Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1555313 > unrolled thread

[PATCH 4.9 000/206] 4.9.3-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.9 000/206] 4.9.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 054/206] USB: serial: io_edgeport: fix NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 090/206] usb: dwc3: gadget: always unmap EP0 requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 135/206] PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 008/206] fscrypt: fix renaming and linking special files Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 013/206] pinctrl/amd: Set the level based on ACPI tables Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 030/206] USB: gadgetfs: fix checks of wTotalLength in config descriptors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 009/206] parisc: Add line-break when printing segfault info Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 032/206] USB: dummy-hcd: fix bug in stop_activity (handle ep0) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 058/206] USB: serial: mos7840: fix NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 004/206] staging: octeon: Call SET_NETDEV_DEV() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 130/206] sbp-target: Fix second argument of percpu_ida_alloc() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 010/206] parisc: Mark cr16 clocksource unstable on SMP systems Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 050/206] USB: serial: io_ti: fix I/O after disconnect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 062/206] USB: serial: mos7720: fix parallel probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 088/206] usb: dwc3: ep0: add dwc3_ep0_prepare_one_trb() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 105/206] hwmon: (scpi) Fix module autoload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 085/206] mei: move write cb to completion on credentials failures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 061/206] USB: serial: mos7720: fix parport use-after-free on probe errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 064/206] xhci: Use delayed_work instead of timer for command timeout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 097/206] ath10k: use the right length of "background" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 110/206] hwmon: (lm90) fix temp1_max_alarm attribute Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 041/206] usb: xhci: hold lock over xhci_abort_cmd_ring() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 051/206] USB: serial: iuu_phoenix: fix NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 046/206] USB: serial: keyspan_pda: verify endpoints at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 095/206] ath10k: fix failure to send NULL func frame for 10.4 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 021/206] KVM: x86: reset MMU on KVM_SET_VCPU_EVENTS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 055/206] USB: serial: oti6858: fix NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 035/206] usb: xhci: fix possible wild pointer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 113/206] clk: clk-wm831x: fix a logic error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 107/206] hwmon: (ds620) Fix overflows seen when writing temperature limits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 014/206] mac80211: initialize fast-xmit info later Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 132/206] ima: fix memory leak in ima_release_policy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 042/206] usb: return error code when platform_get_irq fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 100/206] clk: renesas: cpg-mssr: Fix inverted debug check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 14:50 +0100
    [PATCH 4.9 191/206] xfs: handle cow fork in xfs_bmap_trace_exlist Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 172/206] tpm_tis: Check return values from get_burstcount. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 154/206] md: fix refcount problem on mddev when stopping array. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 205/206] clocksource/dummy_timer: Move hotplug callback after the real timers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 151/206] crypto: arm64/aes-xts-ce: fix for big endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 201/206] xfs: fix double-cleanup when CUI recovery fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 190/206] xfs: pass state not whichfork to trace_xfs_extlist Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 192/206] xfs: forbid AG btrees with level == 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 178/206] xfs: check minimum block size for CRC filesystems Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 199/206] xfs: ignore leaf attr ichdr.count in verifier during log replay Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 177/206] xfs: provide helper for counting extents from if_bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 169/206] drm/i915: disable PSR by default on HSW/BDW Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 187/206] xfs: use new extent lookup helpers xfs_file_iomap_begin_delay Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 148/206] crypto: arm64/aes-ccm-ce: fix for big endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 157/206] [media] staging: media: davinci_vpfe: unlock on error in vpfe_reqbufs() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 161/206] PCI: Convert broken INTx masking quirks from HEADER to FINAL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 202/206] xfs: use the actual AG length when reserving blocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 181/206] xfs: factor rmap btree size into the indlen calculations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 174/206] xfs: check return value of _trans_reserve_quota_nblks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 118/206] clk: renesas: mstp: Support 8-bit registers for r7s72100 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 164/206] PCI: Enable access to non-standard VPD for Chelsio devices (cxgb3) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 162/206] PCI: Convert Mellanox broken INTx quirks to be for listed devices only Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 163/206] PCI: Support INTx masking on ConnectX-4 with firmware x.14.1100+ Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 141/206] mm: khugepaged: close use-after-free race during shmem collapsing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 193/206] xfs: check for bogus values in btree block headers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 158/206] PCI: rockchip: Fix negotiated lanes calculation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 185/206] xfs: use new extent lookup helpers in __xfs_reflink_reserve_cow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 183/206] xfs: remove prev argument to xfs_bmapi_reserve_delalloc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 197/206] xfs: dont allow di_size with high bit set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 165/206] powerpc/pci/rpadlpar: Fix device reference leaks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 139/206] mm/hugetlb.c: use the right pte val for compare in hugetlb_cow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 206/206] tick/broadcast: Prevent NULL pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 194/206] xfs: complain if we dont get nextents bmap records Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 120/206] iommu/amd: Fix the left value check of cmd buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 173/206] xfs: dont call xfs_sb_quota_from_disk twice Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 195/206] xfs: dont crash if reading a directory results in an unexpected hole Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 186/206] xfs: clean up cow fork reservation and tag inodes correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 146/206] crypto: arm64/ghash-ce - fix for big endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 152/206] crypto: arm64/aes-ce - fix for big endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 196/206] xfs: error out if trying to add attrs and anextents > 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 160/206] PCI: Add Mellanox device IDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 170/206] drm/i915/gen9: unconditionally apply the memory bandwidth WA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 200/206] xfs: use GPF_NOFS when allocating btree cursors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 159/206] PCI: rockchip: Correct the use of FTS mask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 149/206] crypto: arm64/aes-neon - fix for big endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 188/206] xfs: pass post-eof speculative prealloc blocks to bmapi Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 198/206] xfs: dont cap maximum dedupe request length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 203/206] xfs: fix crash and data corruption due to removal of busy COW extents Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 204/206] xfs: fix max_retries _show and _store functions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:00 +0100
    [PATCH 4.9 112/206] clk: qcom: ipq806x: Fix board clk rates Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 179/206] xfs: fix unbalanced inode reclaim flush locking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 167/206] s390/pci: fix dma address calculation in map_sg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 189/206] xfs: Move AGI buffer type setting to xfs_read_agi Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 166/206] s390/topology: always use s390 specific sched_domain_topology_level Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 171/206] drm/i915/gen9: fix the WM memory bandwidth WA for Y tiling cases Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 176/206] xfs: dont BUG() on mixed direct and mapped I/O Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 119/206] iommu/amd: Missing error code in amd_iommu_init_device() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 155/206] f2fs: remove percpu_count due to performance regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 182/206] xfs: always succeed when deduping zero bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 121/206] iommu/vt-d: Fix pasid table size encoding Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 184/206] xfs: track preallocation separately in xfs_bmapi_reserve_delalloc() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 175/206] xfs: dont skip cow forks w/ delalloc blocks in cowblocks scan Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 180/206] xfs: new inode extent list lookup helpers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:10 +0100
    [PATCH 4.9 150/206] crypto: arm64/sha1-ce - fix for big endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 153/206] md: MD_RECOVERY_NEEDED is set for mddev->recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 143/206] mm, compaction: fix NR_ISOLATED_* stats for pfn based migration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 140/206] docs-rst: fix LaTeX \DURole renewcommand with Sphinx 1.3+ Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 144/206] s390/crypto: unlock on error in prng_tdes_read() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 136/206] genirq/affinity: Fix node generation from cpumask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 147/206] crypto: arm/aes-ce - fix for big endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 134/206] irqchip/bcm7038-l1: Implement irq_cpu_offline() callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 115/206] clk: sunxi-ng: sun8i-a23: Set CLK_SET_RATE_PARENT for audio module clocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 145/206] crypto: arm64/sha2-ce - fix for big endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 116/206] clk: sunxi-ng: sun8i-h3: Set CLK_SET_RATE_PARENT for audio module clocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 142/206] mm: khugepaged: fix radix tree node leak in shmem collapse error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 138/206] rpmsg: qcom_smd: Correct return value for O_NONBLOCK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:30 +0100
    [PATCH 4.9 108/206] hwmon: (nct7802) Fix overflows seen when writing into limit attributes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 077/206] ARM: dts: r8a7794: Correct hsusb parent clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 133/206] PCI/MSI: Check for NULL affinity mask in pci_irq_get_affinity() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 103/206] x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 109/206] hwmon: (g762) Fix overflows and crash seen when writing limit attributes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 096/206] mfd: tps65217: Fix page fault on unloading modules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 098/206] cris: Only build flash rescue image if CONFIG_ETRAX_AXISFLASHMAP is selected Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 126/206] ASoC: samsung: i2s: Fixup last IRQ unsafe spin lock call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 114/206] clk: ti: dra7: fix "failed to lookup clock node gmac_gmii_ref_clk_div" boot message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 128/206] scsi: mvsas: fix command_active typo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 111/206] Input: synaptics-rmi4 - unlock on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 079/206] arm64: dts: hip06: Correct hardware pin number of usb node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 075/206] usb: gadget: Fix second argument of percpu_ida_alloc() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 074/206] USB: serial: kl5kusb105: abort on open exception path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 129/206] target/iscsi: Fix double free in lio_target_tiqn_addtpg() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 073/206] ALSA: usb-audio: Fix bogus error return in snd_usb_create_stream() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 125/206] ASoC: Intel: Skylake: Fix a shift wrapping bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 106/206] hwmon: (amc6821) sign extension temperature Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 122/206] iommu/vt-d: Flush old iommu caches for kdump when the device gets context mapped Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:40 +0100
    [PATCH 4.9 033/206] usb: gadget: composite: Test get_alt() presence instead of set_alt() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 026/206] usb: storage: unusual_uas: Add JMicron JMS56x to unusual device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 052/206] USB: serial: garmin_gps: fix memory leak on failed URB submit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 056/206] USB: serial: cyberjack: fix NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 034/206] usb: dwc3: core: avoid Overflow events Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 066/206] usb: dwc3: pci: add Intel Gemini Lake PCI ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 063/206] usb: xhci-mem: use passed in GFP flags instead of GFP_KERNEL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 065/206] xhci: Fix race related to abort operation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 053/206] USB: serial: ti_usb_3410_5052: fix NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 029/206] USB: gadgetfs: fix use-after-free bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 060/206] USB: serial: mos7720: fix use-after-free on probe errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 094/206] nl80211: Use different attrs for BSSID and random MAC addr in scan req Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 057/206] USB: serial: kobil_sct: fix NULL-deref in write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 093/206] mac80211: fix tid_agg_rx NULL dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 068/206] usb: dwc3: gadget: Fix full speed mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 084/206] mei: bus: fix mei_cldev_enable KDoc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 082/206] USB: serial: io_ti: bind to interface after fw download Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 048/206] USB: serial: io_ti: fix NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 031/206] USB: fix problems with duplicate endpoint addresses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 081/206] [media] dibusb: fix possible memory leak in dibusb_rc_query() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 049/206] USB: serial: io_ti: fix another NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 15:50 +0100
    [PATCH 4.9 038/206] usb: xhci: fix return value of xhci_setup_device() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 007/206] ALSA: usb-audio: Fix irq/process data synchronization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 012/206] ARM: davinci: da850: dont add emac clock to lookup table twice Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 036/206] usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Apollo Lake Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 044/206] USB: serial: quatech2: fix sleep-while-atomic in close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 005/206] ALSA: hda - Fix up GPIO for ASUS ROG Ranger Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 001/206] iio: common: st_sensors: fix channel data parsing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 040/206] xhci: Handle command completion and timeout race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 027/206] usb: gadgetfs: restrict upper bound on device configuration size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 011/206] HID: sensor-hub: Move the memset to sensor_hub_get_feature() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 006/206] ALSA: hda - Apply asus-mode8 fixup to ASUS X71SL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 039/206] usb: host: xhci: Fix possible wild pointer when handling abort command Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 025/206] usb: musb: dsps: implement clear_ep_rxintr() callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 047/206] USB: serial: spcp8x5: fix NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 043/206] USB: serial: omninet: fix NULL-derefs at open and disconnect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 002/206] iio: max44000: correct value in illuminance_integration_time_available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    [PATCH 4.9 028/206] USB: gadgetfs: fix unbounded memory allocation bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:00 +0100
    Re: [PATCH 4.9 000/206] 4.9.3-stable review Shuah Khan <shuah.kh@samsung.com> - 2017-01-10 18:40 +0100
      Re: [PATCH 4.9 000/206] 4.9.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 18:50 +0100
    Re: [PATCH 4.9 000/206] 4.9.3-stable review Guenter Roeck <linux@roeck-us.net> - 2017-01-10 23:30 +0100
      Re: [PATCH 4.9 000/206] 4.9.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-11 08:00 +0100
        Re: [PATCH 4.9 000/206] 4.9.3-stable review Guenter Roeck <linux@roeck-us.net> - 2017-01-11 12:10 +0100

Page 8 of 9 — ← Prev page 1 2 3 4 5 6 7 [8] 9  Next page →

#1555506 — [PATCH 4.9 060/206] USB: serial: mos7720: fix use-after-free on probe errors

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 91a1ff4d53c5184d383d0baeeaeab6f9736f2ff3 upstream.

The interrupt URB was submitted on probe but never stopped on probe
errors. This can lead to use-after-free issues in the completion
handler when accessing the freed usb-serial struct:

Unable to handle kernel paging request at virtual address 6b6b6be7
...
[<bf052e70>] (mos7715_interrupt_callback [mos7720]) from [<c052a894>] (__usb_hcd_giveback_urb+0x80/0x140)
[<c052a894>] (__usb_hcd_giveback_urb) from [<c052a9a4>] (usb_hcd_giveback_urb+0x50/0x138)
[<c052a9a4>] (usb_hcd_giveback_urb) from [<c0550684>] (musb_giveback+0xc8/0x1cc)

Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/mos7720.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -1965,8 +1965,10 @@ static int mos7720_startup(struct usb_se
 #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
 	if (product == MOSCHIP_DEVICE_ID_7715) {
 		ret_val = mos7715_parport_init(serial);
-		if (ret_val < 0)
+		if (ret_val < 0) {
+			usb_kill_urb(serial->port[0]->interrupt_in_urb);
 			return ret_val;
+		}
 	}
 #endif
 	/* LSR For Port 1 */
@@ -1978,6 +1980,8 @@ static int mos7720_startup(struct usb_se
 
 static void mos7720_release(struct usb_serial *serial)
 {
+	usb_kill_urb(serial->port[0]->interrupt_in_urb);
+
 #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
 	/* close the parallel port */
 

[toc] | [prev] | [next] | [standalone]

#1555507 — [PATCH 4.9 094/206] nl80211: Use different attrs for BSSID and random MAC addr in scan req

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vamsi Krishna <vamsin@qti.qualcomm.com>

commit 2fa436b3a2a7009c11a3bc03fe0ff4c26e80fd87 upstream.

NL80211_ATTR_MAC was used to set both the specific BSSID to be scanned
and the random MAC address to be used when privacy is enabled. When both
the features are enabled, both the BSSID and the local MAC address were
getting same value causing Probe Request frames to go with unintended
DA. Hence, this has been fixed by using a different NL80211_ATTR_BSSID
attribute to set the specific BSSID (which was the more recent addition
in cfg80211) for a scan.

Backwards compatibility with old userspace software is maintained to
some extent by allowing NL80211_ATTR_MAC to be used to set the specific
BSSID when scanning without enabling random MAC address use.

Scanning with random source MAC address was introduced by commit
ad2b26abc157 ("cfg80211: allow drivers to support random MAC addresses
for scan") and the issue was introduced with the addition of the second
user for the same attribute in commit 818965d39177 ("cfg80211: Allow a
scan request for a specific BSSID").

Fixes: 818965d39177 ("cfg80211: Allow a scan request for a specific BSSID")
Signed-off-by: Vamsi Krishna <vamsin@qti.qualcomm.com>
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/uapi/linux/nl80211.h |    7 ++++++-
 net/wireless/nl80211.c       |   16 +++++++++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -323,7 +323,7 @@
  * @NL80211_CMD_GET_SCAN: get scan results
  * @NL80211_CMD_TRIGGER_SCAN: trigger a new scan with the given parameters
  *	%NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the
- *	probe requests at CCK rate or not. %NL80211_ATTR_MAC can be used to
+ *	probe requests at CCK rate or not. %NL80211_ATTR_BSSID can be used to
  *	specify a BSSID to scan for; if not included, the wildcard BSSID will
  *	be used.
  * @NL80211_CMD_NEW_SCAN_RESULTS: scan notification (as a reply to
@@ -1937,6 +1937,9 @@ enum nl80211_commands {
  * @NL80211_ATTR_NAN_MATCH: used to report a match. This is a nested attribute.
  *	See &enum nl80211_nan_match_attributes.
  *
+ * @NL80211_ATTR_BSSID: The BSSID of the AP. Note that %NL80211_ATTR_MAC is also
+ *	used in various commands/events for specifying the BSSID.
+ *
  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
@@ -2336,6 +2339,8 @@ enum nl80211_attrs {
 	NL80211_ATTR_NAN_FUNC,
 	NL80211_ATTR_NAN_MATCH,
 
+	NL80211_ATTR_BSSID,
+
 	/* add attributes here, update the policy in nl80211.c */
 
 	__NL80211_ATTR_AFTER_LAST,
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -414,6 +414,7 @@ static const struct nla_policy nl80211_p
 	[NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
 	[NL80211_ATTR_NAN_DUAL] = { .type = NLA_U8 },
 	[NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
+	[NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 };
 
 /* policy for the key attributes */
@@ -6677,7 +6678,20 @@ static int nl80211_trigger_scan(struct s
 	request->no_cck =
 		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
 
-	if (info->attrs[NL80211_ATTR_MAC])
+	/* Initial implementation used NL80211_ATTR_MAC to set the specific
+	 * BSSID to scan for. This was problematic because that same attribute
+	 * was already used for another purpose (local random MAC address). The
+	 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
+	 * compatibility with older userspace components, also use the
+	 * NL80211_ATTR_MAC value here if it can be determined to be used for
+	 * the specific BSSID use case instead of the random MAC address
+	 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
+	 */
+	if (info->attrs[NL80211_ATTR_BSSID])
+		memcpy(request->bssid,
+		       nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
+	else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
+		 info->attrs[NL80211_ATTR_MAC])
 		memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
 		       ETH_ALEN);
 	else

[toc] | [prev] | [next] | [standalone]

#1555508 — [PATCH 4.9 057/206] USB: serial: kobil_sct: fix NULL-deref in write

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 21ce57840243c7b70fbc1ebd3dceeb70bb6e9e09 upstream.

Fix NULL-pointer dereference in write() should the device lack the
expected interrupt-out endpoint:

Unable to handle kernel NULL pointer dereference at virtual address 00000054
...
PC is at kobil_write+0x144/0x2a0 [kobil_sct]

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/kobil_sct.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -51,6 +51,7 @@
 
 
 /* Function prototypes */
+static int kobil_attach(struct usb_serial *serial);
 static int kobil_port_probe(struct usb_serial_port *probe);
 static int kobil_port_remove(struct usb_serial_port *probe);
 static int  kobil_open(struct tty_struct *tty, struct usb_serial_port *port);
@@ -86,6 +87,7 @@ static struct usb_serial_driver kobil_de
 	.description =		"KOBIL USB smart card terminal",
 	.id_table =		id_table,
 	.num_ports =		1,
+	.attach =		kobil_attach,
 	.port_probe =		kobil_port_probe,
 	.port_remove =		kobil_port_remove,
 	.ioctl =		kobil_ioctl,
@@ -113,6 +115,16 @@ struct kobil_private {
 };
 
 
+static int kobil_attach(struct usb_serial *serial)
+{
+	if (serial->num_interrupt_out < serial->num_ports) {
+		dev_err(&serial->interface->dev, "missing interrupt-out endpoint\n");
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
 static int kobil_port_probe(struct usb_serial_port *port)
 {
 	struct usb_serial *serial = port->serial;

[toc] | [prev] | [next] | [standalone]

#1555509 — [PATCH 4.9 093/206] mac80211: fix tid_agg_rx NULL dereference

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Berg <johannes.berg@intel.com>

commit 1c3d185a9a0b136a58e73b02912d593d0303d1da upstream.

On drivers setting the SUPPORTS_REORDERING_BUFFER hardware flag,
we crash when the peer sends an AddBA request while we already
have a session open on the seame TID; this is because on those
drivers, the tid_agg_rx is left NULL even though the session is
valid, and the agg_session_valid bit is set.

To fix this, store the dialog tokens outside the tid_agg_rx to
be able to compare them to the received AddBA request.

Fixes: f89e07d4cf26 ("mac80211: agg-rx: refuse ADDBA Request with timeout update")
Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/agg-rx.c      |    8 ++------
 net/mac80211/debugfs_sta.c |    2 +-
 net/mac80211/sta_info.h    |    4 ++--
 3 files changed, 5 insertions(+), 9 deletions(-)

--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -315,11 +315,7 @@ void __ieee80211_start_rx_ba_session(str
 	mutex_lock(&sta->ampdu_mlme.mtx);
 
 	if (test_bit(tid, sta->ampdu_mlme.agg_session_valid)) {
-		tid_agg_rx = rcu_dereference_protected(
-				sta->ampdu_mlme.tid_rx[tid],
-				lockdep_is_held(&sta->ampdu_mlme.mtx));
-
-		if (tid_agg_rx->dialog_token == dialog_token) {
+		if (sta->ampdu_mlme.tid_rx_token[tid] == dialog_token) {
 			ht_dbg_ratelimited(sta->sdata,
 					   "updated AddBA Req from %pM on tid %u\n",
 					   sta->sta.addr, tid);
@@ -396,7 +392,6 @@ void __ieee80211_start_rx_ba_session(str
 	}
 
 	/* update data */
-	tid_agg_rx->dialog_token = dialog_token;
 	tid_agg_rx->ssn = start_seq_num;
 	tid_agg_rx->head_seq_num = start_seq_num;
 	tid_agg_rx->buf_size = buf_size;
@@ -418,6 +413,7 @@ end:
 	if (status == WLAN_STATUS_SUCCESS) {
 		__set_bit(tid, sta->ampdu_mlme.agg_session_valid);
 		__clear_bit(tid, sta->ampdu_mlme.unexpected_agg);
+		sta->ampdu_mlme.tid_rx_token[tid] = dialog_token;
 	}
 	mutex_unlock(&sta->ampdu_mlme.mtx);
 
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -205,7 +205,7 @@ static ssize_t sta_agg_status_read(struc
 		p += scnprintf(p, sizeof(buf) + buf - p, "%02d", i);
 		p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x", !!tid_rx);
 		p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
-				tid_rx ? tid_rx->dialog_token : 0);
+				tid_rx ? sta->ampdu_mlme.tid_rx_token[i] : 0);
 		p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.3x",
 				tid_rx ? tid_rx->ssn : 0);
 
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -184,7 +184,6 @@ struct tid_ampdu_tx {
  * @ssn: Starting Sequence Number expected to be aggregated.
  * @buf_size: buffer size for incoming A-MPDUs
  * @timeout: reset timer value (in TUs).
- * @dialog_token: dialog token for aggregation session
  * @rcu_head: RCU head used for freeing this struct
  * @reorder_lock: serializes access to reorder buffer, see below.
  * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
@@ -213,7 +212,6 @@ struct tid_ampdu_rx {
 	u16 ssn;
 	u16 buf_size;
 	u16 timeout;
-	u8 dialog_token;
 	bool auto_seq;
 	bool removed;
 };
@@ -225,6 +223,7 @@ struct tid_ampdu_rx {
  *	to tid_tx[idx], which are protected by the sta spinlock)
  *	tid_start_tx is also protected by sta->lock.
  * @tid_rx: aggregation info for Rx per TID -- RCU protected
+ * @tid_rx_token: dialog tokens for valid aggregation sessions
  * @tid_rx_timer_expired: bitmap indicating on which TIDs the
  *	RX timer expired until the work for it runs
  * @tid_rx_stop_requested:  bitmap indicating which BA sessions per TID the
@@ -243,6 +242,7 @@ struct sta_ampdu_mlme {
 	struct mutex mtx;
 	/* rx */
 	struct tid_ampdu_rx __rcu *tid_rx[IEEE80211_NUM_TIDS];
+	u8 tid_rx_token[IEEE80211_NUM_TIDS];
 	unsigned long tid_rx_timer_expired[BITS_TO_LONGS(IEEE80211_NUM_TIDS)];
 	unsigned long tid_rx_stop_requested[BITS_TO_LONGS(IEEE80211_NUM_TIDS)];
 	unsigned long agg_session_valid[BITS_TO_LONGS(IEEE80211_NUM_TIDS)];

[toc] | [prev] | [next] | [standalone]

#1555510 — [PATCH 4.9 068/206] usb: dwc3: gadget: Fix full speed mode

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Roger Quadros <rogerq@ti.com>

commit 9418ee15f718939aa7e650fd586d73765eb21f20 upstream.

DCFG.DEVSPD == 0x3 is not valid and we need to set
DCFG.DEVSPD to 0x1 for full speed mode. Same goes for
DSTS.CONNECTSPD.

Old databooks had 0x3 for full speed in 48MHz mode for
USB1.1 transceivers which was never supported. Newer databooks
don't mention 0x3 at all.

Cc: John Youn <John.Youn@synopsys.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/core.h   |    6 ++----
 drivers/usb/dwc3/gadget.c |    5 ++---
 2 files changed, 4 insertions(+), 7 deletions(-)

--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -301,9 +301,8 @@
 #define DWC3_DCFG_SUPERSPEED_PLUS (5 << 0)  /* DWC_usb31 only */
 #define DWC3_DCFG_SUPERSPEED	(4 << 0)
 #define DWC3_DCFG_HIGHSPEED	(0 << 0)
-#define DWC3_DCFG_FULLSPEED2	(1 << 0)
+#define DWC3_DCFG_FULLSPEED	(1 << 0)
 #define DWC3_DCFG_LOWSPEED	(2 << 0)
-#define DWC3_DCFG_FULLSPEED1	(3 << 0)
 
 #define DWC3_DCFG_NUMP_SHIFT	17
 #define DWC3_DCFG_NUMP(n)	(((n) >> DWC3_DCFG_NUMP_SHIFT) & 0x1f)
@@ -395,9 +394,8 @@
 #define DWC3_DSTS_SUPERSPEED_PLUS	(5 << 0) /* DWC_usb31 only */
 #define DWC3_DSTS_SUPERSPEED		(4 << 0)
 #define DWC3_DSTS_HIGHSPEED		(0 << 0)
-#define DWC3_DSTS_FULLSPEED2		(1 << 0)
+#define DWC3_DSTS_FULLSPEED		(1 << 0)
 #define DWC3_DSTS_LOWSPEED		(2 << 0)
-#define DWC3_DSTS_FULLSPEED1		(3 << 0)
 
 /* Device Generic Command Register */
 #define DWC3_DGCMD_SET_LMP		0x01
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1606,7 +1606,7 @@ static int __dwc3_gadget_start(struct dw
 			reg |= DWC3_DCFG_LOWSPEED;
 			break;
 		case USB_SPEED_FULL:
-			reg |= DWC3_DCFG_FULLSPEED1;
+			reg |= DWC3_DCFG_FULLSPEED;
 			break;
 		case USB_SPEED_HIGH:
 			reg |= DWC3_DCFG_HIGHSPEED;
@@ -2465,8 +2465,7 @@ static void dwc3_gadget_conndone_interru
 		dwc->gadget.ep0->maxpacket = 64;
 		dwc->gadget.speed = USB_SPEED_HIGH;
 		break;
-	case DWC3_DSTS_FULLSPEED2:
-	case DWC3_DSTS_FULLSPEED1:
+	case DWC3_DSTS_FULLSPEED:
 		dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(64);
 		dwc->gadget.ep0->maxpacket = 64;
 		dwc->gadget.speed = USB_SPEED_FULL;

[toc] | [prev] | [next] | [standalone]

#1555511 — [PATCH 4.9 084/206] mei: bus: fix mei_cldev_enable KDoc

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexander Usyskin <alexander.usyskin@intel.com>

commit 5026c9cb0744a9cd40242743ca91a5d712f468c6 upstream.

Adjust function name in KDoc.

Fixes: d49dc5e76fc9 (mei: bus: use mei_cldev_ prefix for the API functions)
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/mei/bus.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -408,7 +408,7 @@ bool mei_cldev_enabled(struct mei_cl_dev
 EXPORT_SYMBOL_GPL(mei_cldev_enabled);
 
 /**
- * mei_cldev_enable_device - enable me client device
+ * mei_cldev_enable - enable me client device
  *     create connection with me client
  *
  * @cldev: me client device

[toc] | [prev] | [next] | [standalone]

#1555513 — [PATCH 4.9 082/206] USB: serial: io_ti: bind to interface after fw download

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit e35d6d7c4e6532a89732cf4bace0e910ee684c88 upstream.

Bind to the interface, but do not register any ports, after having
downloaded the firmware. The device will still disconnect and
re-enumerate, but this way we avoid an error messages from being logged
as part of the process:

io_ti: probe of 1-1.3:1.0 failed with error -5

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/io_ti.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1499,8 +1499,7 @@ static int do_boot_mode(struct edgeport_
 
 		dev_dbg(dev, "%s - Download successful -- Device rebooting...\n", __func__);
 
-		/* return an error on purpose */
-		return -ENODEV;
+		return 1;
 	}
 
 stayinbootmode:

[toc] | [prev] | [next] | [standalone]

#1555515 — [PATCH 4.9 048/206] USB: serial: io_ti: fix NULL-deref at open

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit a323fefc6f5079844dc62ffeb54f491d0242ca35 upstream.

Fix NULL-pointer dereference when clearing halt at open should a
malicious device lack the expected endpoints when in download mode.

Unable to handle kernel NULL pointer dereference at virtual address 00000030
...
[<bf011ed8>] (edge_open [io_ti]) from [<bf000118>] (serial_port_activate+0x68/0x98 [usbserial])
[<bf000118>] (serial_port_activate [usbserial]) from [<c0470ca4>] (tty_port_open+0x9c/0xe8)
[<c0470ca4>] (tty_port_open) from [<bf000da0>] (serial_open+0x48/0x6c [usbserial])
[<bf000da0>] (serial_open [usbserial]) from [<c0469178>] (tty_open+0xcc/0x5cc)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/io_ti.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2549,6 +2549,13 @@ static int edge_startup(struct usb_seria
 	int status;
 	u16 product_id;
 
+	/* Make sure we have the required endpoints when in download mode. */
+	if (serial->interface->cur_altsetting->desc.bNumEndpoints > 1) {
+		if (serial->num_bulk_in < serial->num_ports ||
+				serial->num_bulk_out < serial->num_ports)
+			return -ENODEV;
+	}
+
 	/* create our private serial structure */
 	edge_serial = kzalloc(sizeof(struct edgeport_serial), GFP_KERNEL);
 	if (!edge_serial)

[toc] | [prev] | [next] | [standalone]

#1555516 — [PATCH 4.9 031/206] USB: fix problems with duplicate endpoint addresses

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Stern <stern@rowland.harvard.edu>

commit 0a8fd1346254974c3a852338508e4a4cddbb35f1 upstream.

When checking a new device's descriptors, the USB core does not check
for duplicate endpoint addresses.  This can cause a problem when the
sysfs files for those endpoints are created; trying to create multiple
files with the same name will provoke a WARNING:

WARNING: CPU: 2 PID: 865 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x8a/0xa0
sysfs: cannot create duplicate filename
'/devices/platform/dummy_hcd.0/usb2/2-1/2-1:64.0/ep_05'
Kernel panic - not syncing: panic_on_warn set ...

CPU: 2 PID: 865 Comm: kworker/2:1 Not tainted 4.9.0-rc7+ #34
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: usb_hub_wq hub_event
 ffff88006bee64c8 ffffffff81f96b8a ffffffff00000001 1ffff1000d7dcc2c
 ffffed000d7dcc24 0000000000000001 0000000041b58ab3 ffffffff8598b510
 ffffffff81f968f8 ffffffff850fee20 ffffffff85cff020 dffffc0000000000
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff81f96b8a>] dump_stack+0x292/0x398 lib/dump_stack.c:51
 [<ffffffff8168c88e>] panic+0x1cb/0x3a9 kernel/panic.c:179
 [<ffffffff812b80b4>] __warn+0x1c4/0x1e0 kernel/panic.c:542
 [<ffffffff812b8195>] warn_slowpath_fmt+0xc5/0x110 kernel/panic.c:565
 [<ffffffff819e70ca>] sysfs_warn_dup+0x8a/0xa0 fs/sysfs/dir.c:30
 [<ffffffff819e7308>] sysfs_create_dir_ns+0x178/0x1d0 fs/sysfs/dir.c:59
 [<     inline     >] create_dir lib/kobject.c:71
 [<ffffffff81fa1b07>] kobject_add_internal+0x227/0xa60 lib/kobject.c:229
 [<     inline     >] kobject_add_varg lib/kobject.c:366
 [<ffffffff81fa2479>] kobject_add+0x139/0x220 lib/kobject.c:411
 [<ffffffff82737a63>] device_add+0x353/0x1660 drivers/base/core.c:1088
 [<ffffffff82738d8d>] device_register+0x1d/0x20 drivers/base/core.c:1206
 [<ffffffff82cb77d3>] usb_create_ep_devs+0x163/0x260 drivers/usb/core/endpoint.c:195
 [<ffffffff82c9f27b>] create_intf_ep_devs+0x13b/0x200 drivers/usb/core/message.c:1030
 [<ffffffff82ca39d3>] usb_set_configuration+0x1083/0x18d0 drivers/usb/core/message.c:1937
 [<ffffffff82cc9e2e>] generic_probe+0x6e/0xe0 drivers/usb/core/generic.c:172
 [<ffffffff82caa7fa>] usb_probe_device+0xaa/0xe0 drivers/usb/core/driver.c:263

This patch prevents the problem by checking for duplicate endpoint
addresses during enumeration and skipping any duplicates.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/config.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -234,6 +234,16 @@ static int usb_parse_endpoint(struct dev
 	if (ifp->desc.bNumEndpoints >= num_ep)
 		goto skip_to_next_endpoint_or_interface_descriptor;
 
+	/* Check for duplicate endpoint addresses */
+	for (i = 0; i < ifp->desc.bNumEndpoints; ++i) {
+		if (ifp->endpoint[i].desc.bEndpointAddress ==
+		    d->bEndpointAddress) {
+			dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
+			    cfgno, inum, asnum, d->bEndpointAddress);
+			goto skip_to_next_endpoint_or_interface_descriptor;
+		}
+	}
+
 	endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
 	++ifp->desc.bNumEndpoints;
 

[toc] | [prev] | [next] | [standalone]

#1555517 — [PATCH 4.9 081/206] [media] dibusb: fix possible memory leak in dibusb_rc_query()

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wei Yongjun <weiyongjun1@huawei.com>

commit 1f5ecaf985c46889278f51fcb7bc143f60f4eb14 upstream.

'buf' is malloced in dibusb_rc_query() and should be freed before
leaving from the error handling cases, otherwise it will cause
memory leak.

Fixes: ff1c123545d7 ("[media] dibusb: handle error code on RC query")

Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/dvb-usb/dibusb-common.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/usb/dvb-usb/dibusb-common.c
+++ b/drivers/media/usb/dvb-usb/dibusb-common.c
@@ -382,9 +382,9 @@ int dibusb_rc_query(struct dvb_usb_devic
 	if (buf[0] != 0)
 		deb_info("key: %*ph\n", 5, buf);
 
+ret:
 	kfree(buf);
 
-ret:
 	return ret;
 }
 EXPORT_SYMBOL(dibusb_rc_query);

[toc] | [prev] | [next] | [standalone]

#1555518 — [PATCH 4.9 049/206] USB: serial: io_ti: fix another NULL-deref at open

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 4f9785cc99feeb3673993b471f646b4dbaec2cc1 upstream.

In case a device is left in "boot-mode" we must not register any port
devices in order to avoid a NULL-pointer dereference on open due to
missing endpoints. This could be used by a malicious device to trigger
an OOPS:

Unable to handle kernel NULL pointer dereference at virtual address 00000030
...
[<bf0caa84>] (edge_open [io_ti]) from [<bf0b0118>] (serial_port_activate+0x68/0x98 [usbserial])
[<bf0b0118>] (serial_port_activate [usbserial]) from [<c0470ca4>] (tty_port_open+0x9c/0xe8)
[<c0470ca4>] (tty_port_open) from [<bf0b0da0>] (serial_open+0x48/0x6c [usbserial])
[<bf0b0da0>] (serial_open [usbserial]) from [<c0469178>] (tty_open+0xcc/0x5cc)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/io_ti.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1508,7 +1508,7 @@ stayinbootmode:
 	dev_dbg(dev, "%s - STAYING IN BOOT MODE\n", __func__);
 	serial->product_info.TiMode = TI_MODE_BOOT;
 
-	return 0;
+	return 1;
 }
 
 static int ti_do_config(struct edgeport_port *port, int feature, int on)
@@ -2563,14 +2563,18 @@ static int edge_startup(struct usb_seria
 
 	mutex_init(&edge_serial->es_lock);
 	edge_serial->serial = serial;
+	INIT_DELAYED_WORK(&edge_serial->heartbeat_work, edge_heartbeat_work);
 	usb_set_serial_data(serial, edge_serial);
 
 	status = download_fw(edge_serial);
-	if (status) {
+	if (status < 0) {
 		kfree(edge_serial);
 		return status;
 	}
 
+	if (status > 0)
+		return 1;	/* bind but do not register any ports */
+
 	product_id = le16_to_cpu(
 			edge_serial->serial->dev->descriptor.idProduct);
 
@@ -2582,7 +2586,6 @@ static int edge_startup(struct usb_seria
 		}
 	}
 
-	INIT_DELAYED_WORK(&edge_serial->heartbeat_work, edge_heartbeat_work);
 	edge_heartbeat_schedule(edge_serial);
 
 	return 0;

[toc] | [prev] | [next] | [standalone]

#1555519 — [PATCH 4.9 038/206] usb: xhci: fix return value of xhci_setup_device()

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lu Baolu <baolu.lu@linux.intel.com>

commit 90797aee5d6902b49a453c97d83c326408aeb5a8 upstream.

xhci_setup_device() should return failure with correct error number
when xhci host has died, removed or halted.

During usb device enumeration, if usb host is not accessible (died,
removed or halted), the hc_driver->address_device() should return
a corresponding error code to usb core. But current xhci driver just
returns success. This misleads usb core to continue the enumeration
by reading the device descriptor, which will result in failure, and
users will get a misleading message like "device descriptor read/8,
error -110".

Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3783,8 +3783,10 @@ static int xhci_setup_device(struct usb_
 
 	mutex_lock(&xhci->mutex);
 
-	if (xhci->xhc_state)	/* dying, removing or halted */
+	if (xhci->xhc_state) {	/* dying, removing or halted */
+		ret = -ESHUTDOWN;
 		goto out;
+	}
 
 	if (!udev->slot_id) {
 		xhci_dbg_trace(xhci, trace_xhci_dbg_address,

[toc] | [prev] | [next] | [standalone]

#1555520 — [PATCH 4.9 007/206] ALSA: usb-audio: Fix irq/process data synchronization

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ioan-Adrian Ratiu <adi@adirat.com>

commit 1d0f953086f090a022f2c0e1448300c15372db46 upstream.

Commit 16200948d83 ("ALSA: usb-audio: Fix race at stopping the stream") was
incomplete causing another more severe kernel panic, so it got reverted.
This fixes both the original problem and its fallout kernel race/crash.

The original fix is to move the endpoint member NULL clearing logic inside
wait_clear_urbs() so the irq triggering the urb completion doesn't call
retire_capture/playback_urb() after the NULL clearing and generate a panic.

However this creates a new race between snd_usb_endpoint_start()'s call
to wait_clear_urbs() and the irq urb completion handler which again calls
retire_capture/playback_urb() leading to a new NULL dereference.

We keep the EP deactivation code in snd_usb_endpoint_start() because
removing it will break the EP reference counting (see [1] [2] for info),
however we don't need the "can_sleep" mechanism anymore because a new
function was introduced (snd_usb_endpoint_sync_pending_stop()) which
synchronizes pending stops and gets called inside the pcm prepare callback.

It also makes sense to remove can_sleep because it was also removed from
deactivate_urbs() signature in [3] so we benefit from more simplification.

[1] commit 015618b90 ("ALSA: snd-usb: Fix URB cancellation at stream start")
[2] commit e9ba389c5 ("ALSA: usb-audio: Fix scheduling-while-atomic bug in PCM capture stream")
[3] commit ccc1696d5 ("ALSA: usb-audio: simplify endpoint deactivation code")

Fixes: f8114f8583bb ("Revert "ALSA: usb-audio: Fix race at stopping the stream"")

Signed-off-by: Ioan-Adrian Ratiu <adi@adirat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/endpoint.c |   17 +++++++----------
 sound/usb/endpoint.h |    2 +-
 sound/usb/pcm.c      |   10 +++++-----
 3 files changed, 13 insertions(+), 16 deletions(-)

--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -534,6 +534,11 @@ static int wait_clear_urbs(struct snd_us
 			alive, ep->ep_num);
 	clear_bit(EP_FLAG_STOPPING, &ep->flags);
 
+	ep->data_subs = NULL;
+	ep->sync_slave = NULL;
+	ep->retire_data_urb = NULL;
+	ep->prepare_data_urb = NULL;
+
 	return 0;
 }
 
@@ -898,9 +903,7 @@ int snd_usb_endpoint_set_params(struct s
 /**
  * snd_usb_endpoint_start: start an snd_usb_endpoint
  *
- * @ep:		the endpoint to start
- * @can_sleep:	flag indicating whether the operation is executed in
- * 		non-atomic context
+ * @ep: the endpoint to start
  *
  * A call to this function will increment the use count of the endpoint.
  * In case it is not already running, the URBs for this endpoint will be
@@ -910,7 +913,7 @@ int snd_usb_endpoint_set_params(struct s
  *
  * Returns an error if the URB submission failed, 0 in all other cases.
  */
-int snd_usb_endpoint_start(struct snd_usb_endpoint *ep, bool can_sleep)
+int snd_usb_endpoint_start(struct snd_usb_endpoint *ep)
 {
 	int err;
 	unsigned int i;
@@ -924,8 +927,6 @@ int snd_usb_endpoint_start(struct snd_us
 
 	/* just to be sure */
 	deactivate_urbs(ep, false);
-	if (can_sleep)
-		wait_clear_urbs(ep);
 
 	ep->active_mask = 0;
 	ep->unlink_mask = 0;
@@ -1006,10 +1007,6 @@ void snd_usb_endpoint_stop(struct snd_us
 
 	if (--ep->use_count == 0) {
 		deactivate_urbs(ep, false);
-		ep->data_subs = NULL;
-		ep->sync_slave = NULL;
-		ep->retire_data_urb = NULL;
-		ep->prepare_data_urb = NULL;
 		set_bit(EP_FLAG_STOPPING, &ep->flags);
 	}
 }
--- a/sound/usb/endpoint.h
+++ b/sound/usb/endpoint.h
@@ -18,7 +18,7 @@ int snd_usb_endpoint_set_params(struct s
 				struct audioformat *fmt,
 				struct snd_usb_endpoint *sync_ep);
 
-int  snd_usb_endpoint_start(struct snd_usb_endpoint *ep, bool can_sleep);
+int  snd_usb_endpoint_start(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep);
 int  snd_usb_endpoint_activate(struct snd_usb_endpoint *ep);
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -218,7 +218,7 @@ int snd_usb_init_pitch(struct snd_usb_au
 	}
 }
 
-static int start_endpoints(struct snd_usb_substream *subs, bool can_sleep)
+static int start_endpoints(struct snd_usb_substream *subs)
 {
 	int err;
 
@@ -231,7 +231,7 @@ static int start_endpoints(struct snd_us
 		dev_dbg(&subs->dev->dev, "Starting data EP @%p\n", ep);
 
 		ep->data_subs = subs;
-		err = snd_usb_endpoint_start(ep, can_sleep);
+		err = snd_usb_endpoint_start(ep);
 		if (err < 0) {
 			clear_bit(SUBSTREAM_FLAG_DATA_EP_STARTED, &subs->flags);
 			return err;
@@ -260,7 +260,7 @@ static int start_endpoints(struct snd_us
 		dev_dbg(&subs->dev->dev, "Starting sync EP @%p\n", ep);
 
 		ep->sync_slave = subs->data_endpoint;
-		err = snd_usb_endpoint_start(ep, can_sleep);
+		err = snd_usb_endpoint_start(ep);
 		if (err < 0) {
 			clear_bit(SUBSTREAM_FLAG_SYNC_EP_STARTED, &subs->flags);
 			return err;
@@ -839,7 +839,7 @@ static int snd_usb_pcm_prepare(struct sn
 	/* for playback, submit the URBs now; otherwise, the first hwptr_done
 	 * updates for all URBs would happen at the same time when starting */
 	if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK)
-		ret = start_endpoints(subs, true);
+		ret = start_endpoints(subs);
 
  unlock:
 	snd_usb_unlock_shutdown(subs->stream->chip);
@@ -1655,7 +1655,7 @@ static int snd_usb_substream_capture_tri
 
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_START:
-		err = start_endpoints(subs, false);
+		err = start_endpoints(subs);
 		if (err < 0)
 			return err;
 

[toc] | [prev] | [next] | [standalone]

#1555521 — [PATCH 4.9 012/206] ARM: davinci: da850: dont add emac clock to lookup table twice

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bartosz Golaszewski <bgolaszewski@baylibre.com>

commit ef37427ac5677331145ab27a17e6f5f1b43f0c11 upstream.

Similarly to the aemif clock - this screws up the linked list of clock
children. Create a separate clock for mdio inheriting the rate from
emac_clk.

Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
[nsekhar@ti.com: add a comment over mdio_clk to explaing its existence +
		 commit headline updates]
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mach-davinci/da850.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/arch/arm/mach-davinci/da850.c
+++ b/arch/arm/mach-davinci/da850.c
@@ -319,6 +319,16 @@ static struct clk emac_clk = {
 	.gpsc		= 1,
 };
 
+/*
+ * In order to avoid adding the emac_clk to the clock lookup table twice (and
+ * screwing up the linked list in the process) create a separate clock for
+ * mdio inheriting the rate from emac_clk.
+ */
+static struct clk mdio_clk = {
+	.name		= "mdio",
+	.parent		= &emac_clk,
+};
+
 static struct clk mcasp_clk = {
 	.name		= "mcasp",
 	.parent		= &async3_clk,
@@ -494,7 +504,7 @@ static struct clk_lookup da850_clks[] =
 	CLK(NULL,		"arm",		&arm_clk),
 	CLK(NULL,		"rmii",		&rmii_clk),
 	CLK("davinci_emac.1",	NULL,		&emac_clk),
-	CLK("davinci_mdio.0",	"fck",		&emac_clk),
+	CLK("davinci_mdio.0",	"fck",		&mdio_clk),
 	CLK("davinci-mcasp.0",	NULL,		&mcasp_clk),
 	CLK("davinci-mcbsp.0",	NULL,		&mcbsp0_clk),
 	CLK("davinci-mcbsp.1",	NULL,		&mcbsp1_clk),

[toc] | [prev] | [next] | [standalone]

#1555527 — [PATCH 4.9 036/206] usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Apollo Lake

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wan Ahmad Zainie <wan.ahmad.zainie.wan.mohamad@intel.com>

commit 6c97cfc1a097b1e0786c836e92b7a72b4d031e25 upstream.

Intel Apollo Lake also requires XHCI_PME_STUCK_QUIRK.
Adding its PCI ID to quirk.

Signed-off-by: Wan Ahmad Zainie <wan.ahmad.zainie.wan.mohamad@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci-pci.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -165,7 +165,8 @@ static void xhci_pci_quirks(struct devic
 		 pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
 		 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
 		 pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
-		 pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI)) {
+		 pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
+		 pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) {
 		xhci->quirks |= XHCI_PME_STUCK_QUIRK;
 	}
 	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&

[toc] | [prev] | [next] | [standalone]

#1555528 — [PATCH 4.9 044/206] USB: serial: quatech2: fix sleep-while-atomic in close

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit f09d1886a41e9063b43da493ef0e845ac8afd2fa upstream.

The write URB was being killed using the synchronous interface while
holding a spin lock in close().

Simply drop the lock and busy-flag update, something which would have
been taken care of by the completion handler if the URB was in flight.

Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/quatech2.c |    4 ----
 1 file changed, 4 deletions(-)

--- a/drivers/usb/serial/quatech2.c
+++ b/drivers/usb/serial/quatech2.c
@@ -408,16 +408,12 @@ static void qt2_close(struct usb_serial_
 {
 	struct usb_serial *serial;
 	struct qt2_port_private *port_priv;
-	unsigned long flags;
 	int i;
 
 	serial = port->serial;
 	port_priv = usb_get_serial_port_data(port);
 
-	spin_lock_irqsave(&port_priv->urb_lock, flags);
 	usb_kill_urb(port_priv->write_urb);
-	port_priv->urb_in_use = false;
-	spin_unlock_irqrestore(&port_priv->urb_lock, flags);
 
 	/* flush the port transmit buffer */
 	i = usb_control_msg(serial->dev,

[toc] | [prev] | [next] | [standalone]

#1555530 — [PATCH 4.9 005/206] ALSA: hda - Fix up GPIO for ASUS ROG Ranger

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 85bcf96caba8b4a7c0805555638629ba3c67ea0c upstream.

ASUS ROG Ranger VIII with ALC1150 codec requires the extra GPIO pin to
up for the front panel.  Just use the existing fixup for setting up
the GPIO pins.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=189411
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2230,6 +2230,7 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
 	SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
+	SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
 	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),

[toc] | [prev] | [next] | [standalone]

#1555531 — [PATCH 4.9 001/206] iio: common: st_sensors: fix channel data parsing

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>

commit 65c8aea07de11b6507efa175edb44bd8b4488218 upstream.

Using realbits as i2c/spi read len, when that value is not byte aligned
(e.g 12 bits), lead to skip msb part of out data registers.
Fix this taking into account scan_type.shift in addition to
scan_type.realbits as read length:

read_len = DIV_ROUND_UP(realbits + shift, 8)

This fix has been tested on 8, 12, 16, 24 bit sensors

Fixes: e7385de5291e ("iio:st_sensors: align on storagebits boundaries")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@st.com>
Tested-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/common/st_sensors/st_sensors_buffer.c |    4 +++-
 drivers/iio/common/st_sensors/st_sensors_core.c   |    4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/iio/common/st_sensors/st_sensors_buffer.c
+++ b/drivers/iio/common/st_sensors/st_sensors_buffer.c
@@ -30,7 +30,9 @@ static int st_sensors_get_buffer_element
 
 	for_each_set_bit(i, indio_dev->active_scan_mask, num_data_channels) {
 		const struct iio_chan_spec *channel = &indio_dev->channels[i];
-		unsigned int bytes_to_read = channel->scan_type.realbits >> 3;
+		unsigned int bytes_to_read =
+			DIV_ROUND_UP(channel->scan_type.realbits +
+				     channel->scan_type.shift, 8);
 		unsigned int storage_bytes =
 			channel->scan_type.storagebits >> 3;
 
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -483,8 +483,10 @@ static int st_sensors_read_axis_data(str
 	int err;
 	u8 *outdata;
 	struct st_sensor_data *sdata = iio_priv(indio_dev);
-	unsigned int byte_for_channel = ch->scan_type.realbits >> 3;
+	unsigned int byte_for_channel;
 
+	byte_for_channel = DIV_ROUND_UP(ch->scan_type.realbits +
+					ch->scan_type.shift, 8);
 	outdata = kmalloc(byte_for_channel, GFP_KERNEL);
 	if (!outdata)
 		return -ENOMEM;

[toc] | [prev] | [next] | [standalone]

#1555533 — [PATCH 4.9 040/206] xhci: Handle command completion and timeout race

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mathias Nyman <mathias.nyman@linux.intel.com>

commit a5a1b9514154437aa1ed35c291191f82fd3e941a upstream.

If we get a command completion event at the same time as the command
timeout work starts on another cpu we might end up aborting the wrong
command.

If the command completion takes the xhci lock before the timeout work, it
will handle the command, pick the next command, mark it as current_cmd, and
re-queue the timeout work. When the timeout work finally gets the lock
It will start aborting the wrong command.

This case can be resolved by checking if the timeout work is pending inside
the timeout function itself. A new timeout work can only be pending if the
command completed and a new command was queued.

If there are no more commands pending then command completion will set
the current_cmd to NULL, which is already handled in the timeout work.

Reported-by: Baolin Wang <baolin.wang@linaro.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci-ring.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1273,7 +1273,11 @@ void xhci_handle_command_timeout(unsigne
 
 	spin_lock_irqsave(&xhci->lock, flags);
 
-	if (!xhci->current_cmd) {
+	/*
+	 * If timeout work is pending, or current_cmd is NULL, it means we
+	 * raced with command completion. Command is handled so just return.
+	 */
+	if (!xhci->current_cmd || timer_pending(&xhci->cmd_timer)) {
 		spin_unlock_irqrestore(&xhci->lock, flags);
 		return;
 	}

[toc] | [prev] | [next] | [standalone]

#1555534 — [PATCH 4.9 027/206] usb: gadgetfs: restrict upper bound on device configuration size

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0994b0a257557e18ee8f0b7c5f0f73fe2b54eec1 upstream.

Andrey Konovalov reported that we were not properly checking the upper
limit before of a device configuration size before calling
memdup_user(), which could cause some problems.

So set the upper limit to PAGE_SIZE * 4, which should be good enough for
all devices.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/legacy/inode.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1762,7 +1762,8 @@ dev_config (struct file *fd, const char
 	}
 	spin_unlock_irq(&dev->lock);
 
-	if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4))
+	if ((len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) ||
+	    (len > PAGE_SIZE * 4))
 		return -EINVAL;
 
 	/* we might need to change message format someday */

[toc] | [prev] | [next] | [standalone]

Page 8 of 9 — ← Prev page 1 2 3 4 5 6 7 [8] 9  Next page →

Back to top | Article view | linux.kernel

csiph-web