linux.git/drivers/usb, branch v4.8-rc3

xhci: don't dereference a xhci member after removing xhci

2016-08-16T07:42:47+00:00

Remove the hcd after checking for the xhci last quirks, not before.

This caused a hang on a Alpine Ridge xhci based maching which remove
the whole xhci controller when unplugging the last usb device

CC: 
Signed-off-by: Mathias Nyman 
Signed-off-by: Greg Kroah-Hartman

usb: xhci: Fix panic if disconnect

2016-08-16T07:42:47+00:00

After a device is disconnected, xhci_stop_device() will be invoked
in xhci_bus_suspend().
Also the "disconnect" IRQ will have ISR to invoke
xhci_free_virt_device() in this sequence.
xhci_irq -> xhci_handle_event -> handle_cmd_completion ->
xhci_handle_cmd_disable_slot -> xhci_free_virt_device

If xhci->devs[slot_id] has been assigned to NULL in
xhci_free_virt_device(), then virt_dev->eps[i].ring in
xhci_stop_device() may point to an invlid address to cause kernel
panic.

virt_dev = xhci->devs[slot_id];
:
if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)

[] Unable to handle kernel paging request at virtual address 00001a68
[] pgd=ffffffc001430000
[] [00001a68] *pgd=000000013c807003, *pud=000000013c807003,
*pmd=000000013c808003, *pte=0000000000000000
[] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[] CPU: 0 PID: 39 Comm: kworker/0:1 Tainted: G     U
[] Workqueue: pm pm_runtime_work
[] task: ffffffc0bc0e0bc0 ti: ffffffc0bc0ec000 task.ti:
ffffffc0bc0ec000
[] PC is at xhci_stop_device.constprop.11+0xb4/0x1a4

This issue is found when running with realtek ethernet device
(0bda:8153).

Signed-off-by: Jim Lin 
Cc: 
Signed-off-by: Mathias Nyman 
Signed-off-by: Greg Kroah-Hartman

xhci: really enqueue zero length TRBs.

2016-08-16T07:42:47+00:00

Enqueue the first TRB even if full_len is zero.
Without this "adb install " freezes the system.

Signed-off-by: Alban Browaeys 
Fixes: 86065c2719a5 ("xhci: don't rely on precalculated value of needed trbs in the enqueue loop")
Signed-off-by: Mathias Nyman 
Signed-off-by: Greg Kroah-Hartman

xhci: always handle "Command Ring Stopped" events

2016-08-16T07:42:47+00:00

Fix "Command completion event does not match command" errors by always
handling the command ring stopped events.

The command ring stopped event is generated as a result of aborting
or stopping the command ring with a register write. It is not caused
by a command in the command queue, and thus won't have a matching command
in the comman list.

Solve it by handling the command ring stopped event before checking for a
matching command.

In most command time out cases we abort the command ring, and get
a command ring stopped event. The events command pointer will point at
the current command ring dequeue, which in most cases matches the timed
out command in the command list, and no error messages are seen.

If we instead get a command aborted event before the command ring stopped
event, the abort event will increse the command ring dequeue pointer, and
the following command ring stopped events command pointer will point at the
next, not yet queued command. This case triggered the error message

Signed-off-by: Mathias Nyman 
CC: 
Signed-off-by: Greg Kroah-Hartman

cdc-acm: fix wrong pipe type on rx interrupt xfers

2016-08-15T14:30:56+00:00

This fixes the "BOGUS urb xfer" warning logged by usb_submit_urb().

Signed-off-by: Gavin Li 
Acked-by: Oliver Neukum 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'usb-serial-4.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

2016-08-12T14:13:27+00:00

Johan writes:

USB-serial fixes for v4.8-rc2

Here is a fix of a memory leak in a driver-registration error path, and
some new device ids.

Signed-off-by: Johan Hovold

usb: misc: usbtest: add fix for driver hang

2016-08-11T16:31:51+00:00

In sg_timeout(), req->status is set to "-ETIMEDOUT" before calling
into usb_sg_cancel(). usb_sg_cancel() will do nothing and return
directly if req->status has been set to a non-zero value. This will
cause driver hang whenever transfer time out is triggered.

This patch fixes this issue. It could be backported to stable kernel
with version later than v3.15.

Cc: stable@vger.kernel.org # 3.15+
Cc: Alan Stern 
Signed-off-by: Lu Baolu 
Suggested-by: Alan Stern 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'fixes-for-v4.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

2016-08-11T16:30:35+00:00

Felipe writes:

usb: fixes for v4.8-rc1

First set of fixes for v4.8-rc cycle. Again, dwc3 is
the most active driver with over 60% of this pull
request touching it.

The most important fixes are related to scatterlist
usage with dwc3. Before this pull request, we were
increment request->actual multiple times and this
would result in request->actual being larger than
request->length.

Also, if a we received a short packet midway through
processing a scatterlist, we were not clearning HWO
bit as we should.

Other than the large dwc3 scatterlist fixes, we have
a new Device ID for Intel's Kabylake silicon.

Other drivers, such as fsl_qe_udc and renesas udc,
also got a few minor fixes. Details are in shortlog.

usb: dwc3: gadget: stop processing on HWO set

2016-08-11T12:09:48+00:00

stop consuming TRBs when we reach one with HWO bit
already set. This will prevent us from prematurely
retiring a TRB.

Signed-off-by: Felipe Balbi

usb: dwc3: don't set last bit for ISOC endpoints

2016-08-11T12:09:48+00:00

According to Synopsys Databook 2.60a, section 8.3.4,
it's stated that:

	The LST bit should be set to 0 (isochronous
	transfers normally continue until the
	endpoint is removed entirely, at which time
	an End Transfer command is used to stop the
	transfer).

This patch makes sure that detail is observed and
fixes a regression with Android Audio playback
caused by recent changes to DWC3 gadget.

Signed-off-by: Janusz Dziedzic 
Signed-off-by: Felipe Balbi