linux.git/drivers/usb/class, branch v3.4

USB: cdc-wdm: fix race leading leading to memory corruption

2012-04-26T23:59:44+00:00

This patch fixes a race whereby a pointer to a buffer
would be overwritten while the buffer was in use leading
to a double free and a memory leak. This causes crashes.
This bug was introduced in 2.6.34

Signed-off-by: Oliver Neukum 
Tested-by: Bjørn Mork 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'usb-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2012-03-20T18:26:30+00:00

Pull USB merge for 3.4-rc1 from Greg KH:
 "Here's the big USB merge for the 3.4-rc1 merge window.

  Lots of gadget driver reworks here, driver updates, xhci changes, some
  new drivers added, usb-serial core reworking to fix some bugs, and
  other various minor things.

  There are some patches touching arch code, but they have all been
  acked by the various arch maintainers."

* tag 'usb-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (302 commits)
  net: qmi_wwan: add support for ZTE MF820D
  USB: option: add ZTE MF820D
  usb: gadget: f_fs: Remove lock is held before freeing checks
  USB: option: make interface blacklist work again
  usb/ub: deprecate & schedule for removal the "Low Performance USB Block" driver
  USB: ohci-pxa27x: add clk_prepare/clk_unprepare calls
  USB: use generic platform driver on ath79
  USB: EHCI: Add a generic platform device driver
  USB: OHCI: Add a generic platform device driver
  USB: ftdi_sio: new PID: LUMEL PD12
  USB: ftdi_sio: add support for FT-X series devices
  USB: serial: mos7840: Fixed MCS7820 device attach problem
  usb: Don't make USB_ARCH_HAS_{XHCI,OHCI,EHCI} depend on USB_SUPPORT.
  usb gadget: fix a section mismatch when compiling g_ffs with CONFIG_USB_FUNCTIONFS_ETH
  USB: ohci-nxp: Remove i2c_write(), use smbus
  USB: ohci-nxp: Support for LPC32xx
  USB: ohci-nxp: Rename symbols from pnx4008 to nxp
  USB: OHCI-HCD: Rename ohci-pnx4008 to ohci-nxp
  usb: gadget: Kconfig: fix typo for 'different'
  usb: dwc3: pci: fix another failure path in dwc3_pci_probe()
  ...

usb: cdc-wdm: adding usb_cdc_wdm_register subdriver support

2012-03-08T21:06:48+00:00

This driver can be used as a subdriver of another USB driver, allowing
it to export a Device Managment interface consisting of a single interrupt
endpoint with no dedicated USB interface.

Some devices provide a Device Management function combined with a wwan
function in a single USB interface having three endpoints (bulk in/out
+ interrupt).  If the interrupt endpoint is used exclusively for DM
notifications, then this driver can support that as a subdriver
provided that the wwan driver calls the appropriate entry points on
probe, suspend, resume, pre_reset, post_reset and disconnect.

The main driver must have full control over all interface related
settings, including the needs_remote_wakeup flag. A manage_power
function must be provided by the main driver.

A manage_power stub doing direct flag manipulation is used in normal
driver mode.

Signed-off-by: Bjørn Mork 
Acked-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

usb: cdc-wdm: adding list lookup indirection

2012-03-08T21:06:48+00:00

Register all interfaces handled by this driver in a list, getting
rid of the dependency on usb_set_intfdata.  This allows further
generalization and simplification of the probe/create functions.

This is needed to decouple wdm_open from the driver owning the
interface, and it also allows us to share all the code in
wdm_create with drivers unable to do usb_set_intfdata.

Signed-off-by: Bjørn Mork 
Acked-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

usb: cdc-wdm: split out reusable parts of probe

2012-03-08T21:06:48+00:00

Preparing for the addition of subdriver registering as an alternative
to probe for interface-less usage.  This should not change anything
apart from minor code reordering.

Signed-off-by: Bjørn Mork 
Acked-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

TTY: remove re-assignments to tty_driver members

2012-03-08T19:37:58+00:00

All num, magic and owner are set by alloc_tty_driver. No need to
re-set them on each allocation site.

pti driver sets something different to what it passes to
alloc_tty_driver. It is not a bug, since we don't use the lines
parameter in any way. Anyway this is fixed, and now we do the right
thing.

Signed-off-by: Jiri Slaby 
Acked-by: Tilman Schmidt 
Signed-off-by: Greg Kroah-Hartman

USB: cdc-acm, use tty_standard_install

2012-03-08T19:30:21+00:00

This is a piece I missed the last time.

Do not copy the functionality all over the tree. Instead, use the
helper the tty layer provides us with.

Signed-off-by: Jiri Slaby 
Acked-by: Oliver Neukum 
Acked-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

USB: allow users to run setserial with cdc-acm

2012-02-24T21:12:15+00:00

We had a user report that running setserial on /dev/ttyACM0 didn't work.
He pointed at an old patch by Oliver Neukum from 2008 that never went anywhere..
http://permalink.gmane.org/gmane.linux.usb.general/9236

I made some minor changes to get it to apply again, and got the user to retest on 3.1,
and he reported it worked for him. https://bugzilla.redhat.com/show_bug.cgi?id=787607

The diff below is against 3.3rc. The only difference between this and
the version the user tested is the removal of the if (!ACM_READY) test
Havard removed ACM_READY in 99823f457d5994b3bd3775515578c8bfacc64b04
I'm unclear if there's need for a different test in its place.

From: Oliver Neukum 
Signed-off-by: Dave Jones 
Signed-off-by: Greg Kroah-Hartman

cdc-wdm: Don't clear WDM_READ unless entire read buffer is emptied

2012-02-24T21:12:14+00:00

The WDM_READ flag is cleared later iff desc->length is reduced to 0.

Signed-off-by: Ben Hutchings 
Tested-by: Bjørn Mork 
Cc: Oliver Neukum 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

cdc-wdm: Fix more races on the read path

2012-02-24T21:11:56+00:00

We must not allow the input buffer length to change while we're
shuffling the buffer contents.  We also mustn't clear the WDM_READ
flag after more data might have arrived.  Therefore move both of these
into the spinlocked region at the bottom of wdm_read().

When reading desc->length without holding the iuspin lock, use
ACCESS_ONCE() to ensure the compiler doesn't re-read it with
inconsistent results.

Signed-off-by: Ben Hutchings 
Tested-by: Bjørn Mork 
Cc: Oliver Neukum 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman