linux-stable.git/drivers/usb, branch v3.14.34

usb: musb: stuff leak of struct usb_hcd

2015-01-27T16:18:57+00:00

commit 68693b8ea4e284c46bff919ac62bd9ccdfdbb6ba upstream.

since the split of host+gadget mode in commit 74c2e9360058 ("usb: musb:
factor out hcd initalization") we leak the usb_hcd struct. We call now
musb_host_cleanup() which does basically usb_remove_hcd() and also sets
the hcd variable to NULL. Doing so makes the finall call to
musb_host_free() basically a nop and the usb_hcd remains around for ever
without anowner.
This patch drops that NULL assignment for that reason.

Fixes: 74c2e9360058 ("usb: musb: factor out hcd initalization")
Cc: Daniel Mack 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

USB: EHCI: fix initialization bug in iso_stream_schedule()

2015-01-27T16:18:57+00:00

commit 6d89252a998a695ecb0348fc2d717dc33d90cae9 upstream.

Commit c3ee9b76aa93 (EHCI: improved logic for isochronous scheduling)
introduced the idea of using ehci->last_iso_frame as the origin (or
base) for the circular calculations involved in modifying the
isochronous schedule.  However, the new code it added used
ehci->last_iso_frame before the value was properly initialized.  This
patch rectifies the mistake by moving the initialization lines earlier
in iso_stream_schedule().

This fixes Bugzilla #72891.

Signed-off-by: Alan Stern 
Fixes: c3ee9b76aa93
Reported-by: Joe Bryant 
Tested-by: Joe Bryant 
Tested-by: Martin Long 
Signed-off-by: Greg Kroah-Hartman

USB: console: fix potential use after free

2015-01-27T16:18:57+00:00

commit 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad upstream.

Use tty kref to release the fake tty in usb_console_setup to avoid use
after free if the underlying serial driver has acquired a reference.

Note that using the tty destructor release_one_tty requires some more
state to be initialised.

Fixes: 4a90f09b20f4 ("tty: usb-serial krefs")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: console: fix uninitialised ldisc semaphore

2015-01-27T16:18:57+00:00

commit d269d4434c72ed0da3a9b1230c30da82c4918c63 upstream.

The USB console currently allocates a temporary fake tty which is used
to pass terminal settings to the underlying serial driver.

The tty struct is not fully initialised, something which can lead to a
lockdep warning (or worse) if a serial driver tries to acquire a
line-discipline reference:

	usbserial: USB Serial support registered for pl2303
	pl2303 1-2.1:1.0: pl2303 converter detected
	usb 1-2.1: pl2303 converter now attached to ttyUSB0
	INFO: trying to register non-static key.
	the code is fine but needs lockdep annotation.
	turning off the locking correctness validator.
	CPU: 0 PID: 68 Comm: udevd Tainted: G        W      3.18.0-rc5 #10
	[] (unwind_backtrace) from [] (show_stack+0x20/0x24)
	[] (show_stack) from [] (dump_stack+0x24/0x28)
	[] (dump_stack) from [] (__lock_acquire+0x1e50/0x2004)
	[] (__lock_acquire) from [] (lock_acquire+0xe4/0x18c)
	[] (lock_acquire) from [] (ldsem_down_read_trylock+0x78/0x90)
	[] (ldsem_down_read_trylock) from [] (tty_ldisc_ref+0x24/0x58)
	[] (tty_ldisc_ref) from [] (usb_serial_handle_dcd_change+0x48/0xe8)
	[] (usb_serial_handle_dcd_change) from [] (pl2303_read_int_callback+0x210/0x220 [pl2303])
	[] (pl2303_read_int_callback [pl2303]) from [] (__usb_hcd_giveback_urb+0x80/0x140)
	[] (__usb_hcd_giveback_urb) from [] (usb_giveback_urb_bh+0x98/0xd4)
	[] (usb_giveback_urb_bh) from [] (tasklet_hi_action+0x9c/0x108)
	[] (tasklet_hi_action) from [] (__do_softirq+0x148/0x42c)
	[] (__do_softirq) from [] (irq_exit+0xd8/0x114)
	[] (irq_exit) from [] (__handle_domain_irq+0x84/0xdc)
	[] (__handle_domain_irq) from [] (omap_intc_handle_irq+0xd8/0xe0)
	[] (omap_intc_handle_irq) from [] (__irq_svc+0x44/0x7c)
	Exception stack(0xdf4e7f08 to 0xdf4e7f50)
	7f00:                   debc0b80 df4e7f5c 00000000 00000000 debc0b80 be8da96c
	7f20: 00000000 00000128 c000fc84 df4e6000 00000000 df4e7f94 00000004 df4e7f50
	7f40: c038ebc0 c038d74c 600f0013 ffffffff
	[] (__irq_svc) from [] (___sys_sendmsg.part.29+0x0/0x2e0)
	[] (___sys_sendmsg.part.29) from [] (SyS_sendmsg+0x18/0x1c)
	[] (SyS_sendmsg) from [] (ret_fast_syscall+0x0/0x48)
	console [ttyUSB0] enabled

Fixes: 36697529b5bb ("tty: Replace ldisc locking with ldisc_sem")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: keyspan: fix null-deref at probe

2015-01-27T16:18:57+00:00

commit b5122236bba8d7ef62153da5b55cc65d0944c61e upstream.

Fix null-pointer dereference during probe if the interface-status
completion handler is called before the individual ports have been set
up.

Fixes: f79b2d0fe81e ("USB: keyspan: fix NULL-pointer dereferences and
memory leaks")
Reported-by: Richard 
Tested-by: Richard 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: cp210x: add IDs for CEL USB sticks and MeshWorks devices

2015-01-27T16:18:57+00:00

commit 1ae78a4870989a354028cb17dabf819b595e70e3 upstream.

Added virtual com port VID/PID entries for CEL USB sticks and MeshWorks
devices.

Signed-off-by: David Peterson 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: cp210x: fix ID for production CEL MeshConnect USB Stick

2015-01-27T16:18:57+00:00

commit 90441b4dbe90ba0c38111ea89fa093a8c9627801 upstream.

Fixing typo for MeshConnect IDs. The original PID (0x8875) is not in
production and is not needed. Instead it has been changed to the
official production PID (0x8857).

Signed-off-by: Preston Fick 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: gadget: Stop TRB preparation after limit is reached

2015-01-27T16:18:56+00:00

commit 39e60635a01520e8c8ed3946a28c2b98e6a46f79 upstream.

DWC3 gadget sets up a pool of 32 TRBs for each EP during initialization. This
means, the max TRBs that can be submitted for an EP is fixed to 32. Since the
request queue for an EP is a linked list, any number of requests can be queued
to it by the gadget layer.  However, the dwc3 driver must not submit TRBs more
than the pool it has created for. This limit wasn't respected when SG was used
resulting in submitting more than the max TRBs, eventually leading to
non-transfer of the TRBs submitted over the max limit.

Root cause:
When SG is used, there are two loops iterating to prepare TRBs:
 - Outer loop over the request_list
 - Inner loop over the SG list
The code was missing break to get out of the outer loop.

Fixes: eeb720fb21d6 (usb: dwc3: gadget: add support for SG lists)
Signed-off-by: Amit Virdi 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: gadget: Fix TRB preparation during SG

2015-01-27T16:18:56+00:00

commit ec512fb8e5611fed1df2895f90317ce6797d6b32 upstream.

When scatter gather (SG) is used, multiple TRBs are prepared from one DWC3
request (dwc3_request). So while preparing TRBs, the 'last' flag should be set
only when it is the last TRB being prepared from the last dwc3_request entry.

The current implementation uses list_is_last to check if the dwc3_request is the
last entry from the request_list. However, list_is_last returns false for the
last entry too. This is because, while preparing the first TRB from a request,
the function dwc3_prepare_one_trb modifies the request's next and prev pointers
while moving the URB to req_queued. Hence, list_is_last always returns false no
matter what.

The correct way is not to access the modified pointers of dwc3_request but to
use list_empty macro instead.

Fixes: e5ba5ec833aa (usb: dwc3: gadget: fix scatter gather implementation)
Signed-off-by: Amit Virdi 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

OHCI: add a quirk for ULi M5237 blocking on reset

2015-01-27T16:18:56+00:00

commit 56abcab833fafcfaeb2f5b25e0364c1dec45f53e upstream.

Commit 8dccddbc2368 ("OHCI: final fix for NVIDIA problems (I hope)")
introduced into 3.1.9 broke boot on e.g. Freescale P2020DS development
board. The code path that was previously specific to NVIDIA controllers
had then become taken for all chips.

However, the M5237 installed on the board wedges solid when accessing
its base+OHCI_FMINTERVAL register, making it impossible to boot any
kernel newer than 3.1.8 on this particular and apparently other similar
machines.

Don't readl() and writel() base+OHCI_FMINTERVAL on PCI ID 10b9:5237.

The patch is suitable for the -next tree as well as all maintained
kernels up to 3.2 inclusive.

Signed-off-by: Arseny Solokha 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman