linux-stable.git/drivers/usb/core/hcd.c, branch linux-3.2.y

USB: hcd: Mark secondary HCD as dead if the primary one died

2017-11-11T13:34:27+00:00

commit cd5a6a4fdaba150089af2afc220eae0fef74878a upstream.

Make usb_hc_died() clear the HCD_FLAG_RH_RUNNING flag for the shared
HCD and set HCD_FLAG_DEAD for it, in analogy with what is done for
the primary one.

Among other thigs, this prevents check_root_hub_suspended() from
returning -EBUSY for dead HCDs which helps to work around system
suspend issues in some situations.

This actually fixes occasional suspend failures on one of my test
machines.

Suggested-by: Alan Stern 
Signed-off-by: Rafael J. Wysocki 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

USB: core: replace %p with %pK

2017-09-15T17:30:42+00:00

commit 2f964780c03b73de269b08d12aff96a9618d13f3 upstream.

Format specifier %p can leak kernel addresses while not valuing the
kptr_restrict system settings. When kptr_restrict is set to (1), kernel
pointers printed using the %pK format specifier will be replaced with
Zeros. Debugging Note : &pK prints only Zeros as address. If you need
actual address information, write 0 to kptr_restrict.

echo 0 > /proc/sys/kernel/kptr_restrict

[Found by poking around in a random vendor kernel tree, it would be nice
if someone would actually send these types of patches upstream - gkh]

Signed-off-by: Vamsi Krishna Samavedam 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: drop changes in proc_reapurb*(), usbdev_do_ioctl(),
 usb_submit_urb()]
Signed-off-by: Ben Hutchings

USB: fix use-after-free bug in usb_hcd_unlink_urb()

2015-05-09T22:16:14+00:00

commit c99197902da284b4b723451c1471c45b18537cde upstream.

The usb_hcd_unlink_urb() routine in hcd.c contains two possible
use-after-free errors.  The dev_dbg() statement at the end of the
routine dereferences urb and urb->dev even though both structures may
have been deallocated.

This patch fixes the problem by storing urb->dev in a local variable
(avoiding the dereference of urb) and moving the dev_dbg() up before
the usb_put_dev() call.

Signed-off-by: Alan Stern 
Reported-by: Joe Lawrence 
Tested-by: Joe Lawrence 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

usb: Do not allow usb_alloc_streams on unconfigured devices

2014-12-14T16:23:54+00:00

commit 90a646c770c50cc206ceba0d7b50453c46c13c36 upstream.

This commit fixes the following oops:

[10238.622067] scsi host3: uas_eh_bus_reset_handler start
[10240.766164] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd
[10245.779365] usb 3-4: device descriptor read/8, error -110
[10245.883331] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd
[10250.897603] usb 3-4: device descriptor read/8, error -110
[10251.058200] BUG: unable to handle kernel NULL pointer dereference at  0000000000000040
[10251.058244] IP: [] xhci_check_streams_endpoint+0x91/0x140

[10251.059473] Call Trace:
[10251.059487]  [] xhci_calculate_streams_and_bitmask+0xbc/0x130
[10251.059520]  [] xhci_alloc_streams+0x10f/0x5a0
[10251.059548]  [] ? check_preempt_curr+0x75/0xa0
[10251.059575]  [] ? ttwu_do_wakeup+0x2c/0x100
[10251.059601]  [] ? ttwu_do_activate.constprop.111+0x66/0x70
[10251.059635]  [] usb_alloc_streams+0xab/0xf0
[10251.059662]  [] uas_configure_endpoints+0x128/0x150 [uas]
[10251.059694]  [] uas_post_reset+0x3c/0xb0 [uas]
[10251.059722]  [] usb_reset_device+0x1b9/0x2a0
[10251.059749]  [] uas_eh_bus_reset_handler+0xb2/0x190 [uas]
[10251.059781]  [] scsi_try_bus_reset+0x53/0x110
[10251.059808]  [] scsi_eh_bus_reset+0xf7/0x270


The problem is the following call sequence (simplified):

1) usb_reset_device
2)  usb_reset_and_verify_device
2)   hub_port_init
3)    hub_port_finish_reset
3)     xhci_discover_or_reset_device
        This frees xhci->devs[slot_id]->eps[ep_index].ring for all eps but 0
4)    usb_get_device_descriptor
       This fails
5)   hub_port_init fails
6)  usb_reset_and_verify_device fails, does not restore device config
7)  uas_post_reset
8)   xhci_alloc_streams
      NULL deref on the free-ed ring

This commit fixes this by not allowing usb_alloc_streams to continue if
the device is not configured.

Note that we do allow usb_free_streams to continue after a (logical)
disconnect, as it is necessary to explicitly free the streams at the xhci
controller level.

Signed-off-by: Hans de Goede 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

USB: Fix race condition when removing host controllers

2012-10-10T02:31:07+00:00

commit 0d00dc2611abbe6ad244d50569c2ee82ce42846c upstream.

This patch (as1607) fixes a race that can occur if a USB host
controller is removed while a process is reading the
/sys/kernel/debug/usb/devices file.

The usb_device_read() routine uses the bus->root_hub pointer to
determine whether or not the root hub is registered.  The is not a
valid test, because the pointer is set before the root hub gets
registered and remains set even after the root hub is unregistered and
deallocated.  As a result, usb_device_read() or usb_device_dump() can
access freed memory, causing an oops.

The patch changes the test to use the hcd->rh_registered flag, which
does get set and cleared at the appropriate times.  It also makes sure
to hold the usb_bus_list_lock mutex while setting the flag, so that
usb_device_read() will become aware of new root hubs as soon as they
are registered.

Signed-off-by: Alan Stern 
Reported-by: Don Zickus 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

USB: Don't fail USB3 probe on missing legacy PCI IRQ.

2012-03-01T00:31:08+00:00

commit 68d07f64b8a11a852d48d1b05b724c3e20c0d94b upstream.

Intel has a PCI USB xhci host controller on a new platform. It doesn't
have a line IRQ definition in BIOS.  The Linux driver refuses to
initialize this controller, but Windows works well because it only depends
on MSI.

Actually, Linux also can work for MSI.  This patch avoids the line IRQ
checking for USB3 HCDs in usb core PCI probe.  It allows the xHCI driver
to try to enable MSI or MSI-X first.  It will fail the probe if MSI
enabling failed and there's no legacy PCI IRQ.

This patch should be backported to kernels as old as 2.6.32.

Signed-off-by: Alex Shi 
Signed-off-by: Sarah Sharp 
Signed-off-by: Greg Kroah-Hartman

usb: fix number of mapped SG DMA entries

2012-01-12T19:29:43+00:00

commit bc677d5b64644c399cd3db6a905453e611f402ab upstream.

Add a new field num_mapped_sgs to struct urb so that we have a place to
store the number of mapped entries and can also retain the original
value of entries in num_sgs.  Previously, usb_hcd_map_urb_for_dma()
would overwrite this with the number of mapped entries, which would
break dma_unmap_sg() because it requires the original number of entries.

This fixes warnings like the following when using USB storage devices:
 ------------[ cut here ]------------
 WARNING: at lib/dma-debug.c:902 check_unmap+0x4e4/0x695()
 ehci_hcd 0000:00:12.2: DMA-API: device driver frees DMA sg list with different entry count [map count=4] [unmap count=1]
 Modules linked in: ohci_hcd ehci_hcd
 Pid: 0, comm: kworker/0:1 Not tainted 3.2.0-rc2+ #319
 Call Trace:
    [] warn_slowpath_common+0x80/0x98
  [] warn_slowpath_fmt+0x41/0x43
  [] check_unmap+0x4e4/0x695
  [] ? trace_hardirqs_off+0xd/0xf
  [] ? _raw_spin_unlock_irqrestore+0x33/0x50
  [] debug_dma_unmap_sg+0xeb/0x117
  [] usb_hcd_unmap_urb_for_dma+0x71/0x188
  [] unmap_urb_for_dma+0x20/0x22
  [] usb_hcd_giveback_urb+0x5d/0xc0
  [] ehci_urb_done+0xf7/0x10c [ehci_hcd]
  [] qh_completions+0x429/0x4bd [ehci_hcd]
  [] ehci_work+0x95/0x9c0 [ehci_hcd]
  ...
 ---[ end trace f29ac88a5a48c580 ]---
 Mapped at:
  [] debug_dma_map_sg+0x45/0x139
  [] usb_hcd_map_urb_for_dma+0x22e/0x478
  [] usb_hcd_submit_urb+0x63f/0x6fa
  [] usb_submit_urb+0x2c7/0x2de
  [] usb_sg_wait+0x55/0x161

Signed-off-by: Clemens Ladisch 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'pm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2011-10-25T13:18:39+00:00

* 'pm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (63 commits)
  PM / Clocks: Remove redundant NULL checks before kfree()
  PM / Documentation: Update docs about suspend and CPU hotplug
  ACPI / PM: Add Sony VGN-FW21E to nonvs blacklist.
  ARM: mach-shmobile: sh7372 A4R support (v4)
  ARM: mach-shmobile: sh7372 A3SP support (v4)
  PM / Sleep: Mark devices involved in wakeup signaling during suspend
  PM / Hibernate: Improve performance of LZO/plain hibernation, checksum image
  PM / Hibernate: Do not initialize static and extern variables to 0
  PM / Freezer: Make fake_signal_wake_up() wake TASK_KILLABLE tasks too
  PM / Hibernate: Add resumedelay kernel param in addition to resumewait
  MAINTAINERS: Update linux-pm list address
  PM / ACPI: Blacklist Vaio VGN-FW520F machine known to require acpi_sleep=nonvs
  PM / ACPI: Blacklist Sony Vaio known to require acpi_sleep=nonvs
  PM / Hibernate: Add resumewait param to support MMC-like devices as resume file
  PM / Hibernate: Fix typo in a kerneldoc comment
  PM / Hibernate: Freeze kernel threads after preallocating memory
  PM: Update the policy on default wakeup settings
  PM / VT: Cleanup #if defined uglyness and fix compile error
  PM / Suspend: Off by one in pm_suspend()
  PM / Hibernate: Include storage keys in hibernation image on s390
  ...

xHCI/USB: Make xHCI driver have a BOS descriptor.

2011-10-18T20:42:06+00:00

To add USB 3.0 link power management (LPM), we need to know what the U1
and U2 exit latencies are for the xHCI host controller.  External USB 3.0
hubs report these values through the SuperSpeed Capabilities descriptor in
the BOS descriptor.  Make the USB 3.0 roothub for the xHCI host behave
like an external hub and return the BOS descriptors.

The U1 and U2 exit latencies will vary across each host controller, so we
need to dynamically fill those values in by reading the exit latencies out
of the xHC registers.  Make the roothub code in the USB core handle
hub_control() returning the length of the data copied.

Signed-off-by: Sarah Sharp 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'pm-runtime' into pm-for-linus

2011-10-07T21:16:55+00:00

* pm-runtime:
  PM / Tracing: build rpm-traces.c only if CONFIG_PM_RUNTIME is set
  PM / Runtime: Replace dev_dbg() with trace_rpm_*()
  PM / Runtime: Introduce trace points for tracing rpm_* functions
  PM / Runtime: Don't run callbacks under lock for power.irq_safe set
  USB: Add wakeup info to debugging messages
  PM / Runtime: pm_runtime_idle() can be called in atomic context
  PM / Runtime: Add macro to test for runtime PM events
  PM / Runtime: Add might_sleep() to runtime PM functions