iov_iter for ep_read_iter can be ITER_UBUF with io_uring.
In that case dup_iter() does not have to allocate iov and it can
return NULL. Fix the assumption by checking for iter_is_ubuf()
other wise ep_read_iter can treat this as failure and return -ENOMEM.

Fixes: 1e23db450cff ("io_uring: use iter_ubuf for single range imports")
Signed-off-by: Sandeep Dhavale <dhavale@google.com>
Acked-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/r/20230401060509.3608259-3-dhavale@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iov_iter for ffs_epfile_read_iter can be ITER_UBUF with io_uring.
In that case dup_iter() does not have to allocate anything and it
can return NULL. ffs_epfile_read_iter treats this as a failure and
returns -ENOMEM. Fix it by checking if iter_is_ubuf().

Fixes: 1e23db450cff ("io_uring: use iter_ubuf for single range imports")
Signed-off-by: Sandeep Dhavale <dhavale@google.com>
Acked-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/r/20230401060509.3608259-2-dhavale@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

WebUSB code uses wLength directly without proper endianness conversion.
Update it to use already prepared temporary variable w_length instead.

Fixes: 93c473948c58 ("usb: gadget: add WebUSB landing page support")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-By: Jó Ágila Bitsch <jgilab@gmail.com>
Link: https://lore.kernel.org/r/20230313154522.52684-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

In the unbind callback for f_uac1 and f_uac2, a call to snd_card_free()
via g_audio_cleanup() will disconnect the card and then wait for all
resources to be released, which happens when the refcount falls to zero.
Since userspace can keep the refcount incremented by not closing the
relevant file descriptor, the call to unbind may block indefinitely.
This can cause a deadlock during reboot, as evidenced by the following
blocked task observed on my machine:

  task:reboot  state:D stack:0   pid:2827  ppid:569    flags:0x0000000c
  Call trace:
   __switch_to+0xc8/0x140
   __schedule+0x2f0/0x7c0
   schedule+0x60/0xd0
   schedule_timeout+0x180/0x1d4
   wait_for_completion+0x78/0x180
   snd_card_free+0x90/0xa0
   g_audio_cleanup+0x2c/0x64
   afunc_unbind+0x28/0x60
   ...
   kernel_restart+0x4c/0xac
   __do_sys_reboot+0xcc/0x1ec
   __arm64_sys_reboot+0x28/0x30
   invoke_syscall+0x4c/0x110
   ...

The issue can also be observed by opening the card with arecord and
then stopping the process through the shell before unbinding:

  # arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null
  Recording WAVE '/dev/null' : Signed 32 bit Little Endian, Rate 48000 Hz, Stereo
  ^Z[1]+  Stopped                    arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null
  # echo gadget.0 > /sys/bus/gadget/drivers/configfs-gadget/unbind
  (observe that the unbind command never finishes)

Fix the problem by using snd_card_free_when_closed() instead, which will
still disconnect the card as desired, but defer the task of freeing the
resources to the core once userspace closes its file descriptor.

Fixes: 132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
Reviewed-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Reviewed-by: John Keeping <john@metanate.com>
Link: https://lore.kernel.org/r/20230302163648.3349669-1-alvin@pqrs.dk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull USB / Thunderbolt driver updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver changes for 6.3-rc1.

  Nothing major in here, just lots of good development, including:

   - Thunderbolt additions for new device support and features

   - xhci driver updates and cleanups

   - USB gadget media driver updates (includes media core changes that
     were acked by the v4l2 maintainers)

   - lots of other USB gadget driver updates for new features

   - dwc3 driver updates and fixes

   - minor debugfs leak fixes

   - typec driver updates and additions

   - dt-bindings conversions to yaml

   - other small bugfixes and driver updates

  All have been in linux-next for a while with no reported issues"

* tag 'usb-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (237 commits)
  usb: dwc3: xilinx: Remove unused of_gpio,h
  usb: typec: pd: Add higher capability sysfs for sink PDO
  usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO
  usb: dwc3: pci: add support for the Intel Meteor Lake-M
  usb: gadget: u_ether: Don't warn in gether_setup_name_default()
  usb: gadget: u_ether: Convert prints to device prints
  usb: gadget: u_serial: Add null pointer check in gserial_resume
  usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
  xhci: host: potential NULL dereference in xhci_generic_plat_probe()
  dt-bindings: usb: amlogic,meson-g12a-usb-ctrl: make G12A usb3-phy0 optional
  usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev
  of: device: Do not ignore error code in of_device_uevent_modalias
  of: device: Ignore modalias of reused nodes
  usb: gadget: configfs: Fix set but not used variable warning
  usb: gadget: uvc: Use custom strings if available
  usb: gadget: uvc: Allow linking function to string descs
  usb: gadget: uvc: Pick up custom string descriptor IDs
  usb: gadget: uvc: Allow linking XUs to string descriptors
  usb: gadget: configfs: Attach arbitrary strings to cdev
  usb: gadget: configfs: Support arbitrary string descriptors
  ...

Pull ARM SoC boardfile updates from Arnd Bergmann
 "Unused boardfile removal for 6.3

  This is a follow-up to the deprecation of most of the old-style board
  files that was merged in linux-6.0, removing them for good.

  This branch is almost exclusively dead code removal based on those
  annotations. Some device driver removals went through separate
  subsystem trees, but the majority is in the same branch, in order to
  better handle dependencies between the patches and avoid breaking
  bisection.

  Unfortunately that leads to merge conflicts against other changes in
  the subsystem trees, but they should all be trivial to resolve by
  removing the files.

  See commit 7d0d3fa7339e ("Merge tag 'arm-boardfiles-6.0' of
  git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc") for the
  description of which machines were marked unused and are now removed.

  The only removals that got postponed are Terastation WXL (mv78xx0) and
  Jornada720 (StrongARM1100), which turned out to still have potential
  users"

* tag 'arm-boardfile-remove-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (91 commits)
  mmc: omap: drop TPS65010 dependency
  ARM: pxa: restore mfp-pxa320.h
  usb: ohci-omap: avoid unused-variable warning
  ARM: debug: remove references in DEBUG_UART_8250_SHIFT to removed configs
  ARM: s3c: remove obsolete s3c-cpu-freq header
  MAINTAINERS: adjust SAMSUNG SOC CLOCK DRIVERS after s3c24xx support removal
  MAINTAINERS: update file entries after arm multi-platform rework and mach-pxa removal
  ARM: remove CONFIG_UNUSED_BOARD_FILES
  mfd: remove htc-pasic3 driver
  w1: remove ds1wm driver
  usb: remove ohci-tmio driver
  fbdev: remove w100fb driver
  fbdev: remove tmiofb driver
  mmc: remove tmio_mmc driver
  mfd: remove ucb1400 support
  mfd: remove toshiba tmio drivers
  rtc: remove v3020 driver
  power: remove pda_power supply driver
  ASoC: pxa: remove unused board support
  pcmcia: remove unused pxa/sa1100 drivers
  ...

The function gether_setup_name_default() is called by various USB
ethernet gadget drivers. Calling this function will select a random
host and device MAC addresses. A properly working driver should be
silent and not warn the user about default MAC addresses selection.
Given that the MAC addresses are also printed when the function
gether_register_netdev() is called, remove these unnecessary warnings.

Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Link: https://lore.kernel.org/r/20230209125319.18589-2-jonathanh@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The USB ethernet gadget driver implements its own print macros which
call printk. Device drivers should use the device prints that print the
device name. Fortunately, the same macro names are defined in the header
file 'linux/usb/composite.h' and these use the device prints. Therefore,
remove the local definitions in the USB ethernet gadget driver and use
those in 'linux/usb/composite.h'. The only difference is that now the
device name is printed instead of the ethernet interface name.

Tested using ethernet gadget on Jetson AGX Orin.

Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20230209125319.18589-1-jonathanh@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Consider a case where gserial_disconnect has already cleared
gser->ioport. And if a wakeup interrupt triggers afterwards,
gserial_resume gets called, which will lead to accessing of
gser->ioport and thus causing null pointer dereference.Add
a null pointer check to prevent this.

Added a static spinlock to prevent gser->ioport from becoming
null after the newly added check.

Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks")
Cc: stable <stable@kernel.org>
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/1676309438-14922-1-git-send-email-quic_prashk@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

If kstrtou8() fails, the mutex_unlock() is missed, move kstrtou8()
before mutex_lock() to fix it up.

Fixes: 0525210c9840 ("usb: gadget: uvc: Allow definition of XUs in configfs")
Fixes: b3c839bd8a07 ("usb: gadget: uvc: Make bSourceID read/write")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20230213070926.776447-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>