linux.git/drivers/usb, branch v3.18-rc3 Linux kernel source tree Merge tag 'usb-serial-3.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus 2014-10-29T16:24:42+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2014-10-29T16:24:42+00:00 9c19db5b11487da704d29dee48345c4841831bac Johan writes: USB-serial fixes for v3.18-rc3 These updates remove two allocations of unused buffers from kobil_sct and add some new device ids. Signed-off-by: Johan Hovold <johan@kernel.org> 
Johan writes:

USB-serial fixes for v3.18-rc3

These updates remove two allocations of unused buffers from kobil_sct
and add some new device ids.

Signed-off-by: Johan Hovold <johan@kernel.org>
usb: chipidea: Fix oops when removing the ci_hdrc module 2014-10-27T02:01:05+00:00 Torsten Fleischer to-fleischer@t-online.de 2014-10-26T11:33:13+00:00 9680b60ed79edaf52f84b65cbb20859bbb26cb68 The call of 'kfree(ci->hw_bank.regmap)' in ci_hdrc_remove() sometimes causes a kernel oops when removing the ci_hdrc module. Since there is no separate memory allocated for the ci->hw_bank.regmap array, there is no need to free it. Cc: v3.14+ <stable@@vger.kernel.org> Signed-off-by: Torsten Fleischer <to-fleischer@t-online.de> Signed-off-by: Peter Chen <peter.chen@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The call of 'kfree(ci->hw_bank.regmap)' in ci_hdrc_remove() sometimes causes
a kernel oops when removing the ci_hdrc module.

Since there is no separate memory allocated for the ci->hw_bank.regmap array,
there is no need to free it.

Cc: v3.14+ <stable@@vger.kernel.org>
Signed-off-by: Torsten Fleischer <to-fleischer@t-online.de>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: gadget: function: Fixed the return value on error path 2014-10-23T19:49:35+00:00 Pavitrakumar Managutte pavitra1729@gmail.com 2014-10-22T14:03:22+00:00 9b1763553a89b2a84881119eeabfccdb803bb468 Fixed the return value on failure. status variable is set to 0 at usb_assign_descriptors call and the same is returned on error which is incorrect. Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Pavitrakumar Managutte <pavitra1729@gmail.com> Signed-off-by: Felipe Balbi <balbi@ti.com> 
Fixed the return value on failure. status variable
is set to 0 at usb_assign_descriptors call and the same is
returned on error which is incorrect.

Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Pavitrakumar Managutte <pavitra1729@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc2: gadget: disable phy before turning off power regulators 2014-10-23T18:58:51+00:00 Marek Szyprowski m.szyprowski@samsung.com 2014-10-20T10:45:34+00:00 3a8146aafcedd93e42045598802e1eb71cae68c0 This patch fixes probe function to match the pattern used elsewhere in the driver, where power regulators are turned off as the last element in the device shutdown procedure. Acked-by: Paul Zimmerman <paulz@synopsys.com> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Felipe Balbi <balbi@ti.com> 
This patch fixes probe function to match the pattern used elsewhere in
the driver, where power regulators are turned off as the last element in
the device shutdown procedure.

Acked-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: Remove redundant usb_free_all_descriptors 2014-10-23T18:57:24+00:00 Pavitrakumar Managutte pavitra1729@gmail.com 2014-10-22T13:54:58+00:00 d12a8727171c770990c246f0682f0af7859bb245 Removed usb_free_all_descriptors in the bind functions, which results in double-free corruption of the descriptors on error path. The usb descriptors are allocated by usb_assign_descriptors. Signed-off-by: Pavitrakumar Managutte <pavitra1729@gmail.com> Reviewed-by: Robert Baldyga <r.baldyga@samsung.com> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Felipe Balbi <balbi@ti.com> 
Removed usb_free_all_descriptors in the bind functions, which
results in double-free corruption of the descriptors on error path.
The usb descriptors are allocated by usb_assign_descriptors.

Signed-off-by: Pavitrakumar Managutte <pavitra1729@gmail.com>
Reviewed-by: Robert Baldyga <r.baldyga@samsung.com>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc3: gadget: Properly initialize LINK TRB 2014-10-23T18:57:24+00:00 Jack Pham jackp@codeaurora.org 2014-10-21T23:31:10+00:00 1200a82a59b6aa65758ccc92c3447b98c53cd7a2 On ISOC endpoints the last trb_pool entry used as a LINK TRB is not getting zeroed out correctly due to memset being called incorrectly and in the wrong place. If pool allocated from DMA was not zero-initialized to begin with this will result in the size and ctrl values being random garbage. Call memset correctly after assignment of the trb_link pointer. Fixes: f6bafc6a1c ("usb: dwc3: convert TRBs into bitshifts") Cc: <stable@vger.kernel.org> # v3.4+ Signed-off-by: Jack Pham <jackp@codeaurora.org> Signed-off-by: Felipe Balbi <balbi@ti.com> 
On ISOC endpoints the last trb_pool entry used as a
LINK TRB is not getting zeroed out correctly due to
memset being called incorrectly and in the wrong place.
If pool allocated from DMA was not zero-initialized
to begin with this will result in the size and ctrl
values being random garbage. Call memset correctly after
assignment of the trb_link pointer.

Fixes: f6bafc6a1c ("usb: dwc3: convert TRBs into bitshifts")
Cc: <stable@vger.kernel.org> # v3.4+
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc2: gadget: fix gadget unregistration in udc_stop() function 2014-10-23T18:57:08+00:00 Marek Szyprowski m.szyprowski@samsung.com 2014-10-20T10:45:33+00:00 32805c350bad16e7d4debe55820d2e79dca89fb6 udc_stop() should clear ->driver pointer unconditionally to let the UDC framework to work correctly with both registering/unregistering gadgets and enabling/disabling gadgets by writing to /sys/class/udc/*hsotg/soft_connect interface. Acked-by: Paul Zimmerman <paulz@synopsys.com> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Felipe Balbi <balbi@ti.com> 
udc_stop() should clear ->driver pointer unconditionally to let the UDC
framework to work correctly with both registering/unregistering gadgets
and enabling/disabling gadgets by writing to
/sys/class/udc/*hsotg/soft_connect interface.

Acked-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc2: Bits in bitfield should add up to 32 2014-10-23T14:55:43+00:00 Charles Manning cdhmanning@gmail.com 2014-10-02T02:36:20+00:00 fd4850cfd4e4060ec85a9db590b5d0e23eec68f5 The unioned u32 is used for clearing etc. Having the number of bitfield bits add up to more than 32 is broken, even if benign. Acked-by: Paul Zimmerman <paulz@synopsys.com> Signed-off-by: Charles Manning <cdhmanning@gmail.com> Signed-off-by: Felipe Balbi <balbi@ti.com> 
The unioned u32 is used for clearing etc. Having the number of
bitfield bits add up to more than 32 is broken, even if benign.

Acked-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Charles Manning <cdhmanning@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc2: gadget: sparse warning of context imbalance 2014-10-23T14:55:43+00:00 Sudip Mukherjee sudipm.mukherjee@gmail.com 2014-10-17T04:44:02+00:00 b585a48b8a9486f26a68886278f2c8f981676dd4 sparse was giving the following warning: warning: context imbalance in 's3c_hsotg_ep_enable' - different lock contexts for basic block we were returning ENOMEM while still holding the spinlock. The sparse warning was fixed by releasing the spinlock before return. Cc: <stable@vger.kernel.org> # v3.17 Acked-by: Paul Zimmerman <paulz@synopsys.com> Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: Felipe Balbi <balbi@ti.com> 
sparse was giving the following warning:
        warning: context imbalance in 's3c_hsotg_ep_enable'
	                - different lock contexts for basic block

we were returning ENOMEM while still holding the spinlock.
The sparse warning was fixed by releasing the spinlock before return.

Cc: <stable@vger.kernel.org> # v3.17
Acked-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: udc: core: fix kernel oops with soft-connect 2014-10-23T14:55:43+00:00 Felipe Balbi balbi@ti.com 2014-10-17T16:10:25+00:00 bfa6b18c680450c17512c741ed1d818695747621 Currently, there's no guarantee that udc->driver will be valid when using soft_connect sysfs interface. In fact, we can very easily trigger a NULL pointer dereference by trying to disconnect when a gadget driver isn't loaded. Fix this bug: ~# echo disconnect > soft_connect [ 33.685743] Unable to handle kernel NULL pointer dereference at virtual address 00000014 [ 33.694221] pgd = ed0cc000 [ 33.697174] [00000014] *pgd=ae351831, *pte=00000000, *ppte=00000000 [ 33.703766] Internal error: Oops: 17 [#1] SMP ARM [ 33.708697] Modules linked in: xhci_plat_hcd xhci_hcd snd_soc_davinci_mcasp snd_soc_tlv320aic3x snd_soc_edma snd_soc_omap snd_soc_evm snd_soc_core dwc3 snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd lis3lv02d_i2c matrix_keypad lis3lv02d dwc3_omap input_polldev soundcore [ 33.734372] CPU: 0 PID: 1457 Comm: bash Not tainted 3.17.0-09740-ga93416e-dirty #345 [ 33.742457] task: ee71ce00 ti: ee68a000 task.ti: ee68a000 [ 33.748116] PC is at usb_udc_softconn_store+0xa4/0xec [ 33.753416] LR is at mark_held_locks+0x78/0x90 [ 33.758057] pc : [<c04df128>] lr : [<c00896a4>] psr: 20000013 [ 33.758057] sp : ee68bec8 ip : c0c00008 fp : ee68bee4 [ 33.770050] r10: ee6b394c r9 : ee68bf80 r8 : ee6062c0 [ 33.775508] r7 : 00000000 r6 : ee6062c0 r5 : 0000000b r4 : ee739408 [ 33.782346] r3 : 00000000 r2 : 00000000 r1 : ee71d390 r0 : ee664170 [ 33.789168] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 33.796636] Control: 10c5387d Table: ad0cc059 DAC: 00000015 [ 33.802638] Process bash (pid: 1457, stack limit = 0xee68a248) [ 33.808740] Stack: (0xee68bec8 to 0xee68c000) [ 33.813299] bec0: 0000000b c0411284 ee6062c0 00000000 ee68bef4 ee68bee8 [ 33.821862] bee0: c04112ac c04df090 ee68bf14 ee68bef8 c01c2868 c0411290 0000000b ee6b3940 [ 33.830419] bf00: 00000000 00000000 ee68bf4c ee68bf18 c01c1a24 c01c2818 00000000 00000000 [ 33.838990] bf20: ee61b940 ee2f47c0 0000000b 000ce408 ee68bf80 c000f304 ee68a000 00000000 [ 33.847544] bf40: ee68bf7c ee68bf50 c0152dd8 c01c1960 ee68bf7c c0170af8 ee68bf7c ee2f47c0 [ 33.856099] bf60: ee2f47c0 000ce408 0000000b c000f304 ee68bfa4 ee68bf80 c0153330 c0152d34 [ 33.864653] bf80: 00000000 00000000 0000000b 000ce408 b6e7fb50 00000004 00000000 ee68bfa8 [ 33.873204] bfa0: c000f080 c01532e8 0000000b 000ce408 00000001 000ce408 0000000b 00000000 [ 33.881763] bfc0: 0000000b 000ce408 b6e7fb50 00000004 0000000b 00000000 000c5758 00000000 [ 33.890319] bfe0: 00000000 bec2c924 b6de422d b6e1d226 40000030 00000001 75716d2f 00657565 [ 33.898890] [<c04df128>] (usb_udc_softconn_store) from [<c04112ac>] (dev_attr_store+0x28/0x34) [ 33.907920] [<c04112ac>] (dev_attr_store) from [<c01c2868>] (sysfs_kf_write+0x5c/0x60) [ 33.916200] [<c01c2868>] (sysfs_kf_write) from [<c01c1a24>] (kernfs_fop_write+0xd0/0x194) [ 33.924773] [<c01c1a24>] (kernfs_fop_write) from [<c0152dd8>] (vfs_write+0xb0/0x1bc) [ 33.932874] [<c0152dd8>] (vfs_write) from [<c0153330>] (SyS_write+0x54/0xb0) [ 33.940247] [<c0153330>] (SyS_write) from [<c000f080>] (ret_fast_syscall+0x0/0x48) [ 33.948160] Code: e1a01007 e12fff33 e5140004 e5143008 (e5933014) [ 33.954625] ---[ end trace f849bead94eab7ea ]--- Fixes: 2ccea03 (usb: gadget: introduce UDC Class) Cc: <stable@vger.kernel.org> # v3.1+ Signed-off-by: Felipe Balbi <balbi@ti.com> 
Currently, there's no guarantee that udc->driver
will be valid when using soft_connect sysfs
interface. In fact, we can very easily trigger
a NULL pointer dereference by trying to disconnect
when a gadget driver isn't loaded.

Fix this bug:

~# echo disconnect > soft_connect
[   33.685743] Unable to handle kernel NULL pointer dereference at virtual address 00000014
[   33.694221] pgd = ed0cc000
[   33.697174] [00000014] *pgd=ae351831, *pte=00000000, *ppte=00000000
[   33.703766] Internal error: Oops: 17 [#1] SMP ARM
[   33.708697] Modules linked in: xhci_plat_hcd xhci_hcd snd_soc_davinci_mcasp snd_soc_tlv320aic3x snd_soc_edma snd_soc_omap snd_soc_evm snd_soc_core dwc3 snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd lis3lv02d_i2c matrix_keypad lis3lv02d dwc3_omap input_polldev soundcore
[   33.734372] CPU: 0 PID: 1457 Comm: bash Not tainted 3.17.0-09740-ga93416e-dirty #345
[   33.742457] task: ee71ce00 ti: ee68a000 task.ti: ee68a000
[   33.748116] PC is at usb_udc_softconn_store+0xa4/0xec
[   33.753416] LR is at mark_held_locks+0x78/0x90
[   33.758057] pc : [<c04df128>]    lr : [<c00896a4>]    psr: 20000013
[   33.758057] sp : ee68bec8  ip : c0c00008  fp : ee68bee4
[   33.770050] r10: ee6b394c  r9 : ee68bf80  r8 : ee6062c0
[   33.775508] r7 : 00000000  r6 : ee6062c0  r5 : 0000000b  r4 : ee739408
[   33.782346] r3 : 00000000  r2 : 00000000  r1 : ee71d390  r0 : ee664170
[   33.789168] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   33.796636] Control: 10c5387d  Table: ad0cc059  DAC: 00000015
[   33.802638] Process bash (pid: 1457, stack limit = 0xee68a248)
[   33.808740] Stack: (0xee68bec8 to 0xee68c000)
[   33.813299] bec0:                   0000000b c0411284 ee6062c0 00000000 ee68bef4 ee68bee8
[   33.821862] bee0: c04112ac c04df090 ee68bf14 ee68bef8 c01c2868 c0411290 0000000b ee6b3940
[   33.830419] bf00: 00000000 00000000 ee68bf4c ee68bf18 c01c1a24 c01c2818 00000000 00000000
[   33.838990] bf20: ee61b940 ee2f47c0 0000000b 000ce408 ee68bf80 c000f304 ee68a000 00000000
[   33.847544] bf40: ee68bf7c ee68bf50 c0152dd8 c01c1960 ee68bf7c c0170af8 ee68bf7c ee2f47c0
[   33.856099] bf60: ee2f47c0 000ce408 0000000b c000f304 ee68bfa4 ee68bf80 c0153330 c0152d34
[   33.864653] bf80: 00000000 00000000 0000000b 000ce408 b6e7fb50 00000004 00000000 ee68bfa8
[   33.873204] bfa0: c000f080 c01532e8 0000000b 000ce408 00000001 000ce408 0000000b 00000000
[   33.881763] bfc0: 0000000b 000ce408 b6e7fb50 00000004 0000000b 00000000 000c5758 00000000
[   33.890319] bfe0: 00000000 bec2c924 b6de422d b6e1d226 40000030 00000001 75716d2f 00657565
[   33.898890] [<c04df128>] (usb_udc_softconn_store) from [<c04112ac>] (dev_attr_store+0x28/0x34)
[   33.907920] [<c04112ac>] (dev_attr_store) from [<c01c2868>] (sysfs_kf_write+0x5c/0x60)
[   33.916200] [<c01c2868>] (sysfs_kf_write) from [<c01c1a24>] (kernfs_fop_write+0xd0/0x194)
[   33.924773] [<c01c1a24>] (kernfs_fop_write) from [<c0152dd8>] (vfs_write+0xb0/0x1bc)
[   33.932874] [<c0152dd8>] (vfs_write) from [<c0153330>] (SyS_write+0x54/0xb0)
[   33.940247] [<c0153330>] (SyS_write) from [<c000f080>] (ret_fast_syscall+0x0/0x48)
[   33.948160] Code: e1a01007 e12fff33 e5140004 e5143008 (e5933014)
[   33.954625] ---[ end trace f849bead94eab7ea ]---

Fixes: 2ccea03 (usb: gadget: introduce UDC Class)
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: Felipe Balbi <balbi@ti.com>