linux-stable.git/drivers/usb, branch v5.4.78

xhci: hisilicon: fix refercence leak in xhci_histb_probe

2020-11-18T18:20:29+00:00

commit 76255470ffa2795a44032e8b3c1ced11d81aa2db upstream.

pm_runtime_get_sync() will increment pm usage at first and it
will resume the device later. We should decrease the usage count
whetever it succeeded or failed(maybe runtime of the device has
error, or device is in inaccessible state, or other error state).
If we do not call put operation to decrease the reference, it will
result in reference leak in xhci_histb_probe. Moreover, this
device cannot enter the idle state and always stay busy or other
non-idle state later. So we fixed it by jumping to error handling
branch.

Fixes: c508f41da0788 ("xhci: hisilicon: support HiSilicon STB xHCI host controller")
Signed-off-by: Zhang Qilong 
Link: https://lore.kernel.org/r/20201106122221.2304528-1-zhangqilong3@huawei.com
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode

2020-11-18T18:20:29+00:00

commit 6d853c9e4104b4fc8d55dc9cd3b99712aa347174 upstream.

Renesas R-Car and RZ/G SoCs have a firmware download mode over USB.
However, on reset a banner string is transmitted out which is not expected
to be echoed back and will corrupt the protocol.

Cc: stable 
Acked-by: Oliver Neukum 
Signed-off-by: Chris Brandt 
Link: https://lore.kernel.org/r/20201111131209.3977903-1-chris.brandt@renesas.com
Signed-off-by: Greg Kroah-Hartman

usb: gadget: goku_udc: fix potential crashes in probe

2020-11-18T18:20:21+00:00

[ Upstream commit 0d66e04875c5aae876cf3d4f4be7978fa2b00523 ]

goku_probe() goes to error label "err" and invokes goku_remove()
in case of failures of pci_enable_device(), pci_resource_start()
and ioremap(). goku_remove() gets a device from
pci_get_drvdata(pdev) and works with it without any checks, in
particular it dereferences a corresponding pointer. But
goku_probe() did not set this device yet. So, one can expect
various crashes. The patch moves setting the device just after
allocation of memory for it.

Found by Linux Driver Verification project (linuxtesting.org).

Reported-by: Pavel Andrianov 
Signed-off-by: Evgeny Novikov 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin

usb: dwc3: pci: add support for the Intel Alder Lake-S

2020-11-18T18:20:21+00:00

[ Upstream commit 1384ab4fee12c4c4f8bd37bc9f8686881587b286 ]

This patch adds the necessary PCI ID for Intel Alder Lake-S
devices.

Signed-off-by: Heikki Krogerus 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin

usb: dwc3: gadget: Reclaim extra TRBs after request completion

2020-11-18T18:20:16+00:00

[ Upstream commit 690e5c2dc29f8891fcfd30da67e0d5837c2c9df5 ]

An SG request may be partially completed (due to no available TRBs).
Don't reclaim extra TRBs and clear the needs_extra_trb flag until the
request is fully completed. Otherwise, the driver will reclaim the wrong
TRB.

Cc: stable@vger.kernel.org
Fixes: 1f512119a08c ("usb: dwc3: gadget: add remaining sg entries to ring")
Signed-off-by: Thinh Nguyen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin

usb: dwc3: gadget: Continue to process pending requests

2020-11-18T18:20:16+00:00

[ Upstream commit d9feef974e0d8cb6842533c92476a1b32a41ba31 ]

If there are still pending requests because no TRB was available,
prepare more when started requests are completed.

Introduce dwc3_gadget_ep_should_continue() to check for incomplete and
pending requests to resume updating new TRBs to the controller's TRB
cache.

Signed-off-by: Thinh Nguyen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin

usb: mtu3: fix panic in mtu3_gadget_stop()

2020-11-10T11:37:33+00:00

commit 20914919ad31849ee2b9cfe0428f4a20335c9e2a upstream.

This patch fixes a possible issue when mtu3_gadget_stop()
already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect().

[] notifier_call_chain+0xa4/0x128
[] __atomic_notifier_call_chain+0x84/0x138
[] notify_die+0xb0/0x120
[] die+0x1f8/0x5d0
[] __do_kernel_fault+0x19c/0x280
[] do_bad_area+0x44/0x140
[] do_translation_fault+0x4c/0x90
[] do_mem_abort+0xb8/0x258
[] el1_da+0x24/0x3c
[] mtu3_gadget_disconnect+0xac/0x128
[] mtu3_irq+0x34c/0xc18
[] __handle_irq_event_percpu+0x2ac/0xcd0
[] handle_irq_event_percpu+0x80/0x138
[] handle_irq_event+0xac/0x148
[] handle_fasteoi_irq+0x234/0x568
[] generic_handle_irq+0x48/0x68
[] __handle_domain_irq+0x264/0x1740
[] gic_handle_irq+0x14c/0x250
[] el1_irq+0xec/0x194
[] dma_pool_alloc+0x6e4/0xae0
[] cmdq_mbox_pool_alloc_impl+0xb0/0x238
[] cmdq_pkt_alloc_buf+0x2dc/0x7c0
[] cmdq_pkt_add_cmd_buffer+0x178/0x270
[] cmdq_pkt_perf_begin+0x108/0x148
[] cmdq_pkt_create+0x178/0x1f0
[] mtk_crtc_config_default_path+0x328/0x7a0
[] mtk_drm_idlemgr_kick+0xa6c/0x1460
[] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68
[] drm_atomic_helper_commit_planes+0x154/0x878
[] mtk_atomic_complete.isra.16+0xe80/0x19c8
[] mtk_atomic_commit+0x258/0x898
[] drm_atomic_commit+0xcc/0x108
[] drm_mode_atomic_ioctl+0x1c20/0x2580
[] drm_ioctl_kernel+0x118/0x1b0
[] drm_ioctl+0x5c0/0x920
[] do_vfs_ioctl+0x188/0x1820
[] SyS_ioctl+0x8c/0xa0

Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver")
Signed-off-by: Macpaul Lin 
Acked-by: Chunfeng Yun 
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1604642069-20961-1-git-send-email-macpaul.lin@mediatek.com
Signed-off-by: Greg Kroah-Hartman

USB: Add NO_LPM quirk for Kingston flash drive

2020-11-10T11:37:33+00:00

commit afaa2e745a246c5ab95103a65b1ed00101e1bc63 upstream.

In Bugzilla #208257, Julien Humbert reports that a 32-GB Kingston
flash drive spontaneously disconnects and reconnects, over and over.
Testing revealed that disabling Link Power Management for the drive
fixed the problem.

This patch adds a quirk entry for that drive to turn off LPM permanently.

CC: Hans de Goede 
CC: 
Reported-and-tested-by: Julien Humbert 
Signed-off-by: Alan Stern 
Link: https://lore.kernel.org/r/20201102145821.GA1478741@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: ep0: Fix delay status handling

2020-11-10T11:37:33+00:00

commit fa27e2f6c5e674f3f1225f9ca7a7821faaf393bb upstream.

If we want to send a control status on our own time (through
delayed_status), make sure to handle a case where we may queue the
delayed status before the host requesting for it (when XferNotReady
is generated). Otherwise, the driver won't send anything because it's
not EP0_STATUS_PHASE yet. To resolve this, regardless whether
dwc->ep0state is EP0_STATUS_PHASE, make sure to clear the
dwc->delayed_status flag if dwc3_ep0_send_delayed_status() is called.
The control status can be sent when the host requests it later.

Cc: 
Fixes: d97c78a1908e ("usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command")
Signed-off-by: Thinh Nguyen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

USB: serial: option: add Telit FN980 composition 0x1055

2020-11-10T11:37:33+00:00

commit db0362eeb22992502764e825c79b922d7467e0eb upstream.

Add the following Telit FN980 composition:

0x1055: tty, adb, tty, tty, tty, tty

Signed-off-by: Daniele Palmas 
Link: https://lore.kernel.org/r/20201103124425.12940-1-dnlplm@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman