Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'usb-5.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB/Thunderbolt fixes from Greg KH:
"Here are a few small USB and Thunderbolt driver fixes for 5.12-rc7 for
reported issues:
- thunderbolt leaks and off-by-one fix
- cdnsp deque fix
- usbip fixes for syzbot-reported issues
All have been in linux-next with no reported problems"
* tag 'usb-5.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
usbip: synchronize event handler with sysfs code paths
usbip: vudc synchronize sysfs code paths
usbip: stub-dev synchronize sysfs code paths
usbip: add sysfs_lock to synchronize sysfs code paths
thunderbolt: Fix off by one in tb_port_find_retimer()
thunderbolt: Fix a leak in tb_retimer_add()
usb: cdnsp: Fixes issue with dequeuing requests after disabling endpoint
+52
-9
+2
-2
drivers/thunderbolt/retimer.c
+2
-2
drivers/thunderbolt/retimer.c
···
347
347
ret = tb_retimer_nvm_add(rt);
348
348
if (ret) {
349
349
dev_err(&rt->dev, "failed to add NVM devices: %d\n", ret);
350
-
device_del(&rt->dev);
350
+
device_unregister(&rt->dev);
351
351
return ret;
352
352
}
353
353
···
406
406
*/
407
407
int tb_retimer_scan(struct tb_port *port)
408
408
{
409
-
u32 status[TB_MAX_RETIMER_INDEX] = {};
409
+
u32 status[TB_MAX_RETIMER_INDEX + 1] = {};
410
410
int ret, i, last_idx = 0;
411
411
412
412
if (!port->cap_usb4)
+4
drivers/usb/cdns3/cdnsp-gadget.c
+4
drivers/usb/cdns3/cdnsp-gadget.c
···
1128
1128
return -ESHUTDOWN;
1129
1129
}
1130
1130
1131
+
/* Requests has been dequeued during disabling endpoint. */
1132
+
if (!(pep->ep_state & EP_ENABLED))
1133
+
return 0;
1134
+
1131
1135
spin_lock_irqsave(&pdev->lock, flags);
1132
1136
ret = cdnsp_ep_dequeue(pep, to_cdnsp_request(request));
1133
1137
spin_unlock_irqrestore(&pdev->lock, flags);
+9
-2
drivers/usb/usbip/stub_dev.c
+9
-2
drivers/usb/usbip/stub_dev.c
···
63
63
64
64
dev_info(dev, "stub up\n");
65
65
66
+
mutex_lock(&sdev->ud.sysfs_lock);
66
67
spin_lock_irq(&sdev->ud.lock);
67
68
68
69
if (sdev->ud.status != SDEV_ST_AVAILABLE) {
···
88
87
tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx");
89
88
if (IS_ERR(tcp_rx)) {
90
89
sockfd_put(socket);
91
-
return -EINVAL;
90
+
goto unlock_mutex;
92
91
}
93
92
tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx");
94
93
if (IS_ERR(tcp_tx)) {
95
94
kthread_stop(tcp_rx);
96
95
sockfd_put(socket);
97
-
return -EINVAL;
96
+
goto unlock_mutex;
98
97
}
99
98
100
99
/* get task structs now */
···
113
112
wake_up_process(sdev->ud.tcp_rx);
114
113
wake_up_process(sdev->ud.tcp_tx);
115
114
115
+
mutex_unlock(&sdev->ud.sysfs_lock);
116
+
116
117
} else {
117
118
dev_info(dev, "stub down\n");
118
119
···
125
122
spin_unlock_irq(&sdev->ud.lock);
126
123
127
124
usbip_event_add(&sdev->ud, SDEV_EVENT_DOWN);
125
+
mutex_unlock(&sdev->ud.sysfs_lock);
128
126
}
129
127
130
128
return count;
···
134
130
sockfd_put(socket);
135
131
err:
136
132
spin_unlock_irq(&sdev->ud.lock);
133
+
unlock_mutex:
134
+
mutex_unlock(&sdev->ud.sysfs_lock);
137
135
return -EINVAL;
138
136
}
139
137
static DEVICE_ATTR_WO(usbip_sockfd);
···
276
270
sdev->ud.side = USBIP_STUB;
277
271
sdev->ud.status = SDEV_ST_AVAILABLE;
278
272
spin_lock_init(&sdev->ud.lock);
273
+
mutex_init(&sdev->ud.sysfs_lock);
279
274
sdev->ud.tcp_socket = NULL;
280
275
sdev->ud.sockfd = -1;
281
276
+3
drivers/usb/usbip/usbip_common.h
+3
drivers/usb/usbip/usbip_common.h
+2
drivers/usb/usbip/usbip_event.c
+2
drivers/usb/usbip/usbip_event.c
···
70
70
while ((ud = get_event()) != NULL) {
71
71
usbip_dbg_eh("pending event %lx\n", ud->event);
72
72
73
+
mutex_lock(&ud->sysfs_lock);
73
74
/*
74
75
* NOTE: shutdown must come first.
75
76
* Shutdown the device.
···
91
90
ud->eh_ops.unusable(ud);
92
91
unset_event(ud, USBIP_EH_UNUSABLE);
93
92
}
93
+
mutex_unlock(&ud->sysfs_lock);
94
94
95
95
wake_up(&ud->eh_waitq);
96
96
}
+1
drivers/usb/usbip/vhci_hcd.c
+1
drivers/usb/usbip/vhci_hcd.c
+25
-5
drivers/usb/usbip/vhci_sysfs.c
+25
-5
drivers/usb/usbip/vhci_sysfs.c
···
185
185
186
186
usbip_dbg_vhci_sysfs("enter\n");
187
187
188
+
mutex_lock(&vdev->ud.sysfs_lock);
189
+
188
190
/* lock */
189
191
spin_lock_irqsave(&vhci->lock, flags);
190
192
spin_lock(&vdev->ud.lock);
···
197
195
/* unlock */
198
196
spin_unlock(&vdev->ud.lock);
199
197
spin_unlock_irqrestore(&vhci->lock, flags);
198
+
mutex_unlock(&vdev->ud.sysfs_lock);
200
199
201
200
return -EINVAL;
202
201
}
···
207
204
spin_unlock_irqrestore(&vhci->lock, flags);
208
205
209
206
usbip_event_add(&vdev->ud, VDEV_EVENT_DOWN);
207
+
208
+
mutex_unlock(&vdev->ud.sysfs_lock);
210
209
211
210
return 0;
212
211
}
···
354
349
else
355
350
vdev = &vhci->vhci_hcd_hs->vdev[rhport];
356
351
352
+
mutex_lock(&vdev->ud.sysfs_lock);
353
+
357
354
/* Extract socket from fd. */
358
355
socket = sockfd_lookup(sockfd, &err);
359
356
if (!socket) {
360
357
dev_err(dev, "failed to lookup sock");
361
-
return -EINVAL;
358
+
err = -EINVAL;
359
+
goto unlock_mutex;
362
360
}
363
361
if (socket->type != SOCK_STREAM) {
364
362
dev_err(dev, "Expecting SOCK_STREAM - found %d",
365
363
socket->type);
366
364
sockfd_put(socket);
367
-
return -EINVAL;
365
+
err = -EINVAL;
366
+
goto unlock_mutex;
368
367
}
369
368
370
369
/* create threads before locking */
371
370
tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx");
372
371
if (IS_ERR(tcp_rx)) {
373
372
sockfd_put(socket);
374
-
return -EINVAL;
373
+
err = -EINVAL;
374
+
goto unlock_mutex;
375
375
}
376
376
tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx");
377
377
if (IS_ERR(tcp_tx)) {
378
378
kthread_stop(tcp_rx);
379
379
sockfd_put(socket);
380
-
return -EINVAL;
380
+
err = -EINVAL;
381
+
goto unlock_mutex;
381
382
}
382
383
383
384
/* get task structs now */
···
408
397
* Will be retried from userspace
409
398
* if there's another free port.
410
399
*/
411
-
return -EBUSY;
400
+
err = -EBUSY;
401
+
goto unlock_mutex;
412
402
}
413
403
414
404
dev_info(dev, "pdev(%u) rhport(%u) sockfd(%d)\n",
···
435
423
436
424
rh_port_connect(vdev, speed);
437
425
426
+
dev_info(dev, "Device attached\n");
427
+
428
+
mutex_unlock(&vdev->ud.sysfs_lock);
429
+
438
430
return count;
431
+
432
+
unlock_mutex:
433
+
mutex_unlock(&vdev->ud.sysfs_lock);
434
+
return err;
439
435
}
440
436
static DEVICE_ATTR_WO(attach);
441
437
+1
drivers/usb/usbip/vudc_dev.c
+1
drivers/usb/usbip/vudc_dev.c
+5
drivers/usb/usbip/vudc_sysfs.c
+5
drivers/usb/usbip/vudc_sysfs.c
···
112
112
dev_err(dev, "no device");
113
113
return -ENODEV;
114
114
}
115
+
mutex_lock(&udc->ud.sysfs_lock);
115
116
spin_lock_irqsave(&udc->lock, flags);
116
117
/* Don't export what we don't have */
117
118
if (!udc->driver || !udc->pullup) {
···
188
187
189
188
wake_up_process(udc->ud.tcp_rx);
190
189
wake_up_process(udc->ud.tcp_tx);
190
+
191
+
mutex_unlock(&udc->ud.sysfs_lock);
191
192
return count;
192
193
193
194
} else {
···
210
207
}
211
208
212
209
spin_unlock_irqrestore(&udc->lock, flags);
210
+
mutex_unlock(&udc->ud.sysfs_lock);
213
211
214
212
return count;
215
213
···
220
216
spin_unlock_irq(&udc->ud.lock);
221
217
unlock:
222
218
spin_unlock_irqrestore(&udc->lock, flags);
219
+
mutex_unlock(&udc->ud.sysfs_lock);
223
220
224
221
return ret;
225
222
}