Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'usb-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are some small USB fixes for 5.3-rc4.
The "biggest" one here is moving code from one file to another in
order to fix a long-standing race condition with the creation of sysfs
files for USB devices. Turns out that there are now userspace tools
out there that are hitting this long-known bug, so it's time to fix
them. Thankfully the tool-maker in this case fixed the issue :)
The other patches in here are all fixes for reported issues. Now that
syzbot knows how to fuzz USB drivers better, and is starting to now
fuzz the userspace facing side of them at the same time, there will be
more and more small fixes like these coming, which is a good thing.
All of these have been in linux-next with no reported issues"
* tag 'usb-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
usb: setup authorized_default attributes using usb_bus_notify
usb: iowarrior: fix deadlock on disconnect
Revert "USB: rio500: simplify locking"
usb: usbfs: fix double-free of usb memory upon submiturb error
usb: yurex: Fix use-after-free in yurex_delete
usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests
xhci: Fix NULL pointer dereference at endpoint zero reset.
usb: host: xhci-rcar: Fix timeout in xhci_suspend()
usb: typec: ucsi: ccg: Fix uninitilized symbol error
usb: typec: tcpm: remove tcpm dir if no children
usb: typec: tcpm: free log buf memory when remove debug file
usb: typec: tcpm: Add NULL check before dereferencing config
+216
-164
-2
drivers/usb/core/devio.c
-2
drivers/usb/core/devio.c
-123
drivers/usb/core/hcd.c
-123
drivers/usb/core/hcd.c
···
103
103
/* wait queue for synchronous unlinks */
104
104
DECLARE_WAIT_QUEUE_HEAD(usb_kill_urb_queue);
105
105
106
-
static inline int is_root_hub(struct usb_device *udev)
107
-
{
108
-
return (udev->parent == NULL);
109
-
}
110
-
111
106
/*-------------------------------------------------------------------------*/
112
107
113
108
/*
···
873
878
spin_unlock_irqrestore(&hcd_root_hub_lock, flags);
874
879
return rc;
875
880
}
876
-
877
-
878
-
879
-
/*
880
-
* Show & store the current value of authorized_default
881
-
*/
882
-
static ssize_t authorized_default_show(struct device *dev,
883
-
struct device_attribute *attr, char *buf)
884
-
{
885
-
struct usb_device *rh_usb_dev = to_usb_device(dev);
886
-
struct usb_bus *usb_bus = rh_usb_dev->bus;
887
-
struct usb_hcd *hcd;
888
-
889
-
hcd = bus_to_hcd(usb_bus);
890
-
return snprintf(buf, PAGE_SIZE, "%u\n", hcd->dev_policy);
891
-
}
892
-
893
-
static ssize_t authorized_default_store(struct device *dev,
894
-
struct device_attribute *attr,
895
-
const char *buf, size_t size)
896
-
{
897
-
ssize_t result;
898
-
unsigned val;
899
-
struct usb_device *rh_usb_dev = to_usb_device(dev);
900
-
struct usb_bus *usb_bus = rh_usb_dev->bus;
901
-
struct usb_hcd *hcd;
902
-
903
-
hcd = bus_to_hcd(usb_bus);
904
-
result = sscanf(buf, "%u\n", &val);
905
-
if (result == 1) {
906
-
hcd->dev_policy = val <= USB_DEVICE_AUTHORIZE_INTERNAL ?
907
-
val : USB_DEVICE_AUTHORIZE_ALL;
908
-
result = size;
909
-
} else {
910
-
result = -EINVAL;
911
-
}
912
-
return result;
913
-
}
914
-
static DEVICE_ATTR_RW(authorized_default);
915
-
916
-
/*
917
-
* interface_authorized_default_show - show default authorization status
918
-
* for USB interfaces
919
-
*
920
-
* note: interface_authorized_default is the default value
921
-
* for initializing the authorized attribute of interfaces
922
-
*/
923
-
static ssize_t interface_authorized_default_show(struct device *dev,
924
-
struct device_attribute *attr, char *buf)
925
-
{
926
-
struct usb_device *usb_dev = to_usb_device(dev);
927
-
struct usb_hcd *hcd = bus_to_hcd(usb_dev->bus);
928
-
929
-
return sprintf(buf, "%u\n", !!HCD_INTF_AUTHORIZED(hcd));
930
-
}
931
-
932
-
/*
933
-
* interface_authorized_default_store - store default authorization status
934
-
* for USB interfaces
935
-
*
936
-
* note: interface_authorized_default is the default value
937
-
* for initializing the authorized attribute of interfaces
938
-
*/
939
-
static ssize_t interface_authorized_default_store(struct device *dev,
940
-
struct device_attribute *attr, const char *buf, size_t count)
941
-
{
942
-
struct usb_device *usb_dev = to_usb_device(dev);
943
-
struct usb_hcd *hcd = bus_to_hcd(usb_dev->bus);
944
-
int rc = count;
945
-
bool val;
946
-
947
-
if (strtobool(buf, &val) != 0)
948
-
return -EINVAL;
949
-
950
-
if (val)
951
-
set_bit(HCD_FLAG_INTF_AUTHORIZED, &hcd->flags);
952
-
else
953
-
clear_bit(HCD_FLAG_INTF_AUTHORIZED, &hcd->flags);
954
-
955
-
return rc;
956
-
}
957
-
static DEVICE_ATTR_RW(interface_authorized_default);
958
-
959
-
/* Group all the USB bus attributes */
960
-
static struct attribute *usb_bus_attrs[] = {
961
-
&dev_attr_authorized_default.attr,
962
-
&dev_attr_interface_authorized_default.attr,
963
-
NULL,
964
-
};
965
-
966
-
static const struct attribute_group usb_bus_attr_group = {
967
-
.name = NULL, /* we want them in the same directory */
968
-
.attrs = usb_bus_attrs,
969
-
};
970
-
971
881
972
882
973
883
/*-------------------------------------------------------------------------*/
···
2794
2894
if (retval != 0)
2795
2895
goto err_register_root_hub;
2796
2896
2797
-
retval = sysfs_create_group(&rhdev->dev.kobj, &usb_bus_attr_group);
2798
-
if (retval < 0) {
2799
-
printk(KERN_ERR "Cannot register USB bus sysfs attributes: %d\n",
2800
-
retval);
2801
-
goto error_create_attr_group;
2802
-
}
2803
2897
if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
2804
2898
usb_hcd_poll_rh_status(hcd);
2805
2899
2806
2900
return retval;
2807
2901
2808
-
error_create_attr_group:
2809
-
clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags);
2810
-
if (HC_IS_RUNNING(hcd->state))
2811
-
hcd->state = HC_STATE_QUIESCING;
2812
-
spin_lock_irq(&hcd_root_hub_lock);
2813
-
hcd->rh_registered = 0;
2814
-
spin_unlock_irq(&hcd_root_hub_lock);
2815
-
2816
-
#ifdef CONFIG_PM
2817
-
cancel_work_sync(&hcd->wakeup_work);
2818
-
#endif
2819
-
cancel_work_sync(&hcd->died_work);
2820
-
mutex_lock(&usb_bus_idr_lock);
2821
-
usb_disconnect(&rhdev); /* Sets rhdev to NULL */
2822
-
mutex_unlock(&usb_bus_idr_lock);
2823
2902
err_register_root_hub:
2824
2903
hcd->rh_pollable = 0;
2825
2904
clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
···
2842
2963
dev_info(hcd->self.controller, "remove, state %x\n", hcd->state);
2843
2964
2844
2965
usb_get_dev(rhdev);
2845
-
sysfs_remove_group(&rhdev->dev.kobj, &usb_bus_attr_group);
2846
-
2847
2966
clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags);
2848
2967
if (HC_IS_RUNNING (hcd->state))
2849
2968
hcd->state = HC_STATE_QUIESCING;
+121
drivers/usb/core/sysfs.c
+121
drivers/usb/core/sysfs.c
···
15
15
#include <linux/kernel.h>
16
16
#include <linux/string.h>
17
17
#include <linux/usb.h>
18
+
#include <linux/usb/hcd.h>
18
19
#include <linux/usb/quirks.h>
19
20
#include <linux/of.h>
20
21
#include "usb.h"
···
923
922
.size = 18 + 65535, /* dev descr + max-size raw descriptor */
924
923
};
925
924
925
+
/*
926
+
* Show & store the current value of authorized_default
927
+
*/
928
+
static ssize_t authorized_default_show(struct device *dev,
929
+
struct device_attribute *attr, char *buf)
930
+
{
931
+
struct usb_device *rh_usb_dev = to_usb_device(dev);
932
+
struct usb_bus *usb_bus = rh_usb_dev->bus;
933
+
struct usb_hcd *hcd;
934
+
935
+
hcd = bus_to_hcd(usb_bus);
936
+
return snprintf(buf, PAGE_SIZE, "%u\n", hcd->dev_policy);
937
+
}
938
+
939
+
static ssize_t authorized_default_store(struct device *dev,
940
+
struct device_attribute *attr,
941
+
const char *buf, size_t size)
942
+
{
943
+
ssize_t result;
944
+
unsigned int val;
945
+
struct usb_device *rh_usb_dev = to_usb_device(dev);
946
+
struct usb_bus *usb_bus = rh_usb_dev->bus;
947
+
struct usb_hcd *hcd;
948
+
949
+
hcd = bus_to_hcd(usb_bus);
950
+
result = sscanf(buf, "%u\n", &val);
951
+
if (result == 1) {
952
+
hcd->dev_policy = val <= USB_DEVICE_AUTHORIZE_INTERNAL ?
953
+
val : USB_DEVICE_AUTHORIZE_ALL;
954
+
result = size;
955
+
} else {
956
+
result = -EINVAL;
957
+
}
958
+
return result;
959
+
}
960
+
static DEVICE_ATTR_RW(authorized_default);
961
+
962
+
/*
963
+
* interface_authorized_default_show - show default authorization status
964
+
* for USB interfaces
965
+
*
966
+
* note: interface_authorized_default is the default value
967
+
* for initializing the authorized attribute of interfaces
968
+
*/
969
+
static ssize_t interface_authorized_default_show(struct device *dev,
970
+
struct device_attribute *attr, char *buf)
971
+
{
972
+
struct usb_device *usb_dev = to_usb_device(dev);
973
+
struct usb_hcd *hcd = bus_to_hcd(usb_dev->bus);
974
+
975
+
return sprintf(buf, "%u\n", !!HCD_INTF_AUTHORIZED(hcd));
976
+
}
977
+
978
+
/*
979
+
* interface_authorized_default_store - store default authorization status
980
+
* for USB interfaces
981
+
*
982
+
* note: interface_authorized_default is the default value
983
+
* for initializing the authorized attribute of interfaces
984
+
*/
985
+
static ssize_t interface_authorized_default_store(struct device *dev,
986
+
struct device_attribute *attr, const char *buf, size_t count)
987
+
{
988
+
struct usb_device *usb_dev = to_usb_device(dev);
989
+
struct usb_hcd *hcd = bus_to_hcd(usb_dev->bus);
990
+
int rc = count;
991
+
bool val;
992
+
993
+
if (strtobool(buf, &val) != 0)
994
+
return -EINVAL;
995
+
996
+
if (val)
997
+
set_bit(HCD_FLAG_INTF_AUTHORIZED, &hcd->flags);
998
+
else
999
+
clear_bit(HCD_FLAG_INTF_AUTHORIZED, &hcd->flags);
1000
+
1001
+
return rc;
1002
+
}
1003
+
static DEVICE_ATTR_RW(interface_authorized_default);
1004
+
1005
+
/* Group all the USB bus attributes */
1006
+
static struct attribute *usb_bus_attrs[] = {
1007
+
&dev_attr_authorized_default.attr,
1008
+
&dev_attr_interface_authorized_default.attr,
1009
+
NULL,
1010
+
};
1011
+
1012
+
static const struct attribute_group usb_bus_attr_group = {
1013
+
.name = NULL, /* we want them in the same directory */
1014
+
.attrs = usb_bus_attrs,
1015
+
};
1016
+
1017
+
1018
+
static int add_default_authorized_attributes(struct device *dev)
1019
+
{
1020
+
int rc = 0;
1021
+
1022
+
if (is_usb_device(dev))
1023
+
rc = sysfs_create_group(&dev->kobj, &usb_bus_attr_group);
1024
+
1025
+
return rc;
1026
+
}
1027
+
1028
+
static void remove_default_authorized_attributes(struct device *dev)
1029
+
{
1030
+
if (is_usb_device(dev)) {
1031
+
sysfs_remove_group(&dev->kobj, &usb_bus_attr_group);
1032
+
}
1033
+
}
1034
+
926
1035
int usb_create_sysfs_dev_files(struct usb_device *udev)
927
1036
{
928
1037
struct device *dev = &udev->dev;
···
1049
938
retval = add_power_attributes(dev);
1050
939
if (retval)
1051
940
goto error;
941
+
942
+
if (is_root_hub(udev)) {
943
+
retval = add_default_authorized_attributes(dev);
944
+
if (retval)
945
+
goto error;
946
+
}
1052
947
return retval;
948
+
1053
949
error:
1054
950
usb_remove_sysfs_dev_files(udev);
1055
951
return retval;
···
1065
947
void usb_remove_sysfs_dev_files(struct usb_device *udev)
1066
948
{
1067
949
struct device *dev = &udev->dev;
950
+
951
+
if (is_root_hub(udev))
952
+
remove_default_authorized_attributes(dev);
1068
953
1069
954
remove_power_attributes(dev);
1070
955
remove_persist_attributes(dev);
+5
drivers/usb/core/usb.h
+5
drivers/usb/core/usb.h
···
153
153
return dev->type == &usb_port_device_type;
154
154
}
155
155
156
+
static inline int is_root_hub(struct usb_device *udev)
157
+
{
158
+
return (udev->parent == NULL);
159
+
}
160
+
156
161
/* Do the same for device drivers and interface drivers. */
157
162
158
163
static inline int is_usb_device_driver(struct device_driver *drv)
+7
-2
drivers/usb/host/xhci-rcar.c
+7
-2
drivers/usb/host/xhci-rcar.c
···
238
238
* pointers. So, this driver clears the AC64 bit of xhci->hcc_params
239
239
* to call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in
240
240
* xhci_gen_setup().
241
+
*
242
+
* And, since the firmware/internal CPU control the USBSTS.STS_HALT
243
+
* and the process speed is down when the roothub port enters U3,
244
+
* long delay for the handshake of STS_HALT is neeed in xhci_suspend().
241
245
*/
242
246
if (xhci_rcar_is_gen2(hcd->self.controller) ||
243
-
xhci_rcar_is_gen3(hcd->self.controller))
244
-
xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
247
+
xhci_rcar_is_gen3(hcd->self.controller)) {
248
+
xhci->quirks |= XHCI_NO_64BIT_SUPPORT | XHCI_SLOW_SUSPEND;
249
+
}
245
250
246
251
if (!xhci_rcar_wait_for_pll_active(hcd))
247
252
return -ETIMEDOUT;
+10
drivers/usb/host/xhci.c
+10
drivers/usb/host/xhci.c
···
3089
3089
return;
3090
3090
udev = (struct usb_device *) host_ep->hcpriv;
3091
3091
vdev = xhci->devs[udev->slot_id];
3092
+
3093
+
/*
3094
+
* vdev may be lost due to xHC restore error and re-initialization
3095
+
* during S3/S4 resume. A new vdev will be allocated later by
3096
+
* xhci_discover_or_reset_device()
3097
+
*/
3098
+
if (!udev->slot_id || !vdev)
3099
+
return;
3092
3100
ep_index = xhci_get_endpoint_index(&host_ep->desc);
3093
3101
ep = &vdev->eps[ep_index];
3102
+
if (!ep)
3103
+
return;
3094
3104
3095
3105
/* Bail out if toggle is already being cleared by a endpoint reset */
3096
3106
if (ep->ep_state & EP_HARD_CLEAR_TOGGLE) {
+4
-3
drivers/usb/misc/iowarrior.c
+4
-3
drivers/usb/misc/iowarrior.c
···
866
866
dev = usb_get_intfdata(interface);
867
867
mutex_lock(&iowarrior_open_disc_lock);
868
868
usb_set_intfdata(interface, NULL);
869
+
/* prevent device read, write and ioctl */
870
+
dev->present = 0;
869
871
870
872
minor = dev->minor;
873
+
mutex_unlock(&iowarrior_open_disc_lock);
874
+
/* give back our minor - this will call close() locks need to be dropped at this point*/
871
875
872
-
/* give back our minor */
873
876
usb_deregister_dev(interface, &iowarrior_class);
874
877
875
878
mutex_lock(&dev->mutex);
876
879
877
880
/* prevent device read, write and ioctl */
878
-
dev->present = 0;
879
881
880
882
mutex_unlock(&dev->mutex);
881
-
mutex_unlock(&iowarrior_open_disc_lock);
882
883
883
884
if (dev->opened) {
884
885
/* There is a process that holds a filedescriptor to the device ,
+27
-16
drivers/usb/misc/rio500.c
+27
-16
drivers/usb/misc/rio500.c
···
51
51
char *obuf, *ibuf; /* transfer buffers */
52
52
char bulk_in_ep, bulk_out_ep; /* Endpoint assignments */
53
53
wait_queue_head_t wait_q; /* for timeouts */
54
+
struct mutex lock; /* general race avoidance */
54
55
};
55
56
56
57
static DEFINE_MUTEX(rio500_mutex);
···
63
62
64
63
/* against disconnect() */
65
64
mutex_lock(&rio500_mutex);
65
+
mutex_lock(&(rio->lock));
66
66
67
67
if (rio->isopen || !rio->present) {
68
+
mutex_unlock(&(rio->lock));
68
69
mutex_unlock(&rio500_mutex);
69
70
return -EBUSY;
70
71
}
···
74
71
75
72
init_waitqueue_head(&rio->wait_q);
76
73
74
+
mutex_unlock(&(rio->lock));
77
75
78
76
dev_info(&rio->rio_dev->dev, "Rio opened.\n");
79
77
mutex_unlock(&rio500_mutex);
···
88
84
89
85
/* against disconnect() */
90
86
mutex_lock(&rio500_mutex);
87
+
mutex_lock(&(rio->lock));
91
88
92
89
rio->isopen = 0;
93
90
if (!rio->present) {
···
100
95
} else {
101
96
dev_info(&rio->rio_dev->dev, "Rio closed.\n");
102
97
}
98
+
mutex_unlock(&(rio->lock));
103
99
mutex_unlock(&rio500_mutex);
104
100
return 0;
105
101
}
···
115
109
int retries;
116
110
int retval=0;
117
111
118
-
mutex_lock(&rio500_mutex);
112
+
mutex_lock(&(rio->lock));
119
113
/* Sanity check to make sure rio is connected, powered, etc */
120
114
if (rio->present == 0 || rio->rio_dev == NULL) {
121
115
retval = -ENODEV;
···
259
253
260
254
261
255
err_out:
262
-
mutex_unlock(&rio500_mutex);
256
+
mutex_unlock(&(rio->lock));
263
257
return retval;
264
258
}
265
259
···
279
273
int errn = 0;
280
274
int intr;
281
275
282
-
intr = mutex_lock_interruptible(&rio500_mutex);
276
+
intr = mutex_lock_interruptible(&(rio->lock));
283
277
if (intr)
284
278
return -EINTR;
285
279
/* Sanity check to make sure rio is connected, powered, etc */
286
280
if (rio->present == 0 || rio->rio_dev == NULL) {
287
-
mutex_unlock(&rio500_mutex);
281
+
mutex_unlock(&(rio->lock));
288
282
return -ENODEV;
289
283
}
290
284
···
307
301
goto error;
308
302
}
309
303
if (signal_pending(current)) {
310
-
mutex_unlock(&rio500_mutex);
304
+
mutex_unlock(&(rio->lock));
311
305
return bytes_written ? bytes_written : -EINTR;
312
306
}
313
307
···
345
339
buffer += copy_size;
346
340
} while (count > 0);
347
341
348
-
mutex_unlock(&rio500_mutex);
342
+
mutex_unlock(&(rio->lock));
349
343
350
344
return bytes_written ? bytes_written : -EIO;
351
345
352
346
error:
353
-
mutex_unlock(&rio500_mutex);
347
+
mutex_unlock(&(rio->lock));
354
348
return errn;
355
349
}
356
350
···
367
361
char *ibuf;
368
362
int intr;
369
363
370
-
intr = mutex_lock_interruptible(&rio500_mutex);
364
+
intr = mutex_lock_interruptible(&(rio->lock));
371
365
if (intr)
372
366
return -EINTR;
373
367
/* Sanity check to make sure rio is connected, powered, etc */
374
368
if (rio->present == 0 || rio->rio_dev == NULL) {
375
-
mutex_unlock(&rio500_mutex);
369
+
mutex_unlock(&(rio->lock));
376
370
return -ENODEV;
377
371
}
378
372
···
383
377
384
378
while (count > 0) {
385
379
if (signal_pending(current)) {
386
-
mutex_unlock(&rio500_mutex);
380
+
mutex_unlock(&(rio->lock));
387
381
return read_count ? read_count : -EINTR;
388
382
}
389
383
if (!rio->rio_dev) {
390
-
mutex_unlock(&rio500_mutex);
384
+
mutex_unlock(&(rio->lock));
391
385
return -ENODEV;
392
386
}
393
387
this_read = (count >= IBUF_SIZE) ? IBUF_SIZE : count;
···
405
399
count = this_read = partial;
406
400
} else if (result == -ETIMEDOUT || result == 15) { /* FIXME: 15 ??? */
407
401
if (!maxretry--) {
408
-
mutex_unlock(&rio500_mutex);
402
+
mutex_unlock(&(rio->lock));
409
403
dev_err(&rio->rio_dev->dev,
410
404
"read_rio: maxretry timeout\n");
411
405
return -ETIME;
···
415
409
finish_wait(&rio->wait_q, &wait);
416
410
continue;
417
411
} else if (result != -EREMOTEIO) {
418
-
mutex_unlock(&rio500_mutex);
412
+
mutex_unlock(&(rio->lock));
419
413
dev_err(&rio->rio_dev->dev,
420
414
"Read Whoops - result:%d partial:%u this_read:%u\n",
421
415
result, partial, this_read);
422
416
return -EIO;
423
417
} else {
424
-
mutex_unlock(&rio500_mutex);
418
+
mutex_unlock(&(rio->lock));
425
419
return (0);
426
420
}
427
421
428
422
if (this_read) {
429
423
if (copy_to_user(buffer, ibuf, this_read)) {
430
-
mutex_unlock(&rio500_mutex);
424
+
mutex_unlock(&(rio->lock));
431
425
return -EFAULT;
432
426
}
433
427
count -= this_read;
···
435
429
buffer += this_read;
436
430
}
437
431
}
438
-
mutex_unlock(&rio500_mutex);
432
+
mutex_unlock(&(rio->lock));
439
433
return read_count;
440
434
}
441
435
···
500
494
}
501
495
dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf);
502
496
497
+
mutex_init(&(rio->lock));
498
+
503
499
usb_set_intfdata (intf, rio);
504
500
rio->present = 1;
505
501
bail_out:
···
519
511
if (rio) {
520
512
usb_deregister_dev(intf, &usb_rio_class);
521
513
514
+
mutex_lock(&(rio->lock));
522
515
if (rio->isopen) {
523
516
rio->isopen = 0;
524
517
/* better let it finish - the release will do whats needed */
525
518
rio->rio_dev = NULL;
519
+
mutex_unlock(&(rio->lock));
526
520
mutex_unlock(&rio500_mutex);
527
521
return;
528
522
}
···
534
524
dev_info(&intf->dev, "USB Rio disconnected.\n");
535
525
536
526
rio->present = 0;
527
+
mutex_unlock(&(rio->lock));
537
528
}
538
529
mutex_unlock(&rio500_mutex);
539
530
}
+1
-1
drivers/usb/misc/yurex.c
+1
-1
drivers/usb/misc/yurex.c
···
92
92
93
93
dev_dbg(&dev->interface->dev, "%s\n", __func__);
94
94
95
-
usb_put_dev(dev->udev);
96
95
if (dev->cntl_urb) {
97
96
usb_kill_urb(dev->cntl_urb);
98
97
kfree(dev->cntl_req);
···
107
108
dev->int_buffer, dev->urb->transfer_dma);
108
109
usb_free_urb(dev->urb);
109
110
}
111
+
usb_put_dev(dev->udev);
110
112
kfree(dev);
111
113
}
112
114
+40
-16
drivers/usb/typec/tcpm/tcpm.c
+40
-16
drivers/usb/typec/tcpm/tcpm.c
···
379
379
return SNK_UNATTACHED;
380
380
else if (port->try_role == TYPEC_SOURCE)
381
381
return SRC_UNATTACHED;
382
-
else if (port->tcpc->config->default_role == TYPEC_SINK)
382
+
else if (port->tcpc->config &&
383
+
port->tcpc->config->default_role == TYPEC_SINK)
383
384
return SNK_UNATTACHED;
384
385
/* Fall through to return SRC_UNATTACHED */
385
386
} else if (port->port_type == TYPEC_PORT_SNK) {
···
587
586
588
587
static void tcpm_debugfs_exit(struct tcpm_port *port)
589
588
{
589
+
int i;
590
+
591
+
mutex_lock(&port->logbuffer_lock);
592
+
for (i = 0; i < LOG_BUFFER_ENTRIES; i++) {
593
+
kfree(port->logbuffer[i]);
594
+
port->logbuffer[i] = NULL;
595
+
}
596
+
mutex_unlock(&port->logbuffer_lock);
597
+
590
598
debugfs_remove(port->dentry);
599
+
if (list_empty(&rootdir->d_subdirs)) {
600
+
debugfs_remove(rootdir);
601
+
rootdir = NULL;
602
+
}
591
603
}
592
604
593
605
#else
···
1109
1095
break;
1110
1096
case CMD_ATTENTION:
1111
1097
/* Attention command does not have response */
1112
-
typec_altmode_attention(adev, p[1]);
1098
+
if (adev)
1099
+
typec_altmode_attention(adev, p[1]);
1113
1100
return 0;
1114
1101
default:
1115
1102
break;
···
1162
1147
}
1163
1148
break;
1164
1149
case CMD_ENTER_MODE:
1165
-
typec_altmode_update_active(pdev, true);
1150
+
if (adev && pdev) {
1151
+
typec_altmode_update_active(pdev, true);
1166
1152
1167
-
if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
1168
-
response[0] = VDO(adev->svid, 1, CMD_EXIT_MODE);
1169
-
response[0] |= VDO_OPOS(adev->mode);
1170
-
return 1;
1153
+
if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
1154
+
response[0] = VDO(adev->svid, 1,
1155
+
CMD_EXIT_MODE);
1156
+
response[0] |= VDO_OPOS(adev->mode);
1157
+
return 1;
1158
+
}
1171
1159
}
1172
1160
return 0;
1173
1161
case CMD_EXIT_MODE:
1174
-
typec_altmode_update_active(pdev, false);
1162
+
if (adev && pdev) {
1163
+
typec_altmode_update_active(pdev, false);
1175
1164
1176
-
/* Back to USB Operation */
1177
-
WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
1178
-
NULL));
1165
+
/* Back to USB Operation */
1166
+
WARN_ON(typec_altmode_notify(adev,
1167
+
TYPEC_STATE_USB,
1168
+
NULL));
1169
+
}
1179
1170
break;
1180
1171
default:
1181
1172
break;
···
1191
1170
switch (cmd) {
1192
1171
case CMD_ENTER_MODE:
1193
1172
/* Back to USB Operation */
1194
-
WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
1195
-
NULL));
1173
+
if (adev)
1174
+
WARN_ON(typec_altmode_notify(adev,
1175
+
TYPEC_STATE_USB,
1176
+
NULL));
1196
1177
break;
1197
1178
default:
1198
1179
break;
···
1205
1182
}
1206
1183
1207
1184
/* Informing the alternate mode drivers about everything */
1208
-
typec_altmode_vdm(adev, p[0], &p[1], cnt);
1185
+
if (adev)
1186
+
typec_altmode_vdm(adev, p[0], &p[1], cnt);
1209
1187
1210
1188
return rlen;
1211
1189
}
···
4138
4114
mutex_lock(&port->lock);
4139
4115
if (tcpc->try_role)
4140
4116
ret = tcpc->try_role(tcpc, role);
4141
-
if (!ret && !tcpc->config->try_role_hw)
4117
+
if (!ret && (!tcpc->config || !tcpc->config->try_role_hw))
4142
4118
port->try_role = role;
4143
4119
port->try_src_count = 0;
4144
4120
port->try_snk_count = 0;
···
4725
4701
port->typec_caps.prefer_role = tcfg->default_role;
4726
4702
port->typec_caps.type = tcfg->type;
4727
4703
port->typec_caps.data = tcfg->data;
4728
-
port->self_powered = port->tcpc->config->self_powered;
4704
+
port->self_powered = tcfg->self_powered;
4729
4705
4730
4706
return 0;
4731
4707
}
+1
-1
drivers/usb/typec/ucsi/ucsi_ccg.c
+1
-1
drivers/usb/typec/ucsi/ucsi_ccg.c
···
1018
1018
******************************************************************************/
1019
1019
static int ccg_fw_update(struct ucsi_ccg *uc, enum enum_flash_mode flash_mode)
1020
1020
{
1021
-
int err;
1021
+
int err = 0;
1022
1022
1023
1023
while (flash_mode != FLASH_NOT_NEEDED) {
1024
1024
err = do_flash(uc, flash_mode);