[linux] 01/01: Revert "xhci: don't finish a TD if we get a short transfer event mid TD"

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch jessie-security
in repository linux.

commit 0d64559e099b97afea7d60d9cf05409ddf5eb213
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Sat Jan 2 03:08:04 2016 +0000

    Revert "xhci: don't finish a TD if we get a short transfer event mid TD"
    
    Closes: #808602, #808953, regression in 3.16.7-ckt20
---
 debian/changelog                                   |  2 ++
 ...-t-finish-a-td-if-we-get-a-short-transfer.patch | 37 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 40 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 52dea2e..867501c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -12,6 +12,8 @@ linux (3.16.7-ckt20-1+deb8u2) UNRELEASED; urgency=medium
     (CVE-2015-7513)
   * udp: properly support MSG_PEEK with truncated buffers
     (Closes: #808293, regression in 3.16.7-ckt17)
+  * Revert "xhci: don't finish a TD if we get a short transfer event mid TD"
+    (Closes: #808602, #808953, regression in 3.16.7-ckt20)
 
  -- Ben Hutchings <ben at decadent.org.uk>  Sun, 27 Dec 2015 14:20:54 +0000
 
diff --git a/debian/patches/bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch b/debian/patches/bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch
new file mode 100644
index 0000000..a0fe6ae
--- /dev/null
+++ b/debian/patches/bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch
@@ -0,0 +1,37 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Sat, 02 Jan 2016 03:03:27 +0000
+Subject: Revert "xhci: don't finish a TD if we get a short transfer event mid TD"
+Bug-Debian: https://bugs.debian.org/808602
+Bug-Debian: https://bugs.debian.org/808953
+
+This reverts commit dbd81f75b991c972970764ba75287cbbc8f066be, which
+was commit e210c422b6fdd2dc123bedc588f399aefd8bf9de upstream.  It
+caused serious regressions as referenced above.
+
+---
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2191,10 +2191,6 @@ static int process_bulk_intr_td(struct x
+ 				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
+ 	/* Fast path - was this the last TRB in the TD for this URB? */
+ 	if (event_trb == td->last_trb) {
+-		if (td->urb_length_set && trb_comp_code == COMP_SHORT_TX)
+-			return finish_td(xhci, td, event_trb, event, ep,
+-					 status, false);
+-
+ 		if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+ 			td->urb->actual_length =
+ 				td->urb->transfer_buffer_length -
+@@ -2246,12 +2242,6 @@ static int process_bulk_intr_td(struct x
+ 			td->urb->actual_length +=
+ 				TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
+ 				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+-
+-		if (trb_comp_code == COMP_SHORT_TX) {
+-			xhci_dbg(xhci, "mid bulk/intr SP, wait for last TRB event\n");
+-			td->urb_length_set = true;
+-			return 0;
+-		}
+ 	}
+ 
+ 	return finish_td(xhci, td, event_trb, event, ep, status, false);
diff --git a/debian/patches/series b/debian/patches/series
index bd98bbd..f22c3f2 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -669,3 +669,4 @@ bugfix/all/keys-fix-race-between-read-and-revoke.patch
 bugfix/x86/KVM-x86-Reload-pit-counters-for-all-channels-when-re.patch
 bugfix/all/revert-net-add-length-argument-to-skb_copy_and_csum_datagram_iovec.patch
 bugfix/all/udp-properly-support-msg_peek-with-truncated-buffers.patch
+bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git