linux.git/drivers/usb/gadget/function, branch v4.8

usb: gadget: prevent potenial null pointer dereference on skb->len

2016-09-06T07:44:03+00:00

An earlier fix partially fixed the null pointer dereference on skb->len
by moving the assignment of len after the check on skb being non-null,
however it failed to remove the erroneous dereference when assigning len.
Correctly fix this by removing the initialisation of len as was
originally intended.

Fixes: 70237dc8efd092 ("usb: gadget: function: f_eem: socket buffer may be NULL")
Acked-by: Peter Chen 
Signed-off-by: Colin Ian King 
Signed-off-by: Felipe Balbi

usb: gadget: Add the gserial port checking in gs_start_tx()

2016-08-22T07:45:13+00:00

When usb gadget is set gadget serial function, it will be crash in below
situation.

It will clean the 'port->port_usb' pointer in gserial_disconnect() function
when usb link is inactive, but it will release lock for disabling the endpoints
in this function. Druing the lock release period, it maybe complete one request
to issue gs_write_complete()--->gs_start_tx() function, but the 'port->port_usb'
pointer had been set NULL, thus it will be crash in gs_start_tx() function.

This patch adds the 'port->port_usb' pointer checking in gs_start_tx() function
to avoid this situation.

Signed-off-by: Baolin Wang 
Signed-off-by: Felipe Balbi

usb: gadget: function: f_rndis: socket buffer may be NULL

2016-08-22T07:45:12+00:00

In eth_start_xmit, the socket buffer may be NULL. So, add NULL pointer
check at .wrap API.

Signed-off-by: Peter Chen 
Signed-off-by: Felipe Balbi

usb: gadget: function: f_eem: socket buffer may be NULL

2016-08-22T07:45:12+00:00

In eth_start_xmit, the socket buffer may be NULL. So, add NULL pointer
check at .wrap API.

Signed-off-by: Peter Chen 
Signed-off-by: Felipe Balbi

usb: gadget: rndis: free response queue during REMOTE_NDIS_RESET_MSG

2016-08-11T12:09:48+00:00

When rndis data transfer is in progress, some Windows7 Host PC is not
sending the GET_ENCAPSULATED_RESPONSE command for receiving the response
for the previous SEND_ENCAPSULATED_COMMAND processed.

The rndis function driver appends each response for the
SEND_ENCAPSULATED_COMMAND in a queue. As the above process got corrupted,
the Host sends a REMOTE_NDIS_RESET_MSG command to do a soft-reset.
As the rndis response queue is not freed, the previous response is sent
as a part of this REMOTE_NDIS_RESET_MSG's reset response and the Host
block any more Rndis transfers.

Hence free the rndis response queue as a part of this soft-reset so that
the correct response for REMOTE_NDIS_RESET_MSG is sent properly during the
response command.

Signed-off-by: Rajkumar Raghupathy 
Signed-off-by: Xerox Lin 
[AmitP: Cherry-picked this patch and folded other relevant
        fixes from Android common kernel android-4.4]
Signed-off-by: Amit Pundir 
Signed-off-by: Felipe Balbi

usb: gadget: uvc: Fix return value in case of error

2016-08-11T12:09:46+00:00

If this memory allocation fail, we will return 0, which means success.
Return -ENOMEM instead.

Reviewed-by: Laurent Pinchart 
Signed-off-by: Christophe JAILLET 
Signed-off-by: Felipe Balbi

usb: gadget: u_ether: fix dereference after null check coverify warning

2016-08-11T12:09:44+00:00

dev->port_usb is checked for null pointer at above code, so dev->port_usb
might be null, fix it by adding null pointer check.

Signed-off-by: Peter Chen 
Signed-off-by: Felipe Balbi

Merge tag 'media/v4.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2016-07-27T01:59:59+00:00

Pull media updates from Mauro Carvalho Chehab:

 - new framework support for HDMI CEC and remote control support

 - new encoding codec driver for Mediatek SoC

 - new frontend driver: helene tuner

 - added support for NetUp almost universal devices, with supports
   DVB-C/S/S2/T/T2 and ISDB-T

 - the mn88472 frontend driver got promoted from staging

 - a new driver for RCar video input

 - some soc_camera legacy drivers got removed: timb, omap1, mx2, mx3

 - lots of driver cleanups, improvements and fixups

* tag 'media/v4.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (377 commits)
  [media] cec: always check all_device_types and features
  [media] cec: poll should check if there is room in the tx queue
  [media] vivid: support monitor all mode
  [media] cec: fix test for unconfigured adapter in main message loop
  [media] cec: limit the size of the transmit queue
  [media] cec: zero unused msg part after msg->len
  [media] cec: don't set fh to NULL in CEC_TRANSMIT
  [media] cec: clear all status fields before transmit and always fill in sequence
  [media] cec: CEC_RECEIVE overwrote the timeout field
  [media] cxd2841er: Reading SNR for DVB-C added
  [media] cxd2841er: Reading BER and UCB for DVB-C added
  [media] cxd2841er: fix switch-case for DVB-C
  [media] cxd2841er: fix signal strength scale for ISDB-T
  [media] cxd2841er: adjust the dB scale for DVB-C
  [media] cxd2841er: provide signal strength for DVB-C
  [media] cxd2841er: fix BER report via DVBv5 stats API
  [media] mb86a20s: apply mask to val after checking for read failure
  [media] airspy: fix error logic during device register
  [media] s5p-cec/TODO: add TODO item
  [media] cec/TODO: drop comment about sphinx documentation
  ...

Merge tag 'v4.7-rc6' into patchwork

2016-07-08T21:14:03+00:00

Linux 4.7-rc6

* tag 'v4.7-rc6': (1245 commits)
  Linux 4.7-rc6
  ovl: warn instead of error if d_type is not supported
  MIPS: Fix possible corruption of cache mode by mprotect.
  locks: use file_inode()
  usb: dwc3: st: Use explicit reset_control_get_exclusive() API
  phy: phy-stih407-usb: Use explicit reset_control_get_exclusive() API
  phy: miphy28lp: Inform the reset framework that our reset line may be shared
  namespace: update event counter when umounting a deleted dentry
  9p: use file_dentry()
  lockd: unregister notifier blocks if the service fails to come up completely
  ACPI,PCI,IRQ: correct operator precedence
  fuse: serialize dirops by default
  drm/i915: Fix missing unlock on error in i915_ppgtt_info()
  powerpc: Initialise pci_io_base as early as possible
  mfd: da9053: Fix compiler warning message for uninitialised variable
  mfd: max77620: Fix FPS switch statements
  phy: phy-stih407-usb: Inform the reset framework that our reset line may be shared
  usb: dwc3: st: Inform the reset framework that our reset line may be shared
  usb: host: ehci-st: Inform the reset framework that our reset line may be shared
  usb: host: ohci-st: Inform the reset framework that our reset line may be shared
  ...

[media] vb2: replace void alloc_ctxs by struct device alloc_devs

2016-07-08T17:45:07+00:00

Make this a proper typed array. Drop the old allocate context code since
that is no longer used.

Note that the memops functions now get a struct device pointer instead of
the struct device ** that was there initially (actually a void pointer to
a struct containing only a struct device pointer).

This code is now a lot cleaner.

Signed-off-by: Hans Verkuil 
Reviewed-by: Laurent Pinchart 
Cc: Sakari Ailus 
Signed-off-by: Mauro Carvalho Chehab