linux-stable.git/drivers/usb/core, branch linux-3.4.y

Revert "USB: Add OTG PET device to TPL"

2016-10-26T15:15:44+00:00

This reverts commit 97fa724b23c3dd22e9c0979ad0e9d260cc6d545d.

Conflicts:
	drivers/usb/core/quirks.c

Signed-off-by: Zefan Li

Revert "USB: Add device quirk for ASUS T100 Base Station keyboard"

2016-10-26T15:15:44+00:00

This reverts commit eea5a87d270e8d6925063019c3b0f3ff61fcb49a.

Conflicts:
	drivers/usb/core/quirks.c
	include/linux/usb/quirks.h

Signed-off-by: Zefan Li

USB: fix invalid memory access in hub_activate()

2016-10-26T15:15:41+00:00

commit e50293ef9775c5f1cf3fcc093037dd6a8c5684ea upstream.

Commit 8520f38099cc ("USB: change hub initialization sleeps to
delayed_work") changed the hub_activate() routine to make part of it
run in a workqueue.  However, the commit failed to take a reference to
the usb_hub structure or to lock the hub interface while doing so.  As
a result, if a hub is plugged in and quickly unplugged before the work
routine can run, the routine will try to access memory that has been
deallocated.  Or, if the hub is unplugged while the routine is
running, the memory may be deallocated while it is in active use.

This patch fixes the problem by taking a reference to the usb_hub at
the start of hub_activate() and releasing it at the end (when the work
is finished), and by locking the hub interface while the work routine
is running.  It also adds a check at the start of the routine to see
if the hub has already been disconnected, in which nothing should be
done.

Signed-off-by: Alan Stern 
Reported-by: Alexandru Cornea 
Tested-by: Alexandru Cornea 
Fixes: 8520f38099cc ("USB: change hub initialization sleeps to delayed_work")
Signed-off-by: Greg Kroah-Hartman 
[lizf: Backported to 3.4: add forward declaration of hub_release()]
Signed-off-by: Zefan Li

usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message

2016-04-27T10:55:30+00:00

commit 5377adb092664d336ac212499961cac5e8728794 upstream.

usb_parse_ss_endpoint_companion() now decodes the burst multiplier
correctly in order to check that it's <= 3, but still uses the wrong
expression if warning that it's > 3.

Fixes: ff30cbc8da42 ("usb: Use the USB_SS_MULT() macro to get the ...")
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Zefan Li

usb: Add device quirk for Logitech PTZ cameras

2016-04-27T10:55:26+00:00

commit 72194739f54607bbf8cfded159627a2015381557 upstream.

Add a device quirk for the Logitech PTZ Pro Camera and its sibling the
ConferenceCam CC3000e Camera.
This fixes the failed camera enumeration on some boot, particularly on
machines with fast CPU.

Tested by connecting a Logitech PTZ Pro Camera to a machine with a
Haswell Core i7-4600U CPU @ 2.10GHz, and doing thousands of reboot cycles
while recording the kernel logs and taking camera picture after each boot.
Before the patch, more than 7% of the boots show some enumeration transfer
failures and in a few of them, the kernel is giving up before actually
enumerating the webcam. After the patch, the enumeration has been correct
on every reboot.

Signed-off-by: Vincent Palatin 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Zefan Li

USB: Add reset-resume quirk for two Plantronics usb headphones.

2016-04-27T10:55:25+00:00

commit 8484bf2981b3d006426ac052a3642c9ce1d8d980 upstream.

These two headphones need a reset-resume quirk to properly resume to
original volume level.

Signed-off-by: Yao-Wen Mao 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Zefan Li

usb: Use the USB_SS_MULT() macro to get the burst multiplier.

2016-04-27T10:55:23+00:00

commit ff30cbc8da425754e8ab96904db1d295bd034f27 upstream.

Bits 1:0 of the bmAttributes are used for the burst multiplier.
The rest of the bits used to be reserved (zero), but USB3.1 takes bit 7
into use.

Use the existing USB_SS_MULT() macro instead to make sure the mult value
and hence max packet calculations are correct for USB3.1 devices.

Note that burst multiplier in bmAttributes is zero based and that
the USB_SS_MULT() macro adds one.

Signed-off-by: Mathias Nyman 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Zefan Li

usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset

2015-10-22T01:20:03+00:00

commit fb6d1f7df5d25299fd7b3e84b72b8851d3634764 upstream.

Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset.

Dissolve the function hub_port_finish_reset() completely and divide the
actions to be taken into those which need to be done after each reset
attempt and those which need to be done after the full procedure is
complete, and place them in the appropriate places in hub_port_reset().
Also, remove an unneeded forward declaration of hub_port_reset().

Verbose Problem Description:

USB 3.0 devices may be "lost for good" during a hub port reset.
This makes Linux unable to boot from USB 3.0 devices in certain
constellations of host controllers and devices, because the USB device is
lost during initialization, preventing the rootfs from being mounted.

The underlying problem is that in the affected constellations, during the
processing inside hub_port_reset(), the hub link state goes from 0 to
SS.inactive after the initial reset, and back to 0 again only after the
following "warm" reset.

However, hub_port_finish_reset() is called after each reset attempt and
sets the state the connected USB device based on the "preliminary" status
of the hot reset to USB_STATE_NOTATTACHED due to SS.inactive, yet when
the following warm reset is complete and hub_port_finish_reset() is
called again, its call to set the device to USB_STATE_DEFAULT is blocked
by usb_set_device_state() which does not allow taking USB devices out of
USB_STATE_NOTATTACHED state.

Thanks to Alan Stern for guiding me to the proper solution and how to
submit it.

Link: http://lkml.kernel.org/r/trinity-25981484-72a9-4d46-bf17-9c1cf9301a31-1432073240136%20()%203capp-gmx-bs27
Signed-off-by: Robert Schlabbach 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
[lizf: Backported to 3.4:
 - adjust context
 - s/usb_clear_port_feature/clear_port_feature
 - hub_port_warm_reset_required() takes only two arguments]
Signed-off-by: Zefan Li

USB: usbfs: don't leak kernel data in siginfo

2015-06-19T03:40:19+00:00

commit f0c2b68198589249afd2b1f2c4e8de8c03e19c16 upstream.

When a signal is delivered, the information in the siginfo structure
is copied to userspace.  Good security practice dicatates that the
unused fields in this structure should be initialized to 0 so that
random kernel stack data isn't exposed to the user.  This patch adds
such an initialization to the two places where usbfs raises signals.

Signed-off-by: Alan Stern 
Reported-by: Dave Mielke 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Zefan Li

USB: fix use-after-free bug in usb_hcd_unlink_urb()

2015-06-19T03:40:13+00:00

commit c99197902da284b4b723451c1471c45b18537cde upstream.

The usb_hcd_unlink_urb() routine in hcd.c contains two possible
use-after-free errors.  The dev_dbg() statement at the end of the
routine dereferences urb and urb->dev even though both structures may
have been deallocated.

This patch fixes the problem by storing urb->dev in a local variable
(avoiding the dereference of urb) and moving the dev_dbg() up before
the usb_put_dev() call.

Signed-off-by: Alan Stern 
Reported-by: Joe Lawrence 
Tested-by: Joe Lawrence 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Zefan Li