linux-stable.git/Documentation/usb, branch linux-3.18.y Linux kernel stable tree USB: core: Fix bug caused by duplicate interface PM usage counter 2019-05-16T07:17:18+00:00 Alan Stern stern@rowland.harvard.edu 2019-04-19T17:52:38+00:00 bc1c5d1ac4772cbc39e485ee94bdf2e9d8a2cd7d commit c2b71462d294cf517a0bc6e4fd6424d7cee5596f upstream. The syzkaller fuzzer reported a bug in the USB hub driver which turned out to be caused by a negative runtime-PM usage counter. This allowed a hub to be runtime suspended at a time when the driver did not expect it. The symptom is a WARNING issued because the hub's status URB is submitted while it is already active: URB 0000000031fb463e submitted while active WARNING: CPU: 0 PID: 2917 at drivers/usb/core/urb.c:363 The negative runtime-PM usage count was caused by an unfortunate design decision made when runtime PM was first implemented for USB. At that time, USB class drivers were allowed to unbind from their interfaces without balancing the usage counter (i.e., leaving it with a positive count). The core code would take care of setting the counter back to 0 before allowing another driver to bind to the interface. Later on when runtime PM was implemented for the entire kernel, the opposite decision was made: Drivers were required to balance their runtime-PM get and put calls. In order to maintain backward compatibility, however, the USB subsystem adapted to the new implementation by keeping an independent usage counter for each interface and using it to automatically adjust the normal usage counter back to 0 whenever a driver was unbound. This approach involves duplicating information, but what is worse, it doesn't work properly in cases where a USB class driver delays decrementing the usage counter until after the driver's disconnect() routine has returned and the counter has been adjusted back to 0. Doing so would cause the usage counter to become negative. There's even a warning about this in the USB power management documentation! As it happens, this is exactly what the hub driver does. The kick_hub_wq() routine increments the runtime-PM usage counter, and the corresponding decrement is carried out by hub_event() in the context of the hub_wq work-queue thread. This work routine may sometimes run after the driver has been unbound from its interface, and when it does it causes the usage counter to go negative. It is not possible for hub_disconnect() to wait for a pending hub_event() call to finish, because hub_disconnect() is called with the device lock held and hub_event() acquires that lock. The only feasible fix is to reverse the original design decision: remove the duplicate interface-specific usage counter and require USB drivers to balance their runtime PM gets and puts. As far as I know, all existing drivers currently do this. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-and-tested-by: syzbot+7634edaea4d0b341c625@syzkaller.appspotmail.com CC: <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit c2b71462d294cf517a0bc6e4fd6424d7cee5596f upstream.

The syzkaller fuzzer reported a bug in the USB hub driver which turned
out to be caused by a negative runtime-PM usage counter.  This allowed
a hub to be runtime suspended at a time when the driver did not expect
it.  The symptom is a WARNING issued because the hub's status URB is
submitted while it is already active:

	URB 0000000031fb463e submitted while active
	WARNING: CPU: 0 PID: 2917 at drivers/usb/core/urb.c:363

The negative runtime-PM usage count was caused by an unfortunate
design decision made when runtime PM was first implemented for USB.
At that time, USB class drivers were allowed to unbind from their
interfaces without balancing the usage counter (i.e., leaving it with
a positive count).  The core code would take care of setting the
counter back to 0 before allowing another driver to bind to the
interface.

Later on when runtime PM was implemented for the entire kernel, the
opposite decision was made: Drivers were required to balance their
runtime-PM get and put calls.  In order to maintain backward
compatibility, however, the USB subsystem adapted to the new
implementation by keeping an independent usage counter for each
interface and using it to automatically adjust the normal usage
counter back to 0 whenever a driver was unbound.

This approach involves duplicating information, but what is worse, it
doesn't work properly in cases where a USB class driver delays
decrementing the usage counter until after the driver's disconnect()
routine has returned and the counter has been adjusted back to 0.
Doing so would cause the usage counter to become negative.  There's
even a warning about this in the USB power management documentation!

As it happens, this is exactly what the hub driver does.  The
kick_hub_wq() routine increments the runtime-PM usage counter, and the
corresponding decrement is carried out by hub_event() in the context
of the hub_wq work-queue thread.  This work routine may sometimes run
after the driver has been unbound from its interface, and when it does
it causes the usage counter to go negative.

It is not possible for hub_disconnect() to wait for a pending
hub_event() call to finish, because hub_disconnect() is called with
the device lock held and hub_event() acquires that lock.  The only
feasible fix is to reverse the original design decision: remove the
duplicate interface-specific usage counter and require USB drivers to
balance their runtime PM gets and puts.  As far as I know, all
existing drivers currently do this.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+7634edaea4d0b341c625@syzkaller.appspotmail.com
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: hub: rename khubd to hub_wq in documentation and comments 2014-09-24T05:33:19+00:00 Petr Mladek pmladek@suse.cz 2014-09-19T15:32:23+00:00 37ebb54915dc42944f6ae92fe53b9531c3903801 USB hub has started to use a workqueue instead of kthread. Let's update the documentation and comments here and there. This patch mostly just replaces "khubd" with "hub_wq". There are only few exceptions where the whole sentence was updated. These more complicated changes can be found in the following files: Documentation/usb/hotplug.txt drivers/net/usb/usbnet.c drivers/usb/core/hcd.c drivers/usb/host/ohci-hcd.c drivers/usb/host/xhci.c Signed-off-by: Petr Mladek <pmladek@suse.cz> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
USB hub has started to use a workqueue instead of kthread. Let's update
the documentation and comments here and there.

This patch mostly just replaces "khubd" with "hub_wq". There are only few
exceptions where the whole sentence was updated. These more complicated
changes can be found in the following files:

	   Documentation/usb/hotplug.txt
	   drivers/net/usb/usbnet.c
	   drivers/usb/core/hcd.c
	   drivers/usb/host/ohci-hcd.c
	   drivers/usb/host/xhci.c

Signed-off-by: Petr Mladek <pmladek@suse.cz>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
uwb: doc: bring uwb documentation up to date 2014-09-24T05:04:44+00:00 Thomas Pugliese thomas.pugliese@gmail.com 2014-09-16T20:53:09+00:00 005799d560769bca8d87b08502c34317ab5e3bcd The existing UWB documentation states that UWB devices show up in /sys/class/uwb and /sys/bus/uwb/devices. Up until the most recent changes to add uwb devices to their own bus, neither of these statements were actually true. Now, UWB devices do show up in /sys/bus/uwb/devices so the documentation has been updated to reflect that and removed references to /sys/class/uwb. The existing documentation also states that local UWB radio controller (RC) devices also show up as UWB devices along with their wireless peer UWB devices under /sys/class/uwb. This is not true so that statement has been removed. Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The existing UWB documentation states that UWB devices show up in
/sys/class/uwb and /sys/bus/uwb/devices.  Up until the most recent
changes to add uwb devices to their own bus, neither of these statements
were actually true.  Now, UWB devices do show up in /sys/bus/uwb/devices
so the documentation has been updated to reflect that and removed
references to /sys/class/uwb.

The existing documentation also states that local UWB radio controller
(RC) devices also show up as UWB devices along with their wireless peer
UWB devices under /sys/class/uwb.  This is not true so that statement
has been removed.

Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: doc: hotplug.txt code typos 2014-07-09T23:05:42+00:00 Jeremiah Mahler jmmahler@gmail.com 2014-06-06T19:29:17+00:00 31e01f0aca3e9b77fea0b1c1b569b02fa2812eb6 Fixed several typos in the code examples given in Documentation/usb/hotplug.txt. - missing [] with array of struct usb_device_id - checkpatch.pl warning: space between function name and parenthesis - missing terminating ';' Signed-off-by: Jeremiah Mahler <jmmahler@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Fixed several typos in the code examples given in
Documentation/usb/hotplug.txt.

  - missing [] with array of struct usb_device_id

  - checkpatch.pl warning: space between function name and parenthesis

  - missing terminating ';'

Signed-off-by: Jeremiah Mahler <jmmahler@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: documentation for usb port power off mechanisms 2014-07-09T22:43:12+00:00 Lan Tianyu tianyu.lan@intel.com 2014-05-29T19:58:52+00:00 f64c51975dd635eba2a65f258013a95859b3d04a describe the mechanisms for controlling port power policy and discovering the port power state. [oliver]: fixes, clarification of wakeup vs port-power-control [sarah]: wordsmithing [djbw]: updates for peer port changes [alan]: review and fixes Cc: Oliver Neukum <oneukum@suse.de> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
describe the mechanisms for controlling port power policy and
discovering the port power state.

[oliver]: fixes, clarification of wakeup vs port-power-control
[sarah]: wordsmithing
[djbw]: updates for peer port changes
[alan]: review and fixes
Cc: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial into next 2014-06-04T15:50:34+00:00 Linus Torvalds torvalds@linux-foundation.org 2014-06-04T15:50:34+00:00 1aacb90eaaac057c10fd746e189553e04cfeb291 Pull trivial tree changes from Jiri Kosina: "Usual pile of patches from trivial tree that make the world go round" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (23 commits) staging: go7007: remove reference to CONFIG_KMOD aic7xxx: Remove obsolete preprocessor define of: dma: doc fixes doc: fix incorrect formula to calculate CommitLimit value doc: Note need of bc in the kernel build from 3.10 onwards mm: Fix printk typo in dmapool.c modpost: Fix comment typo "Modules.symvers" Kconfig.debug: Grammar s/addition/additional/ wimax: Spelling s/than/that/, wording s/destinatary/recipient/ aic7xxx: Spelling s/termnation/termination/ arm64: mm: Remove superfluous "the" in comment of: Spelling s/anonymouns/anonymous/ dma: imx-sdma: Spelling s/determnine/determine/ ath10k: Improve grammar in comments ath6kl: Spelling s/determnine/determine/ of: Improve grammar for of_alias_get_id() documentation drm/exynos: Spelling s/contro/control/ radio-bcm2048.c: fix wrong overflow check doc: printk-formats: do not mention casts for u64/s64 doc: spelling error changes ... 
Pull trivial tree changes from Jiri Kosina:
 "Usual pile of patches from trivial tree that make the world go round"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (23 commits)
  staging: go7007: remove reference to CONFIG_KMOD
  aic7xxx: Remove obsolete preprocessor define
  of: dma: doc fixes
  doc: fix incorrect formula to calculate CommitLimit value
  doc: Note need of bc in the kernel build from 3.10 onwards
  mm: Fix printk typo in dmapool.c
  modpost: Fix comment typo "Modules.symvers"
  Kconfig.debug: Grammar s/addition/additional/
  wimax: Spelling s/than/that/, wording s/destinatary/recipient/
  aic7xxx: Spelling s/termnation/termination/
  arm64: mm: Remove superfluous "the" in comment
  of: Spelling s/anonymouns/anonymous/
  dma: imx-sdma: Spelling s/determnine/determine/
  ath10k: Improve grammar in comments
  ath6kl: Spelling s/determnine/determine/
  of: Improve grammar for of_alias_get_id() documentation
  drm/exynos: Spelling s/contro/control/
  radio-bcm2048.c: fix wrong overflow check
  doc: printk-formats: do not mention casts for u64/s64
  doc: spelling error changes
  ...
Doc: usb: chipidea: need to build both kernel Image and modules 2014-05-23T02:36:44+00:00 Peter Chen peter.chen@freescale.com 2014-05-04T01:24:43+00:00 ec447ab138e033ad96a8c6649bce51ecdcc0abe0 When tried to enable OTG FSM, we need to rebuild both kernel Image and modules, since there are some codes at gadget modules which are controlled by related configurations. Signed-off-by: Peter Chen <peter.chen@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
When tried to enable OTG FSM, we need to rebuild both kernel Image
and modules, since there are some codes at gadget modules which are
controlled by related configurations.

Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
doc: spelling error changes 2014-05-05T13:32:05+00:00 Carlos Garcia carlos@cgarcia.org 2014-04-05T02:31:00+00:00 c98be0c96db00e9b6b02d31e0fa7590c54cdaaac Fixed multiple spelling errors. Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Carlos E. Garcia <carlos@cgarcia.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
Fixed multiple spelling errors.

Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Carlos E. Garcia <carlos@cgarcia.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Documentation: usb: add chipidea.txt for how to demo usb OTG HNP and SRP 2014-04-24T19:56:35+00:00 Li Jun b47624@freescale.com 2014-04-23T07:56:54+00:00 9159e049c072bb4f77ac65a7c0fb05953b10fc21 This patch adds a file chipidea.txt for how to demo chipidea usb OTG HNP and SRP functions via sysfs input files, any other possible information should be documented for chipidea usb driver in future can be added into this file. Signed-off-by: Peter Chen <peter.chen@freescale.com> Signed-off-by: Li Jun <b47624@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This patch adds a file chipidea.txt for how to demo chipidea usb OTG HNP and SRP
functions via sysfs input files, any other possible information should be
documented for chipidea usb driver in future can be added into this file.

Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Li Jun <b47624@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
doc: fix double words 2014-03-21T12:16:58+00:00 Masanari Iida standby24x7@gmail.com 2014-03-21T01:04:30+00:00 df5cbb27836ff6a6c807f9030ca536403fc674d2 Fix double words "the the" in various files within Documentations. Signed-off-by: Masanari Iida <standby24x7@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
Fix double words "the the" in various files
within Documentations.

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>