linux-toradex.git/drivers/usb/gadget, branch v4.2.2

usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth

2015-09-21T17:10:52+00:00

commit 913e4a90b6f9687ac0f543e7b632753e4f51c441 upstream.

According to USB Audio Device 2.0 Spec, Ch4.10.1.1:
wMaxPacketSize is defined as follows:
Maximum packet size this endpoint is capable of sending or receiving
when this configuration is selected.
This is determined by the audio bandwidth constraints of the endpoint.

In current code, the wMaxPacketSize is defined as the maximum packet size
for ISO endpoint, and it will let the host reserve much more space than
it really needs, so that we can't let more endpoints work together at
one frame.

We find this issue when we try to let 4 f_uac2 gadgets work together [1]
at FS connection.

[1]http://www.spinics.net/lists/linux-usb/msg123478.html

Acked-by: Daniel Mack 
Cc: andrzej.p@samsung.com
Cc: Daniel Mack 
Cc: tiwai@suse.de
Cc: Alan Stern 
Signed-off-by: Peter Chen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: m66592-udc: forever loop in set_feature()

2015-09-21T17:10:52+00:00

commit 5feb5d2003499b1094d898c010a7604d7afddc4c upstream.

There is an "&&" vs "||" typo here so this loops 3000 times or if we get
unlucky it could loop forever.

Fixes: ceaa0a6eeadf ('usb: gadget: m66592-udc: add support for TEST_MODE')
Signed-off-by: Dan Carpenter 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: udc: core: add device_del() call to error pathway

2015-08-03T14:54:18+00:00

This patch fixes a bug in the error pathway of
usb_add_gadget_udc_release() in udc-core.c.  If the udc registration
fails, the gadget registration is not fully undone; there's a
put_device(&gadget->dev) call but no device_del().

CC: 
Acked-by: Peter Chen 
Signed-off-by: Alan Stern 
Signed-off-by: Felipe Balbi

usb: gadget: f_printer: actually limit the number of instances

2015-07-27T15:19:50+00:00

There is a predefined maximum number of printer instances, currently 4.
A chrdev region is allocated accordingly, but with configfs the user
can create as many printer function directories as they like. To make the
number of printer  instances consistent with the number of allocated
minors, the limit is enforced at directory creation time.

Signed-off-by: Andrzej Pietrasiewicz 
Signed-off-by: Felipe Balbi

usb: gadget: f_hid: actually limit the number of instances

2015-07-27T15:19:50+00:00

There is a predefined maximum number of hid instances, currently 4.
A chrdev region is allocated accordingly, but with configfs the user
can create as many hid function directories as they like. To make
the number of hid instances consistent with the number of allocated minors,
the limit is enforced at directory creation time.

Signed-off-by: Andrzej Pietrasiewicz 
Signed-off-by: Felipe Balbi

usb: gadget: f_uac2: fix calculation of uac2->p_interval

2015-07-27T15:18:06+00:00

The p_interval should be less if the 'bInterval' at the descriptor
is larger, eg, if 'bInterval' is 5 for HS, the p_interval should be
8000 / 16 = 500.

It fixes the patch 9bb87f168931 ("usb: gadget: f_uac2: send
reasonably sized packets")

Cc:  # v3.18+
Fixes: 9bb87f168931 ("usb: gadget: f_uac2: send reasonably sized packets")
Acked-by: Daniel Mack 
Signed-off-by: Peter Chen 
Signed-off-by: Felipe Balbi

usb: gadget: bdc: fix a driver crash on disconnect

2015-07-27T15:15:06+00:00

ep_dequeue() in bdc_ep.c was capturing the hw dequeue pointer
incorrectly by reading the wrong register for the upper 32 bits.

Signed-off-by: Al Cooper 
Signed-off-by: Felipe Balbi

usb: gadget: udc: core: Fix argument of dma_map_single for IOMMU

2015-07-20T17:57:46+00:00

The dma_map_single and dma_unmap_single should set "gadget->dev.parent"
instead of "&gadget->dev" in the first argument because the parent has
a udc controller's device pointer.
Otherwise, iommu functions are not called in ARM environment.

Signed-off-by: Yoshihiro Shimoda 
Signed-off-by: Felipe Balbi

usb: gadget: mv_udc_core: fix phy_regs I/O memory leak

2015-07-20T17:57:46+00:00

There was an omission in transition to devm_xxx resource handling.
iounmap(udc->phy_regs) were removed, but ioremap() was left
without devm_.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Fixes: 3517c31a8ece6 ("usb: gadget: mv_udc: use devm_xxx for probe")
Signed-off-by: Felipe Balbi

configfs: fix kernel infoleak through user-controlled format string

2015-07-17T23:39:53+00:00

Some modules call config_item_init_type_name() and config_group_init_type_name()
with parameter "name" directly controlled by userspace.  These two
functions call config_item_set_name() with this name used as a format
string, which can be used to leak information such as content of the
stack to userspace.

For example, make_netconsole_target() in netconsole module calls
config_item_init_type_name() with the name of a newly-created directory.
This means that the following commands give some unexpected output, with
configfs mounted in /sys/kernel/config/ and on a system with a
configured eth0 ethernet interface:

    # modprobe netconsole
    # mkdir /sys/kernel/config/netconsole/target_%lx
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # echo 1 > /sys/kernel/config/netconsole/target_%lx/enabled
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # dmesg |tail -n1
    [  142.697668] netconsole: target (target_ffffffffc0ae8080) is
    enabled, disable to update parameters

The directory name is correct but %lx has been interpreted in the
internal item name, displayed here in the error message used by
store_dev_name() in drivers/net/netconsole.c.

To fix this, update every caller of config_item_set_name to use "%s"
when operating on untrusted input.

This issue was found using -Wformat-security gcc flag, once a __printf
attribute has been added to config_item_set_name().

Signed-off-by: Nicolas Iooss 
Acked-by: Greg Kroah-Hartman 
Acked-by: Felipe Balbi 
Acked-by: Joel Becker 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds