20 Sep, 2018

10 commits

  • Functions typec_mux_get() and typec_switch_get() already
    make sure that the mux device reference count is
    incremented, but the same must be done to the driver module
    as well to prevent the drivers from being unloaded in the
    middle of operation.

    This fixes a potential "BUG: unable to handle kernel paging
    request at ..." from happening.

    Fixes: 93dd2112c7b2 ("usb: typec: mux: Get the mux identifier from function parameter")
    Acked-by: Hans de Goede
    Tested-by: Hans de Goede
    Signed-off-by: Heikki Krogerus
    Signed-off-by: Greg Kroah-Hartman

    Heikki Krogerus
     
  • Applying dynamic usbcore quirks in early booting when the slab is
    not yet ready would cause kernel panic of null pointer dereference
    because the quirk_count has been counted as 1 while the quirk_list
    was failed to allocate.

    i.e.,
    [ 1.044970] BUG: unable to handle kernel NULL pointer dereference at (null)
    [ 1.044995] IP: [] usb_detect_quirks+0x88/0xd1
    [ 1.045016] PGD 0
    [ 1.045026] Oops: 0000 [#1] PREEMPT SMP
    [ 1.046986] gsmi: Log Shutdown Reason 0x03
    [ 1.046995] Modules linked in:
    [ 1.047008] CPU: 0 PID: 81 Comm: kworker/0:3 Not tainted 4.4.154 #28
    [ 1.047016] Hardware name: Google Coral/Coral, BIOS Google_Coral.10068.27.0 12/04/2017
    [ 1.047028] Workqueue: usb_hub_wq hub_event
    [ 1.047037] task: ffff88017a321c80 task.stack: ffff88017a384000
    [ 1.047044] RIP: 0010:[] [] usb_detect_quirks+0x88/0xd1

    To tackle this odd, let's balance the quirk_count to 0 when the kcalloc
    call fails, and defer the quirk setting into a lower level callback
    which ensures that the kernel memory management has been initialized.

    Fixes: 027bd6cafd9a ("usb: core: Add "quirks" parameter for usbcore")
    Signed-off-by: Harry Pan
    Acked-by: Kai-Heng Feng
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Harry Pan
     
  • This fixes potential "BUG: unable to handle kernel paging
    request at ..." from happening.

    Fixes: fde0aa6c175a ("usb: common: Small class for USB role switches")
    Cc:
    Acked-by: Hans de Goede
    Tested-by: Hans de Goede
    Signed-off-by: Heikki Krogerus
    Signed-off-by: Greg Kroah-Hartman

    Heikki Krogerus
     
  • usb_find_alt_setting() takes a pointer to a struct usb_host_config as
    an argument; it searches for an interface with specified interface and
    alternate setting numbers in that config. However, it crashes if the
    usb_host_config pointer argument is NULL.

    Since this is a general-purpose routine, available for use in many
    places, we want to to be more robust. This patch makes it return NULL
    whenever the config argument is NULL.

    Signed-off-by: Alan Stern
    Reported-by: syzbot+19c3aaef85a89d451eac@syzkaller.appspotmail.com
    CC:
    Signed-off-by: Greg Kroah-Hartman

    Alan Stern
     
  • The syzbot fuzzing project found a use-after-free bug in the USB
    core. The bug was caused by usbfs not unbinding from an interface
    when the USB device file was closed, which led another process to
    attempt the unbind later on, after the private data structure had been
    deallocated.

    The reason usbfs did not unbind the interface at the appropriate time
    was because it thought the interface had never been claimed in the
    first place. This was caused by the fact that
    usb_driver_claim_interface() does not clean up properly when
    device_bind_driver() returns an error. Although the error code gets
    passed back to the caller, the iface->dev.driver pointer remains set
    and iface->condition remains equal to USB_INTERFACE_BOUND.

    This patch adds proper error handling to usb_driver_claim_interface().

    Signed-off-by: Alan Stern
    Reported-by: syzbot+f84aa7209ccec829536f@syzkaller.appspotmail.com
    CC:
    Signed-off-by: Greg Kroah-Hartman

    Alan Stern
     
  • usb_driver_claim_interface() disables and re-enables Link Power
    Management, but it shouldn't do either one, for the reasons listed
    below. This patch removes the two LPM-related function calls from the
    routine.

    The reason for disabling LPM in the analogous function
    usb_probe_interface() is so that drivers won't have to deal with
    unwanted LPM transitions in their probe routine. But
    usb_driver_claim_interface() doesn't call the driver's probe routine
    (or any other callbacks), so that reason doesn't apply here.

    Furthermore, no driver other than usbfs will ever call
    usb_driver_claim_interface() unless it is already bound to another
    interface in the same device, which means disabling LPM here would be
    redundant. usbfs doesn't interact with LPM at all.

    Lastly, the error return from usb_unlocked_disable_lpm() isn't handled
    properly; the code doesn't clean up its earlier actions before
    returning.

    Signed-off-by: Alan Stern
    Fixes: 8306095fd2c1 ("USB: Disable USB 3.0 LPM in critical sections.")
    CC:
    Signed-off-by: Greg Kroah-Hartman

    Alan Stern
     
  • If we filter flags before they reach the core we need to generate our
    own warnings.

    Signed-off-by: Oliver Neukum
    Fixes: 0cb54a3e47cb ("USB: debugging code shouldn't alter control flow")
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Oliver Neukum
     
  • Requesting a ZERO_PACKET or not is sensible only for output.
    In the input direction the device decides.
    Likewise accepting short packets makes sense only for input.

    This allows operation with panic_on_warn without opening up
    a local DOS.

    Signed-off-by: Oliver Neukum
    Reported-by: syzbot+843efa30c8821bd69f53@syzkaller.appspotmail.com
    Fixes: 0cb54a3e47cb ("USB: debugging code shouldn't alter control flow")
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Oliver Neukum
     
  • This reverts commit 6e22e3af7bb3a7b9dc53cb4687659f6e63fca427.

    The bug the patch describes to, has been already fixed in commit
    2df6948428542 ("USB: cdc-wdm: don't enable interrupts in USB-giveback")
    so need to this, revert it.

    Fixes: 6e22e3af7bb3 ("usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()")
    Cc: stable
    Signed-off-by: Sebastian Andrzej Siewior
    Signed-off-by: Greg Kroah-Hartman

    Sebastian Andrzej Siewior
     
  • TI AM335x CPPI 4.1 module uses a single register bit for CPPI interrupts
    in both musb controllers. So disabling the CPPI irq in one musb driver
    breaks the other musb module.

    Since musb is already disabled before tearing down dma controller in
    musb_remove(), it is safe to not disable CPPI irq in
    musb_dma_controller_destroy().

    Fixes: 255348289f71 ("usb: musb: dsps: Manage CPPI 4.1 DMA interrupt in DSPS")
    Cc: stable@vger.kernel.org
    Signed-off-by: Bin Liu
    Signed-off-by: Greg Kroah-Hartman

    Bin Liu
     

11 Sep, 2018

3 commits

  • This reverts commit a81cf9799ad7299b03a4dff020d9685f9ac5f3e0.

    The patch causes a regression, which I cannot find the reason for.
    So let's revert for now, as a revert hurts only performance.

    Original report:
    I was trying to resolve the problem with Oliver but we don't get any conclusion
    for 5 months, so I am now sending this to mail list and cdc_acm authors.

    I am using simple request-response protocol to obtain the boiller parameters
    in constant intervals.

    A simple one transaction is:
    1. opening the /dev/ttyACM0
    2. sending the following 10-bytes request to the device:
    unsigned char req[] = {0x02, 0xfe, 0x01, 0x05, 0x08, 0x02, 0x01, 0x69, 0xab, 0x03};
    3. reading response (frame of 74 bytes length).
    4. closing the descriptor
    I am doing this transaction with 5 seconds intervals.

    Before the bad commit everything was working correctly: I've got a requests and
    a responses in a timely manner.

    After the bad commit more time I am using the kernel module, more problems I have.
    The graph [2] is showing the problem.

    As you can see after module load all seems fine but after about 30 minutes I've got
    a plenty of EAGAINs when doing read()'s and trying to read back the data.

    When I rmmod and insmod the cdc_acm module again, then the situation is starting
    over again: running ok shortly after load, and more time it is running, more EAGAINs
    I have when calling read().

    As a bonus I can see the problem on the device itself:
    The device is configured as you can see here on this screen [3].
    It has two transmision LEDs: TX and RX. Blink duration is set for 100ms.
    This is a recording before the bad commit when all is working fine: [4]
    And this is with the bad commit: [5]
    As you can see the TX led is blinking wrongly long (indicating transmission?)
    and I have problems doing read() calls (EAGAIN).

    Reported-by: Mariusz Bialonczyk
    Signed-off-by: Oliver Neukum
    Fixes: a81cf9799ad7 ("cdc-acm: implement put_char() and flush_chars()")
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Oliver Neukum
     
  • Since renesas_usb3 udc driver calls usb_of_get_companion_dev()
    which is on usb/core/of.c, build error like below happens if we
    disable CONFIG_USB because the usb/core/ needs CONFIG_USB:

    ERROR: "usb_of_get_companion_dev" [drivers/usb/gadget/udc/renesas_usb3.ko] undefined!

    According to the usb/gadget/Kconfig, "NOTE: Gadget support
    ** DOES NOT ** depend on host-side CONFIG_USB !!".
    So, to fix the issue, this patch changes the usb_of_get_companion_dev()
    place from usb/core/of.c to usb/common/common.c to be called by both
    host and gadget.

    Reported-by: John Garry
    Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
    Signed-off-by: Yoshihiro Shimoda
    Acked-by: Arnd Bergmann
    Signed-off-by: Greg Kroah-Hartman

    Yoshihiro Shimoda
     
  • The MTK xHCI controller use some reserved bytes in endpoint context for
    bandwidth scheduling, so need keep them in xhci_endpoint_copy();

    The issue is introduced by:
    commit f5249461b504 ("xhci: Clear the host side toggle manually when
    endpoint is soft reset")
    It resets endpoints and will drop bandwidth scheduling parameters used
    by interrupt or isochronous endpoints on MTK xHCI controller.
    Fixes: f5249461b504 ("xhci: Clear the host side toggle manually when
    endpoint is soft reset")

    Cc: stable@vger.kernel.org
    Signed-off-by: Chunfeng Yun
    Tested-by: Sean Wang
    Signed-off-by: Greg Kroah-Hartman

    Chunfeng Yun
     

06 Sep, 2018

1 commit


05 Sep, 2018

18 commits

  • …it/johan/usb-serial into usb-linus

    Johan writes:

    USB-serial fixes for v4.19-rc3

    Here are two fixes for array-underflow bugs in completion handlers due
    to insufficient sanity checks.

    All have been in linux-next with no reported issues.

    Signed-off-by: Johan Hovold <johan@kernel.org>

    Greg Kroah-Hartman
     
  • wdm_in_callback() is a completion handler function for the USB driver.
    So it should not sleep. But it calls service_outstanding_interrupt(),
    which calls usb_submit_urb() with GFP_KERNEL.

    To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.

    This bug is found by my static analysis tool DSAC.

    Signed-off-by: Jia-Ju Bai
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Jia-Ju Bai
     
  • async_complete() in uss720.c is a completion handler function for the
    USB driver. So it should not sleep, but it is can sleep according to the
    function call paths (from bottom to top) in Linux-4.16.

    [FUNC] set_1284_register(GFP_KERNEL)
    drivers/usb/misc/uss720.c, 372:
    set_1284_register in parport_uss720_frob_control
    drivers/parport/ieee1284.c, 560:
    [FUNC_PTR]parport_uss720_frob_control in parport_ieee1284_ack_data_avail
    drivers/parport/ieee1284.c, 577:
    parport_ieee1284_ack_data_avail in parport_ieee1284_interrupt
    ./include/linux/parport.h, 474:
    parport_ieee1284_interrupt in parport_generic_irq
    drivers/usb/misc/uss720.c, 116:
    parport_generic_irq in async_complete

    [FUNC] get_1284_register(GFP_KERNEL)
    drivers/usb/misc/uss720.c, 382:
    get_1284_register in parport_uss720_read_status
    drivers/parport/ieee1284.c, 555:
    [FUNC_PTR]parport_uss720_read_status in parport_ieee1284_ack_data_avail
    drivers/parport/ieee1284.c, 577:
    parport_ieee1284_ack_data_avail in parport_ieee1284_interrupt
    ./include/linux/parport.h, 474:
    parport_ieee1284_interrupt in parport_generic_irq
    drivers/usb/misc/uss720.c, 116:
    parport_generic_irq in async_complete

    Note that [FUNC_PTR] means a function pointer call is used.

    To fix these bugs, GFP_KERNEL is replaced with GFP_ATOMIC.

    These bugs are found by my static analysis tool DSAC.

    Signed-off-by: Jia-Ju Bai
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Jia-Ju Bai
     
  • i_usX2Y_subs_startup in usbusx2yaudio.c is a completion handler function
    for the USB driver. So it should not sleep, but it is can sleep
    according to the function call paths (from bottom to top) in Linux-4.16.

    [FUNC] msleep
    drivers/usb/host/u132-hcd.c, 2558:
    msleep in u132_get_frame
    drivers/usb/core/hcd.c, 2231:
    [FUNC_PTR]u132_get_frame in usb_hcd_get_frame_number
    drivers/usb/core/usb.c, 822:
    usb_hcd_get_frame_number in usb_get_current_frame_number
    sound/usb/usx2y/usbusx2yaudio.c, 303:
    usb_get_current_frame_number in i_usX2Y_urb_complete
    sound/usb/usx2y/usbusx2yaudio.c, 366:
    i_usX2Y_urb_complete in i_usX2Y_subs_startup

    Note that [FUNC_PTR] means a function pointer call is used.

    To fix this bug, msleep() is replaced with mdelay().

    This bug is found by my static analysis tool DSAC.

    Signed-off-by: Jia-Ju Bai
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Jia-Ju Bai
     
  • The steps taken by usb core to set a new interface is very different from
    what is done on the xHC host side.

    xHC hardware will do everything in one go. One command is used to set up
    new endpoints, free old endpoints, check bandwidth, and run the new
    endpoints.

    All this is done by xHC when usb core asks the hcd to check for
    available bandwidth. At this point usb core has not yet flushed the old
    endpoints, which will cause use-after-free issues in xhci driver as
    queued URBs are cancelled on a re-allocated endpoint.

    To resolve this add a call to usb_disable_interface() which will flush
    the endpoints before calling usb_hcd_alloc_bandwidth()

    Additional checks in xhci driver will also be implemented to gracefully
    handle stale URB cancel on freed and re-allocated endpoints

    Cc:
    Reported-by: Sudip Mukherjee
    Signed-off-by: Mathias Nyman
    Acked-by: Alan Stern
    Signed-off-by: Greg Kroah-Hartman

    Mathias Nyman
     
  • Fix kernel-doc warning for missing function parameter 'mode' description:

    ../drivers/usb/typec/bus.c:268: warning: Function parameter or member 'mode' not described in 'typec_match_altmode'

    Also fix typos for same function documentation.

    Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")

    Signed-off-by: Randy Dunlap
    Acked-by: Heikki Krogerus
    Signed-off-by: Greg Kroah-Hartman

    Randy Dunlap
     
  • usb_hc_died() should only be called once, and with the primary HCD
    as parameter. It will mark both primary and secondary hcd's dead.

    Remove the extra call to usb_cd_died with the shared hcd as parameter.

    Fixes: ff9d78b36f76 ("USB: Set usb_hcd->state and flags for shared roothubs")
    Signed-off-by: Mathias Nyman
    Cc: stable
    Acked-by: Alan Stern
    Signed-off-by: Greg Kroah-Hartman

    Mathias Nyman
     
  • If dual role mode is enabled, when switch u3port0 to device mode,
    it will affect port id calculation of host(xHCI), specially when
    host supports multi U2 ports or U3 ports, so need enable its dual
    role mode, and fix it here.

    Signed-off-by: Chunfeng Yun
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Chunfeng Yun
     
  • The hope that UAS devices would be less broken than old style storage
    devices has turned out to be unfounded. Make UAS support more of the
    quirk flags of the old driver.

    Signed-off-by: Oliver Neukum
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Oliver Neukum
     
  • This device does not correctly handle the LPM operations.

    Also, the device cannot handle ATA pass-through commands
    and locks up when attempted while running in super speed.

    This patch adds the equivalent quirk logic as found in uas.

    Signed-off-by: Tim Anderson
    Acked-by: Alan Stern
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Tim Anderson
     
  • Fix kernel-doc warning (13 times):

    ../drivers/usb/typec/class.c:1497: warning: Excess function parameter 'drvdata' description in 'typec_port_register_altmode'

    Signed-off-by: Randy Dunlap
    Acked-by: Heikki Krogerus
    Signed-off-by: Greg Kroah-Hartman

    Randy Dunlap
     
  • Fix kernel-doc warning:

    ../drivers/usb/dwc3/gadget.c:510: warning: Excess function parameter 'dwc' description in 'dwc3_gadget_start_config'

    Signed-off-by: Randy Dunlap
    Cc: Felipe Balbi
    Signed-off-by: Greg Kroah-Hartman

    Randy Dunlap
     
  • snprintf() always returns the full length of the string it could have
    printed, even if it was truncated because the buffer was too small.
    So in case the counter value is truncated, we will over-read from
    in_buffer and over-write to the caller's buffer.

    I don't think it's actually possible for this to happen, but in case
    truncation occurs, WARN and return -EIO.

    Signed-off-by: Ben Hutchings
    Signed-off-by: Greg Kroah-Hartman

    Ben Hutchings
     
  • If the written data starts with a digit, yurex_write() tries to parse
    it as an integer using simple_strtoull(). This requires a null-
    terminator, and currently there's no guarantee that there is one.

    (The sample program at
    https://github.com/NeoCat/YUREX-driver-for-Linux/blob/master/sample/yurex_clock.pl
    writes an integer without a null terminator. It seems like it must
    have worked by chance!)

    Always add a null byte after the written data. Enlarge the buffer
    to allow for this.

    Cc: stable@vger.kernel.org
    Signed-off-by: Ben Hutchings
    Signed-off-by: Greg Kroah-Hartman

    Ben Hutchings
     
  • In xhci_plat_probe() both sysdev and pdev->dev are being used
    for finding quirks. There are some drivers(like dwc3 host.c)
    which adds quirks(like usb3-lpm-capable) into pdev and the logic
    present in xhci_plat_probe() checks for quirks in either sysdev
    or pdev for finding the quirks. Because of this logic, some of
    the quirks are getting missed(usb3-lpm-capable quirk added by dwc3
    host.c driver is getting missed).This patch fixes this by iterating
    over all the available parents for finding the quirks. In this way
    all the quirks which are present in child or parent are correctly
    updated.

    Signed-off-by: Anurag Kumar Vulisha
    Signed-off-by: Mathias Nyman
    Signed-off-by: Greg Kroah-Hartman

    Anurag Kumar Vulisha
     
  • Make sure the cancelled URB is on the current endpoint ring.

    If the endpoint ring has been reallocated since the URB was enqueued
    then the URB may contain TD and TRB pointers to a already freed ring.
    In this the case return the URB without touching any of the freed ring
    structure data.

    Don't try to stop the ring. It would be useless.

    This can occur if endpoint is not flushed before it is dropped and
    re-added, which is the case in usb_set_interface() as xhci does
    things in an odd order.

    Cc:
    Tested-by: Sudip Mukherjee
    Signed-off-by: Mathias Nyman
    Signed-off-by: Greg Kroah-Hartman

    Mathias Nyman
     
  • WORLDE Controller KS49 or Prodipe MIDI 49C USB controller
    cause a -EPROTO error, a communication restart and loop again.

    This issue has already been fixed for KS25.
    https://lore.kernel.org/patchwork/patch/753077/

    I just add device 201 for KS49 in quirks.c to get it works.

    Signed-off-by: Laurent Roux
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Maxence Duprès
     
  • Some SoC/IP as STM32F469, the snpsid can only be read after clock is
    enabled, otherwise it will read as 0, and the dwc2_check_core_endianness
    will assume the core and AHB have opposite endianness, leading to the
    following error:

    [ 1.976339] dwc2 50000000.usb: 50000000.usb supply vusb_d not found, using dummy regulator
    [ 1.986124] dwc2 50000000.usb: Linked as a consumer to regulator.0
    [ 1.992711] dwc2 50000000.usb: 50000000.usb supply vusb_a not found, using dummy regulator
    [ 2.003672] dwc2 50000000.usb: dwc2_core_reset: HANG! AHB Idle timeout GRSTCTL GRSTCTL_AHBIDLE
    [ 2.015176] dwc2: probe of 50000000.usb failed with error -16

    The proposed patch changes the location where dwc2_check_core_endianness
    is called, allowing the clock peripheral to be enabled first.

    Acked-by: Minas Harutyunyan
    Tested-by: Martin Blumenstingl
    Signed-off-by: Bruno Meirelles Herrera
    Signed-off-by: Felipe Balbi

    Bruno Meirelles Herrera
     

29 Aug, 2018

5 commits

  • In case of error, the function pcim_iomap() returns NULL pointer not
    ERR_PTR(). The IS_ERR() test in the return value check should be
    replaced with NULL test.

    Fixes: 7740d04d901d ("usb: dwc3: pci: Enable ULPI Refclk on platforms where the firmware does not")
    Reviewed-by: Hans de Goede
    Signed-off-by: Wei Yongjun
    Signed-off-by: Felipe Balbi

    Wei Yongjun
     
  • This patch fixes an issue that maxpacket size of ep0 is incorrect
    for SuperSpeed. Otherwise, CDC NCM class with SuperSpeed doesn't
    work correctly on this driver because its control read data size
    is more than 64 bytes.

    Reported-by: Junki Kato
    Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
    Cc: # v4.5+
    Signed-off-by: Yoshihiro Shimoda
    Tested-by: Junki Kato
    Signed-off-by: Felipe Balbi

    Yoshihiro Shimoda
     
  • There is no deallocation of fotg210->ep[i] elements, allocated at
    fotg210_udc_probe.

    The patch adds deallocation of fotg210->ep array elements and simplifies
    error path of fotg210_udc_probe().

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Anton Vasilyev
    Signed-off-by: Felipe Balbi

    Anton Vasilyev
     
  • Commit f16443a034c7 ("USB: gadgetfs, dummy-hcd, net2280: fix locking
    for callbacks") was based on a serious misunderstanding. It
    introduced regressions into both the dummy-hcd and net2280 drivers.

    The problem in dummy-hcd was fixed by commit 7dbd8f4cabd9 ("USB:
    dummy-hcd: Fix erroneous synchronization change"), but the problem in
    net2280 remains. Namely: the ->disconnect(), ->suspend(), ->resume(),
    and ->reset() callbacks must be invoked without the private lock held;
    otherwise a deadlock will occur when the callback routine tries to
    interact with the UDC driver.

    This patch largely is a reversion of the relevant parts of
    f16443a034c7. It also drops the private lock around the calls to
    ->suspend() and ->resume() (something the earlier patch forgot to do).
    This is safe from races with device interrupts because it occurs
    within the interrupt handler.

    Finally, the patch changes where the ->disconnect() callback is
    invoked when net2280_pullup() turns the pullup off. Rather than
    making the callback from within stop_activity() at a time when dropping
    the private lock could be unsafe, the callback is moved to a point
    after the lock has already been dropped.

    Signed-off-by: Alan Stern
    Fixes: f16443a034c7 ("USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks")
    Reported-by: D. Ziesche
    Tested-by: D. Ziesche
    CC:
    Signed-off-by: Felipe Balbi

    Alan Stern
     
  • An incorrect #ifdef caused a pair of harmless warnings when CONFIG_PM_SLEEP
    is disabled:

    drivers/usb/dwc3/dwc3-of-simple.c:223:12: error: 'dwc3_of_simple_resume' defined but not used [-Werror=unused-function]
    static int dwc3_of_simple_resume(struct device *dev)
    ^~~~~~~~~~~~~~~~~~~~~
    drivers/usb/dwc3/dwc3-of-simple.c:213:12: error: 'dwc3_of_simple_suspend' defined but not used [-Werror=unused-function]
    static int dwc3_of_simple_suspend(struct device *dev)

    Since the #ifdef method is generally hard to get right, use
    a simpler __maybe_unused annotation here to let the compiler
    drop the unused functions silently. This also improves
    compile-time coverage.

    Fixes: 76251db86561 ("usb: dwc3: of-simple: reset host controller at suspend/resume")
    Signed-off-by: Arnd Bergmann
    Signed-off-by: Felipe Balbi

    Arnd Bergmann
     

27 Aug, 2018

2 commits

  • Similarly to a recently reported bug in io_ti, a malicious USB device
    could set port_number to a negative value and we would underflow the
    port array in the interrupt completion handler.

    As these devices only have one or two ports, fix this by making sure we
    only consider the seventh bit when determining the port number (and
    ignore bits 0xb0 which are typically set to 0x30).

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: stable
    Signed-off-by: Johan Hovold

    Johan Hovold
     
  • As reported by Dan Carpenter, a malicious USB device could set
    port_number to a negative value and we would underflow the port array in
    the interrupt completion handler.

    As these devices only have one or two ports, fix this by making sure we
    only consider the seventh bit when determining the port number (and
    ignore bits 0xb0 which are typically set to 0x30).

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: stable
    Reported-by: Dan Carpenter
    Signed-off-by: Johan Hovold

    Johan Hovold
     

24 Aug, 2018

1 commit

  • Pull ARM SoC driver updates from Olof Johansson:
    "Some of the larger changes this merge window:

    - Removal of drivers for Exynos5440, a Samsung SoC that never saw
    widespread use.

    - Uniphier support for USB3 and SPI reset handling

    - Syste control and SRAM drivers and bindings for Allwinner platforms

    - Qualcomm AOSS (Always-on subsystem) reset controller drivers

    - Raspberry Pi hwmon driver for voltage

    - Mediatek pwrap (pmic) support for MT6797 SoC"

    * tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (52 commits)
    drivers/firmware: psci_checker: stash and use topology_core_cpumask for hotplug tests
    soc: fsl: cleanup Kconfig menu
    soc: fsl: dpio: Convert DPIO documentation to .rst
    staging: fsl-mc: Remove remaining files
    staging: fsl-mc: Move DPIO from staging to drivers/soc/fsl
    staging: fsl-dpaa2: eth: move generic FD defines to DPIO
    soc: fsl: qe: gpio: Add qe_gpio_set_multiple
    usb: host: exynos: Remove support for Exynos5440
    clk: samsung: Remove support for Exynos5440
    soc: sunxi: Add the A13, A23 and H3 system control compatibles
    reset: uniphier: add reset control support for SPI
    cpufreq: exynos: Remove support for Exynos5440
    ata: ahci-platform: Remove support for Exynos5440
    soc: imx6qp: Use GENPD_FLAG_ALWAYS_ON for PU errata
    soc: mediatek: pwrap: add mt6351 driver for mt6797 SoCs
    soc: mediatek: pwrap: add pwrap driver for mt6797 SoCs
    soc: mediatek: pwrap: fix cipher init setting error
    dt-bindings: pwrap: mediatek: add pwrap support for MT6797
    reset: uniphier: add USB3 core reset control
    dt-bindings: reset: uniphier: add USB3 core reset support
    ...

    Linus Torvalds