<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/usb/core, branch v5.10-rc2</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>usbcore: Check both id_table and match() when both available</title>
<updated>2020-10-28T12:24:58+00:00</updated>
<author>
<name>Bastien Nocera</name>
<email>hadess@hadess.net</email>
</author>
<published>2020-10-22T13:55:20+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=0942d59b0af46511d59dbf5bd69ec4a64d1a854c'/>
<id>0942d59b0af46511d59dbf5bd69ec4a64d1a854c</id>
<content type='text'>
From: Bastien Nocera &lt;hadess@hadess.net&gt;

When a USB device driver has both an id_table and a match() function, make
sure to check both to find a match, first matching the id_table, then
checking the match() function.

This makes it possible to have module autoloading done through the
id_table when devices are plugged in, before checking for further
device eligibility in the match() function.

Cc: &lt;stable@vger.kernel.org&gt; # 5.8
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Co-developed-by: M. Vefa Bicakci &lt;m.v.b@runbox.com&gt;
Tested-by: Bastien Nocera &lt;hadess@hadess.net&gt;
Signed-off-by: Bastien Nocera &lt;hadess@hadess.net&gt;
Signed-off-by: M. Vefa Bicakci &lt;m.v.b@runbox.com&gt;
Tested-by: Pan (Pany) YUAN &lt;pany@fedoraproject.org&gt;
Link: https://lore.kernel.org/r/20201022135521.375211-2-m.v.b@runbox.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
From: Bastien Nocera &lt;hadess@hadess.net&gt;

When a USB device driver has both an id_table and a match() function, make
sure to check both to find a match, first matching the id_table, then
checking the match() function.

This makes it possible to have module autoloading done through the
id_table when devices are plugged in, before checking for further
device eligibility in the match() function.

Cc: &lt;stable@vger.kernel.org&gt; # 5.8
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Co-developed-by: M. Vefa Bicakci &lt;m.v.b@runbox.com&gt;
Tested-by: Bastien Nocera &lt;hadess@hadess.net&gt;
Signed-off-by: Bastien Nocera &lt;hadess@hadess.net&gt;
Signed-off-by: M. Vefa Bicakci &lt;m.v.b@runbox.com&gt;
Tested-by: Pan (Pany) YUAN &lt;pany@fedoraproject.org&gt;
Link: https://lore.kernel.org/r/20201022135521.375211-2-m.v.b@runbox.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'dma-mapping-5.10' of git://git.infradead.org/users/hch/dma-mapping</title>
<updated>2020-10-15T21:43:29+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2020-10-15T21:43:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=5a32c3413d3340f90c82c84b375ad4b335a59f28'/>
<id>5a32c3413d3340f90c82c84b375ad4b335a59f28</id>
<content type='text'>
Pull dma-mapping updates from Christoph Hellwig:

 - rework the non-coherent DMA allocator

 - move private definitions out of &lt;linux/dma-mapping.h&gt;

 - lower CMA_ALIGNMENT (Paul Cercueil)

 - remove the omap1 dma address translation in favor of the common code

 - make dma-direct aware of multiple dma offset ranges (Jim Quinlan)

 - support per-node DMA CMA areas (Barry Song)

 - increase the default seg boundary limit (Nicolin Chen)

 - misc fixes (Robin Murphy, Thomas Tai, Xu Wang)

 - various cleanups

* tag 'dma-mapping-5.10' of git://git.infradead.org/users/hch/dma-mapping: (63 commits)
  ARM/ixp4xx: add a missing include of dma-map-ops.h
  dma-direct: simplify the DMA_ATTR_NO_KERNEL_MAPPING handling
  dma-direct: factor out a dma_direct_alloc_from_pool helper
  dma-direct check for highmem pages in dma_direct_alloc_pages
  dma-mapping: merge &lt;linux/dma-noncoherent.h&gt; into &lt;linux/dma-map-ops.h&gt;
  dma-mapping: move large parts of &lt;linux/dma-direct.h&gt; to kernel/dma
  dma-mapping: move dma-debug.h to kernel/dma/
  dma-mapping: remove &lt;asm/dma-contiguous.h&gt;
  dma-mapping: merge &lt;linux/dma-contiguous.h&gt; into &lt;linux/dma-map-ops.h&gt;
  dma-contiguous: remove dma_contiguous_set_default
  dma-contiguous: remove dev_set_cma_area
  dma-contiguous: remove dma_declare_contiguous
  dma-mapping: split &lt;linux/dma-mapping.h&gt;
  cma: decrease CMA_ALIGNMENT lower limit to 2
  firewire-ohci: use dma_alloc_pages
  dma-iommu: implement -&gt;alloc_noncoherent
  dma-mapping: add new {alloc,free}_noncoherent dma_map_ops methods
  dma-mapping: add a new dma_alloc_pages API
  dma-mapping: remove dma_cache_sync
  53c700: convert to dma_alloc_noncoherent
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull dma-mapping updates from Christoph Hellwig:

 - rework the non-coherent DMA allocator

 - move private definitions out of &lt;linux/dma-mapping.h&gt;

 - lower CMA_ALIGNMENT (Paul Cercueil)

 - remove the omap1 dma address translation in favor of the common code

 - make dma-direct aware of multiple dma offset ranges (Jim Quinlan)

 - support per-node DMA CMA areas (Barry Song)

 - increase the default seg boundary limit (Nicolin Chen)

 - misc fixes (Robin Murphy, Thomas Tai, Xu Wang)

 - various cleanups

* tag 'dma-mapping-5.10' of git://git.infradead.org/users/hch/dma-mapping: (63 commits)
  ARM/ixp4xx: add a missing include of dma-map-ops.h
  dma-direct: simplify the DMA_ATTR_NO_KERNEL_MAPPING handling
  dma-direct: factor out a dma_direct_alloc_from_pool helper
  dma-direct check for highmem pages in dma_direct_alloc_pages
  dma-mapping: merge &lt;linux/dma-noncoherent.h&gt; into &lt;linux/dma-map-ops.h&gt;
  dma-mapping: move large parts of &lt;linux/dma-direct.h&gt; to kernel/dma
  dma-mapping: move dma-debug.h to kernel/dma/
  dma-mapping: remove &lt;asm/dma-contiguous.h&gt;
  dma-mapping: merge &lt;linux/dma-contiguous.h&gt; into &lt;linux/dma-map-ops.h&gt;
  dma-contiguous: remove dma_contiguous_set_default
  dma-contiguous: remove dev_set_cma_area
  dma-contiguous: remove dma_declare_contiguous
  dma-mapping: split &lt;linux/dma-mapping.h&gt;
  cma: decrease CMA_ALIGNMENT lower limit to 2
  firewire-ohci: use dma_alloc_pages
  dma-iommu: implement -&gt;alloc_noncoherent
  dma-mapping: add new {alloc,free}_noncoherent dma_map_ops methods
  dma-mapping: add a new dma_alloc_pages API
  dma-mapping: remove dma_cache_sync
  53c700: convert to dma_alloc_noncoherent
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge 5.9-rc8 into usb-next</title>
<updated>2020-10-05T06:54:36+00:00</updated>
<author>
<name>Greg Kroah-Hartman</name>
<email>gregkh@linuxfoundation.org</email>
</author>
<published>2020-10-05T06:54:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=168ae5a74b4a9ebf0bd9c5ea7008af0b7a6ccf04'/>
<id>168ae5a74b4a9ebf0bd9c5ea7008af0b7a6ccf04</id>
<content type='text'>
We need the USB fixes in here as well for testing.

Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We need the USB fixes in here as well for testing.

Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB: core: remove polling for /sys/kernel/debug/usb/devices</title>
<updated>2020-10-02T13:32:46+00:00</updated>
<author>
<name>Sergey Korolev</name>
<email>s.korolev@ndmsystems.com</email>
</author>
<published>2020-08-09T16:12:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=97b65223c18f131e18d662448381b727c04c2325'/>
<id>97b65223c18f131e18d662448381b727c04c2325</id>
<content type='text'>
The latest reference to usbfs_conn_disc_event() removed in
commit fb28d58b72aa ("USB: remove CONFIG_USB_DEVICEFS")
in 2012 and now a user poll() waits infinitely for content changes.

Signed-off-by: Sergey Korolev &lt;s.korolev@ndmsystems.com&gt;
Link: https://lore.kernel.org/r/20200809161233.13135-1-s.korolev@ndmsystems.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The latest reference to usbfs_conn_disc_event() removed in
commit fb28d58b72aa ("USB: remove CONFIG_USB_DEVICEFS")
in 2012 and now a user poll() waits infinitely for content changes.

Signed-off-by: Sergey Korolev &lt;s.korolev@ndmsystems.com&gt;
Link: https://lore.kernel.org/r/20200809161233.13135-1-s.korolev@ndmsystems.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB: hub: Add Kconfig option to reduce number of port initialization retries</title>
<updated>2020-10-02T09:29:02+00:00</updated>
<author>
<name>Alan Stern</name>
<email>stern@rowland.harvard.edu</email>
</author>
<published>2020-09-28T15:22:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=fb6f076d543414cec709401ec65e5f8e6985d77a'/>
<id>fb6f076d543414cec709401ec65e5f8e6985d77a</id>
<content type='text'>
Description based on one by Yasushi Asano:

According to 6.7.22 A-UUT “Device No Response” for connection timeout
of USB OTG and EH automated compliance plan v1.2, enumeration failure
has to be detected within 30 seconds.  However, the old and new
enumeration schemes each make a total of 12 attempts, and each attempt
can take 5 seconds to time out, so the PET test fails.

This patch adds a new Kconfig option (CONFIG_USB_FEW_INIT_RETRIES);
when the option is set all the initialization retry loops except the
outermost are reduced to a single iteration.  This reduces the total
number of attempts to four, allowing Linux hosts to pass the PET test.

The new option is disabled by default to preserve the existing
behavior.  The reduced number of retries may fail to initialize a few
devices that currently do work, but for the most part there should be
no change.  And in cases where the initialization does fail, it will
fail much more quickly.

Reported-and-tested-by: yasushi asano &lt;yazzep@gmail.com&gt;
Signed-off-by: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Link: https://lore.kernel.org/r/20200928152217.GB134701@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Description based on one by Yasushi Asano:

According to 6.7.22 A-UUT “Device No Response” for connection timeout
of USB OTG and EH automated compliance plan v1.2, enumeration failure
has to be detected within 30 seconds.  However, the old and new
enumeration schemes each make a total of 12 attempts, and each attempt
can take 5 seconds to time out, so the PET test fails.

This patch adds a new Kconfig option (CONFIG_USB_FEW_INIT_RETRIES);
when the option is set all the initialization retry loops except the
outermost are reduced to a single iteration.  This reduces the total
number of attempts to four, allowing Linux hosts to pass the PET test.

The new option is disabled by default to preserve the existing
behavior.  The reduced number of retries may fail to initialize a few
devices that currently do work, but for the most part there should be
no change.  And in cases where the initialization does fail, it will
fail much more quickly.

Reported-and-tested-by: yasushi asano &lt;yazzep@gmail.com&gt;
Signed-off-by: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Link: https://lore.kernel.org/r/20200928152217.GB134701@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB: hub: Clean up use of port initialization schemes and retries</title>
<updated>2020-10-02T09:28:59+00:00</updated>
<author>
<name>Alan Stern</name>
<email>stern@rowland.harvard.edu</email>
</author>
<published>2020-09-28T15:20:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=19502e6911e4ef4a036344eed36274bb18225033'/>
<id>19502e6911e4ef4a036344eed36274bb18225033</id>
<content type='text'>
The SET_CONFIG_TRIES macro in hub.c is badly named; it controls the
number of port-initialization retry attempts rather than the number of
Set-Configuration attempts.  Furthermore, the USE_NEW_SCHEME macro and
use_new_scheme() function are written in a very confusing manner,
making it almost impossible to figure out exactly what they do or
check that they are correct.

This patch renames SET_CONFIG_TRIES to PORT_INIT_TRIES, removes
USE_NEW_SCHEME entirely, and rewrites use_new_scheme() to be much more
transparent, with added comments explaining how it works.  The patch
also pulls the single call site of use_new_scheme() out from the
Get-Descriptor retry loop (where it returns the same value each time)
and renames the local variable used to store the result.

The overall effect is a minor cleanup.  However, there is one
functional change: If the "use_both_schemes" module parameter isn't
set (by default it is set), the existing code does only two retry
iterations.  After this patch it will always perform four, regardless
of the parameter's value.

Signed-off-by: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Link: https://lore.kernel.org/r/20200928152050.GA134701@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The SET_CONFIG_TRIES macro in hub.c is badly named; it controls the
number of port-initialization retry attempts rather than the number of
Set-Configuration attempts.  Furthermore, the USE_NEW_SCHEME macro and
use_new_scheme() function are written in a very confusing manner,
making it almost impossible to figure out exactly what they do or
check that they are correct.

This patch renames SET_CONFIG_TRIES to PORT_INIT_TRIES, removes
USE_NEW_SCHEME entirely, and rewrites use_new_scheme() to be much more
transparent, with added comments explaining how it works.  The patch
also pulls the single call site of use_new_scheme() out from the
Get-Descriptor retry loop (where it returns the same value each time)
and renames the local variable used to store the result.

The overall effect is a minor cleanup.  However, there is one
functional change: If the "use_both_schemes" module parameter isn't
set (by default it is set), the existing code does only two retry
iterations.  After this patch it will always perform four, regardless
of the parameter's value.

Signed-off-by: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Link: https://lore.kernel.org/r/20200928152050.GA134701@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usbcore/driver: Accommodate usbip</title>
<updated>2020-09-25T14:53:02+00:00</updated>
<author>
<name>M. Vefa Bicakci</name>
<email>m.v.b@runbox.com</email>
</author>
<published>2020-09-22T11:07:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=3fce39601a1a34d940cf62858ee01ed9dac5d459'/>
<id>3fce39601a1a34d940cf62858ee01ed9dac5d459</id>
<content type='text'>
Commit 88b7381a939d ("USB: Select better matching USB drivers when
available") inadvertently broke usbip functionality. The commit in
question allows USB device drivers to be explicitly matched with
USB devices via the use of driver-provided identifier tables and
match functions, which is useful for a specialised device driver
to be chosen for a device that can also be handled by another,
more generic, device driver.

Prior, the USB device section of usb_device_match() had an
unconditional "return 1" statement, which allowed user-space to bind
USB devices to the usbip_host device driver, if desired. However,
the aforementioned commit changed the default/fallback return
value to zero. This breaks device drivers such as usbip_host, so
this commit restores the legacy behaviour, but only if a device
driver does not have an id_table and a match() function.

In addition, if usb_device_match is called for a device driver
and device pair where the device does not match the id_table of the
device driver in question, then the device driver will be disqualified
for the device. This allows avoiding the default case of "return 1",
which prevents undesirable probe() calls to a driver even though
its id_table did not match the device.

Finally, this commit changes the specialised-driver-to-generic-driver
transition code so that when a device driver returns -ENODEV, a more
generic device driver is only considered if the current device driver
does not have an id_table and a match() function. This ensures that
"generic" drivers such as usbip_host will not be considered specialised
device drivers and will not cause the device to be locked in to the
generic device driver, when a more specialised device driver could be
tried.

All of these changes restore usbip functionality without regressions,
ensure that the specialised/generic device driver selection logic works
as expected with the usb and apple-mfi-fastcharge drivers, and do not
negatively affect the use of devices provided by dummy_hcd.

Fixes: 88b7381a939d ("USB: Select better matching USB drivers when available")
Cc: &lt;stable@vger.kernel.org&gt; # 5.8
Cc: Bastien Nocera &lt;hadess@hadess.net&gt;
Cc: Valentina Manea &lt;valentina.manea.m@gmail.com&gt;
Cc: Shuah Khan &lt;shuah@kernel.org&gt;
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Cc: &lt;syzkaller@googlegroups.com&gt;
Tested-by: Andrey Konovalov &lt;andreyknvl@google.com&gt;
Acked-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: M. Vefa Bicakci &lt;m.v.b@runbox.com&gt;
Link: https://lore.kernel.org/r/20200922110703.720960-5-m.v.b@runbox.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Commit 88b7381a939d ("USB: Select better matching USB drivers when
available") inadvertently broke usbip functionality. The commit in
question allows USB device drivers to be explicitly matched with
USB devices via the use of driver-provided identifier tables and
match functions, which is useful for a specialised device driver
to be chosen for a device that can also be handled by another,
more generic, device driver.

Prior, the USB device section of usb_device_match() had an
unconditional "return 1" statement, which allowed user-space to bind
USB devices to the usbip_host device driver, if desired. However,
the aforementioned commit changed the default/fallback return
value to zero. This breaks device drivers such as usbip_host, so
this commit restores the legacy behaviour, but only if a device
driver does not have an id_table and a match() function.

In addition, if usb_device_match is called for a device driver
and device pair where the device does not match the id_table of the
device driver in question, then the device driver will be disqualified
for the device. This allows avoiding the default case of "return 1",
which prevents undesirable probe() calls to a driver even though
its id_table did not match the device.

Finally, this commit changes the specialised-driver-to-generic-driver
transition code so that when a device driver returns -ENODEV, a more
generic device driver is only considered if the current device driver
does not have an id_table and a match() function. This ensures that
"generic" drivers such as usbip_host will not be considered specialised
device drivers and will not cause the device to be locked in to the
generic device driver, when a more specialised device driver could be
tried.

All of these changes restore usbip functionality without regressions,
ensure that the specialised/generic device driver selection logic works
as expected with the usb and apple-mfi-fastcharge drivers, and do not
negatively affect the use of devices provided by dummy_hcd.

Fixes: 88b7381a939d ("USB: Select better matching USB drivers when available")
Cc: &lt;stable@vger.kernel.org&gt; # 5.8
Cc: Bastien Nocera &lt;hadess@hadess.net&gt;
Cc: Valentina Manea &lt;valentina.manea.m@gmail.com&gt;
Cc: Shuah Khan &lt;shuah@kernel.org&gt;
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Cc: &lt;syzkaller@googlegroups.com&gt;
Tested-by: Andrey Konovalov &lt;andreyknvl@google.com&gt;
Acked-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: M. Vefa Bicakci &lt;m.v.b@runbox.com&gt;
Link: https://lore.kernel.org/r/20200922110703.720960-5-m.v.b@runbox.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usbcore/driver: Fix incorrect downcast</title>
<updated>2020-09-25T14:53:02+00:00</updated>
<author>
<name>M. Vefa Bicakci</name>
<email>m.v.b@runbox.com</email>
</author>
<published>2020-09-22T11:07:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=4df30e7603432704380b12fe40a604ee7f66746d'/>
<id>4df30e7603432704380b12fe40a604ee7f66746d</id>
<content type='text'>
This commit resolves a minor bug in the selection/discovery of more
specific USB device drivers for devices that are currently bound to
generic USB device drivers.

The bug is related to the way a candidate USB device driver is
compared against the generic USB device driver. The code in
is_dev_usb_generic_driver() assumes that the device driver in question
is a USB device driver by calling to_usb_device_driver(dev-&gt;driver)
to downcast; however I have observed that this assumption is not always
true, through code instrumentation.

This commit avoids the incorrect downcast altogether by comparing
the USB device's driver (i.e., dev-&gt;driver) to the generic USB
device driver directly. This method was suggested by Alan Stern.

This bug was found while investigating Andrey Konovalov's report
indicating usbip device driver misbehaviour with the recently merged
generic USB device driver selection feature. The report is linked
below.

Fixes: d5643d2249b2 ("USB: Fix device driver race")
Cc: &lt;stable@vger.kernel.org&gt; # 5.8
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Cc: Bastien Nocera &lt;hadess@hadess.net&gt;
Cc: Shuah Khan &lt;shuah@kernel.org&gt;
Cc: Valentina Manea &lt;valentina.manea.m@gmail.com&gt;
Cc: &lt;syzkaller@googlegroups.com&gt;
Tested-by: Andrey Konovalov &lt;andreyknvl@google.com&gt;
Signed-off-by: M. Vefa Bicakci &lt;m.v.b@runbox.com&gt;
Link: https://lore.kernel.org/r/20200922110703.720960-4-m.v.b@runbox.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This commit resolves a minor bug in the selection/discovery of more
specific USB device drivers for devices that are currently bound to
generic USB device drivers.

The bug is related to the way a candidate USB device driver is
compared against the generic USB device driver. The code in
is_dev_usb_generic_driver() assumes that the device driver in question
is a USB device driver by calling to_usb_device_driver(dev-&gt;driver)
to downcast; however I have observed that this assumption is not always
true, through code instrumentation.

This commit avoids the incorrect downcast altogether by comparing
the USB device's driver (i.e., dev-&gt;driver) to the generic USB
device driver directly. This method was suggested by Alan Stern.

This bug was found while investigating Andrey Konovalov's report
indicating usbip device driver misbehaviour with the recently merged
generic USB device driver selection feature. The report is linked
below.

Fixes: d5643d2249b2 ("USB: Fix device driver race")
Cc: &lt;stable@vger.kernel.org&gt; # 5.8
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Cc: Bastien Nocera &lt;hadess@hadess.net&gt;
Cc: Shuah Khan &lt;shuah@kernel.org&gt;
Cc: Valentina Manea &lt;valentina.manea.m@gmail.com&gt;
Cc: &lt;syzkaller@googlegroups.com&gt;
Tested-by: Andrey Konovalov &lt;andreyknvl@google.com&gt;
Signed-off-by: M. Vefa Bicakci &lt;m.v.b@runbox.com&gt;
Link: https://lore.kernel.org/r/20200922110703.720960-4-m.v.b@runbox.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usbcore/driver: Fix specific driver selection</title>
<updated>2020-09-25T14:52:49+00:00</updated>
<author>
<name>M. Vefa Bicakci</name>
<email>m.v.b@runbox.com</email>
</author>
<published>2020-09-22T11:07:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=aea850cd35ae3d266fe6f93fb9edb25e4a555230'/>
<id>aea850cd35ae3d266fe6f93fb9edb25e4a555230</id>
<content type='text'>
This commit resolves a bug in the selection/discovery of more
specific USB device drivers for devices that are currently bound to
generic USB device drivers.

The bug is in the logic that determines whether a device currently
bound to a generic USB device driver should be re-probed by a
more specific USB device driver or not. The code in
__usb_bus_reprobe_drivers() used to have the following lines:

  if (usb_device_match_id(udev, new_udriver-&gt;id_table) == NULL &amp;&amp;
      (!new_udriver-&gt;match || new_udriver-&gt;match(udev) != 0))
 		return 0;

  ret = device_reprobe(dev);

As the reader will notice, the code checks whether the USB device in
consideration matches the identifier table (id_table) of a specific
USB device_driver (new_udriver), followed by a similar check, but this
time with the USB device driver's match function. However, the match
function's return value is not checked correctly. When match() returns
zero, it means that the specific USB device driver is *not* applicable
to the USB device in question, but the code then goes on to reprobe the
device with the new USB device driver under consideration. All this to
say, the logic is inverted.

This bug was found by code inspection and instrumentation while
investigating the root cause of the issue reported by Andrey Konovalov,
where usbip took over syzkaller's virtual USB devices in an undesired
manner. The report is linked below.

Fixes: d5643d2249b2 ("USB: Fix device driver race")
Cc: &lt;stable@vger.kernel.org&gt; # 5.8
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Cc: Bastien Nocera &lt;hadess@hadess.net&gt;
Cc: Shuah Khan &lt;shuah@kernel.org&gt;
Cc: Valentina Manea &lt;valentina.manea.m@gmail.com&gt;
Cc: &lt;syzkaller@googlegroups.com&gt;
Tested-by: Andrey Konovalov &lt;andreyknvl@google.com&gt;
Signed-off-by: M. Vefa Bicakci &lt;m.v.b@runbox.com&gt;
Link: https://lore.kernel.org/r/20200922110703.720960-3-m.v.b@runbox.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This commit resolves a bug in the selection/discovery of more
specific USB device drivers for devices that are currently bound to
generic USB device drivers.

The bug is in the logic that determines whether a device currently
bound to a generic USB device driver should be re-probed by a
more specific USB device driver or not. The code in
__usb_bus_reprobe_drivers() used to have the following lines:

  if (usb_device_match_id(udev, new_udriver-&gt;id_table) == NULL &amp;&amp;
      (!new_udriver-&gt;match || new_udriver-&gt;match(udev) != 0))
 		return 0;

  ret = device_reprobe(dev);

As the reader will notice, the code checks whether the USB device in
consideration matches the identifier table (id_table) of a specific
USB device_driver (new_udriver), followed by a similar check, but this
time with the USB device driver's match function. However, the match
function's return value is not checked correctly. When match() returns
zero, it means that the specific USB device driver is *not* applicable
to the USB device in question, but the code then goes on to reprobe the
device with the new USB device driver under consideration. All this to
say, the logic is inverted.

This bug was found by code inspection and instrumentation while
investigating the root cause of the issue reported by Andrey Konovalov,
where usbip took over syzkaller's virtual USB devices in an undesired
manner. The report is linked below.

Fixes: d5643d2249b2 ("USB: Fix device driver race")
Cc: &lt;stable@vger.kernel.org&gt; # 5.8
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Cc: Bastien Nocera &lt;hadess@hadess.net&gt;
Cc: Shuah Khan &lt;shuah@kernel.org&gt;
Cc: Valentina Manea &lt;valentina.manea.m@gmail.com&gt;
Cc: &lt;syzkaller@googlegroups.com&gt;
Tested-by: Andrey Konovalov &lt;andreyknvl@google.com&gt;
Signed-off-by: M. Vefa Bicakci &lt;m.v.b@runbox.com&gt;
Link: https://lore.kernel.org/r/20200922110703.720960-3-m.v.b@runbox.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB: correct API of usb_control_msg_send/recv</title>
<updated>2020-09-25T14:33:58+00:00</updated>
<author>
<name>Oliver Neukum</name>
<email>oneukum@suse.com</email>
</author>
<published>2020-09-23T13:43:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=ddd1198e3e0935066d6e309180d49f64ef4fa702'/>
<id>ddd1198e3e0935066d6e309180d49f64ef4fa702</id>
<content type='text'>
They need to specify how memory is to be allocated,
as control messages need to work in contexts that require GFP_NOIO.

Signed-off-by: Oliver Neukum &lt;oneukum@suse.com&gt;
Link: https://lore.kernel.org/r/20200923134348.23862-9-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
They need to specify how memory is to be allocated,
as control messages need to work in contexts that require GFP_NOIO.

Signed-off-by: Oliver Neukum &lt;oneukum@suse.com&gt;
Link: https://lore.kernel.org/r/20200923134348.23862-9-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
