linux-stable.git/drivers/usb, branch v4.8.9

cdc-acm: fix uninitialized variable

2016-11-18T09:51:47+00:00

commit 7309aa847ead3fa561663b16779a0dde8c64cc7c upstream.

variable struct usb_cdc_parsed_header h may be used
uninitialized in acm_probe.

In kernel 4.8.

    /* handle quirks deadly to normal probing*/
    if (quirks == NO_UNION_NORMAL)

        ...

        goto skip_normal_probe;
    }

we bypass call to

    cdc_parse_cdc_header(&h, intf, buffer, buflen);

but later use h in

    if (h.usb_cdc_country_functional_desc) { /* export the country data */

Signed-off-by: Oliver Neukum 
Reported-by: Victor Sologoubov 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_ether: remove interrupt throttling

2016-11-18T09:51:47+00:00

commit fd9afd3cbe404998d732be6cc798f749597c5114 upstream.

According to Dave Miller "the networking stack has a
hard requirement that all SKBs which are transmitted
must have their completion signalled in a fininte
amount of time. This is because, until the SKB is
freed by the driver, it holds onto socket,
netfilter, and other subsystem resources."

In summary, this means that using TX IRQ throttling
for the networking gadgets is, at least, complex and
we should avoid it for the time being.

Reported-by: Ville Syrjälä 
Tested-by: Ville Syrjälä 
Suggested-by: David Miller 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

USB: cdc-acm: fix TIOCMIWAIT

2016-11-18T09:51:47+00:00

commit 18266403f3fe507f0246faa1d5432333a2f139ca upstream.

The TIOCMIWAIT implementation would return -EINVAL if any of the three
supported signals were included in the mask.

Instead of returning an error in case TIOCM_CTS is included, simply
drop the mask check completely, which is in accordance with how other
drivers implement this ioctl.

Fixes: 5a6a62bdb925 ("cdc-acm: add TIOCMIWAIT")
Signed-off-by: Johan Hovold 
Acked-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: Fix error handling for core init

2016-11-18T09:51:47+00:00

commit 9b9d7cdd0a20a8c26a022604580f93516ad69c36 upstream.

Fixing the sequence of events in dwc3_core_init() error exit path.
dwc3_core_exit() call is also removed from the error path since,
whatever it's doing is already done.

Fixes: c499ff7 usb: dwc3: core: re-factor init and exit paths

Cc: Felipe Balbi 
Cc: Greg KH 
Signed-off-by: Vivek Gautam 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: gadget: properly account queued requests

2016-11-15T06:48:54+00:00

commit a9c3ca5fae6bf73770f0576eaf57d5f1305ef4b3 upstream.

Some requests could be accounted for multiple
times. Let's fix that so each and every requests is
accounted for only once.

Fixes: 55a0237f8f47 ("usb: dwc3: gadget: use allocated/queued reqs for LST bit")
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: musb: Fix hardirq-safe hardirq-unsafe lock order error

2016-11-10T15:38:56+00:00

commit d8e5f0eca1e88215e45aca27115ea747e6164da1 upstream.

If we configure musb with 2430 glue as a peripheral, and then rmmod
omap2430 module, we'll get the following error:

[ INFO: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected ]
...
rmmod/413 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
 (&phy->mutex){+.+.+.}, at: [] phy_power_off+0x1c/0xb8
[  204.678710]
               and this task is already holding:
 (&(&musb->lock)->rlock){-.-...}, at: []
 musb_gadget_stop+0x24/0xec [musb_hdrc]
which would create a new lock dependency:
 (&(&musb->lock)->rlock){-.-...} -> (&phy->mutex){+.+.+.}
...

This is because some glue layers expect musb_platform_enable/disable
to be called with spinlock held, and 2430 glue layer has USB PHY on
the I2C bus using a mutex.

We could fix the glue layers to take the spinlock, but we still have
a problem of musb_plaform_enable/disable being called in an unbalanced
manner. So that would still lead into USB PHY enable/disable related
problems for omap2430 glue layer.

While it makes sense to only enable USB PHY when needed from PM point
of view, in this case we just can't do it yet without breaking things.
So let's just revert phy_enable/disable related changes instead and
reconsider this after we have fixed musb_platform_enable/disable to
be balanced.

Fixes: a83e17d0f73b ("usb: musb: Improve PM runtime and phy handling for 2430 glue layer")
Reviewed-by: Laurent Pinchart 
Signed-off-by: Tony Lindgren 
Signed-off-by: Bin Liu 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

usb: chipidea: host: fix NULL ptr dereference during shutdown

2016-11-10T15:38:56+00:00

commit 991d5add50a5bb6ab8f12f2129f5c7487f6baaf6 upstream.

After commit b09b5224fe86 ("usb: chipidea: implement platform shutdown
callback") and commit 43a404577a93 ("usb: chipidea: host: set host to
be null after hcd is freed") a NULL pointer dereference is caused
on i.MX23 during shutdown. So ensure that role is set to CI_ROLE_END and
we finish interrupt handling before the hcd is deallocated. This avoids
the NULL pointer dereference.

Suggested-by: Alan Stern 
Signed-off-by: Stefan Wahren 
Fixes: b09b5224fe86 ("usb: chipidea: implement platform shutdown callback")
Signed-off-by: Peter Chen 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: Fix size used in dma_free_coherent()

2016-11-10T15:38:56+00:00

commit 51fbc7c06c8900370c6da5fc4a4685add8fa4fb0 upstream.

In commit 2abd9d5fa60f9 ("usb: dwc3: ep0: Add chained TRB support"), the
size of the memory allocated with 'dma_alloc_coherent()' has been modified
but the corresponding calls to 'dma_free_coherent()' have not been updated
accordingly.

This has been spotted with coccinelle, using the following script:
////////////////////
@r@
expression x0, x1, y0, y1, z0, z1, t0, t1, ret;
@@

*   ret = dma_alloc_coherent(x0, y0, z0, t0);
    ...
*   dma_free_coherent(x1, y1, ret, t1);

@script:python@
y0 << r.y0;
y1 << r.y1;

@@
if y1.find(y0) == -1:
 print "WARNING: sizes look different:  '%s'   vs   '%s'" % (y0, y1)
////////////////////

Fixes: 2abd9d5fa60f9 ("usb: dwc3: ep0: Add chained TRB support")

Signed-off-by: Christophe JAILLET 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

xhci: workaround for hosts missing CAS bit

2016-11-10T15:38:50+00:00

commit 346e99736c3ce328fd42d678343b70243aca5f36 upstream.

If a device is unplugged and replugged during Sx system suspend
some  Intel xHC hosts will overwrite the CAS (Cold attach status) flag
and no device connection is noticed in resume.

A device in this state can be identified in resume if its link state
is in polling or compliance mode, and the current connect status is 0.
A device in this state needs to be warm reset.

Intel 100/c230 series PCH specification update Doc #332692-006 Errata #8

Observed on Cherryview and Apollolake as they go into compliance mode
if LFPS times out during polling, and re-plugged devices are not
discovered at resume.

Signed-off-by: Mathias Nyman 
Signed-off-by: Greg Kroah-Hartman

xhci: add restart quirk for Intel Wildcatpoint PCH

2016-11-10T15:38:50+00:00

commit 4c39135aa412d2f1381e43802523da110ca7855c upstream.

xHC in Wildcatpoint-LP PCH is similar to LynxPoint-LP and need the
same quirks to prevent machines from spurious restart while
shutting them down.

Reported-by: Hasan Mahmood 
Signed-off-by: Mathias Nyman 
Signed-off-by: Greg Kroah-Hartman