Skip to content

Commit a1b85b3

Browse files
torvaldstorvalds
committed
Merge tag 'usb-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH: "Here are some small USB driver fixes for reported issues for 5.5-rc2 There's the usual gadget and xhci fixes, as well as some other problems that syzbot has been finding during it's fuzzing runs. Full details are in the shortlog. All of these have been in linux-next with no reported issues" * tag 'usb-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (21 commits) usb: dwc3: pci: add ID for the Intel Comet Lake -H variant xhci: make sure interrupts are restored to correct state xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour. xhci: Increase STS_HALT timeout in xhci_suspend() usb: xhci: only set D3hot for pci device xhci: fix USB3 device initiated resume race with roothub autosuspend xhci: Fix memory leak in xhci_add_in_port() USB: Fix incorrect DMA allocations for local memory pool drivers usb: gadget: fix wrong endpoint desc usb: dwc3: ep0: Clear started flag on completion usb: dwc3: gadget: Clear started flag for non-IOC usb: dwc3: gadget: Fix logical condition USB: atm: ueagle-atm: add missing endpoint check USB: adutux: fix interface sanity check USB: idmouse: fix interface sanity checks USB: serial: io_edgeport: fix epic endpoint lookup usb: mon: Fix a deadlock in usbmon between mmap and read usb: common: usb-conn-gpio: Don't log an error on probe deferral usb: core: urb: fix URB structure initialization function usb: typec: fix use after free in typec_register_port() ...
2 parents 81d5598 + 3c3caae commit a1b85b3

File tree

22 files changed

+135
-67
lines changed

22 files changed

+135
-67
lines changed

‎drivers/usb/atm/ueagle-atm.c

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2124,10 +2124,11 @@ static void uea_intr(struct urb *urb)
21242124
/*
21252125
* Start the modem : init the data and start kernel thread
21262126
*/
2127-
static int uea_boot(struct uea_softc *sc)
2127+
static int uea_boot(struct uea_softc *sc, struct usb_interface *intf)
21282128
{
2129-
int ret, size;
21302129
struct intr_pkt *intr;
2130+
int ret = -ENOMEM;
2131+
int size;
21312132

21322133
uea_enters(INS_TO_USBDEV(sc));
21332134

@@ -2152,6 +2153,11 @@ static int uea_boot(struct uea_softc *sc)
21522153
if (UEA_CHIP_VERSION(sc) == ADI930)
21532154
load_XILINX_firmware(sc);
21542155

2156+
if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
2157+
ret = -ENODEV;
2158+
goto err0;
2159+
}
2160+
21552161
intr = kmalloc(size, GFP_KERNEL);
21562162
if (!intr)
21572163
goto err0;
@@ -2163,8 +2169,7 @@ static int uea_boot(struct uea_softc *sc)
21632169
usb_fill_int_urb(sc->urb_int, sc->usb_dev,
21642170
usb_rcvintpipe(sc->usb_dev, UEA_INTR_PIPE),
21652171
intr, size, uea_intr, sc,
2166-
sc->usb_dev->actconfig->interface[0]->altsetting[0].
2167-
endpoint[0].desc.bInterval);
2172+
intf->cur_altsetting->endpoint[0].desc.bInterval);
21682173

21692174
ret = usb_submit_urb(sc->urb_int, GFP_KERNEL);
21702175
if (ret < 0) {
@@ -2179,6 +2184,7 @@ static int uea_boot(struct uea_softc *sc)
21792184
sc->kthread = kthread_create(uea_kthread, sc, "ueagle-atm");
21802185
if (IS_ERR(sc->kthread)) {
21812186
uea_err(INS_TO_USBDEV(sc), "failed to create thread\n");
2187+
ret = PTR_ERR(sc->kthread);
21822188
goto err2;
21832189
}
21842190

@@ -2193,7 +2199,7 @@ static int uea_boot(struct uea_softc *sc)
21932199
kfree(intr);
21942200
err0:
21952201
uea_leaves(INS_TO_USBDEV(sc));
2196-
return -ENOMEM;
2202+
return ret;
21972203
}
21982204

21992205
/*
@@ -2548,7 +2554,7 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf,
25482554
}
25492555
}
25502556

2551-
ret = uea_boot(sc);
2557+
ret = uea_boot(sc, intf);
25522558
if (ret < 0)
25532559
goto error;
25542560

‎drivers/usb/common/usb-conn-gpio.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,8 @@ static int usb_conn_probe(struct platform_device *pdev)
156156

157157
info->vbus = devm_regulator_get(dev, "vbus");
158158
if (IS_ERR(info->vbus)) {
159-
dev_err(dev, "failed to get vbus\n");
159+
if (PTR_ERR(info->vbus) != -EPROBE_DEFER)
160+
dev_err(dev, "failed to get vbus\n");
160161
return PTR_ERR(info->vbus);
161162
}
162163

‎drivers/usb/core/hcd.c

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1409,7 +1409,17 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
14091409
if (usb_endpoint_xfer_control(&urb->ep->desc)) {
14101410
if (hcd->self.uses_pio_for_control)
14111411
return ret;
1412-
if (hcd_uses_dma(hcd)) {
1412+
if (hcd->localmem_pool) {
1413+
ret = hcd_alloc_coherent(
1414+
urb->dev->bus, mem_flags,
1415+
&urb->setup_dma,
1416+
(void **)&urb->setup_packet,
1417+
sizeof(struct usb_ctrlrequest),
1418+
DMA_TO_DEVICE);
1419+
if (ret)
1420+
return ret;
1421+
urb->transfer_flags |= URB_SETUP_MAP_LOCAL;
1422+
} else if (hcd_uses_dma(hcd)) {
14131423
if (object_is_on_stack(urb->setup_packet)) {
14141424
WARN_ONCE(1, "setup packet is on stack\n");
14151425
return -EAGAIN;
@@ -1424,23 +1434,22 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
14241434
urb->setup_dma))
14251435
return -EAGAIN;
14261436
urb->transfer_flags |= URB_SETUP_MAP_SINGLE;
1427-
} else if (hcd->localmem_pool) {
1428-
ret = hcd_alloc_coherent(
1429-
urb->dev->bus, mem_flags,
1430-
&urb->setup_dma,
1431-
(void **)&urb->setup_packet,
1432-
sizeof(struct usb_ctrlrequest),
1433-
DMA_TO_DEVICE);
1434-
if (ret)
1435-
return ret;
1436-
urb->transfer_flags |= URB_SETUP_MAP_LOCAL;
14371437
}
14381438
}
14391439

14401440
dir = usb_urb_dir_in(urb) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
14411441
if (urb->transfer_buffer_length != 0
14421442
&& !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) {
1443-
if (hcd_uses_dma(hcd)) {
1443+
if (hcd->localmem_pool) {
1444+
ret = hcd_alloc_coherent(
1445+
urb->dev->bus, mem_flags,
1446+
&urb->transfer_dma,
1447+
&urb->transfer_buffer,
1448+
urb->transfer_buffer_length,
1449+
dir);
1450+
if (ret == 0)
1451+
urb->transfer_flags |= URB_MAP_LOCAL;
1452+
} else if (hcd_uses_dma(hcd)) {
14441453
if (urb->num_sgs) {
14451454
int n;
14461455

@@ -1491,15 +1500,6 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
14911500
else
14921501
urb->transfer_flags |= URB_DMA_MAP_SINGLE;
14931502
}
1494-
} else if (hcd->localmem_pool) {
1495-
ret = hcd_alloc_coherent(
1496-
urb->dev->bus, mem_flags,
1497-
&urb->transfer_dma,
1498-
&urb->transfer_buffer,
1499-
urb->transfer_buffer_length,
1500-
dir);
1501-
if (ret == 0)
1502-
urb->transfer_flags |= URB_MAP_LOCAL;
15031503
}
15041504
if (ret && (urb->transfer_flags & (URB_SETUP_MAP_SINGLE |
15051505
URB_SETUP_MAP_LOCAL)))

‎drivers/usb/core/urb.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ void usb_init_urb(struct urb *urb)
4545
if (urb) {
4646
memset(urb, 0, sizeof(*urb));
4747
kref_init(&urb->kref);
48+
INIT_LIST_HEAD(&urb->urb_list);
4849
INIT_LIST_HEAD(&urb->anchor_list);
4950
}
5051
}

‎drivers/usb/dwc3/dwc3-pci.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,8 @@
2929
#define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa
3030
#define PCI_DEVICE_ID_INTEL_APL 0x5aaa
3131
#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0
32-
#define PCI_DEVICE_ID_INTEL_CMLH 0x02ee
32+
#define PCI_DEVICE_ID_INTEL_CMLLP 0x02ee
33+
#define PCI_DEVICE_ID_INTEL_CMLH 0x06ee
3334
#define PCI_DEVICE_ID_INTEL_GLK 0x31aa
3435
#define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee
3536
#define PCI_DEVICE_ID_INTEL_CNPH 0xa36e
@@ -308,6 +309,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
308309
{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MRFLD),
309310
(kernel_ulong_t) &dwc3_pci_mrfld_properties, },
310311

312+
{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLLP),
313+
(kernel_ulong_t) &dwc3_pci_intel_properties, },
314+
311315
{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLH),
312316
(kernel_ulong_t) &dwc3_pci_intel_properties, },
313317

‎drivers/usb/dwc3/ep0.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1117,6 +1117,9 @@ static void dwc3_ep0_xfernotready(struct dwc3 *dwc,
11171117
void dwc3_ep0_interrupt(struct dwc3 *dwc,
11181118
const struct dwc3_event_depevt *event)
11191119
{
1120+
struct dwc3_ep *dep = dwc->eps[event->endpoint_number];
1121+
u8 cmd;
1122+
11201123
switch (event->endpoint_event) {
11211124
case DWC3_DEPEVT_XFERCOMPLETE:
11221125
dwc3_ep0_xfer_complete(dwc, event);
@@ -1129,7 +1132,12 @@ void dwc3_ep0_interrupt(struct dwc3 *dwc,
11291132
case DWC3_DEPEVT_XFERINPROGRESS:
11301133
case DWC3_DEPEVT_RXTXFIFOEVT:
11311134
case DWC3_DEPEVT_STREAMEVT:
1135+
break;
11321136
case DWC3_DEPEVT_EPCMDCMPLT:
1137+
cmd = DEPEVT_PARAMETER_CMD(event->parameters);
1138+
1139+
if (cmd == DWC3_DEPCMD_ENDTRANSFER)
1140+
dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
11331141
break;
11341142
}
11351143
}

‎drivers/usb/dwc3/gadget.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2491,7 +2491,7 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
24912491

24922492
req->request.actual = req->request.length - req->remaining;
24932493

2494-
if (!dwc3_gadget_ep_request_completed(req) &&
2494+
if (!dwc3_gadget_ep_request_completed(req) ||
24952495
req->num_pending_sgs) {
24962496
__dwc3_gadget_kick_transfer(dep);
24972497
goto out;
@@ -2719,6 +2719,9 @@ static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force,
27192719
WARN_ON_ONCE(ret);
27202720
dep->resource_index = 0;
27212721

2722+
if (!interrupt)
2723+
dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
2724+
27222725
if (dwc3_is_usb31(dwc) || dwc->revision < DWC3_REVISION_310A)
27232726
udelay(100);
27242727
}

‎drivers/usb/gadget/function/f_ecm.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -621,8 +621,12 @@ static void ecm_disable(struct usb_function *f)
621621

622622
DBG(cdev, "ecm deactivated\n");
623623

624-
if (ecm->port.in_ep->enabled)
624+
if (ecm->port.in_ep->enabled) {
625625
gether_disconnect(&ecm->port);
626+
} else {
627+
ecm->port.in_ep->desc = NULL;
628+
ecm->port.out_ep->desc = NULL;
629+
}
626630

627631
usb_ep_disable(ecm->notify);
628632
ecm->notify->desc = NULL;

‎drivers/usb/gadget/function/f_rndis.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -618,6 +618,7 @@ static void rndis_disable(struct usb_function *f)
618618
gether_disconnect(&rndis->port);
619619

620620
usb_ep_disable(rndis->notify);
621+
rndis->notify->desc = NULL;
621622
}
622623

623624
/*-------------------------------------------------------------------------*/

‎drivers/usb/host/xhci-hub.c

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -806,7 +806,7 @@ static void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status,
806806

807807
static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
808808
u32 *status, u32 portsc,
809-
unsigned long flags)
809+
unsigned long *flags)
810810
{
811811
struct xhci_bus_state *bus_state;
812812
struct xhci_hcd *xhci;
@@ -860,11 +860,11 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
860860
xhci_test_and_clear_bit(xhci, port, PORT_PLC);
861861
xhci_set_link_state(xhci, port, XDEV_U0);
862862

863-
spin_unlock_irqrestore(&xhci->lock, flags);
863+
spin_unlock_irqrestore(&xhci->lock, *flags);
864864
time_left = wait_for_completion_timeout(
865865
&bus_state->rexit_done[wIndex],
866866
msecs_to_jiffies(XHCI_MAX_REXIT_TIMEOUT_MS));
867-
spin_lock_irqsave(&xhci->lock, flags);
867+
spin_lock_irqsave(&xhci->lock, *flags);
868868

869869
if (time_left) {
870870
slot_id = xhci_find_slot_id_by_port(hcd, xhci,
@@ -920,11 +920,13 @@ static void xhci_get_usb3_port_status(struct xhci_port *port, u32 *status,
920920
{
921921
struct xhci_bus_state *bus_state;
922922
struct xhci_hcd *xhci;
923+
struct usb_hcd *hcd;
923924
u32 link_state;
924925
u32 portnum;
925926

926927
bus_state = &port->rhub->bus_state;
927928
xhci = hcd_to_xhci(port->rhub->hcd);
929+
hcd = port->rhub->hcd;
928930
link_state = portsc & PORT_PLS_MASK;
929931
portnum = port->hcd_portnum;
930932

@@ -952,12 +954,20 @@ static void xhci_get_usb3_port_status(struct xhci_port *port, u32 *status,
952954
bus_state->suspended_ports &= ~(1 << portnum);
953955
}
954956

957+
/* remote wake resume signaling complete */
958+
if (bus_state->port_remote_wakeup & (1 << portnum) &&
959+
link_state != XDEV_RESUME &&
960+
link_state != XDEV_RECOVERY) {
961+
bus_state->port_remote_wakeup &= ~(1 << portnum);
962+
usb_hcd_end_port_resume(&hcd->self, portnum);
963+
}
964+
955965
xhci_hub_report_usb3_link_state(xhci, status, portsc);
956966
xhci_del_comp_mod_timer(xhci, portsc, portnum);
957967
}
958968

959969
static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
960-
u32 portsc, unsigned long flags)
970+
u32 portsc, unsigned long *flags)
961971
{
962972
struct xhci_bus_state *bus_state;
963973
u32 link_state;
@@ -1007,7 +1017,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
10071017
static u32 xhci_get_port_status(struct usb_hcd *hcd,
10081018
struct xhci_bus_state *bus_state,
10091019
u16 wIndex, u32 raw_port_status,
1010-
unsigned long flags)
1020+
unsigned long *flags)
10111021
__releases(&xhci->lock)
10121022
__acquires(&xhci->lock)
10131023
{
@@ -1130,7 +1140,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
11301140
}
11311141
trace_xhci_get_port_status(wIndex, temp);
11321142
status = xhci_get_port_status(hcd, bus_state, wIndex, temp,
1133-
flags);
1143+
&flags);
11341144
if (status == 0xffffffff)
11351145
goto error;
11361146

0 commit comments

Comments
 (0)