horia Geantă's avatar
      staging: fsl-dpaa2/eth: fix off-by-one FD ctrl bitmaks · 34c874a4
      Horia Geantă authored
      commit 11b86a84 upstream.
      
      Fix the values of DPAA2_FD_CTRL_FSE and DPAA2_FD_CTRL_FAERR,
      which are shifted off by one bit.
      
      Fixes: 39163c0c ("staging: fsl-dpaa2/eth: Errors checking update")
      Signed-off-by: default avatarHoria Geantă <horia.geanta@nxp.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      34c874a4
    • Gilad Ben-Yossef's avatar
      staging: ccree: save ciphertext for CTS IV · 2d94a1e8
      Gilad Ben-Yossef authored
      commit 737aed94 upstream.
      
      The crypto API requires saving the last blocks of ciphertext
      in req->info for use as IV for CTS mode. The ccree driver
      was not doing this. This patch fixes that.
      
      The bug was manifested with cts(cbc(aes)) mode in tcrypt tests.
      
      Fixes: 302ef8eb ("Add CryptoCell skcipher support")
      Signed-off-by: default avatarGilad Ben-Yossef <gilad@benyossef.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2d94a1e8
    • Colin Ian King's avatar
      staging/rts5208: fix incorrect shift to extract upper nybble · a55273d7
      Colin Ian King authored
      commit 34ff1bf4 upstream.
      
      The mask of sns_key_info1 suggests the upper nybble is being extracted
      however the following shift of 8 bits is too large and always results in
      0.  Fix this by shifting only by 4 bits to correctly get the upper nybble.
      
      Detected by CoverityScan, CID#142891 ("Operands don't affect result")
      
      Fixes: fa590c22 ("staging: rts5208: add support for rts5208 and rts5288")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a55273d7
    • Douglas Anderson's avatar
      USB: core: Avoid race of async_completed() w/ usbdev_release() · 9bf12567
      Douglas Anderson authored
      commit ed62ca2f upstream.
      
      While running reboot tests w/ a specific set of USB devices (and
      slub_debug enabled), I found that once every few hours my device would
      be crashed with a stack that looked like this:
      
      [   14.012445] BUG: spinlock bad magic on CPU#0, modprobe/2091
      [   14.012460]  lock: 0xffffffc0cb055978, .magic: ffffffc0, .owner: cryption contexts: %lu/%lu
      [   14.012460] /1025536097, .owner_cpu: 0
      [   14.012466] CPU: 0 PID: 2091 Comm: modprobe Not tainted 4.4.79 #352
      [   14.012468] Hardware name: Google Kevin (DT)
      [   14.012471] Call trace:
      [   14.012483] [<....>] dump_backtrace+0x0/0x160
      [   14.012487] [<....>] show_stack+0x20/0x28
      [   14.012494] [<....>] dump_stack+0xb4/0xf0
      [   14.012500] [<....>] spin_dump+0x8c/0x98
      [   14.012504] [<....>] spin_bug+0x30/0x3c
      [   14.012508] [<....>] do_raw_spin_lock+0x40/0x164
      [   14.012515] [<....>] _raw_spin_lock_irqsave+0x64/0x74
      [   14.012521] [<....>] __wake_up+0x2c/0x60
      [   14.012528] [<....>] async_completed+0x2d0/0x300
      [   14.012534] [<....>] __usb_hcd_giveback_urb+0xc4/0x138
      [   14.012538] [<....>] usb_hcd_giveback_urb+0x54/0xf0
      [   14.012544] [<....>] xhci_irq+0x1314/0x1348
      [   14.012548] [<....>] usb_hcd_irq+0x40/0x50
      [   14.012553] [<....>] handle_irq_event_percpu+0x1b4/0x3f0
      [   14.012556] [<....>] handle_irq_event+0x4c/0x7c
      [   14.012561] [<....>] handle_fasteoi_irq+0x158/0x1c8
      [   14.012564] [<....>] generic_handle_irq+0x30/0x44
      [   14.012568] [<....>] __handle_domain_irq+0x90/0xbc
      [   14.012572] [<....>] gic_handle_irq+0xcc/0x18c
      
      Investigation using kgdb() found that the wait queue that was passed
      into wake_up() had been freed (it was filled with slub_debug poison).
      
      I analyzed and instrumented the code and reproduced.  My current
      belief is that this is happening:
      
      1. async_completed() is called (from IRQ).  Moves "as" onto the
         completed list.
      2. On another CPU, proc_reapurbnonblock_compat() calls
         async_getcompleted().  Blocks on spinlock.
      3. async_completed() releases the lock; keeps running; gets blocked
         midway through wake_up().
      4. proc_reapurbnonblock_compat() => async_getcompleted() gets the
         lock; removes "as" from completed list and frees it.
      5. usbdev_release() is called.  Frees "ps".
      6. async_completed() finally continues running wake_up().  ...but
         wake_up() has a pointer to the freed "ps".
      
      The instrumentation that led me to believe this was based on adding
      some trace_printk() calls in a select few functions and then using
      kdb's "ftdump" at crash time.  The trace follows (NOTE: in the trace
      below I cheated a little bit and added a udelay(1000) in
      async_completed() after releasing the spinlock because I wanted it to
      trigger quicker):
      
      <...>-2104   0d.h2 13759034us!: async_completed at start: as=ffffffc0cc638200
      mtpd-2055    3.... 13759356us : async_getcompleted before spin_lock_irqsave
      mtpd-2055    3d..1 13759362us : async_getcompleted after list_del_init: as=ffffffc0cc638200
      mtpd-2055    3.... 13759371us+: proc_reapurbnonblock_compat: free_async(ffffffc0cc638200)
      mtpd-2055    3.... 13759422us+: async_getcompleted before spin_lock_irqsave
      mtpd-2055    3.... 13759479us : usbdev_release at start: ps=ffffffc0cc042080
      mtpd-2055    3.... 13759487us : async_getcompleted before spin_lock_irqsave
      mtpd-2055    3.... 13759497us!: usbdev_release after kfree(ps): ps=ffffffc0cc042080
      <...>-2104   0d.h2 13760294us : async_completed before wake_up(): as=ffffffc0cc638200
      
      To fix this problem we can just move the wake_up() under the ps->lock.
      There should be no issues there that I'm aware of.
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9bf12567
    • Martijn Coenen's avatar
      ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES. · 5da7c0ce
      Martijn Coenen authored
      commit 9e18d0c8 upstream.
      
      These will be required going forward.
      Signed-off-by: default avatarMartijn Coenen <maco@android.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5da7c0ce
    • Martijn Coenen's avatar
      ANDROID: binder: add padding to binder_fd_array_object. · df338972
      Martijn Coenen authored
      commit 5cdcf4c6 upstream.
      
      binder_fd_array_object starts with a 4-byte header,
      followed by a few fields that are 8 bytes when
      ANDROID_BINDER_IPC_32BIT=N.
      
      This can cause alignment issues in a 64-bit kernel
      with a 32-bit userspace, as on x86_32 an 8-byte primitive
      may be aligned to a 4-byte address. Pad with a __u32
      to fix this.
      Signed-off-by: default avatarMartijn Coenen <maco@android.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      df338972
    • Johan Hovold's avatar
      USB: musb: fix external abort on suspend · 26be1058
      Johan Hovold authored
      commit 082df8be upstream.
      
      Make sure that the controller is runtime resumed when system suspending
      to avoid an external abort when accessing the interrupt registers:
      
        Unhandled fault: external abort on non-linefetch (0x1008) at 0xd025840a
        ...
        [<c05481a4>] (musb_default_readb) from [<c0545abc>] (musb_disable_interrupts+0x84/0xa8)
        [<c0545abc>] (musb_disable_interrupts) from [<c0546b08>] (musb_suspend+0x38/0xb8)
        [<c0546b08>] (musb_suspend) from [<c04a57f8>] (platform_pm_suspend+0x3c/0x64)
      
      This is easily reproduced on a BBB by enabling the peripheral port only
      (as the host port may enable the shared clock) and keeping it
      disconnected so that the controller is runtime suspended. (Well, you
      would also need to the not-yet-merged am33xx-suspend patches by Dave
      Gerlach to be able to suspend the BBB.)
      
      This is a regression that was introduced by commit 1c4d0b4e ("usb:
      musb: Remove pm_runtime_set_irq_safe") which allowed the parent glue
      device to runtime suspend and thereby exposed a couple of older issues:
      
      Register accesses without explicitly making sure the controller is
      runtime resumed during suspend was first introduced by commit c338412b
      ("usb: musb: unconditionally save and restore the context on suspend")
      in 3.14.
      
      Commit a1fc1920 ("usb: musb: core: make sure musb is in RPM_ACTIVE on
      resume") later started setting the RPM status to active during resume,
      and this was also implicitly relying on the parent always being active.
      Since commit 71723f95 ("PM / runtime: print error when activating a
      child to unactive parent") this now also results in the following
      warning:
      
        musb-hdrc musb-hdrc.0: runtime PM trying to activate child device
          musb-hdrc.0 but parent (47401400.usb) is not active
      
      This patch has been verified on 4.13-rc2, 4.12 and 4.9 using a BBB
      (the dsps glue would always be active also in 4.8).
      
      Fixes: c338412b ("usb: musb: unconditionally save and restore the context on suspend")
      Fixes: a1fc1920 ("usb: musb: core: make sure musb is in RPM_ACTIVE on resume")
      Fixes: 1c4d0b4e ("usb: musb: Remove pm_runtime_set_irq_safe")
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Cc: Daniel Mack <zonque@gmail.com>
      Cc: Dave Gerlach <d-gerlach@ti.com>
      Cc: Rafael J. Wysocki <rjw@rjwysocki.net>
      Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
      Cc: Tony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarBin Liu <b-liu@ti.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      26be1058
    • Sandeep Singh's avatar
      usb:xhci:Fix regression when ATI chipsets detected · 02fa8722
      Sandeep Singh authored
      commit e6b422b8 upstream.
      
      The following commit cause a regression on ATI chipsets.
      'commit e788787e ("usb:xhci:Add quirk for Certain
      failing HP keyboard on reset after resume")'
      
      This causes pinfo->smbus_dev to be wrongly set to NULL on
      systems with the ATI chipset that this function checks for first.
      
      Added conditional check for AMD chipsets to avoid the overwriting
      pinfo->smbus_dev.
      Reported-by: default avatarBen Hutchings <ben@decadent.org.uk>
      Fixes: e788787e ("usb:xhci:Add quirk for Certain
      failing HP keyboard on reset after resume")
      cc: Nehal Shah <Nehal-bakulchandra.Shah@amd.com>
      Signed-off-by: default avatarSandeep Singh <Sandeep.Singh@amd.com>
      Signed-off-by: default avatarShyam Sundar S K <Shyam-sundar.S-k@amd.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      02fa8722
    • Dmitry Fleytman's avatar
      usb: Add device quirk for Logitech HD Pro Webcam C920-C · f6f8eb10
      Dmitry Fleytman authored
      commit a1279ef7 upstream.
      
      Commit e0429362
      ("usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e")
      introduced quirk to workaround an issue with some Logitech webcams.
      
      Apparently model C920-C has the same issue so applying
      the same quirk as well.
      
      See aforementioned commit message for detailed explanation of the problem.
      Signed-off-by: default avatarDmitry Fleytman <dmitry@daynix.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f6f8eb10
    • Maciej S. Szmigiero's avatar
      USB: serial: option: add support for D-Link DWM-157 C1 · 520369b7
      Maciej S. Szmigiero authored
      commit 169e8654 upstream.
      
      This commit adds support (an ID, really) for D-Link DWM-157 hardware
      version C1 USB modem to option driver.
      
      According to manufacturer-provided Windows INF file the device has four
      serial ports:
      "D-Link HSPA+DataCard Diagnostics Interface" (interface 2; modem port),
      "D-Link HSPA+DataCard NMEA Device" (interface 3),
      "D-Link HSPA+DataCard Speech Port" (interface 4),
      "D-Link HSPA+DataCard Debug Port" (interface 5).
      
      usb-devices output:
      T:  Bus=05 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#=  3 Spd=480 MxCh= 0
      D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=2001 ProdID=7d0e Rev=03.00
      S:  Manufacturer=D-Link,Inc
      S:  Product=D-Link DWM-157
      C:  #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
      I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
      I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=option
      I:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
      I:  If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
      Signed-off-by: default avatarMaciej S. Szmigiero <mail@maciej.szmigiero.name>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      520369b7
    • Kai-Heng Feng's avatar
      usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard · 970974a7
      Kai-Heng Feng authored
      commit de3af5bf upstream.
      
      Corsair Strafe RGB keyboard has trouble to initialize:
      
      [ 1.679455] usb 3-6: new full-speed USB device number 4 using xhci_hcd
      [ 6.871136] usb 3-6: unable to read config index 0 descriptor/all
      [ 6.871138] usb 3-6: can't read configurations, error -110
      [ 6.991019] usb 3-6: new full-speed USB device number 5 using xhci_hcd
      [ 12.246642] usb 3-6: unable to read config index 0 descriptor/all
      [ 12.246644] usb 3-6: can't read configurations, error -110
      [ 12.366555] usb 3-6: new full-speed USB device number 6 using xhci_hcd
      [ 17.622145] usb 3-6: unable to read config index 0 descriptor/all
      [ 17.622147] usb 3-6: can't read configurations, error -110
      [ 17.742093] usb 3-6: new full-speed USB device number 7 using xhci_hcd
      [ 22.997715] usb 3-6: unable to read config index 0 descriptor/all
      [ 22.997716] usb 3-6: can't read configurations, error -110
      
      Although it may work after several times unpluging/pluging:
      
      [ 68.195240] usb 3-6: new full-speed USB device number 11 using xhci_hcd
      [ 68.337459] usb 3-6: New USB device found, idVendor=1b1c, idProduct=1b20
      [ 68.337463] usb 3-6: New USB device strings: Mfr=1, Product=2, SerialNumber=3
      [ 68.337466] usb 3-6: Product: Corsair STRAFE RGB Gaming Keyboard
      [ 68.337468] usb 3-6: Manufacturer: Corsair
      [ 68.337470] usb 3-6: SerialNumber: 0F013021AEB8046755A93ED3F5001941
      
      Tried three quirks: USB_QUIRK_DELAY_INIT, USB_QUIRK_NO_LPM and
      USB_QUIRK_DEVICE_QUALIFIER, user confirmed that USB_QUIRK_DELAY_INIT alone
      can workaround this issue. Hence add the quirk for Corsair Strafe RGB.
      
      BugLink: https://bugs.launchpad.net/bugs/1678477Signed-off-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      970974a7
  2. 03 Sep, 2017 5 commits
  3. 02 Sep, 2017 2 commits
  4. 01 Sep, 2017 12 commits
    • Olof Johansson's avatar
      Merge tag 'mvebu-fixes-4.13-3' of git://git.infradead.org/linux-mvebu into fixes · 6f71a925
      Olof Johansson authored
      mvebu fixes for 4.13 (part 3)
      
      Fix number of GPIOs in AP806 description for Armada 7K/8K
      
      * tag 'mvebu-fixes-4.13-3' of git://git.infradead.org/linux-mvebu:
        arm64: dts: marvell: fix number of GPIOs in Armada AP806 description
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      6f71a925
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · f8c6d724
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "The ismt driver had a problem with a rarely used transaction type and
        the designware driver was made even more robust against non standard
        ACPI tables"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: designware: Round down ACPI provided clk to nearest supported clk
        i2c: ismt: Return EMSGSIZE for block reads with bogus length
        i2c: ismt: Don't duplicate the receive length for block reads
      f8c6d724
    • Oleg Nesterov's avatar
      epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove() · 138e4ad6
      Oleg Nesterov authored
      The race was introduced by me in commit 971316f0 ("epoll:
      ep_unregister_pollwait() can use the freed pwq->whead").  I did not
      realize that nothing can protect eventpoll after ep_poll_callback() sets
      ->whead = NULL, only whead->lock can save us from the race with
      ep_free() or ep_remove().
      
      Move ->whead = NULL to the end of ep_poll_callback() and add the
      necessary barriers.
      
      TODO: cleanup the ewake/EPOLLEXCLUSIVE logic, it was confusing even
      before this patch.
      
      Hopefully this explains use-after-free reported by syzcaller:
      
      	BUG: KASAN: use-after-free in debug_spin_lock_before
      	...
      	 _raw_spin_lock_irqsave+0x4a/0x60 kernel/locking/spinlock.c:159
      	 ep_poll_callback+0x29f/0xff0 fs/eventpoll.c:1148
      
      this is spin_lock(eventpoll->lock),
      
      	...
      	Freed by task 17774:
      	...
      	 kfree+0xe8/0x2c0 mm/slub.c:3883
      	 ep_free+0x22c/0x2a0 fs/eventpoll.c:865
      
      Fixes: 971316f0 ("epoll: ep_unregister_pollwait() can use the freed pwq->whead")
      Reported-by: default avatar范龙飞 <long7573@126.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      138e4ad6
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 8cf9f2a2
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix handling of pinned BPF map nodes in hash of maps, from Daniel
          Borkmann.
      
       2) IPSEC ESP error paths leak memory, from Steffen Klassert.
      
       3) We need an RCU grace period before freeing fib6_node objects, from
          Wei Wang.
      
       4) Must check skb_put_padto() return value in HSR driver, from FLorian
          Fainelli.
      
       5) Fix oops on PHY probe failure in ftgmac100 driver, from Andrew
          Jeffery.
      
       6) Fix infinite loop in UDP queue when using SO_PEEK_OFF, from Eric
          Dumazet.
      
       7) Use after free when tcf_chain_destroy() called multiple times, from
          Jiri Pirko.
      
       8) Fix KSZ DSA tag layer multiple free of SKBS, from Florian Fainelli.
      
       9) Fix leak of uninitialized memory in sctp_get_sctp_info(),
          inet_diag_msg_sctpladdrs_fill() and inet_diag_msg_sctpaddrs_fill().
          From Stefano Brivio.
      
      10) L2TP tunnel refcount fixes from Guillaume Nault.
      
      11) Don't leak UDP secpath in udp_set_dev_scratch(), from Yossi
          Kauperman.
      
      12) Revert a PHY layer change wrt. handling of PHY_HALTED state in
          phy_stop_machine(), it causes regressions for multiple people. From
          Florian Fainelli.
      
      13) When packets are sent out of br0 we have to clear the
          offload_fwdq_mark value.
      
      14) Several NULL pointer deref fixes in packet schedulers when their
          ->init() routine fails. From Nikolay Aleksandrov.
      
      15) Aquantium devices cannot checksum offload correctly when the packet
          is <= 60 bytes. From Pavel Belous.
      
      16) Fix vnet header access past end of buffer in AF_PACKET, from
          Benjamin Poirier.
      
      17) Double free in probe error paths of nfp driver, from Dan Carpenter.
      
      18) QOS capability not checked properly in DCB init paths of mlx5
          driver, from Huy Nguyen.
      
      19) Fix conflicts between firmware load failure and health_care timer in
          mlx5, also from Huy Nguyen.
      
      20) Fix dangling page pointer when DMA mapping errors occur in mlx5,
          from Eran Ben ELisha.
      
      21) ->ndo_setup_tc() in bnxt_en driver doesn't count rings properly,
          from Michael Chan.
      
      22) Missing MSIX vector free in bnxt_en, also from Michael Chan.
      
      23) Refcount leak in xfrm layer when using sk_policy, from Lorenzo
          Colitti.
      
      24) Fix copy of uninitialized data in qlge driver, from Arnd Bergmann.
      
      25) bpf_setsockopts() erroneously always returns -EINVAL even on
          success. Fix from Yuchung Cheng.
      
      26) tipc_rcv() needs to linearize the SKB before parsing the inner
          headers, from Parthasarathy Bhuvaragan.
      
      27) Fix deadlock between link status updates and link removal in netvsc
          driver, from Stephen Hemminger.
      
      28) Missed locking of page fragment handling in ESP output, from Steffen
          Klassert.
      
      29) Fix refcnt leak in ebpf congestion control code, from Sabrina
          Dubroca.
      
      30) sxgbe_probe_config_dt() doesn't check devm_kzalloc()'s return value,
          from Christophe Jaillet.
      
      31) Fix missing ipv6 rx_dst_cookie update when rx_dst is updated during
          early demux, from Paolo Abeni.
      
      32) Several info leaks in xfrm_user layer, from Mathias Krause.
      
      33) Fix out of bounds read in cxgb4 driver, from Stefano Brivio.
      
      34) Properly propagate obsolete state of route upwards in ipv6 so that
          upper holders like xfrm can see it. From Xin Long.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (118 commits)
        udp: fix secpath leak
        bridge: switchdev: Clear forward mark when transmitting packet
        mlxsw: spectrum: Forbid linking to devices that have uppers
        wl1251: add a missing spin_lock_init()
        Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"
        net: dsa: bcm_sf2: Fix number of CFP entries for BCM7278
        kcm: do not attach PF_KCM sockets to avoid deadlock
        sch_tbf: fix two null pointer dereferences on init failure
        sch_sfq: fix null pointer dereference on init failure
        sch_netem: avoid null pointer deref on init failure
        sch_fq_codel: avoid double free on init failure
        sch_cbq: fix null pointer dereferences on init failure
        sch_hfsc: fix null pointer deref and double free on init failure
        sch_hhf: fix null pointer dereference on init failure
        sch_multiq: fix double free on init failure
        sch_htb: fix crash on init failure
        net/mlx5e: Fix CQ moderation mode not set properly
        net/mlx5e: Fix inline header size for small packets
        net/mlx5: E-Switch, Unload the representors in the correct order
        net/mlx5e: Properly resolve TC offloaded ipv6 vxlan tunnel source address
        ...
      8cf9f2a2
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.13-rc8' of git://github.com/ceph/ceph-client · b8a78bb4
      Linus Torvalds authored
      Pull ceph fix from Ilya Dryomov:
       "ceph fscache page locking fix from Zheng, marked for stable"
      
      * tag 'ceph-for-4.13-rc8' of git://github.com/ceph/ceph-client:
        ceph: fix readpage from fscache
      b8a78bb4
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 3e1d79c8
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
       "Just a couple drivers fixes (Synaptics PS/2, Xpad)"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: xpad - fix PowerA init quirk for some gamepad models
        Input: synaptics - fix device info appearing different on reconnect
      3e1d79c8
    • Linus Torvalds's avatar
      Merge tag 'mmc-v4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · d7e44b86
      Linus Torvalds authored
      Pull two more MMC fixes from Ulf Hansson:
       "MMC core:
         - Fix block status codes
      
        MMC host:
         - sdhci-xenon: Fix SD bus voltage select"
      
      * tag 'mmc-v4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: sdhci-xenon: add set_power callback
        mmc: block: Fix block status codes
      d7e44b86
    • Linus Torvalds's avatar
      Merge tag 'sound-4.13-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 381cce59
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Three regression fixes that should be addressed before the final
        release: a missing mutex call in OSS PCM emulation ioctl, ASoC rt5670
        headset detection breakage, and a regression in simple-card parser
        code"
      
      * tag 'sound-4.13-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ASoC: simple_card_utils: fix fallback when "label" property isn't present
        ALSA: pcm: Fix power lock unbalance via OSS emulation
        ASoC: rt5670: Fix GPIO headset detection regression
      381cce59
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · bba2a5b8
      Linus Torvalds authored
      Pull s390 fixes from Martin Schwidefsky:
       "Three more bug fixes for v4.13.
      
        The two memory management related fixes are quite new, they fix kernel
        crashes that can be triggered by user space.
      
        The third commit fixes a bug in the vfio ccw translation code"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/mm: fix BUG_ON in crst_table_upgrade
        s390/mm: fork vs. 5 level page tabel
        vfio: ccw: fix bad ptr math for TIC cda translation
      bba2a5b8
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · a1c516a6
      Linus Torvalds authored
      Pull crypto fixes from Herbert Xu:
       "This fixes the following issues:
      
         - Regression in chacha20 handling of chunked input
      
         - Crash in algif_skcipher when used with async io
      
         - Potential bogus pointer dereference in lib/mpi"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: algif_skcipher - only call put_page on referenced and used pages
        crypto: testmgr - add chunked test cases for chacha20
        crypto: chacha20 - fix handling of chunked input
        lib/mpi: kunmap after finishing accessing buffer
      a1c516a6
    • Yossi Kuperman's avatar
      udp: fix secpath leak · e8a732d1
      Yossi Kuperman authored
      After commit dce4551c ("udp: preserve head state for IP_CMSG_PASSSEC")
      we preserve the secpath for the whole skb lifecycle, but we also
      end up leaking a reference to it.
      
      We must clear the head state on skb reception, if secpath is
      present.
      
      Fixes: dce4551c ("udp: preserve head state for IP_CMSG_PASSSEC")
      Signed-off-by: default avatarYossi Kuperman <yossiku@mellanox.com>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e8a732d1
    • Ido Schimmel's avatar
      bridge: switchdev: Clear forward mark when transmitting packet · 79e99bdd
      Ido Schimmel authored
      Commit 6bc506b4 ("bridge: switchdev: Add forward mark support for
      stacked devices") added the 'offload_fwd_mark' bit to the skb in order
      to allow drivers to indicate to the bridge driver that they already
      forwarded the packet in L2.
      
      In case the bit is set, before transmitting the packet from each port,
      the port's mark is compared with the mark stored in the skb's control
      block. If both marks are equal, we know the packet arrived from a switch
      device that already forwarded the packet and it's not re-transmitted.
      
      However, if the packet is transmitted from the bridge device itself
      (e.g., br0), we should clear the 'offload_fwd_mark' bit as the mark
      stored in the skb's control block isn't valid.
      
      This scenario can happen in rare cases where a packet was trapped during
      L3 forwarding and forwarded by the kernel to a bridge device.
      
      Fixes: 6bc506b4 ("bridge: switchdev: Add forward mark support for stacked devices")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reported-by: default avatarYotam Gigi <yotamg@mellanox.com>
      Tested-by: default avatarYotam Gigi <yotamg@mellanox.com>
      Reviewed-by: default avatarJiri Pirko <jiri@mellanox.com>
      Acked-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      79e99bdd