aboutsummaryrefslogtreecommitdiff
path: root/drivers/usb
AgeCommit message (Collapse)AuthorFilesLines
2021-03-18usb: typec: tcpm: PD3.0 sinks can send Discover Identity even in device modeBadhri Jagan Sridharan1-2/+2
>From 6.4.4.2 Structured VDM: • Either Port May be an Initiator of Structured VDMs except for the Enter Mode and Exit Mode Commands which Shall only be initiated by the DFP." The above implies that when PD3.0 link is established PD3.0 sinks can send out discover identity command/AMS once PD negotiation is done. This allows discovering identity for PD3.0 UFP ports as well. Acked-by: Heikki Krogerus <[email protected]> Signed-off-by: Badhri Jagan Sridharan <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-18usb: mtu3: Fix spelling mistake "disabed" -> "disabled"Colin Ian King1-4/+4
The variable u3_ports_disabed contains a spelling mistake, rename it to u3_ports_disabled. Reviewed-by: Chunfeng Yun <[email protected]> Signed-off-by: Colin Ian King <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-18usb: webcam: Invalid size of Processing Unit DescriptorPawel Laszczak2-0/+2
According with USB Device Class Definition for Video Device the Processing Unit Descriptor bLength should be 12 (10 + bmControlSize), but it has 11. Invalid length caused that Processing Unit Descriptor Test Video form CV tool failed. To fix this issue patch adds bmVideoStandards into uvc_processing_unit_descriptor structure. The bmVideoStandards field was added in UVC 1.1 and it wasn't part of UVC 1.0a. Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Pawel Laszczak <[email protected]> Reviewed-by: Peter Chen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-18usb: gadget: uvc: Updating bcdUVC field to 0x0110Pawel Laszczak2-2/+2
Command Verifier during UVC Descriptor Tests (Class Video Control Interface Descriptor Test Video) complains about: Video Control Interface Header bcdUVC is 0x0100. USB Video Class specification 1.0 has been replaced by 1.1 specification (UVC: 6.2.26) Class Video Control Interface Descriptor bcdUVC is not 1.1 Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Pawel Laszczak <[email protected]> Reviewed-by: Peter Chen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-18usb: gadget: uvc: add bInterval checking for HS modePawel Laszczak1-1/+6
Patch adds extra checking for bInterval passed by configfs. The 5.6.4 chapter of USB Specification (rev. 2.0) say: "A high-bandwidth endpoint must specify a period of 1x125 µs (i.e., a bInterval value of 1)." The issue was observed during testing UVC class on CV. I treat this change as improvement because we can control bInterval by configfs. Reviewed-by: Peter Chen <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Pawel Laszczak <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-18drivers: usb: Fix a typo in dwc3-qcom.cHe Fengqing1-1/+1
This patch fix a spelling typo in dwc3-qcom.c Signed-off-by: He Fengqing <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-18usb: host: Mundane spello fix in the file sl811_cs.cBhaskar Chowdhury1-1/+1
s/seting/setting/ Acked-by: Randy Dunlap <[email protected]> Signed-off-by: Bhaskar Chowdhury <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-18usb: typec: tcpci: Added few missing TCPCI register definitionsBadhri Jagan Sridharan1-0/+16
This change adds some of the register bit definitions from the TCPCI spec: https://www.usb.org/sites/default/files/documents/ usb-port_controller_specification_rev2.0_v1.0_0.pdf Reviewed-by: Guenter Roeck <[email protected]> Signed-off-by: Badhri Jagan Sridharan <[email protected]> Reviewed-by: Heikki Krogerus <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-17usb: dwc3: gadget: Prevent EP queuing while stopping transfersWesley Cheng1-6/+5
In the situations where the DWC3 gadget stops active transfers, once calling the dwc3_gadget_giveback(), there is a chance where a function driver can queue a new USB request in between the time where the dwc3 lock has been released and re-aquired. This occurs after we've already issued an ENDXFER command. When the stop active transfers continues to remove USB requests from all dep lists, the newly added request will also be removed, while controller still has an active TRB for it. This can lead to the controller accessing an unmapped memory address. Fix this by ensuring parameters to prevent EP queuing are set before calling the stop active transfers API. Fixes: ae7e86108b12 ("usb: dwc3: Stop active transfers before halting the controller") Signed-off-by: Wesley Cheng <[email protected]> Link: https://lore.kernel.org/r/[email protected] Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-17usb: typec: tcpm: Invoke power_supply_changed for tcpm-source-psy-Badhri Jagan Sridharan1-1/+8
tcpm-source-psy- does not invoke power_supply_changed API when one of the published power supply properties is changed. power_supply_changed needs to be called to notify userspace clients(uevents) and kernel clients. Fixes: f2a8aa053c176 ("typec: tcpm: Represent source supply through power_supply") Reviewed-by: Guenter Roeck <[email protected]> Reviewed-by: Heikki Krogerus <[email protected]> Signed-off-by: Badhri Jagan Sridharan <[email protected]> Cc: stable <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-17usb: typec: Remove vdo[3] part of tps6598x_rx_identity_reg structElias Rudberg1-1/+0
Remove the unused "u32 vdo[3]" part in the tps6598x_rx_identity_reg struct. This helps avoid "failed to register partner" errors which happen when tps6598x_read_partner_identity() fails because the amount of data read is 12 bytes smaller than the struct size. Note that vdo[3] is already in usb_pd_identity and hence shouldn't be added to tps6598x_rx_identity_reg as well. Fixes: f6c56ca91b92 ("usb: typec: Add the Product Type VDOs to struct usb_pd_identity") Reviewed-by: Heikki Krogerus <[email protected]> Reviewed-by: Guido Günther <[email protected]> Signed-off-by: Elias Rudberg <[email protected]> Cc: stable <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-17usb-storage: Add quirk to defeat Kindle's automatic unloadAlan Stern2-0/+19
Matthias reports that the Amazon Kindle automatically removes its emulated media if it doesn't receive another SCSI command within about one second after a SYNCHRONIZE CACHE. It does so even when the host has sent a PREVENT MEDIUM REMOVAL command. The reason for this behavior isn't clear, although it's not hard to make some guesses. At any rate, the results can be unexpected for anyone who tries to access the Kindle in an unusual fashion, and in theory they can lead to data loss (for example, if one file is closed and synchronized while other files are still in the middle of being written). To avoid such problems, this patch creates a new usb-storage quirks flag telling the driver always to issue a REQUEST SENSE following a SYNCHRONIZE CACHE command, and adds an unusual_devs entry for the Kindle with the flag set. This is sufficient to prevent the Kindle from doing its automatic unload, without interfering with proper operation. Another possible way to deal with this would be to increase the frequency of TEST UNIT READY polling that the kernel normally carries out for removable-media storage devices. However that would increase the overall load on the system and it is not as reliable, because the user can override the polling interval. Changing the driver's behavior is safer and has minimal overhead. CC: <[email protected]> Reported-and-tested-by: Matthias Schwarzott <[email protected]> Signed-off-by: Alan Stern <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-17usb: gadget: configfs: Fix KASAN use-after-freeJim Lin1-4/+10
When gadget is disconnected, running sequence is like this. . composite_disconnect . Call trace: usb_string_copy+0xd0/0x128 gadget_config_name_configuration_store+0x4 gadget_config_name_attr_store+0x40/0x50 configfs_write_file+0x198/0x1f4 vfs_write+0x100/0x220 SyS_write+0x58/0xa8 . configfs_composite_unbind . configfs_composite_bind In configfs_composite_bind, it has "cn->strings.s = cn->configuration;" When usb_string_copy is invoked. it would allocate memory, copy input string, release previous pointed memory space, and use new allocated memory. When gadget is connected, host sends down request to get information. Call trace: usb_gadget_get_string+0xec/0x168 lookup_string+0x64/0x98 composite_setup+0xa34/0x1ee8 If gadget is disconnected and connected quickly, in the failed case, cn->configuration memory has been released by usb_string_copy kfree but configfs_composite_bind hasn't been run in time to assign new allocated "cn->configuration" pointer to "cn->strings.s". When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling memory is accessed, "BUG: KASAN: use-after-free" error occurs. Cc: [email protected] Signed-off-by: Jim Lin <[email protected]> Signed-off-by: Macpaul Lin <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-17usbip: Fix incorrect double assignment to udc->ud.tcp_rxColin Ian King1-1/+1
Currently udc->ud.tcp_rx is being assigned twice, the second assignment is incorrect, it should be to udc->ud.tcp_tx instead of rx. Fix this. Fixes: 46613c9dfa96 ("usbip: fix vudc usbip_sockfd_store races leading to gpf") Acked-by: Shuah Khan <[email protected]> Signed-off-by: Colin Ian King <[email protected]> Cc: stable <[email protected]> Addresses-Coverity: ("Unused value") Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-17module: remove never implemented MODULE_SUPPORTED_DEVICELeon Romanovsky1-1/+0
MODULE_SUPPORTED_DEVICE was added in pre-git era and never was implemented. We can safely remove it, because the kernel has grown to have many more reliable mechanisms to determine if device is supported or not. Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2021-03-17USB: serial: pl2303: TA & TB alternate divider with non-standard baud ratesMichael G. Katzmann1-0/+44
Use an alternate clock divider algorithm and bit ordering for the TA and TB versions of the pl2303. It was discovered that these variants do not produce the correct baud rates with the existing scheme. see https://lore.kernel.org/r/[email protected] Signed-off-by: Michael G. Katzmann <[email protected]> Signed-off-by: Johan Hovold <[email protected]>
2021-03-17USB: serial: pl2303: add device-type namesJohan Hovold1-1/+8
Add names for the device types to be printed at probe when debugging is enabled. Note that the HXN type is referred to as G for now as that is the name the vendor uses. Signed-off-by: Johan Hovold <[email protected]>
2021-03-17USB: serial: pl2303: tighten type HXN (G) detectionJohan Hovold1-12/+20
Tighten the detection of the new HXN (G) type instead of assuming that every device which doesn't support the old read request is an HXN. Signed-off-by: Johan Hovold <[email protected]>
2021-03-17USB: serial: pl2303: rename legacy PL2303H typeJohan Hovold1-6/+6
Rename the legacy type which is supposedly a PL2303H which came in two variants (and which we handle the same way). Signed-off-by: Johan Hovold <[email protected]>
2021-03-17USB: serial: pl2303: amend and tighten type detectionJohan Hovold1-8/+42
Add support for detecting the HX, TA, TB and HXD device types and refuse to bind to any unknown types. Note that the HX type includes the XA variant, while the HXD type includes the EA, RA and SA variants. Signed-off-by: Johan Hovold <[email protected]>
2021-03-17USB: serial: pl2303: clean up type detectionJohan Hovold1-26/+42
Clean up the type detection somewhat in preparation for adding support for more types. Note this also fixes the type debug printk for the new HXN type. Signed-off-by: Johan Hovold <[email protected]>
2021-03-16Merge tag 'usb-v5.12-rc4' of ↵Greg Kroah-Hartman1-1/+4
git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-linus Peter writes: It fixed one incorrect value issue for cdns ssp driver * tag 'usb-v5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb: usb: cdnsp: Fixes incorrect value in ISOC TRB
2021-03-15USB: serial: io_edgeport: drop unneeded forward declarationsJiri Slaby1-44/+1
Forward declarations make the code larger and rewrites harder. Harder as they are often omitted from global changes. Remove forward declarations which are not really needed, i.e. the definition of the function is before its first use. Signed-off-by: Jiri Slaby <[email protected]> Reviewed-by: Greg Kroah-Hartman <[email protected]> [ johan: update the prototype comments ] Signed-off-by: Johan Hovold <[email protected]>
2021-03-15USB: serial: keyspan: drop unneeded forward declarationsJiri Slaby1-20/+0
Forward declarations make the code larger, harder to follow and rewrite. Harder as the declarations are often omitted from global changes. Remove forward declarations which are not really needed, i.e. when the definition of the function is before its first use. Signed-off-by: Jiri Slaby <[email protected]> Reviewed-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Johan Hovold <[email protected]>
2021-03-15Merge 5.12-rc3 into usb-nextGreg Kroah-Hartman20-107/+258
We want the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-15Merge 5.12-rc3 into tty-nextGreg Kroah-Hartman20-107/+258
Resolves a merge issue with: drivers/tty/hvc/hvcs.c and we want the tty/serial fixes from 5.12-rc3 in here as well. Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-13Merge tag 'usb-5.12-rc3' of ↵Linus Torvalds19-107/+226
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a small number of USB fixes for 5.12-rc3 to resolve a bunch of reported issues: - usbip fixups for issues found by syzbot - xhci driver fixes and quirk additions - gadget driver fixes - dwc3 QCOM driver fix - usb-serial new ids and fixes - usblp fix for a long-time issue - cdc-acm quirk addition - other tiny fixes for reported problems All of these have been in linux-next for a while with no reported issues" * tag 'usb-5.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits) xhci: Fix repeated xhci wake after suspend due to uncleared internal wake state usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing xhci: Improve detection of device initiated wake signal. usb: xhci: do not perform Soft Retry for some xHCI hosts usbip: fix vudc usbip_sockfd_store races leading to gpf usbip: fix vhci_hcd attach_store() races leading to gpf usbip: fix stub_dev usbip_sockfd_store() races leading to gpf usbip: fix vudc to check for stream socket usbip: fix vhci_hcd to check for stream socket usbip: fix stub_dev to check for stream socket usb: dwc3: qcom: Add missing DWC3 OF node refcount decrement USB: usblp: fix a hang in poll() if disconnected USB: gadget: udc: s3c2410_udc: fix return value check in s3c2410_udc_probe() usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM usb: dwc3: qcom: Honor wakeup enabled/disabled state usb: gadget: f_uac1: stop playback on function disable usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot USB: gadget: u_ether: Fix a configfs return code usb: dwc3: qcom: add ACPI device id for sc8180x Goodix Fingerprint device is not a modem ...
2021-03-13usb: cdnsp: Fixes incorrect value in ISOC TRBPawel Laszczak1-1/+4
Fixes issue with priority of operator. Operator "|" priority is higher then "? :". To improve the readability the operator "? :" has been replaced with "if ()" statement. Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") Reviewed-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Pawel Laszczak <[email protected]> Signed-off-by: Peter Chen <[email protected]>
2021-03-12usb: typec: tipd: Separate file for tracepoint creationHeikki Krogerus4-6/+15
Creating the tracepoints only when tracing is enabled. Signed-off-by: Heikki Krogerus <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-12usb: typec: tps6598x: Move the driver under its own subdirectoryHeikki Krogerus7-17/+19
The driver consist of multiple files. Grouping all of them under a separate directory drivers/usb/typec/tipd/. Signed-off-by: Heikki Krogerus <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-12usb: typec: tps6598x: Fix tracepoint header fileHeikki Krogerus1-2/+2
There were two typos in the precompiler conditions. Fixes: 65a2f67d9945 ("usb: typec: tps6598x: Add trace event for IRQ events") Signed-off-by: Heikki Krogerus <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-12usb: typec: tcpci: Refactor tcpc_presenting_cc1_rd macroBadhri Jagan Sridharan1-9/+5
Defining one macro instead of two for tcpc_presenting_*_rd. This is a follow up of the comment left by Heikki Krogerus. https://patchwork.kernel.org/project/linux-usb/patch/ [email protected]/ Reviewed-by: Guenter Roeck <[email protected]> Reviewed-by: Heikki Krogerus <[email protected]> Signed-off-by: Badhri Jagan Sridharan <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-11xhci: Fix repeated xhci wake after suspend due to uncleared internal wake stateMathias Nyman1-32/+30
If port terminations are detected in suspend, but link never reaches U0 then xHCI may have an internal uncleared wake state that will cause an immediate wake after suspend. This wake state is normally cleared when driver clears the PORT_CSC bit, which is set after a device is enabled and in U0. Write 1 to clear PORT_CSC for ports that don't have anything connected when suspending. This makes sure any pending internal wake states in xHCI are cleared. Cc: [email protected] Tested-by: Mika Westerberg <[email protected]> Signed-off-by: Mathias Nyman <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-11usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressingForest Crossman1-2/+6
I've confirmed that both the ASMedia ASM1042A and ASM3242 have the same problem as the ASM1142 and ASM2142/ASM3142, where they lose some of the upper bits of 64-bit DMA addresses. As with the other chips, this can cause problems on systems where the upper bits matter, and adding the XHCI_NO_64BIT_SUPPORT quirk completely fixes the issue. Cc: [email protected] Signed-off-by: Forest Crossman <[email protected]> Signed-off-by: Mathias Nyman <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-11xhci: Improve detection of device initiated wake signal.Mathias Nyman1-3/+13
A xHC USB 3 port might miss the first wake signal from a USB 3 device if the port LFPS reveiver isn't enabled fast enough after xHC resume. xHC host will anyway be resumed by a PME# signal, but will go back to suspend if no port activity is seen. The device resends the U3 LFPS wake signal after a 100ms delay, but by then host is already suspended, starting all over from the beginning of this issue. USB 3 specs say U3 wake LFPS signal is sent for max 10ms, then device needs to delay 100ms before resending the wake. Don't suspend immediately if port activity isn't detected in resume. Instead add a retry. If there is no port activity then delay for 120ms, and re-check for port activity. Cc: <[email protected]> Signed-off-by: Mathias Nyman <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-11usb: xhci: do not perform Soft Retry for some xHCI hostsStanislaw Gruszka3-1/+8
On some systems rt2800usb and mt7601u devices are unable to operate since commit f8f80be501aa ("xhci: Use soft retry to recover faster from transaction errors") Seems that some xHCI controllers can not perform Soft Retry correctly, affecting those devices. To avoid the problem add xhci->quirks flag that restore pre soft retry xhci behaviour for affected xHCI controllers. Currently those are AMD_PROMONTORYA_4 and AMD_PROMONTORYA_2, since it was confirmed by the users: on those xHCI hosts issue happen and is gone after disabling Soft Retry. [minor commit message rewording for checkpatch -Mathias] Fixes: f8f80be501aa ("xhci: Use soft retry to recover faster from transaction errors") Cc: <[email protected]> # 4.20+ Reported-by: Bernhard <[email protected]> Tested-by: Bernhard <[email protected]> Signed-off-by: Stanislaw Gruszka <[email protected]> Signed-off-by: Mathias Nyman <[email protected]> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202541 Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-11drm: Use USB controller's DMA mask when importing dmabufsThomas Zimmermann1-0/+32
USB devices cannot perform DMA and hence have no dma_mask set in their device structure. Therefore importing dmabuf into a USB-based driver fails, which breaks joining and mirroring of display in X11. For USB devices, pick the associated USB controller as attachment device. This allows the DRM import helpers to perform the DMA setup. If the DMA controller does not support DMA transfers, we're out of luck and cannot import. Our current USB-based DRM drivers don't use DMA, so the actual DMA device is not important. Tested by joining/mirroring displays of udl and radeon under Gnome/X11. v8: * release dmadev if device initialization fails (Noralf) * fix commit description (Noralf) v7: * fix use-before-init bug in gm12u320 (Dan) v6: * implement workaround in DRM drivers and hold reference to DMA device while USB device is in use * remove dev_is_usb() (Greg) * collapse USB helper into usb_intf_get_dma_device() (Alan) * integrate Daniel's TODO statement (Daniel) * fix typos (Greg) v5: * provide a helper for USB interfaces (Alan) * add FIXME item to documentation and TODO list (Daniel) v4: * implement workaround with USB helper functions (Greg) * use struct usb_device->bus->sysdev as DMA device (Takashi) v3: * drop gem_create_object * use DMA mask of USB controller, if any (Daniel, Christian, Noralf) v2: * move fix to importer side (Christian, Daniel) * update SHMEM and CMA helpers for new PRIME callbacks Signed-off-by: Thomas Zimmermann <[email protected]> Fixes: 6eb0233ec2d0 ("usb: don't inherity DMA properties for USB devices") Tested-by: Pavel Machek <[email protected]> Reviewed-by: Greg Kroah-Hartman <[email protected]> Acked-by: Christian König <[email protected]> Acked-by: Daniel Vetter <[email protected]> Acked-by: Noralf Trønnes <[email protected]> Cc: Christoph Hellwig <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: <[email protected]> # v5.10+ Signed-off-by: Thomas Zimmermann <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected] Signed-off-by: Maarten Lankhorst <[email protected]>
2021-03-11Merge tag 'usb-serial-5.12-rc3' of ↵Greg Kroah-Hartman4-35/+20
https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.12-rc3 Here's a fix for a long-standing memory leak after probe failure in io_edgeport and a fix for a NULL-deref on disconnect in the new xr driver. Included are also some new device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-5.12-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: io_edgeport: fix memory leak in edge_startup USB: serial: ch341: add new Product ID USB: serial: xr: fix NULL-deref on disconnect USB: serial: cp210x: add some more GE USB IDs USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter
2021-03-10usbip: fix vudc usbip_sockfd_store races leading to gpfShuah Khan1-8/+34
usbip_sockfd_store() is invoked when user requests attach (import) detach (unimport) usb gadget device from usbip host. vhci_hcd sends import request and usbip_sockfd_store() exports the device if it is free for export. Export and unexport are governed by local state and shared state - Shared state (usbip device status, sockfd) - sockfd and Device status are used to determine if stub should be brought up or shut down. Device status is shared between host and client. - Local state (tcp_socket, rx and tx thread task_struct ptrs) A valid tcp_socket controls rx and tx thread operations while the device is in exported state. - While the device is exported, device status is marked used and socket, sockfd, and thread pointers are valid. Export sequence (stub-up) includes validating the socket and creating receive (rx) and transmit (tx) threads to talk to the client to provide access to the exported device. rx and tx threads depends on local and shared state to be correct and in sync. Unexport (stub-down) sequence shuts the socket down and stops the rx and tx threads. Stub-down sequence relies on local and shared states to be in sync. There are races in updating the local and shared status in the current stub-up sequence resulting in crashes. These stem from starting rx and tx threads before local and global state is updated correctly to be in sync. 1. Doesn't handle kthread_create() error and saves invalid ptr in local state that drives rx and tx threads. 2. Updates tcp_socket and sockfd, starts stub_rx and stub_tx threads before updating usbip_device status to SDEV_ST_USED. This opens up a race condition between the threads and usbip_sockfd_store() stub up and down handling. Fix the above problems: - Stop using kthread_get_run() macro to create/start threads. - Create threads and get task struct reference. - Add kthread_create() failure handling and bail out. - Hold usbip_device lock to update local and shared states after creating rx and tx threads. - Update usbip_device status to SDEV_ST_USED. - Update usbip_device tcp_socket, sockfd, tcp_rx, and tcp_tx - Start threads after usbip_device (tcp_socket, sockfd, tcp_rx, tcp_tx, and status) is complete. Credit goes to syzbot and Tetsuo Handa for finding and root-causing the kthread_get_run() improper error handling problem and others. This is a hard problem to find and debug since the races aren't seen in a normal case. Fuzzing forces the race window to be small enough for the kthread_get_run() error path bug and starting threads before updating the local and shared state bug in the stub-up sequence. Fixes: 9720b4bc76a83807 ("staging/usbip: convert to kthread") Cc: [email protected] Reported-by: syzbot <[email protected]> Reported-by: syzbot <[email protected]> Reported-by: syzbot <[email protected]> Reported-by: Tetsuo Handa <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Link: https://lore.kernel.org/r/b1c08b983ffa185449c9f0f7d1021dc8c8454b60.1615171203.git.skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usbip: fix vhci_hcd attach_store() races leading to gpfShuah Khan1-4/+25
attach_store() is invoked when user requests import (attach) a device from usbip host. Attach and detach are governed by local state and shared state - Shared state (usbip device status) - Device status is used to manage the attach and detach operations on import-able devices. - Local state (tcp_socket, rx and tx thread task_struct ptrs) A valid tcp_socket controls rx and tx thread operations while the device is in exported state. - Device has to be in the right state to be attached and detached. Attach sequence includes validating the socket and creating receive (rx) and transmit (tx) threads to talk to the host to get access to the imported device. rx and tx threads depends on local and shared state to be correct and in sync. Detach sequence shuts the socket down and stops the rx and tx threads. Detach sequence relies on local and shared states to be in sync. There are races in updating the local and shared status in the current attach sequence resulting in crashes. These stem from starting rx and tx threads before local and global state is updated correctly to be in sync. 1. Doesn't handle kthread_create() error and saves invalid ptr in local state that drives rx and tx threads. 2. Updates tcp_socket and sockfd, starts stub_rx and stub_tx threads before updating usbip_device status to VDEV_ST_NOTASSIGNED. This opens up a race condition between the threads, port connect, and detach handling. Fix the above problems: - Stop using kthread_get_run() macro to create/start threads. - Create threads and get task struct reference. - Add kthread_create() failure handling and bail out. - Hold vhci and usbip_device locks to update local and shared states after creating rx and tx threads. - Update usbip_device status to VDEV_ST_NOTASSIGNED. - Update usbip_device tcp_socket, sockfd, tcp_rx, and tcp_tx - Start threads after usbip_device (tcp_socket, sockfd, tcp_rx, tcp_tx, and status) is complete. Credit goes to syzbot and Tetsuo Handa for finding and root-causing the kthread_get_run() improper error handling problem and others. This is hard problem to find and debug since the races aren't seen in a normal case. Fuzzing forces the race window to be small enough for the kthread_get_run() error path bug and starting threads before updating the local and shared state bug in the attach sequence. - Update usbip_device tcp_rx and tcp_tx pointers holding vhci and usbip_device locks. Tested with syzbot reproducer: - https://syzkaller.appspot.com/text?tag=ReproC&x=14801034d00000 Fixes: 9720b4bc76a83807 ("staging/usbip: convert to kthread") Cc: [email protected] Reported-by: syzbot <[email protected]> Reported-by: syzbot <[email protected]> Reported-by: syzbot <[email protected]> Reported-by: Tetsuo Handa <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Link: https://lore.kernel.org/r/bb434bd5d7a64fbec38b5ecfb838a6baef6eb12b.1615171203.git.skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usbip: fix stub_dev usbip_sockfd_store() races leading to gpfShuah Khan1-7/+25
usbip_sockfd_store() is invoked when user requests attach (import) detach (unimport) usb device from usbip host. vhci_hcd sends import request and usbip_sockfd_store() exports the device if it is free for export. Export and unexport are governed by local state and shared state - Shared state (usbip device status, sockfd) - sockfd and Device status are used to determine if stub should be brought up or shut down. - Local state (tcp_socket, rx and tx thread task_struct ptrs) A valid tcp_socket controls rx and tx thread operations while the device is in exported state. - While the device is exported, device status is marked used and socket, sockfd, and thread pointers are valid. Export sequence (stub-up) includes validating the socket and creating receive (rx) and transmit (tx) threads to talk to the client to provide access to the exported device. rx and tx threads depends on local and shared state to be correct and in sync. Unexport (stub-down) sequence shuts the socket down and stops the rx and tx threads. Stub-down sequence relies on local and shared states to be in sync. There are races in updating the local and shared status in the current stub-up sequence resulting in crashes. These stem from starting rx and tx threads before local and global state is updated correctly to be in sync. 1. Doesn't handle kthread_create() error and saves invalid ptr in local state that drives rx and tx threads. 2. Updates tcp_socket and sockfd, starts stub_rx and stub_tx threads before updating usbip_device status to SDEV_ST_USED. This opens up a race condition between the threads and usbip_sockfd_store() stub up and down handling. Fix the above problems: - Stop using kthread_get_run() macro to create/start threads. - Create threads and get task struct reference. - Add kthread_create() failure handling and bail out. - Hold usbip_device lock to update local and shared states after creating rx and tx threads. - Update usbip_device status to SDEV_ST_USED. - Update usbip_device tcp_socket, sockfd, tcp_rx, and tcp_tx - Start threads after usbip_device (tcp_socket, sockfd, tcp_rx, tcp_tx, and status) is complete. Credit goes to syzbot and Tetsuo Handa for finding and root-causing the kthread_get_run() improper error handling problem and others. This is a hard problem to find and debug since the races aren't seen in a normal case. Fuzzing forces the race window to be small enough for the kthread_get_run() error path bug and starting threads before updating the local and shared state bug in the stub-up sequence. Tested with syzbot reproducer: - https://syzkaller.appspot.com/text?tag=ReproC&x=14801034d00000 Fixes: 9720b4bc76a83807 ("staging/usbip: convert to kthread") Cc: [email protected] Reported-by: syzbot <[email protected]> Reported-by: syzbot <[email protected]> Reported-by: syzbot <[email protected]> Reported-by: Tetsuo Handa <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Link: https://lore.kernel.org/r/268a0668144d5ff36ec7d87fdfa90faf583b7ccc.1615171203.git.skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usbip: fix vudc to check for stream socketShuah Khan1-0/+9
Fix usbip_sockfd_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream. Cc: [email protected] Suggested-by: Tetsuo Handa <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Link: https://lore.kernel.org/r/387a670316002324113ac7ea1e8b53f4085d0c95.1615171203.git.skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usbip: fix vhci_hcd to check for stream socketShuah Khan1-1/+9
Fix attach_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream. Cc: [email protected] Suggested-by: Tetsuo Handa <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Link: https://lore.kernel.org/r/52712aa308915bda02cece1589e04ee8b401d1f3.1615171203.git.skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usbip: fix stub_dev to check for stream socketShuah Khan1-1/+11
Fix usbip_sockfd_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream. Cc: [email protected] Suggested-by: Tetsuo Handa <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Link: https://lore.kernel.org/r/e942d2bd03afb8e8552bd2a5d84e18d17670d521.1615171203.git.skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usb: typec: stusb160x: fix return value check in stusb160x_probe()Wei Yongjun1-2/+2
In case of error, the function device_get_named_child_node() returns NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check should be replaced with NULL test. Fixes: da0cb6310094 ("usb: typec: add support for STUSB160x Type-C controller family") Reported-by: Hulk Robot <[email protected]> Reviewed-by: Heikki Krogerus <[email protected]> Reviewed-by: Amelie Delaunay <[email protected]> Signed-off-by: Wei Yongjun <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usb: typec: tps6598x: Fix return value check in tps6598x_probe()Wei Yongjun1-2/+2
In case of error, the function device_get_named_child_node() returns NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check should be replaced with NULL test. Fixes: 18a6c866bb19 ("usb: typec: tps6598x: Add USB role switching logic") Reported-by: Hulk Robot <[email protected]> Reviewed-by: Heikki Krogerus <[email protected]> Signed-off-by: Wei Yongjun <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usb: typec: tcpm: turn tcpm_ams_finish into void functionYang Li1-5/+1
This function always return '0' and no callers use the return value. So make it a void function. This eliminates the following coccicheck warning: ./drivers/usb/typec/tcpm/tcpm.c:778:5-8: Unneeded variable: "ret". Return "0" on line 794 Reported-by: Abaci Robot <[email protected]> Reviewed-by: Heikki Krogerus <[email protected]> Signed-off-by: Yang Li <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUSBadhri Jagan Sridharan1-3/+18
While interpreting CC_STATUS, ROLE_CONTROL has to be read to make sure that CC1/CC2 is not forced presenting Rp/Rd. >From the TCPCI spec: 4.4.5.2 ROLE_CONTROL (Normative): The TCPM shall write B6 (DRP) = 0b and B3..0 (CC1/CC2) if it wishes to control the Rp/Rd directly instead of having the TCPC perform DRP toggling autonomously. When controlling Rp/Rd directly, the TCPM writes to B3..0 (CC1/CC2) each time it wishes to change the CC1/CC2 values. This control is used for TCPM-TCPC implementing Source or Sink only as well as when a connection has been detected via DRP toggling but the TCPM wishes to attempt Try.Src or Try.Snk. Table 4-22. CC_STATUS Register Definition: If (ROLE_CONTROL.CC1 = Rd) or ConnectResult=1) 00b: SNK.Open (Below maximum vRa) 01b: SNK.Default (Above minimum vRd-Connect) 10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp-1.5A 11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp-3.0A If (ROLE_CONTROL.CC2=Rd) or (ConnectResult=1) 00b: SNK.Open (Below maximum vRa) 01b: SNK.Default (Above minimum vRd-Connect) 10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp 1.5A 11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp 3.0A Fixes: 74e656d6b0551 ("staging: typec: Type-C Port Controller Interface driver (tcpci)") Acked-by: Heikki Krogerus <[email protected]> Signed-off-by: Badhri Jagan Sridharan <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usb: common: move function's kerneldoc next to its definitionChunfeng Yun2-2/+55
Following a general rule, add the kerneldoc for a function next to it's definition, but not next to its declaration in a header file. Suggested-by: Alan Stern <[email protected]> Suggested-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Chunfeng Yun <[email protected]> Link: https://lore.kernel.org/r/c4d2e010ae2bf67cdfa0b55e6d1deb9339d9d3dc.1615170625.git.chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <[email protected]>
2021-03-10usb: xhci-mtk: print debug info of endpoint intervalChunfeng Yun1-8/+29
Print bInterval and convert it into the time expressed in us or ms unit, this is the key info when allocate bandwidth failed. Signed-off-by: Chunfeng Yun <[email protected]> Link: https://lore.kernel.org/r/f7a9fa7a812296fcd6c603bfa9853076144018d6.1615170625.git.chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.