linux-stable.git/drivers/usb, branch v3.18.4

usb: musb: stuff leak of struct usb_hcd

2015-01-27T16:29:43+00:00

commit 68693b8ea4e284c46bff919ac62bd9ccdfdbb6ba upstream.

since the split of host+gadget mode in commit 74c2e9360058 ("usb: musb:
factor out hcd initalization") we leak the usb_hcd struct. We call now
musb_host_cleanup() which does basically usb_remove_hcd() and also sets
the hcd variable to NULL. Doing so makes the finall call to
musb_host_free() basically a nop and the usb_hcd remains around for ever
without anowner.
This patch drops that NULL assignment for that reason.

Fixes: 74c2e9360058 ("usb: musb: factor out hcd initalization")
Cc: Daniel Mack 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

USB: EHCI: fix initialization bug in iso_stream_schedule()

2015-01-27T16:29:43+00:00

commit 6d89252a998a695ecb0348fc2d717dc33d90cae9 upstream.

Commit c3ee9b76aa93 (EHCI: improved logic for isochronous scheduling)
introduced the idea of using ehci->last_iso_frame as the origin (or
base) for the circular calculations involved in modifying the
isochronous schedule.  However, the new code it added used
ehci->last_iso_frame before the value was properly initialized.  This
patch rectifies the mistake by moving the initialization lines earlier
in iso_stream_schedule().

This fixes Bugzilla #72891.

Signed-off-by: Alan Stern 
Fixes: c3ee9b76aa93
Reported-by: Joe Bryant 
Tested-by: Joe Bryant 
Tested-by: Martin Long 
Signed-off-by: Greg Kroah-Hartman

USB: console: fix potential use after free

2015-01-27T16:29:43+00:00

commit 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad upstream.

Use tty kref to release the fake tty in usb_console_setup to avoid use
after free if the underlying serial driver has acquired a reference.

Note that using the tty destructor release_one_tty requires some more
state to be initialised.

Fixes: 4a90f09b20f4 ("tty: usb-serial krefs")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: console: fix uninitialised ldisc semaphore

2015-01-27T16:29:43+00:00

commit d269d4434c72ed0da3a9b1230c30da82c4918c63 upstream.

The USB console currently allocates a temporary fake tty which is used
to pass terminal settings to the underlying serial driver.

The tty struct is not fully initialised, something which can lead to a
lockdep warning (or worse) if a serial driver tries to acquire a
line-discipline reference:

	usbserial: USB Serial support registered for pl2303
	pl2303 1-2.1:1.0: pl2303 converter detected
	usb 1-2.1: pl2303 converter now attached to ttyUSB0
	INFO: trying to register non-static key.
	the code is fine but needs lockdep annotation.
	turning off the locking correctness validator.
	CPU: 0 PID: 68 Comm: udevd Tainted: G        W      3.18.0-rc5 #10
	[] (unwind_backtrace) from [] (show_stack+0x20/0x24)
	[] (show_stack) from [] (dump_stack+0x24/0x28)
	[] (dump_stack) from [] (__lock_acquire+0x1e50/0x2004)
	[] (__lock_acquire) from [] (lock_acquire+0xe4/0x18c)
	[] (lock_acquire) from [] (ldsem_down_read_trylock+0x78/0x90)
	[] (ldsem_down_read_trylock) from [] (tty_ldisc_ref+0x24/0x58)
	[] (tty_ldisc_ref) from [] (usb_serial_handle_dcd_change+0x48/0xe8)
	[] (usb_serial_handle_dcd_change) from [] (pl2303_read_int_callback+0x210/0x220 [pl2303])
	[] (pl2303_read_int_callback [pl2303]) from [] (__usb_hcd_giveback_urb+0x80/0x140)
	[] (__usb_hcd_giveback_urb) from [] (usb_giveback_urb_bh+0x98/0xd4)
	[] (usb_giveback_urb_bh) from [] (tasklet_hi_action+0x9c/0x108)
	[] (tasklet_hi_action) from [] (__do_softirq+0x148/0x42c)
	[] (__do_softirq) from [] (irq_exit+0xd8/0x114)
	[] (irq_exit) from [] (__handle_domain_irq+0x84/0xdc)
	[] (__handle_domain_irq) from [] (omap_intc_handle_irq+0xd8/0xe0)
	[] (omap_intc_handle_irq) from [] (__irq_svc+0x44/0x7c)
	Exception stack(0xdf4e7f08 to 0xdf4e7f50)
	7f00:                   debc0b80 df4e7f5c 00000000 00000000 debc0b80 be8da96c
	7f20: 00000000 00000128 c000fc84 df4e6000 00000000 df4e7f94 00000004 df4e7f50
	7f40: c038ebc0 c038d74c 600f0013 ffffffff
	[] (__irq_svc) from [] (___sys_sendmsg.part.29+0x0/0x2e0)
	[] (___sys_sendmsg.part.29) from [] (SyS_sendmsg+0x18/0x1c)
	[] (SyS_sendmsg) from [] (ret_fast_syscall+0x0/0x48)
	console [ttyUSB0] enabled

Fixes: 36697529b5bb ("tty: Replace ldisc locking with ldisc_sem")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: udc: atmel: fix possible oops when unloading module

2015-01-27T16:29:43+00:00

commit 5fb694f96e7c19e66b1c55124b98812e32e3efa5 upstream.

When unloading the module 'g_hid.ko', the urb request will be dequeued and the
completion routine will be excuted. If there is no urb packet, the urb request
will not be added to the endpoint queue and the completion routine pointer in
urb request is NULL.

Accessing to this NULL function pointer will cause the Oops issue reported
below.

Add the code to check if the urb request is in the endpoint queue
or not. If the urb request is not in the endpoint queue, a negative
error code will be returned.

Here is the Oops log:

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = dedf0000
[00000000] *pgd=3ede5831, *pte=00000000, *ppte=00000000
Internal error: Oops: 80000007 [#1] ARM
Modules linked in: g_hid(-) usb_f_hid libcomposite
CPU: 0 PID: 923 Comm: rmmod Not tainted 3.18.0+ #2
Hardware name: Atmel SAMA5 (Device Tree)
task: df6b1100 ti: dedf6000 task.ti: dedf6000
PC is at 0x0
LR is at usb_gadget_giveback_request+0xc/0x10
pc : [<00000000>]    lr : []    psr: 60000093
sp : dedf7eb0  ip : df572634  fp : 00000000
r10: 00000000  r9 : df52e210  r8 : 60000013
r7 : df6a9858  r6 : df52e210  r5 : df6a9858  r4 : df572600
r3 : 00000000  r2 : ffffff98  r1 : df572600  r0 : df6a9868
Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c53c7d  Table: 3edf0059  DAC: 00000015
Process rmmod (pid: 923, stack limit = 0xdedf6230)
Stack: (0xdedf7eb0 to 0xdedf8000)
7ea0:                                     00000000 c02adbbc df572580 deced608
7ec0: df572600 df6a9868 df572634 c02aed3c df577c00 c01b8608 00000000 df6be27c
7ee0: 00200200 00100100 bf0162f4 c000e544 dedf6000 00000000 00000000 bf010c00
7f00: bf0162cc bf00159c 00000000 df572980 df52e218 00000001 df5729b8 bf0031d0
[..]
[] (usb_gadget_giveback_request) from [] (request_complete+0x64/0x88)
[] (request_complete) from [] (usba_ep_dequeue+0x70/0x128)
[] (usba_ep_dequeue) from [] (hidg_unbind+0x50/0x7c [usb_f_hid])
[] (hidg_unbind [usb_f_hid]) from [] (remove_config.isra.6+0x98/0x9c [libcomposite])
[] (remove_config.isra.6 [libcomposite]) from [] (__composite_unbind+0x34/0x98 [libcomposite])
[] (__composite_unbind [libcomposite]) from [] (usb_gadget_remove_driver+0x50/0x78)
[] (usb_gadget_remove_driver) from [] (usb_gadget_unregister_driver+0x64/0x94)
[] (usb_gadget_unregister_driver) from [] (hidg_cleanup+0x10/0x34 [g_hid])
[] (hidg_cleanup [g_hid]) from [] (SyS_delete_module+0x118/0x19c)
[] (SyS_delete_module) from [] (ret_fast_syscall+0x0/0x30)
Code: bad PC value

Signed-off-by: Songjun Wu 
[nicolas.ferre@atmel.com: reworked the commit message]
Signed-off-by: Nicolas Ferre 
Fixes: 914a3f3b3754 ("USB: add atmel_usba_udc driver")
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: udc: atmel: fix possible IN hang issue

2015-01-27T16:29:43+00:00

commit 6785a1034461c2d2c205215f63a50a740896e55b upstream.

When receive data, the RXRDY in status register set by hardware
after a new packet has been stored in the endpoint FIFO. When it
is copied from FIFO, this bit is cleared which make the FIFO can
be accessed again.

In the receive_data() function, this bit RXRDY has been cleared.
So, after the receive_data() function return, this bit should
not be cleared again, or else it may cause the accessing FIFO
corrupt, which will make the data loss.

Fixes: 914a3f3b3754 (USB: add atmel_usba_udc driver)
Acked-by: Nicolas Ferre 
Signed-off-by: Bo Shen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: udc: atmel: change setting for DMA

2015-01-27T16:29:42+00:00

commit f40afdddeb6c54ffd1e2920a5e93e363d6748db6 upstream.

According to the datasheet, when transfer using DMA, the control
setting for IN packet only need END_BUF_EN, END_BUF_IE, CH_EN,
while for OUT packet, need more two bits END_TR_EN and END_TR_IE
to be configured.

Fixes: 914a3f3b3754 (USB: add atmel_usba_udc driver)
Acked-by: Nicolas Ferre 
Signed-off-by: Bo Shen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: gadgetfs: Free memory allocated by memdup_user()

2015-01-27T16:29:42+00:00

commit b44be2462dbe3e23f0aedff64de52a1e8e47a1cd upstream.

Commit 3b74c73f8d6f053f422e85fce955b61fb181cfe7 switched over to memdup_user()
in ep_write() function and removed kfree (kbuf).
memdup_user() function allocates memory which is never freed.

Fixes: 3b74c73 (usb: gadget: inode: switch over to memdup_user())
Signed-off-by: Mario Schuknecht 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

USB: keyspan: fix null-deref at probe

2015-01-27T16:29:42+00:00

commit b5122236bba8d7ef62153da5b55cc65d0944c61e upstream.

Fix null-pointer dereference during probe if the interface-status
completion handler is called before the individual ports have been set
up.

Fixes: f79b2d0fe81e ("USB: keyspan: fix NULL-pointer dereferences and
memory leaks")
Reported-by: Richard 
Tested-by: Richard 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: qcserial/option: make AT URCs work for Sierra Wireless MC73xx

2015-01-27T16:29:42+00:00

commit d80c0d14183516f184a5ac88e11008ee4c7d2a2e upstream.

As has been discussed in the thread starting with
https://lkml.kernel.org/g/549748e9.d+SiJzqu50f1r4lSAL043YSc@arcor.de
Sierra Wireless MC73xx devices with USB VID/PID 0x1199:0x68c0 require the
option_send_setup() code to be used on the USB interface for the AT port
to make unsolicited response codes work correctly. Move these devices from
the qcserial driver where they have been added by commit
70a3615fc07c2330ed7c1e922f3c44f4a67c0762 ("usb: qcserial: add Sierra Wireless
MC73xx") to the option driver and add a MC73xx-specific blacklist
to ensure that
1. the sendsetup code is not used for the DIAG/DM and NMEA interfaces
2. the option driver does not attach to the QMI/network interfaces

Signed-off-by: Reinhard Speyerer 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman