linux-toradex.git/drivers/usb/core, branch v2.6.31.12

USB: Close usb_find_interface race v3

2009-12-18T21:43:33+00:00

commit c2d284ee04ab6f6718de2ddcf1b43160e046c41d upstream.

USB drivers that create character devices call usb_register_dev in their
probe function. This associates the usb_interface device with that minor
number and creates the character device and announces it to the world.
However, the driver's probe function is called before the new
usb_interface is added to the driver's klist_devices.

This is a problem because userspace will respond to the character device
creation announcement by opening the character device. The driver's open
function will the call usb_find_interface to find the usb_interface
associated with that minor number. usb_find_interface will walk the
driver's list of devices and find the usb_interface with the matching
minor number.

Because the announcement happens before the usb_interface is added to the
driver's klist_devices, a race condition exists. A straightforward fix
is to walk the list of devices on usb_bus_type instead since the device
is added to that list before the announcement occurs.

bus_find_device calls get_device to bump the reference count on the found
device. It is arguable that the reference count should be dropped by the
caller of usb_find_interface instead of usb_find_interface, however,
the current users of usb_find_interface do not expect this.

The original version of this patch only matched against minor number
instead of driver and minor number. This version matches against both.

Signed-off-by: Russ Dill 
Signed-off-by: Greg Kroah-Hartman

USB: EHCI: don't send Clear-TT-Buffer following a STALL

2009-12-08T18:22:12+00:00

commit c2f6595fbdb408d3d6850cfae590c8fa93e27399 upstream.

This patch (as1304) fixes a regression in ehci-hcd.  Evidently some
hubs don't handle Clear-TT-Buffer requests correctly, so we should
avoid sending them when they don't appear to be absolutely necessary.
The reported symptom is that output on a downstream audio device cuts
out because the hub stops relaying isochronous packets.

The patch prevents Clear-TT-Buffer requests from being sent following
a STALL handshake.  In theory a STALL indicates either that the
downstream device sent a STALL or that no matching TT buffer could be
found.  In either case, the transfer is completed and the TT buffer
does not remain busy, so it doesn't need to be cleared.

Also, the patch fixes a minor flaw in the code that actually sends the
Clear-TT-Buffer requests.  Although the pipe direction isn't really
used for control transfers, it should be a Send rather than a Receive.

Signed-off-by: Alan Stern 
Reported-by: Javier Kohen 
CC: David Brownell 
Signed-off-by: Greg Kroah-Hartman

USB: Fix SS endpoint companion descriptor parsing.

2009-10-05T16:32:54+00:00

commit 6682bb39e111b34290e25c4d275c5bcf8bbccbe1 upstream.

When there's a descriptor after the SuperSpeed endpoint companion
descriptor, the previous code would have skipped over twice the length it
was supposed to.  This code fixes crashes seen with UASP devices (which
have a UASP descriptor after the SS endpoint companion descriptor).

Signed-off-by: Sarah Sharp 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: fix -ENOENT error code to be -ENODEV

2009-08-07T23:05:13+00:00

This patch (as1272) changes the error code returned when an open call
for a USB device node fails to locate the corresponding device.  The
appropriate error code is -ENODEV, not -ENOENT.

Signed-off-by: Alan Stern 
CC: Kay Sievers 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

USB: devio: Properly do access_ok() checks

2009-08-07T23:05:12+00:00

access_ok() checks must be done on every part of the userspace structure
that is accessed. If access_ok() on one part of the struct succeeded, it
does not imply it will succeed on other parts of the struct. (Does
depend on the architecture implementation of access_ok()).

This changes the __get_user() users to first check access_ok() on the
data structure.

Signed-off-by: Michael Buesch 
Cc: stable 
Cc: Pete Zaitcev 
Signed-off-by: Greg Kroah-Hartman

USB: Fix parsing of SuperSpeed Endpoint Companion descriptor.

2009-07-28T21:31:13+00:00

usb_parse_ss_endpoint_companion() was supposed to allocate a structure to
hold the SuperSpeed Endpoint Companion descriptor, and either copy the
values the device returned, or fill in default values if the device
descriptor did not include the companion descriptor.

However, the previous code would miss the last endpoint in a configuration
with no descriptors after it.  Make usb_parse_endpoint() allocate the SS
endpoint companion descriptor and fill it with default values, even if
we've run out of buffer space in this configuration descriptor.

Signed-off-by: Sarah Sharp 
Signed-off-by: Greg Kroah-Hartman

USB: handle zero-length usbfs submissions correctly

2009-07-12T22:16:41+00:00

This patch (as1262) fixes a bug in usbfs: It refuses to accept
zero-length transfers, and it insists that the buffer pointer be valid
even if there is no data being transferred.

The patch also consolidates a bunch of repetitive access_ok() checks
into a single check, which incidentally fixes the lack of such a check
for Isochronous URBs.

Signed-off-by: Alan Stern 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

USB: fix LANGID=0 regression

2009-07-12T22:16:40+00:00

commit b7af0bb ("USB: allow malformed LANGID descriptors") broke support
for devices without string descriptor support.

Reporting string descriptors is optional to USB devices, and a device
lets us know it can't deal with strings by responding to the LANGID
request with a STALL token.

The kernel handled that correctly before b7af0bb came in, but failed
hard if the LANGID was reported but broken. More than that, if a device
was not able to provide string descriptors, the LANGID was retrieved
over and over again at each string read request.

This patch changes the behaviour so that

 a) the LANGID is only queried once
 b) devices which can't handle string requests are not asked again
 c) devices with malformed LANGID values have a sane fallback to 0x0409

Signed-off-by: Daniel Mack 
Acked-by: Alan Stern 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

USB: fix race leading to a write after kfree in usbfs

2009-07-12T22:16:40+00:00

this fixes a race between async_completed() and proc_reapurbnonblock().

CPU A                   CPU B

spin_lock(&ps->lock);
list_move_tail(&as->asynclist, &ps->async_completed);
spin_unlock(&ps->lock);

                                if (!(as = async_getcompleted(ps)))
                                        return -EAGAIN;
                                return processcompl(as, (void __user * __user *)arg);

processcompl() calls free_async() which calls kfree(as)

as->status = urb->status;
if (as->signr) {
        sinfo.si_signo = as->signr;
        sinfo.si_errno = as->status;
        sinfo.si_code = SI_ASYNCIO;
        sinfo.si_addr = as->userurb;
        kill_pid_info_as_uid(as->signr, &sinfo, as->pid, as->uid,
                              as->euid, as->secid);
}
snoop(&urb->dev->dev, "urb complete\n");
snoop_urb(urb, as->userurb);

write after kfree

Signed-off-by: Oliver Neukum

Revert USB: usbfs: deprecate and hide option for !embedded

2009-07-12T22:16:39+00:00

This reverts commit cc71329b3b89b4a5be849b617f2c4f151f0b9213, so that
Red Hat machines can boot properly.  It seems that the Red Hat initrd
code tries to watch the /proc/bus/usb/devices file to monitor usb
devices showing up.  While this task is prone to lots of races and does
not show the true state of the system, they seem to like it.

So for now, don't move this option under the EMBEDDED config option.


Cc: Scott James Remnant 
Cc: Kay Sievers 
Cc: Dave Airlie 
Cc: Peter Jones 
Cc: Jeff Chua 
Cc: Dave Jones 
Signed-off-by: Greg Kroah-Hartman