linux-toradex.git/drivers/usb/core, branch v3.12.47

USB: usbfs: allow URBs to be reaped after disconnection

2015-08-04T14:52:31+00:00

commit 3f2cee73b650921b2e214bf487b2061a1c266504 upstream.

The usbfs API has a peculiar hole: Users are not allowed to reap their
URBs after the device has been disconnected.  There doesn't seem to be
any good reason for this; it is an ad-hoc inconsistency.

The patch allows users to issue the USBDEVFS_REAPURB and
USBDEVFS_REAPURBNDELAY ioctls (together with their 32-bit counterparts
on 64-bit systems) even after the device is gone.  If no URBs are
pending for a disconnected device then the ioctls will return -ENODEV
rather than -EAGAIN, because obviously no new URBs will ever be able
to complete.

The patch also adds a new capability flag for
USBDEVFS_GET_CAPABILITIES to indicate that the reap-after-disconnect
feature is supported.

Signed-off-by: Alan Stern 
Tested-by: Chris Dickens 
Acked-by: Hans de Goede 
Signed-off-by: Jiri Slaby

USB: devio: fix a condition in async_completed()

2015-08-04T14:52:12+00:00

commit 83ed07c5db71bc02bd646d6eb60b48908235cdf9 upstream.

Static checkers complain that the current condition is never true.  It
seems pretty likely that it's a typo and "URB" was intended instead of
"USB".

Fixes: 3d97ff63f899 ('usbdevfs: Use scatter-gather lists for large bulk transfers')
Signed-off-by: Dan Carpenter 
Acked-by: Alan Stern 
Signed-off-by: Jiri Slaby

Added another USB product ID for ELAN touchscreen quirks.

2015-05-26T14:26:59+00:00

commit dc703ec22074d9c71a12da20670369fac3ea4296 upstream.

I've had the same issue as described in commit

c68929f75dfcb6354918862b91b5778585de1fa5

Except my touchscreen's ID is

ID 04f3:0125 Elan Microelectronics Corp.

Signed-off-by: Logan Gunthorpe 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Jiri Slaby

usb: core: hub: use new USB_RESUME_TIMEOUT

2015-05-04T09:50:00+00:00

commit bbc78c07a51f6fd29c227b1220a9016e585358ba upstream.

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Signed-off-by: Felipe Balbi 
Signed-off-by: Jiri Slaby

HID: yet another buggy ELAN touchscreen

2015-03-16T10:09:26+00:00

commit a32c99e7ab8410bae7c276a7e94ca84d108de034 upstream.

The touchscreen needs the same quirk as the other models.

Signed-off-by: Oliver Neukum 
Reported-by: Bryan Poling 
CC: stable@vger.kernel.org
Acked-by: Greg Kroah-Hartman 
Signed-off-by: Jiri Kosina 
Signed-off-by: Jiri Slaby

USB: usbfs: don't leak kernel data in siginfo

2015-03-12T16:31:13+00:00

commit f0c2b68198589249afd2b1f2c4e8de8c03e19c16 upstream.

When a signal is delivered, the information in the siginfo structure
is copied to userspace.  Good security practice dicatates that the
unused fields in this structure should be initialized to 0 so that
random kernel stack data isn't exposed to the user.  This patch adds
such an initialization to the two places where usbfs raises signals.

Signed-off-by: Alan Stern 
Reported-by: Dave Mielke 
Signed-off-by: Jiri Slaby

usb: core: buffer: smallest buffer should start at ARCH_DMA_MINALIGN

2015-03-01T22:34:20+00:00

commit 5efd2ea8c9f4f12916ffc8ba636792ce052f6911 upstream.

the following error pops up during "testusb -a -t 10"
| musb-hdrc musb-hdrc.1.auto: dma_pool_free buffer-128,	f134e000/be842000 (bad dma)
hcd_buffer_create() creates a few buffers, the smallest has 32 bytes of
size. ARCH_KMALLOC_MINALIGN is set to 64 bytes. This combo results in
hcd_buffer_alloc() returning memory which is 32 bytes aligned and it
might by identified by buffer_offset() as another buffer. This means the
buffer which is on a 32 byte boundary will not get freed, instead it
tries to free another buffer with the error message.

This patch fixes the issue by creating the smallest DMA buffer with the
size of ARCH_KMALLOC_MINALIGN (or 32 in case ARCH_KMALLOC_MINALIGN is
smaller). This might be 32, 64 or even 128 bytes. The next three pools
will have the size 128, 512 and 2048.
In case the smallest pool is 128 bytes then we have only three pools
instead of four (and zero the first entry in the array).
The last pool size is always 2048 bytes which is the assumed PAGE_SIZE /
2 of 4096. I doubt it makes sense to continue using PAGE_SIZE / 2 where
we would end up with 8KiB buffer in case we have 16KiB pages.
Instead I think it makes sense to have a common size(s) and extend them
if there is need to.
There is a BUILD_BUG_ON() now in case someone has a minalign of more than
128 bytes.

Signed-off-by: Sebastian Andrzej Siewior 
Acked-by: Alan Stern 
Signed-off-by: Jiri Slaby

USB: fix use-after-free bug in usb_hcd_unlink_urb()

2015-03-01T22:34:20+00:00

commit c99197902da284b4b723451c1471c45b18537cde upstream.

The usb_hcd_unlink_urb() routine in hcd.c contains two possible
use-after-free errors.  The dev_dbg() statement at the end of the
routine dereferences urb and urb->dev even though both structures may
have been deallocated.

This patch fixes the problem by storing urb->dev in a local variable
(avoiding the dereference of urb) and moving the dev_dbg() up before
the usb_put_dev() call.

Signed-off-by: Alan Stern 
Reported-by: Joe Lawrence 
Tested-by: Joe Lawrence 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Jiri Slaby

usb-quirks: Add reset-resume quirk for MS Wireless Laser Mouse 6000

2014-12-06T14:18:17+00:00

commit 263e80b43559a6103e178a9176938ce171b23872 upstream.

This wireless mouse receiver needs a reset-resume quirk to properly come
out of reset.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1165206
Signed-off-by: Hans de Goede 
Signed-off-by: Jiri Slaby

usb: Do not allow usb_alloc_streams on unconfigured devices

2014-11-13T18:02:54+00:00

commit 90a646c770c50cc206ceba0d7b50453c46c13c36 upstream.

This commit fixes the following oops:

[10238.622067] scsi host3: uas_eh_bus_reset_handler start
[10240.766164] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd
[10245.779365] usb 3-4: device descriptor read/8, error -110
[10245.883331] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd
[10250.897603] usb 3-4: device descriptor read/8, error -110
[10251.058200] BUG: unable to handle kernel NULL pointer dereference at  0000000000000040
[10251.058244] IP: [] xhci_check_streams_endpoint+0x91/0x140

[10251.059473] Call Trace:
[10251.059487]  [] xhci_calculate_streams_and_bitmask+0xbc/0x130
[10251.059520]  [] xhci_alloc_streams+0x10f/0x5a0
[10251.059548]  [] ? check_preempt_curr+0x75/0xa0
[10251.059575]  [] ? ttwu_do_wakeup+0x2c/0x100
[10251.059601]  [] ? ttwu_do_activate.constprop.111+0x66/0x70
[10251.059635]  [] usb_alloc_streams+0xab/0xf0
[10251.059662]  [] uas_configure_endpoints+0x128/0x150 [uas]
[10251.059694]  [] uas_post_reset+0x3c/0xb0 [uas]
[10251.059722]  [] usb_reset_device+0x1b9/0x2a0
[10251.059749]  [] uas_eh_bus_reset_handler+0xb2/0x190 [uas]
[10251.059781]  [] scsi_try_bus_reset+0x53/0x110
[10251.059808]  [] scsi_eh_bus_reset+0xf7/0x270


The problem is the following call sequence (simplified):

1) usb_reset_device
2)  usb_reset_and_verify_device
2)   hub_port_init
3)    hub_port_finish_reset
3)     xhci_discover_or_reset_device
        This frees xhci->devs[slot_id]->eps[ep_index].ring for all eps but 0
4)    usb_get_device_descriptor
       This fails
5)   hub_port_init fails
6)  usb_reset_and_verify_device fails, does not restore device config
7)  uas_post_reset
8)   xhci_alloc_streams
      NULL deref on the free-ed ring

This commit fixes this by not allowing usb_alloc_streams to continue if
the device is not configured.

Note that we do allow usb_free_streams to continue after a (logical)
disconnect, as it is necessary to explicitly free the streams at the xhci
controller level.

Signed-off-by: Hans de Goede 
Acked-by: Alan Stern 
Signed-off-by: Jiri Slaby