linux-toradex.git/drivers/usb/core/urb.c, branch v5.12

USB: move snd_usb_pipe_sanity_check into the USB core

2020-09-16T09:02:23+00:00

snd_usb_pipe_sanity_check() is a great function, so let's move it into
the USB core so that other parts of the kernel, including the USB core,
can call it.

Name it usb_pipe_type_check() to match the existing
usb_urb_ep_type_check() call, which now uses this function.

Cc: Jaroslav Kysela 
Cc: "Gustavo A. R. Silva" 
Cc: Eli Billauer 
Cc: Emiliano Ingrassia 
Cc: Alan Stern 
Cc: Alexander Tsoy 
Cc: "Geoffrey D. Bennett" 
Cc: Jussi Laako 
Cc: Nick Kossifidis 
Cc: Dmitry Panchenko 
Cc: Chris Wulff 
Cc: Jesus Ramos 
Reviewed-by: Takashi Iwai 
Link: https://lore.kernel.org/r/20200914153756.3412156-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

usb: core: Solve race condition in anchor cleanup functions

2020-08-18T10:59:27+00:00

usb_kill_anchored_urbs() is commonly used to cancel all URBs on an
anchor just before releasing resources which the URBs rely on. By doing
so, users of this function rely on that no completer callbacks will take
place from any URB on the anchor after it returns.

However if this function is called in parallel with __usb_hcd_giveback_urb
processing a URB on the anchor, the latter may call the completer
callback after usb_kill_anchored_urbs() returns. This can lead to a
kernel panic due to use after release of memory in interrupt context.

The race condition is that __usb_hcd_giveback_urb() first unanchors the URB
and then makes the completer callback. Such URB is hence invisible to
usb_kill_anchored_urbs(), allowing it to return before the completer has
been called, since the anchor's urb_list is empty.

Even worse, if the racing completer callback resubmits the URB, it may
remain in the system long after usb_kill_anchored_urbs() returns.

Hence list_empty(&anchor->urb_list), which is used in the existing
while-loop, doesn't reliably ensure that all URBs of the anchor are gone.

A similar problem exists with usb_poison_anchored_urbs() and
usb_scuttle_anchored_urbs().

This patch adds an external do-while loop, which ensures that all URBs
are indeed handled before these three functions return. This change has
no effect at all unless the race condition occurs, in which case the
loop will busy-wait until the racing completer callback has finished.
This is a rare condition, so the CPU waste of this spinning is
negligible.

The additional do-while loop relies on usb_anchor_check_wakeup(), which
returns true iff the anchor list is empty, and there is no
__usb_hcd_giveback_urb() in the system that is in the middle of the
unanchor-before-complete phase. The @suspend_wakeups member of
struct usb_anchor is used for this purpose, which was introduced to solve
another problem which the same race condition causes, in commit
6ec4147e7bdb ("usb-anchor: Delay usb_wait_anchor_empty_timeout wake up
till completion is done").

The surely_empty variable is necessary, because usb_anchor_check_wakeup()
must be called with the lock held to prevent races. However the spinlock
must be released and reacquired if the outer loop spins with an empty
URB list while waiting for the unanchor-before-complete passage to finish:
The completer callback may very well attempt to take the very same lock.

To summarize, using usb_anchor_check_wakeup() means that the patched
functions can return only when the anchor's list is empty, and there is
no invisible URB being processed. Since the inner while loop finishes on
the empty list condition, the new do-while loop will terminate as well,
except for when the said race condition occurs.

Signed-off-by: Eli Billauer 
Acked-by: Oliver Neukum 
Acked-by: Alan Stern 
Link: https://lore.kernel.org/r/20200731054650.30644-1-eli.billauer@gmail.com
Signed-off-by: Greg Kroah-Hartman

usb: Use fallthrough pseudo-keyword

2020-07-10T06:55:17+00:00

Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
fall-through markings when it is the case.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Signed-off-by: Gustavo A. R. Silva 
Link: https://lore.kernel.org/r/20200707195607.GA4198@embeddedor
Signed-off-by: Greg Kroah-Hartman

usb: core: urb: fix URB structure initialization function

2019-12-10T10:41:19+00:00

Explicitly initialize URB structure urb_list field in usb_init_urb().
This field can be potentially accessed uninitialized and its
initialization is coherent with the usage of list_del_init() in
usb_hcd_unlink_urb_from_ep() and usb_giveback_urb_bh() and its
explicit initialization in usb_hcd_submit_urb() error path.

Signed-off-by: Emiliano Ingrassia 
Cc: stable 
Link: https://lore.kernel.org/r/20191127160355.GA27196@ingrassia.epigenesys.com
Signed-off-by: Greg Kroah-Hartman

USB: core: urb: Use struct_size() in kmalloc()

2019-01-08T15:46:46+00:00

One of the more common cases of allocation size calculations is finding
the size of a structure that has a zero-sized array at the end, along
with memory for some number of elements for that array. For example:

struct foo {
    int stuff;
    void *entry[];
};

instance = kmalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL);

Instead of leaving these open-coded and prone to type mistakes, we can
now use the new struct_size() helper:

instance = kmalloc(struct_size(instance, entry, count), GFP_KERNEL);

This code was detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Greg Kroah-Hartman

usb: core: urb: Check SSP isoc ep comp descriptor

2018-03-20T09:13:30+00:00

The maximum bytes per interval for USB SuperSpeed Plus can be set by
isoc endpoint companion descriptor when it is above 48K. If the
descriptor is provided, then use its value.

USB 3.1 spec 9.6.8

Acked-by: Felipe Balbi 
Signed-off-by: Thinh Nguyen 
Signed-off-by: Greg Kroah-Hartman

USB: remove the URB_NO_FSBR flag

2017-12-12T12:16:07+00:00

The URB_NO_FSBR flag has never really been used.  It was introduced as
a potential way for UHCI to minimize PCI bus usage (by not attempting
full-speed bulk and control transfers more than once per frame), but
the flag was not set by any drivers.

There's no point in keeping it around.  This patch simplifies the API
by removing it.  Unfortunately, it does have to be kept as part of the
usbfs ABI, but at least we can document in
include/uapi/linux/usbdevice_fs.h that it doesn't do anything.

Signed-off-by: Alan Stern 
Acked-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'sound-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

2017-11-15T02:01:46+00:00

Pull sound updates from Takashi Iwai:
 "There are no big surprising changes in this cycle, yet not too boring,
  either. The biggest change from diffstat POV is the removal of the
  legacy OSS driver codes that have been already disabled for a long
  time. This will bring a few trivial merge conflicts.

  As new features in ASoC side, there are two things: a new AC97 bus
  implementation and AMD Stony platform support. Both include the
  relevant changes shared with other subsystems, e.g. AC97 MFD changes
  and DRM AMD changes.

  Some other highlighted topics are:

   - A bunch of USB-audio drivers got the hardening against the
     malicious device accesses with a new helper code for endpoint
     sanity check

   - Lots of cleanups for ASoC Intel platform code, including support
     for their open source audio firmware

   - Continued ASoC core componentization works

   - Support for scaling MCLK with sample rate in ASoC simple-card

   - Stabler PCM hot-unplug capability, especially for ASoC usages"

* tag 'sound-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (302 commits)
  Documentation: sound: hd-audio: notes.rst
  ASoC: bcm2835: Support left/right justified and DSP modes
  ASoC: bcm2835: Enforce full symmetry
  ASoC: bcm2835: Support additional samplerates up to 384kHz
  ASoC: bcm2835: Add support for TDM modes
  ASoC: add mclk-fs support to audio graph card
  ASoC: add mclk-fs to audio graph card binding
  ASoC: rt5514: work around link error
  ASoC: rt5514: mark PM functions as __maybe_unused
  ASoC: rt5663: Check the JD status in the button pushing
  ASoC: amd: Modified DMA transfer Mechanism for Playback
  ASoC: rt5645: Wait for 400msec before concluding on value of RT5645_VENDOR_ID2
  ASoC: sun4i-codec: fixed 32bit audio capture support for H3/H2+
  ASoC: da7213: add support for DSP modes
  ASoC: sun8i-codec: Add a comment on the LRCK inversion
  ASoC: sun8i-codec: Set the BCLK divider
  ASoC: rt5663: Delay and retry reading rt5663 ID register
  ASoC: amd: use do_div rather than 64 bit division to fix 32 bit builds
  ASoC: cs42l56: Fix reset GPIO name in example DT binding
  ASoC: rt5514-spi: check irq status to schedule data copy in resume function
  ...

USB: core: move existing SPDX tags to top of the file

2017-11-03T09:12:26+00:00

To match the rest of the kernel, the SPDX tags for the drivers/usb/core/
files are moved to the first line of the file.  This makes it more
obvious the tag is present as well as making it match the other 12k
files in the tree with this location.

It also uses // to match the "expected style" as well.

Signed-off-by: Greg Kroah-Hartman

usb: core: urb: mark expected switch fall-through

2017-11-01T16:01:07+00:00

In preparation to enabling -Wimplicit-fallthrough, mark switch cases
where we are expecting to fall through.

Addresses-Coverity-ID: 1162594
Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Greg Kroah-Hartman