aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/usb (follow)
AgeCommit message (Collapse)AuthorFilesLines
2018-10-26Merge tag 'usb-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usbLinus Torvalds94-1649/+4027
Pull USB/PHY updates from Greg KH: "Here is the big USB/PHY driver patches for 4.20-rc1 Lots of USB changes in here, primarily in these areas: - typec updates and new drivers - new PHY drivers - dwc2 driver updates and additions (this old core keeps getting added to new devices.) - usbtmc major update based on the industry group coming together and working to add new features and performance to the driver. - USB gadget additions for new features - USB gadget configfs updates - chipidea driver updates - other USB gadget updates - USB serial driver updates - renesas driver updates - xhci driver updates - other tiny USB driver updates All of these have been in linux-next for a while with no reported issues" * tag 'usb-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (229 commits) usb: phy: ab8500: silence some uninitialized variable warnings usb: xhci: tegra: Add genpd support usb: xhci: tegra: Power-off power-domains on removal usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten usbip: tools: fix atoi() on non-null terminated string USB: misc: appledisplay: fix backlight update_status return code phy: phy-pxa-usb: add a new driver usb: host: add DT bindings for faraday fotg2 usb: host: ohci-at91: fix request of irq for optional gpio usb/early: remove set but not used variable 'remain_length' usb: typec: Fix copy/paste on typec_set_vconn_role() kerneldoc usb: typec: tcpm: Report back negotiated PPS voltage and current USB: core: remove set but not used variable 'udev' usb: core: fix memory leak on port_dev_path allocation USB: net2280: Remove ->disconnect() callback from net2280_pullup() usb: dwc2: disable power_down on rockchip devices usb: gadget: udc: renesas_usb3: add support for r8a77990 dt-bindings: usb: renesas_usb3: add bindings for r8a77990 usb: gadget: udc: renesas_usb3: Add r8a774a1 support USB: serial: cypress_m8: remove set but not used variable 'iflag' ...
2018-10-25Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds1-8/+8
Pull crypto updates from Herbert Xu: "API: - Remove VLA usage - Add cryptostat user-space interface - Add notifier for new crypto algorithms Algorithms: - Add OFB mode - Remove speck Drivers: - Remove x86/sha*-mb as they are buggy - Remove pcbc(aes) from x86/aesni - Improve performance of arm/ghash-ce by up to 85% - Implement CTS-CBC in arm64/aes-blk, faster by up to 50% - Remove PMULL based arm64/crc32 driver - Use PMULL in arm64/crct10dif - Add aes-ctr support in s5p-sss - Add caam/qi2 driver Others: - Pick better transform if one becomes available in crc-t10dif" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (124 commits) crypto: chelsio - Update ntx queue received from cxgb4 crypto: ccree - avoid implicit enum conversion crypto: caam - add SPDX license identifier to all files crypto: caam/qi - simplify CGR allocation, freeing crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static crypto: arm64/aes-blk - ensure XTS mask is always loaded crypto: testmgr - fix sizeof() on COMP_BUF_SIZE crypto: chtls - remove set but not used variable 'csk' crypto: axis - fix platform_no_drv_owner.cocci warnings crypto: x86/aes-ni - fix build error following fpu template removal crypto: arm64/aes - fix handling sub-block CTS-CBC inputs crypto: caam/qi2 - avoid double export crypto: mxs-dcp - Fix AES issues crypto: mxs-dcp - Fix SHA null hashes and output length crypto: mxs-dcp - Implement sha import/export crypto: aegis/generic - fix for big endian systems crypto: morus/generic - fix for big endian systems crypto: lrw - fix rebase error after out of bounds fix crypto: cavium/nitrox - use pci_alloc_irq_vectors() while enabling MSI-X. crypto: cavium/nitrox - NITROX command queue changes. ...
2018-10-24Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfsLinus Torvalds19-535/+239
Pull tty ioctl updates from Al Viro: "This is the compat_ioctl work related to tty ioctls. Quite a bit of dead code taken out, all tty-related stuff gone from fs/compat_ioctl.c. A bunch of compat bugs fixed - some still remain, but all more or less generic tty-related ioctls should be covered (remaining issues are in things like driver-private ioctls in a pcmcia serial card driver not getting properly handled in 32bit processes on 64bit host, etc)" * 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (53 commits) kill TIOCSERGSTRUCT change semantics of ldisc ->compat_ioctl() kill TIOCSER[SG]WILD synclink_gt(): fix compat_ioctl() pty: fix compat ioctls compat_ioctl - kill keyboard ioctl handling gigaset: add ->compat_ioctl() vt_compat_ioctl(): clean up, use compat_ptr() properly gigaset: don't try to printk userland buffer contents dgnc: don't bother with (empty) stub for TCXONC dgnc: leave TIOC[GS]SOFTCAR to ldisc remove fallback to drivers for TIOCGICOUNT dgnc: break-related ioctls won't reach ->ioctl() kill the rest of tty COMPAT_IOCTL() entries dgnc: TIOCM... won't reach ->ioctl() isdn_tty: TCSBRK{,P} won't reach ->ioctl() kill capinc_tty_ioctl() take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl() synclink: reduce pointless checks in ->ioctl() complete ->[sg]et_serial() switchover ...
2018-10-24Merge branch 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespaceLinus Torvalds2-4/+4
Pull siginfo updates from Eric Biederman: "I have been slowly sorting out siginfo and this is the culmination of that work. The primary result is in several ways the signal infrastructure has been made less error prone. The code has been updated so that manually specifying SEND_SIG_FORCED is never necessary. The conversion to the new siginfo sending functions is now complete, which makes it difficult to send a signal without filling in the proper siginfo fields. At the tail end of the patchset comes the optimization of decreasing the size of struct siginfo in the kernel from 128 bytes to about 48 bytes on 64bit. The fundamental observation that enables this is by definition none of the known ways to use struct siginfo uses the extra bytes. This comes at the cost of a small user space observable difference. For the rare case of siginfo being injected into the kernel only what can be copied into kernel_siginfo is delivered to the destination, the rest of the bytes are set to 0. For cases where the signal and the si_code are known this is safe, because we know those bytes are not used. For cases where the signal and si_code combination is unknown the bits that won't fit into struct kernel_siginfo are tested to verify they are zero, and the send fails if they are not. I made an extensive search through userspace code and I could not find anything that would break because of the above change. If it turns out I did break something it will take just the revert of a single change to restore kernel_siginfo to the same size as userspace siginfo. Testing did reveal dependencies on preferring the signo passed to sigqueueinfo over si->signo, so bit the bullet and added the complexity necessary to handle that case. Testing also revealed bad things can happen if a negative signal number is passed into the system calls. Something no sane application will do but something a malicious program or a fuzzer might do. So I have fixed the code that performs the bounds checks to ensure negative signal numbers are handled" * 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (80 commits) signal: Guard against negative signal numbers in copy_siginfo_from_user32 signal: Guard against negative signal numbers in copy_siginfo_from_user signal: In sigqueueinfo prefer sig not si_signo signal: Use a smaller struct siginfo in the kernel signal: Distinguish between kernel_siginfo and siginfo signal: Introduce copy_siginfo_from_user and use it's return value signal: Remove the need for __ARCH_SI_PREABLE_SIZE and SI_PAD_SIZE signal: Fail sigqueueinfo if si_signo != sig signal/sparc: Move EMT_TAGOVF into the generic siginfo.h signal/unicore32: Use force_sig_fault where appropriate signal/unicore32: Generate siginfo in ucs32_notify_die signal/unicore32: Use send_sig_fault where appropriate signal/arc: Use force_sig_fault where appropriate signal/arc: Push siginfo generation into unhandled_exception signal/ia64: Use force_sig_fault where appropriate signal/ia64: Use the force_sig(SIGSEGV,...) in ia64_rt_sigreturn signal/ia64: Use the generic force_sigsegv in setup_frame signal/arm/kvm: Use send_sig_mceerr signal/arm: Use send_sig_fault where appropriate signal/arm: Use force_sig_fault where appropriate ...
2018-10-18usb: phy: ab8500: silence some uninitialized variable warningsDan Carpenter1-2/+6
Smatch complains that "reg" can be uninitialized if the abx500_get_register_interruptible() call fails. It's an interruptable function, so we should check if the user presses CTRL-C. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-18usb: xhci: tegra: Add genpd supportJon Hunter1-12/+77
The generic power-domain framework has been updated to allow devices that require more than one power-domain to create a new device for each power-domain required and then link these new power-domain devices to the consumer device. Update the Tegra xHCI driver to use the new APIs provided by the generic power-domain framework so we can use the generic power-domain framework for managing the xHCI controllers power-domains. Please note that to maintain backward compatibility with older device-tree blobs these new generic power-domain APIs are only used if the 'power-domains' property is present and otherwise we fall back to using the legacy Tegra APIs for managing the power-domains. Signed-off-by: Jon Hunter <jonathanh@nvidia.com> Acked-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-18usb: xhci: tegra: Power-off power-domains on removalJon Hunter1-0/+5
Currently the XUSB power domains used by the Tegra xHCI controller are never powered off on the removal of the driver, however, they will be powered off on probe failure. Update the removal code to be consistent with the probe failure path to power off the XUSB power domains. Signed-off-by: Jon Hunter <jonathanh@nvidia.com> Acked-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-18usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwrittenShuah Khan (Samsung OSG)1-1/+9
In rmmod path, usbip_vudc does platform_device_put() twice once from platform_device_unregister() and then from put_vudc_device(). The second put results in: BUG kmalloc-2048 (Not tainted): Poison overwritten error or BUG: KASAN: use-after-free in kobject_put+0x1e/0x230 if KASAN is enabled. [ 169.042156] calling init+0x0/0x1000 [usbip_vudc] @ 1697 [ 169.042396] ============================================================================= [ 169.043678] probe of usbip-vudc.0 returned 1 after 350 usecs [ 169.044508] BUG kmalloc-2048 (Not tainted): Poison overwritten [ 169.044509] ----------------------------------------------------------------------------- ... [ 169.057849] INFO: Freed in device_release+0x2b/0x80 age=4223 cpu=3 pid=1693 [ 169.057852] kobject_put+0x86/0x1b0 [ 169.057853] 0xffffffffc0c30a96 [ 169.057855] __x64_sys_delete_module+0x157/0x240 Fix it to call platform_device_del() instead and let put_vudc_device() do the platform_device_put(). Reported-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-18USB: misc: appledisplay: fix backlight update_status return codeMattias Jacobsson1-2/+5
Upon success the update_status handler returns a positive number corresponding to the number of bytes transferred by usb_control_msg. However the return code of the update_status handler should indicate if an error occurred(negative) or how many bytes of the user's input to sysfs that was consumed. Return code zero indicates all bytes were consumed. The bug can for example result in the update_status handler being called twice, the second time with only the "unconsumed" part of the user's input to sysfs. Effectively setting an incorrect brightness. Change the update_status handler to return zero for all successful transactions and forward usb_control_msg's error code upon failure. Signed-off-by: Mattias Jacobsson <2pi@mok.nu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-18Merge tag 'usb-serial-4.20-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-nextGreg Kroah-Hartman3-6/+420
Johan writes: USB-serial updates for v4.20-rc1 Here are the USB-serial updates for 4.20-rc1, including: - support for CBUS GPIO on FTDI devices (FTX and FT232R) - fix of a long-standing transfer-length bug Included are also various clean ups. All have been in linux-next with no reported issues. Signed-off-by: Johan Hovold <johan@kernel.org> * tag 'usb-serial-4.20-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: cypress_m8: remove set but not used variable 'iflag' USB: serial: cypress_m8: fix interrupt-out transfer length USB: serial: ftdi_sio: add support for FT232R CBUS gpios USB: serial: ftdi_sio: fix gpio name collisions USB: serial: ftdi_sio: implement GPIO support for FT-X devices USB: serial: cypress_m8: fix spelling mistake "retreiving" -> "retrieving"
2018-10-17usb: gadget: storage: Fix Spectre v1 vulnerabilityGustavo A. R. Silva1-0/+3
num can be indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/usb/gadget/function/f_mass_storage.c:3177 fsg_lun_make() warn: potential spectre issue 'fsg_opts->common->luns' [r] (local cap) Fix this by sanitizing num before using it to index fsg_opts->common->luns Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Acked-by: Felipe Balbi <felipe.balbi@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-16USB: fix the usbfs flag sanitization for control transfersAlan Stern1-2/+2
Commit 7a68d9fb8510 ("USB: usbdevfs: sanitize flags more") checks the transfer flags for URBs submitted from userspace via usbfs. However, the check for whether the USBDEVFS_URB_SHORT_NOT_OK flag should be allowed for a control transfer was added in the wrong place, before the code has properly determined the direction of the control transfer. (Control transfers are special because for them, the direction is set by the bRequestType byte of the Setup packet rather than direction bit of the endpoint address.) This patch moves code which sets up the allow_short flag for control transfers down after is_in has been set to the correct value. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-and-tested-by: syzbot+24a30223a4b609bb802e@syzkaller.appspotmail.com Fixes: 7a68d9fb8510 ("USB: usbdevfs: sanitize flags more") CC: Oliver Neukum <oneukum@suse.com> CC: <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-15usb: host: ohci-at91: fix request of irq for optional gpioTudor.Ambarus@microchip.com1-0/+2
atmel,oc-gpio is optional. Request its irq only when atmel,oc is set in device tree. devm_gpiod_get_index_optional returns NULL if -ENOENT. Check its return value for NULL before error, because it is more probable that atmel,oc is not set. This fixes the following errors on boards where atmel,oc is not set in device tree: [ 0.960000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ [ 0.960000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ [ 0.970000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-13complete ->[sg]et_serial() switchoverAl Viro1-2/+2
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13usb_wwan: switch to ->[sg]et_serial()Al Viro3-49/+23
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13whiteheat: switch to ->get_serial()Al Viro1-27/+15
... and fix the return value - on success it used to have ioctl(2) fill the user-supplied struct serial_struct and return -ENOTTY. Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13ti_usb_3410_5052: switch to ->[sg]et_serial()Al Viro1-50/+24
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13ssu100: switch to ->get_serial()Al Viro1-31/+11
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13quatech2: switch to ->get_serial()Al Viro1-31/+11
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13pl2303: switch to ->get_serial()Al Viro1-21/+8
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13opticon: switch to ->get_serial()Al Viro1-31/+12
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13mos7840: switch to ->get_serial()Al Viro1-26/+13
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13mos7720: switch to ->get_serial()Al Viro1-21/+13
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13io_ti: switch to ->get_serial()Al Viro1-33/+14
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13io_edgeport: switch to ->get_serial()Al Viro1-21/+16
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13fdti_sio: switch to ->[sg]et_serial()Al Viro1-27/+21
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13f81534: switch to ->get_serial()Al Viro1-30/+8
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13f81232: switch to ->get_serial()Al Viro1-28/+8
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13ark3116: switch to ->get_serial()Al Viro1-30/+8
Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13cdc-acm: switch to ->[sg]et_serial()Al Viro1-27/+14
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-13usb-serial: begin switching to ->[sg]et_serial()Al Viro1-0/+20
add such methods for usb_serial_driver, provide tty_operations ->[sg]et_serial() calling those. For now the lack of methods in driver means ENOIOCTLCMD from usb-serial ->[sg]et_serial(), making tty_ioctl() fall back to calling ->ioctl(). Once all drivers are converted, we'll be returning -ENOTTY instead, completing the switchover. Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2018-10-09usb: xhci: pci: Enable Intel USB role mux on Apollo Lake platformsHeikki Krogerus1-2/+4
Intel Apollo Lake has the same internal USB role mux as Intel Cherry Trail. Cc: <stable@vger.kernel.org> Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-09usb: roles: intel_xhci: Fix Unbalanced pm_runtime_enableWan Ahmad Zainie1-0/+2
Add missing pm_runtime_disable() to remove(), in order to avoid an Unbalanced pm_runtime_enable when the module is removed and re-probed. Error log: root@intel-corei7-64:~# modprobe -r intel_xhci_usb_role_switch root@intel-corei7-64:~# modprobe intel_xhci_usb_role_switch intel_xhci_usb_sw intel_xhci_usb_sw: Unbalanced pm_runtime_enable! Fixes: cb2968468605 (usb: roles: intel_xhci: Enable runtime PM) Cc: <stable@vger.kernel.org> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by: Wan Ahmad Zainie <wan.ahmad.zainie.wan.mohamad@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-09cdc-acm: correct counting of UART states in serial state notificationTobias Herzog1-7/+7
The usb standard ("Universal Serial Bus Class Definitions for Communication Devices") distiguishes between "consistent signals" (DSR, DCD), and "irregular signals" (break, ring, parity error, framing error, overrun). The bits of "irregular signals" are set, if this error/event occurred on the device side and are immeadeatly unset, if the serial state notification was sent. Like other drivers of real serial ports do, just the occurence of those events should be counted in serial_icounter_struct (but no 1->0 transitions). Signed-off-by: Tobias Herzog <t-herzog@gmx.de> Acked-by: Oliver Neukum <oneukum@suse.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-09cdc-acm: do not reset notification buffer index upon urb unlinkingTobias Herzog1-1/+0
Resetting the write index of the notification buffer on urb unlink (e.g. closing a cdc-acm device from userspace) may lead to wrong interpretation of further received notifications, in case the index is not 0 when urb unlink happens (i.e. when parts of a notification already have been transferred). On the device side there is no "reset" of the notification transimission and thus we would get out of sync with the device. Signed-off-by: Tobias Herzog <t-herzog@gmx.de> Acked-by: Oliver Neukum <oneukum@suse.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-09cdc-acm: fix race between reset and control messagingOliver Neukum1-0/+1
If a device splits up a control message and a reset() happens between the parts, the message is lost and already recieved parts must be dropped. Signed-off-by: Oliver Neukum <oneukum@suse.com> Fixes: 1aba579f3cf51 ("cdc-acm: handle read pipe errors") Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-09usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control()Shuah Khan (Samsung OSG)1-15/+42
vhci_hub_control() accesses port_status array with out of bounds port value. Fix it to reference port_status[] only with a valid rhport value when invalid_rhport flag is true. The invalid_rhport flag is set early on after detecting in port value is within the bounds or not. The following is used reproduce the problem and verify the fix: C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14ed8ab6400000 Reported-by: syzbot+bccc1fe10b70fadc78d0@syzkaller.appspotmail.com Cc: stable <stable@vger.kernel.org> Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-09usb/early: remove set but not used variable 'remain_length'YueHaibing1-3/+0
Fixes gcc '-Wunused-but-set-variable' warning: drivers/usb/early/xhci-dbc.c: In function 'xdbc_handle_tx_event': drivers/usb/early/xhci-dbc.c:720:9: warning: variable 'remain_length' set but not used [-Wunused-but-set-variable] It never be used since introduction in commit aeb9dd1de98c ("usb/early: Add driver for xhci debug capability") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-09usb: typec: Fix copy/paste on typec_set_vconn_role() kerneldocStephen Boyd1-1/+1
This must have been copy pasted from the function above. Fix it. Signed-off-by: Stephen Boyd <swboyd@chromium.org> Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-09usb: typec: tcpm: Report back negotiated PPS voltage and currentAdam Thomson1-0/+6
Currently when requesting a specific voltage or current through the psy interface, for PPS, when reading back from that interface the values will always be the same as previously given, if the request was successful. However PPS only allows for 20mV voltage steps and 50mA current steps, and the psy class expects microvolt and micro amp requests, so inbetween values can be provided through this interface. Really when reading back the true values negotiated should be given, and not the ones originally asked for. To report the actual values negotiated with the Source, the values stored are now rounded down to the relevant step units prior to building the PPS request, so that those values are later correctly reported through the psy interface. In addition this improves the adjustments made to meet the operating power requirements of the platform, which previously could have been slightly out due to not using valid PPS units of voltage and current. Signed-off-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-09USB: core: remove set but not used variable 'udev'YueHaibing1-3/+0
Fixes gcc '-Wunused-but-set-variable' warning: drivers/usb/core/driver.c: In function 'usb_driver_claim_interface': drivers/usb/core/driver.c:513:21: warning: variable 'udev' set but not used [-Wunused-but-set-variable] Since commit c183813fcee44a24 ("USB: remove LPM management from usb_driver_claim_interface()"), 'udev' is not used. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-09usb: core: fix memory leak on port_dev_path allocationColin Ian King1-1/+3
Currently the allocation of port_dev_path from the call to kobject_get_path is not being kfree'd, causing a memory leak. Fix this by kfree'ing this at the end of the function. Add an extra error exit path to fix one of the early leaks when envp[0] fails to be allocated. Detected by CoverityScan, CID#1473771 ("Resource Leak") Fixes: 201af55da8a3 ("usb: core: added uevent for over-current") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-08Merge tag 'usb-ci-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-testingGreg Kroah-Hartman7-17/+55
Peter writes: - Add pinctrl support for dual-role switch at chipidea-core - improve overcorrent handling for imx - some small code restructure (no function affect) * tag 'usb-ci-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb: usb: chipidea: Fix otg event handler usb: chipidea: Prevent unbalanced IRQ disable doc: usb: ci-hdrc-usb2: Add pinctrl properties definition usb: chipidea: Add dynamic pinctrl selection usb: chipidea: imx: make MODULE_LICENCE and SPDX-identifier match usb: chipidea: imx: enable OTG overcurrent in case USB subsystem is already started usb: chipidea: imx: do not use preprocessor conditionals for PM
2018-10-08Merge 4.19-rc7 into usb-nextGreg Kroah-Hartman5-5/+25
We want the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-05Merge tag 'usb-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-nextGreg Kroah-Hartman26-778/+1284
Felipe writes: USB for v4.20 With 63 non-merge commits, this is not a large merge window for USB peripheral. The largest changes go to the UVC gadget driver which a few folks have been improving. Apart from UVC changes, we have a few more devices being added to Renesas USB3 and DWC3 controller drivers and a couple minor bug fixes on other drivers. * tag 'usb-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: (63 commits) USB: net2280: Remove ->disconnect() callback from net2280_pullup() usb: dwc2: disable power_down on rockchip devices usb: gadget: udc: renesas_usb3: add support for r8a77990 dt-bindings: usb: renesas_usb3: add bindings for r8a77990 usb: gadget: udc: renesas_usb3: Add r8a774a1 support usb: gadget: udc: renesas_usb3: Fix b-device mode for "workaround" usb: dwc2: gadget: Add handler for WkupAlert interrupt usb: dwc2: gadget: enable WKUP_ALERT interrupt usb: dwc2: gadget: Program GREFCLK register usb: dwc2: gadget: Add parameters for GREFCLK register usb: dwc2: Add definitions for new registers usb: dwc2: Update target (u)frame calculation usb: dwc2: Add dwc2_gadget_dec_frame_num_by_one() function usb: dwc2: Add core parameter for service interval support usb: dwc2: Update registers definitions to support service interval usb: renesas_usbhs: add support for R-Car E3 dt-bindings: usb: renesas_usbhs: add bindings for r8a77990 usb: renesas_usbhs: rcar3: Use OTG mode for R-Car D3 Revert "usb: renesas_usbhs: set the mode by using extcon state for non-otg channel" usb: gadget: f_uac2: disable IN/OUT ep if unused ...
2018-10-05USB: net2280: Remove ->disconnect() callback from net2280_pullup()Alan Stern1-3/+0
The net2280 UDC driver invokes the gadget driver's ->disconnect() callback routine when the net2280_pullup() routine turns off the D+ pullup. This is now unnecessary, because the gadget core performs the callback on our behalf. This patch removes the unneeded callback. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-10-05usb: dwc2: disable power_down on rockchip devicesSolidHal1-0/+1
The bug would let the usb controller enter partial power down, which was formally known as hibernate, upon boot if nothing was plugged in to the port. Partial power down couldn't be exited properly, so any usb devices plugged in after boot would not be usable. Before the name change, params.hibernation was false by default, so _dwc2_hcd_suspend() would skip entering hibernation. With the rename, _dwc2_hcd_suspend() was changed to use params.power_down to decide whether or not to enter partial power down. Since params.power_down is non-zero by default, it needs to be set to 0 for rockchip devices to restore functionality. This bug was reported in the linux-usb thread: REGRESSION: usb: dwc2: USB device not seen after boot The commit that caused this regression is: 6d23ee9caa6790aea047f9aca7f3c03cb8d96eb6 Signed-off-by: SolidHal <hal@halemmerich.com> Acked-by: Minas Harutyunyan <hminas@synopsys.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-10-05usb: gadget: udc: renesas_usb3: add support for r8a77990Yoshihiro Shimoda1-0/+11
Since r8a77990 (R-Car E3) doesn't have VBUS detect pin and number of ramif is 4, this patch adds a new renesas_usb3_priv variable for the SoC. Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-10-05USB: serial: cypress_m8: remove set but not used variable 'iflag'YueHaibing1-2/+1
Fixes gcc '-Wunused-but-set-variable' warning: drivers/usb/serial/cypress_m8.c: In function 'cypress_set_termios': drivers/usb/serial/cypress_m8.c:866:18: warning: variable 'iflag' set but not used [-Wunused-but-set-variable] Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Johan Hovold <johan@kernel.org>
2018-10-05USB: serial: cypress_m8: fix interrupt-out transfer lengthJohan Hovold1-1/+1
Fix interrupt-out transfer length which was being set to the transfer-buffer length rather than the size of the outgoing packet. Note that no slab data was leaked as the whole transfer buffer is always cleared before each transfer. Fixes: 9aa8dae7b1fa ("cypress_m8: use usb_fill_int_urb where appropriate") Signed-off-by: Johan Hovold <johan@kernel.org>