linux-toradex.git/drivers/usb, branch v4.4.73

usb: chipidea: debug: check before accessing ci_role

2017-06-14T11:16:22+00:00

commit 0340ff83cd4475261e7474033a381bc125b45244 upstream.

ci_role BUGs when the role is >= CI_ROLE_END.

Signed-off-by: Michael Thalmeier 
Signed-off-by: Peter Chen 
Signed-off-by: Greg Kroah-Hartman

usb: chipidea: udc: fix NULL pointer dereference if udc_start failed

2017-06-14T11:16:22+00:00

commit aa1f058d7d9244423b8c5a75b9484b1115df7f02 upstream.

Fix below NULL pointer dereference. we set ci->roles[CI_ROLE_GADGET]
too early in ci_hdrc_gadget_init(), if udc_start() fails due to some
reason, the ci->roles[CI_ROLE_GADGET] check in  ci_hdrc_gadget_destroy
can't protect us.

We fix this issue by only setting ci->roles[CI_ROLE_GADGET] if
udc_start() succeed.

[    1.398550] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
...
[    1.448600] PC is at dma_pool_free+0xb8/0xf0
[    1.453012] LR is at dma_pool_free+0x28/0xf0
[    2.113369] [] dma_pool_free+0xb8/0xf0
[    2.118857] [] destroy_eps+0x4c/0x68
[    2.124165] [] ci_hdrc_gadget_destroy+0x28/0x50
[    2.130461] [] ci_hdrc_probe+0x588/0x7e8
[    2.136129] [] platform_drv_probe+0x50/0xb8
[    2.142066] [] driver_probe_device+0x1fc/0x2a8
[    2.148270] [] __device_attach_driver+0x9c/0xf8
[    2.154563] [] bus_for_each_drv+0x58/0x98
[    2.160317] [] __device_attach+0xc4/0x138
[    2.166072] [] device_initial_probe+0x10/0x18
[    2.172185] [] bus_probe_device+0x94/0xa0
[    2.177940] [] device_add+0x3f0/0x560
[    2.183337] [] platform_device_add+0x180/0x240
[    2.189541] [] ci_hdrc_add_device+0x440/0x4f8
[    2.195654] [] ci_hdrc_usb2_probe+0x13c/0x2d8
[    2.201769] [] platform_drv_probe+0x50/0xb8
[    2.207705] [] driver_probe_device+0x1fc/0x2a8
[    2.213910] [] __driver_attach+0xac/0xb0
[    2.219575] [] bus_for_each_dev+0x60/0xa0
[    2.225329] [] driver_attach+0x20/0x28
[    2.230816] [] bus_add_driver+0x1d0/0x238
[    2.236571] [] driver_register+0x60/0xf8
[    2.242237] [] __platform_driver_register+0x44/0x50
[    2.248891] [] ci_hdrc_usb2_driver_init+0x18/0x20
[    2.255365] [] do_one_initcall+0x38/0x128
[    2.261121] [] kernel_init_freeable+0x1ac/0x250
[    2.267414] [] kernel_init+0x10/0x100
[    2.272810] [] ret_from_fork+0x10/0x50

Fixes: 3f124d233e97 ("usb: chipidea: add role init and destroy APIs")
Signed-off-by: Jisheng Zhang 
Signed-off-by: Peter Chen 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_mass_storage: Serialize wake and sleep execution

2017-06-14T11:16:22+00:00

commit dc9217b69dd6089dcfeb86ed4b3c671504326087 upstream.

f_mass_storage has a memorry barrier issue with the sleep and wake
functions that can cause a deadlock. This results in intermittent hangs
during MSC file transfer. The host will reset the device after receiving
no response to resume the transfer. This issue is seen when dwc3 is
processing 2 transfer-in-progress events at the same time, invoking
completion handlers for CSW and CBW. Also this issue occurs depending on
the system timing and latency.

To increase the chance to hit this issue, you can force dwc3 driver to
wait and process those 2 events at once by adding a small delay (~100us)
in dwc3_check_event_buf() whenever the request is for CSW and read the
event count again. Avoid debugging with printk and ftrace as extra
delays and memory barrier will mask this issue.

Scenario which can lead to failure:
-----------------------------------
1) The main thread sleeps and waits for the next command in
   get_next_command().
2) bulk_in_complete() wakes up main thread for CSW.
3) bulk_out_complete() tries to wake up the running main thread for CBW.
4) thread_wakeup_needed is not loaded with correct value in
   sleep_thread().
5) Main thread goes to sleep again.

The pattern is shown below. Note the 2 critical variables.
 * common->thread_wakeup_needed
 * bh->state

	CPU 0 (sleep_thread)		CPU 1 (wakeup_thread)
	==============================  ===============================

					bh->state = BH_STATE_FULL;
					smp_wmb();
	thread_wakeup_needed = 0;	thread_wakeup_needed = 1;
	smp_rmb();
	if (bh->state != BH_STATE_FULL)
		sleep again ...

As pointed out by Alan Stern, this is an R-pattern issue. The issue can
be seen when there are two wakeups in quick succession. The
thread_wakeup_needed can be overwritten in sleep_thread, and the read of
the bh->state maybe reordered before the write to thread_wakeup_needed.

This patch applies full memory barrier smp_mb() in both sleep_thread()
and wakeup_thread() to ensure the order which the thread_wakeup_needed
and bh->state are written and loaded.

However, a better solution in the future would be to use wait_queue
method that takes care of managing memory barrier between waker and
waiter.

Acked-by: Alan Stern 
Signed-off-by: Thinh Nguyen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

USB: hub: fix non-SS hub-descriptor handling

2017-05-25T12:30:13+00:00

commit bec444cd1c94c48df409a35ad4e5b143c245c3f7 upstream.

Add missing sanity check on the non-SuperSpeed hub-descriptor length in
order to avoid parsing and leaking two bytes of uninitialised slab data
through sysfs removable-attributes (or a compound-device debug
statement).

Note that we only make sure that the DeviceRemovable field is always
present (and specifically ignore the unused PortPwrCtrlMask field) in
order to continue support any hubs with non-compliant descriptors. As a
further safeguard, the descriptor buffer is also cleared.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: hub: fix SS hub-descriptor handling

2017-05-25T12:30:13+00:00

commit 2c25a2c818023df64463aac3288a9f969491e507 upstream.

A SuperSpeed hub descriptor does not have any variable-length fields so
bail out when reading a short descriptor.

This avoids parsing and leaking two bytes of uninitialised slab data
through sysfs removable-attributes.

Fixes: dbe79bbe9dcb ("USB 3.0 Hub Changes")
Cc: John Youn 
Acked-by: Alan Stern 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: serial: io_ti: fix div-by-zero in set_termios

2017-05-25T12:30:13+00:00

commit 6aeb75e6adfaed16e58780309613a578fe1ee90b upstream.

Fix a division-by-zero in set_termios when debugging is enabled and a
high-enough speed has been requested so that the divisor value becomes
zero.

Instead of just fixing the offending debug statement, cap the baud rate
at the base as a zero divisor value also appears to crash the firmware.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: serial: mct_u232: fix big-endian baud-rate handling

2017-05-25T12:30:13+00:00

commit 26cede343656c0bc2c33cdc783771282405c7fb2 upstream.

Drop erroneous cpu_to_le32 when setting the baud rate, something which
corrupted the divisor on big-endian hosts.

Found using sparse:

	warning: incorrect type in argument 1 (different base types)
	    expected unsigned int [unsigned] [usertype] val
	    got restricted __le32 [usertype] 

Fixes: af2ac1a091bc ("USB: serial mct_usb232: move DMA buffers to heap")
Reviewed-by: Greg Kroah-Hartman 
Acked-By: Pete Zaitcev 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: serial: qcserial: add more Lenovo EM74xx device IDs

2017-05-25T12:30:13+00:00

commit 8d7a10dd323993cc40bd37bce8bc570133b0c396 upstream.

In their infinite wisdom, and never ending quest for end user frustration,
Lenovo has decided to use new USB device IDs for the wwan modules in
their 2017 laptops.  The actual hardware is still the Sierra Wireless
EM7455 or EM7430, depending on region.

Signed-off-by: Bjørn Mork 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

usb: serial: option: add Telit ME910 support

2017-05-25T12:30:13+00:00

commit 40dd46048c155b8f0683f468c950a1c107f77a7c upstream.

This patch adds support for Telit ME910 PID 0x1100.

Signed-off-by: Daniele Palmas 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: iowarrior: fix info ioctl on big-endian hosts

2017-05-25T12:30:13+00:00

commit dd5ca753fa92fb736b1395db892bd29f78e6d408 upstream.

Drop erroneous le16_to_cpu when returning the USB device speed which is
already in host byte order.

Found using sparse:

	warning: cast to restricted __le16

Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman