linux-stable.git/drivers/usb, branch v3.18.41

usb: xhci: Fix panic if disconnect

2016-09-01T02:05:44+00:00

[ Upstream commit 88716a93766b8f095cdef37a8e8f2c93aa233b21 ]

After a device is disconnected, xhci_stop_device() will be invoked
in xhci_bus_suspend().
Also the "disconnect" IRQ will have ISR to invoke
xhci_free_virt_device() in this sequence.
xhci_irq -> xhci_handle_event -> handle_cmd_completion ->
xhci_handle_cmd_disable_slot -> xhci_free_virt_device

If xhci->devs[slot_id] has been assigned to NULL in
xhci_free_virt_device(), then virt_dev->eps[i].ring in
xhci_stop_device() may point to an invlid address to cause kernel
panic.

virt_dev = xhci->devs[slot_id];
:
if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)

[] Unable to handle kernel paging request at virtual address 00001a68
[] pgd=ffffffc001430000
[] [00001a68] *pgd=000000013c807003, *pud=000000013c807003,
*pmd=000000013c808003, *pte=0000000000000000
[] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[] CPU: 0 PID: 39 Comm: kworker/0:1 Tainted: G     U
[] Workqueue: pm pm_runtime_work
[] task: ffffffc0bc0e0bc0 ti: ffffffc0bc0ec000 task.ti:
ffffffc0bc0ec000
[] PC is at xhci_stop_device.constprop.11+0xb4/0x1a4

This issue is found when running with realtek ethernet device
(0bda:8153).

Signed-off-by: Jim Lin 
Cc: 
Signed-off-by: Mathias Nyman 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

xhci: always handle "Command Ring Stopped" events

2016-09-01T02:05:44+00:00

[ Upstream commit 33be126510974e2eb9679f1ca9bca4f67ee4c4c7 ]

Fix "Command completion event does not match command" errors by always
handling the command ring stopped events.

The command ring stopped event is generated as a result of aborting
or stopping the command ring with a register write. It is not caused
by a command in the command queue, and thus won't have a matching command
in the comman list.

Solve it by handling the command ring stopped event before checking for a
matching command.

In most command time out cases we abort the command ring, and get
a command ring stopped event. The events command pointer will point at
the current command ring dequeue, which in most cases matches the timed
out command in the command list, and no error messages are seen.

If we instead get a command aborted event before the command ring stopped
event, the abort event will increse the command ring dequeue pointer, and
the following command ring stopped events command pointer will point at the
next, not yet queued command. This case triggered the error message

Signed-off-by: Mathias Nyman 
CC: 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

cdc-acm: fix wrong pipe type on rx interrupt xfers

2016-09-01T02:05:44+00:00

[ Upstream commit add125054b8727103631dce116361668436ef6a7 ]

This fixes the "BOGUS urb xfer" warning logged by usb_submit_urb().

Signed-off-by: Gavin Li 
Acked-by: Oliver Neukum 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usb: misc: usbtest: add fix for driver hang

2016-09-01T02:05:44+00:00

[ Upstream commit 539587511835ea12d8daa444cbed766cf2bc3612 ]

In sg_timeout(), req->status is set to "-ETIMEDOUT" before calling
into usb_sg_cancel(). usb_sg_cancel() will do nothing and return
directly if req->status has been set to a non-zero value. This will
cause driver hang whenever transfer time out is triggered.

This patch fixes this issue. It could be backported to stable kernel
with version later than v3.15.

Cc: stable@vger.kernel.org # 3.15+
Cc: Alan Stern 
Signed-off-by: Lu Baolu 
Suggested-by: Alan Stern 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usb: dwc3: gadget: always cleanup all TRBs

2016-08-31T23:32:14+00:00

[ Upstream commit 7c705dfe2ebe731c8fd068623b6b4df2d3512c08 ]

If we stop earlier due to short packet, we will
not be able to giveback all TRBs.

Cc: 
Cc: Brian E Rogers 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin

usb: dwc3: gadget: fix for short pkts during chained xfers

2016-08-31T23:32:09+00:00

[ Upstream commit e5b36ae2f851024d43c76e51f395d32ce8d769ce ]

DWC3 has one interesting peculiarity with chained
transfers. If we setup N chained transfers and we
get a short packet before processing all N TRBs,
DWC3 will (conditionally) issue a XferComplete or
XferInProgress event and retire all TRBs from the
one which got a short packet to the last without
clearing their HWO bits.

This means SW must clear HWO bit manually, which
this patch is doing.

Cc: 
Cc: Brian E Rogers 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin

usb: dwc3: gadget: increment request->actual once

2016-08-31T23:32:04+00:00

[ Upstream commit c7de573471832dff7d31f0c13b0f143d6f017799 ]

When using SG lists, we would end up setting
request->actual to:

	num_mapped_sgs * (request->length - count)

Let's fix that up by incrementing request->actual
only once.

Cc: 
Reported-by: Brian E Rogers 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin

usb: hub: Fix unbalanced reference count/memory leak/deadlocks

2016-08-31T23:26:30+00:00

[ Upstream commit 6bb47e8ab98accb1319bd43c64966340ba3bba9a ]

Memory leak and unbalanced reference count:

If the hub gets disconnected while the core is still activating it, this
can result in leaking memory of few USB structures.

This will happen if we have done a kref_get() from hub_activate() and
scheduled a delayed work item for HUB_INIT2/3. Now if hub_disconnect()
gets called before the delayed work expires, then we will cancel the
work from hub_quiesce(), but wouldn't do a kref_put(). And so the
unbalance.

kmemleak reports this as (with the commit e50293ef9775 backported to
3.10 kernel with other changes, though the same is true for mainline as
well):

unreferenced object 0xffffffc08af5b800 (size 1024):
  comm "khubd", pid 73, jiffies 4295051211 (age 6482.350s)
  hex dump (first 32 bytes):
    30 68 f3 8c c0 ff ff ff 00 a0 b2 2e c0 ff ff ff  0h..............
    01 00 00 00 00 00 00 00 00 94 7d 40 c0 ff ff ff  ..........}@....
  backtrace:
    [] create_object+0x148/0x2a0
    [] kmemleak_alloc+0x80/0xbc
    [] kmem_cache_alloc_trace+0x120/0x1ac
    [] hub_probe+0x120/0xb84
    [] usb_probe_interface+0x1ec/0x298
    [] driver_probe_device+0x160/0x374
    [] __device_attach+0x28/0x4c
    [] bus_for_each_drv+0x78/0xac
    [] device_attach+0x6c/0x9c
    [] bus_probe_device+0x28/0xa0
    [] device_add+0x324/0x604
    [] usb_set_configuration+0x660/0x6cc
    [] generic_probe+0x44/0x84
    [] usb_probe_device+0x54/0x74
    [] driver_probe_device+0x160/0x374
    [] __device_attach+0x28/0x4c

Deadlocks:

If the hub gets disconnected early enough (i.e. before INIT2/INIT3 are
finished and the init_work is still queued), the core may call
hub_quiesce() after acquiring interface device locks and it will wait
for the work to be cancelled synchronously. But if the work handler is
already running in parallel, it may try to acquire the same interface
device lock and this may result in deadlock.

Fix both the issues by removing the call to cancel_delayed_work_sync().

CC:  #4.4+
Fixes: e50293ef9775 ("USB: fix invalid memory access in hub_activate()")
Reported-by: Manu Gautam 
Signed-off-by: Viresh Kumar 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

USB: serial: fix memleak in driver-registration error path

2016-08-31T23:26:08+00:00

[ Upstream commit 647024a7df36014bbc4479d92d88e6b77c0afcf6 ]

udriver struct allocated by kzalloc() will not be freed
if usb_register() and next calls fail. This patch fixes this
by adding one more step with kfree(udriver) in error path.

Signed-off-by: Alexey Klimov 
Acked-by: Alan Stern 
Cc: stable 
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin

USB: serial: option: add support for Telit LE920A4

2016-08-31T23:26:03+00:00

[ Upstream commit 01d7956b58e644ea0d2e8d9340c5727a8fc39d70 ]

This patch adds a set of compositions for Telit LE920A4.

Compositions in short are:

0x1207: tty + tty
0x1208: tty + adb + tty + tty
0x1211: tty + adb + ecm
0x1212: tty + adb
0x1213: ecm + tty
0x1214: tty + adb + ecm + tty

telit_le922_blacklist_usbcfg3 is reused for compositions 0x1211
and 0x1214 due to the same interfaces positions.

Signed-off-by: Daniele Palmas 
Cc: stable 
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin