Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'usb-4.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are some USB driver fixes for 4.17-rc4.
The majority of them are some USB gadget fixes that missed my last
pull request. The "largest" patch in here is a fix for the old visor
driver that syzbot found 6 months or so ago and I finally remembered
to fix it.
All of these have been in linux-next with no reported issues"
* tag 'usb-4.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
Revert "usb: host: ehci: Use dma_pool_zalloc()"
usb: typec: tps6598x: handle block reads separately with plain-I2C adapters
usb: typec: tcpm: Release the role mux when exiting
USB: Accept bulk endpoints with 1024-byte maxpacket
xhci: Fix use-after-free in xhci_free_virt_device
USB: serial: visor: handle potential invalid device configuration
USB: serial: option: adding support for ublox R410M
usb: musb: trace: fix NULL pointer dereference in musb_g_tx()
usb: musb: host: fix potential NULL pointer dereference
usb: gadget: composite Allow for larger configuration descriptors
usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue
usb: dwc3: gadget: dwc3_gadget_del_and_unmap_request() can be static
usb: dwc2: pci: Fix error return code in dwc2_pci_probe()
usb: dwc2: WA for Full speed ISOC IN in DDMA mode.
usb: dwc2: dwc2_vbus_supply_init: fix error check
usb: gadget: f_phonet: fix pn_net_xmit()'s return type
+133
-58
+3
-1
drivers/usb/core/config.c
+3
-1
drivers/usb/core/config.c
···
191
191
static const unsigned short high_speed_maxpacket_maxes[4] = {
192
192
[USB_ENDPOINT_XFER_CONTROL] = 64,
193
193
[USB_ENDPOINT_XFER_ISOC] = 1024,
194
-
[USB_ENDPOINT_XFER_BULK] = 512,
194
+
195
+
/* Bulk should be 512, but some devices use 1024: we will warn below */
196
+
[USB_ENDPOINT_XFER_BULK] = 1024,
195
197
[USB_ENDPOINT_XFER_INT] = 1024,
196
198
};
197
199
static const unsigned short super_speed_maxpacket_maxes[4] = {
+2
drivers/usb/dwc2/core.h
+2
drivers/usb/dwc2/core.h
···
985
985
986
986
/* DWC OTG HW Release versions */
987
987
#define DWC2_CORE_REV_2_71a 0x4f54271a
988
+
#define DWC2_CORE_REV_2_72a 0x4f54272a
988
989
#define DWC2_CORE_REV_2_80a 0x4f54280a
989
990
#define DWC2_CORE_REV_2_90a 0x4f54290a
990
991
#define DWC2_CORE_REV_2_91a 0x4f54291a
···
993
992
#define DWC2_CORE_REV_2_94a 0x4f54294a
994
993
#define DWC2_CORE_REV_3_00a 0x4f54300a
995
994
#define DWC2_CORE_REV_3_10a 0x4f54310a
995
+
#define DWC2_CORE_REV_4_00a 0x4f54400a
996
996
#define DWC2_FS_IOT_REV_1_00a 0x5531100a
997
997
#define DWC2_HS_IOT_REV_1_00a 0x5532100a
998
998
+21
drivers/usb/dwc2/gadget.c
+21
drivers/usb/dwc2/gadget.c
···
3928
3928
if (index && !hs_ep->isochronous)
3929
3929
epctrl |= DXEPCTL_SETD0PID;
3930
3930
3931
+
/* WA for Full speed ISOC IN in DDMA mode.
3932
+
* By Clear NAK status of EP, core will send ZLP
3933
+
* to IN token and assert NAK interrupt relying
3934
+
* on TxFIFO status only
3935
+
*/
3936
+
3937
+
if (hsotg->gadget.speed == USB_SPEED_FULL &&
3938
+
hs_ep->isochronous && dir_in) {
3939
+
/* The WA applies only to core versions from 2.72a
3940
+
* to 4.00a (including both). Also for FS_IOT_1.00a
3941
+
* and HS_IOT_1.00a.
3942
+
*/
3943
+
u32 gsnpsid = dwc2_readl(hsotg->regs + GSNPSID);
3944
+
3945
+
if ((gsnpsid >= DWC2_CORE_REV_2_72a &&
3946
+
gsnpsid <= DWC2_CORE_REV_4_00a) ||
3947
+
gsnpsid == DWC2_FS_IOT_REV_1_00a ||
3948
+
gsnpsid == DWC2_HS_IOT_REV_1_00a)
3949
+
epctrl |= DXEPCTL_CNAK;
3950
+
}
3951
+
3931
3952
dev_dbg(hsotg->dev, "%s: write DxEPCTL=0x%08x\n",
3932
3953
__func__, epctrl);
3933
3954
+8
-5
drivers/usb/dwc2/hcd.c
+8
-5
drivers/usb/dwc2/hcd.c
···
358
358
359
359
static int dwc2_vbus_supply_init(struct dwc2_hsotg *hsotg)
360
360
{
361
+
int ret;
362
+
361
363
hsotg->vbus_supply = devm_regulator_get_optional(hsotg->dev, "vbus");
362
-
if (IS_ERR(hsotg->vbus_supply))
363
-
return 0;
364
+
if (IS_ERR(hsotg->vbus_supply)) {
365
+
ret = PTR_ERR(hsotg->vbus_supply);
366
+
hsotg->vbus_supply = NULL;
367
+
return ret == -ENODEV ? 0 : ret;
368
+
}
364
369
365
370
return regulator_enable(hsotg->vbus_supply);
366
371
}
···
4347
4342
4348
4343
spin_unlock_irqrestore(&hsotg->lock, flags);
4349
4344
4350
-
dwc2_vbus_supply_init(hsotg);
4351
-
4352
-
return 0;
4345
+
return dwc2_vbus_supply_init(hsotg);
4353
4346
}
4354
4347
4355
4348
/*
+3
-1
drivers/usb/dwc2/pci.c
+3
-1
drivers/usb/dwc2/pci.c
+2
-2
drivers/usb/dwc3/gadget.c
+2
-2
drivers/usb/dwc3/gadget.c
···
166
166
dwc3_ep_inc_trb(&dep->trb_dequeue);
167
167
}
168
168
169
-
void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
169
+
static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
170
170
struct dwc3_request *req, int status)
171
171
{
172
172
struct dwc3 *dwc = dep->dwc;
···
1424
1424
dwc->lock);
1425
1425
1426
1426
if (!r->trb)
1427
-
goto out1;
1427
+
goto out0;
1428
1428
1429
1429
if (r->num_pending_sgs) {
1430
1430
struct dwc3_trb *trb;
+1
-1
drivers/usb/gadget/function/f_phonet.c
+1
-1
drivers/usb/gadget/function/f_phonet.c
···
221
221
netif_wake_queue(dev);
222
222
}
223
223
224
-
static int pn_net_xmit(struct sk_buff *skb, struct net_device *dev)
224
+
static netdev_tx_t pn_net_xmit(struct sk_buff *skb, struct net_device *dev)
225
225
{
226
226
struct phonet_port *port = netdev_priv(dev);
227
227
struct f_phonet *fp;
+2
-1
drivers/usb/host/ehci-mem.c
+2
-1
drivers/usb/host/ehci-mem.c
···
73
73
if (!qh)
74
74
goto done;
75
75
qh->hw = (struct ehci_qh_hw *)
76
-
dma_pool_zalloc(ehci->qh_pool, flags, &dma);
76
+
dma_pool_alloc(ehci->qh_pool, flags, &dma);
77
77
if (!qh->hw)
78
78
goto fail;
79
+
memset(qh->hw, 0, sizeof *qh->hw);
79
80
qh->qh_dma = dma;
80
81
// INIT_LIST_HEAD (&qh->qh_list);
81
82
INIT_LIST_HEAD (&qh->qtd_list);
+4
-2
drivers/usb/host/ehci-sched.c
+4
-2
drivers/usb/host/ehci-sched.c
···
1287
1287
} else {
1288
1288
alloc_itd:
1289
1289
spin_unlock_irqrestore(&ehci->lock, flags);
1290
-
itd = dma_pool_zalloc(ehci->itd_pool, mem_flags,
1290
+
itd = dma_pool_alloc(ehci->itd_pool, mem_flags,
1291
1291
&itd_dma);
1292
1292
spin_lock_irqsave(&ehci->lock, flags);
1293
1293
if (!itd) {
···
1297
1297
}
1298
1298
}
1299
1299
1300
+
memset(itd, 0, sizeof(*itd));
1300
1301
itd->itd_dma = itd_dma;
1301
1302
itd->frame = NO_FRAME;
1302
1303
list_add(&itd->itd_list, &sched->td_list);
···
2081
2080
} else {
2082
2081
alloc_sitd:
2083
2082
spin_unlock_irqrestore(&ehci->lock, flags);
2084
-
sitd = dma_pool_zalloc(ehci->sitd_pool, mem_flags,
2083
+
sitd = dma_pool_alloc(ehci->sitd_pool, mem_flags,
2085
2084
&sitd_dma);
2086
2085
spin_lock_irqsave(&ehci->lock, flags);
2087
2086
if (!sitd) {
···
2091
2090
}
2092
2091
}
2093
2092
2093
+
memset(sitd, 0, sizeof(*sitd));
2094
2094
sitd->sitd_dma = sitd_dma;
2095
2095
sitd->frame = NO_FRAME;
2096
2096
list_add(&sitd->sitd_list, &iso_sched->td_list);
+1
drivers/usb/host/xhci.c
+1
drivers/usb/host/xhci.c
+2
-1
drivers/usb/musb/musb_gadget.c
+2
-1
drivers/usb/musb/musb_gadget.c
···
417
417
req = next_request(musb_ep);
418
418
request = &req->request;
419
419
420
-
trace_musb_req_tx(req);
421
420
csr = musb_readw(epio, MUSB_TXCSR);
422
421
musb_dbg(musb, "<== %s, txcsr %04x", musb_ep->end_point.name, csr);
423
422
···
454
455
if (request) {
455
456
u8 is_dma = 0;
456
457
bool short_packet = false;
458
+
459
+
trace_musb_req_tx(req);
457
460
458
461
if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
459
462
is_dma = 1;
+3
-1
drivers/usb/musb/musb_host.c
+3
-1
drivers/usb/musb/musb_host.c
+5
drivers/usb/serial/option.c
+5
drivers/usb/serial/option.c
···
233
233
/* These Quectel products use Qualcomm's vendor ID */
234
234
#define QUECTEL_PRODUCT_UC20 0x9003
235
235
#define QUECTEL_PRODUCT_UC15 0x9090
236
+
/* These u-blox products use Qualcomm's vendor ID */
237
+
#define UBLOX_PRODUCT_R410M 0x90b2
236
238
/* These Yuga products use Qualcomm's vendor ID */
237
239
#define YUGA_PRODUCT_CLM920_NC5 0x9625
238
240
···
1067
1065
/* Yuga products use Qualcomm vendor ID */
1068
1066
{ USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5),
1069
1067
.driver_info = RSVD(1) | RSVD(4) },
1068
+
/* u-blox products using Qualcomm vendor ID */
1069
+
{ USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M),
1070
+
.driver_info = RSVD(1) | RSVD(3) },
1070
1071
/* Quectel products using Quectel vendor ID */
1071
1072
{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
1072
1073
.driver_info = RSVD(4) },
+35
-34
drivers/usb/serial/visor.c
+35
-34
drivers/usb/serial/visor.c
···
335
335
goto exit;
336
336
}
337
337
338
-
if (retval == sizeof(*connection_info)) {
339
-
connection_info = (struct visor_connection_info *)
340
-
transfer_buffer;
341
-
342
-
num_ports = le16_to_cpu(connection_info->num_ports);
343
-
for (i = 0; i < num_ports; ++i) {
344
-
switch (
345
-
connection_info->connections[i].port_function_id) {
346
-
case VISOR_FUNCTION_GENERIC:
347
-
string = "Generic";
348
-
break;
349
-
case VISOR_FUNCTION_DEBUGGER:
350
-
string = "Debugger";
351
-
break;
352
-
case VISOR_FUNCTION_HOTSYNC:
353
-
string = "HotSync";
354
-
break;
355
-
case VISOR_FUNCTION_CONSOLE:
356
-
string = "Console";
357
-
break;
358
-
case VISOR_FUNCTION_REMOTE_FILE_SYS:
359
-
string = "Remote File System";
360
-
break;
361
-
default:
362
-
string = "unknown";
363
-
break;
364
-
}
365
-
dev_info(dev, "%s: port %d, is for %s use\n",
366
-
serial->type->description,
367
-
connection_info->connections[i].port, string);
368
-
}
338
+
if (retval != sizeof(*connection_info)) {
339
+
dev_err(dev, "Invalid connection information received from device\n");
340
+
retval = -ENODEV;
341
+
goto exit;
369
342
}
370
-
/*
371
-
* Handle devices that report invalid stuff here.
372
-
*/
343
+
344
+
connection_info = (struct visor_connection_info *)transfer_buffer;
345
+
346
+
num_ports = le16_to_cpu(connection_info->num_ports);
347
+
348
+
/* Handle devices that report invalid stuff here. */
373
349
if (num_ports == 0 || num_ports > 2) {
374
350
dev_warn(dev, "%s: No valid connect info available\n",
375
351
serial->type->description);
376
352
num_ports = 2;
377
353
}
378
354
355
+
for (i = 0; i < num_ports; ++i) {
356
+
switch (connection_info->connections[i].port_function_id) {
357
+
case VISOR_FUNCTION_GENERIC:
358
+
string = "Generic";
359
+
break;
360
+
case VISOR_FUNCTION_DEBUGGER:
361
+
string = "Debugger";
362
+
break;
363
+
case VISOR_FUNCTION_HOTSYNC:
364
+
string = "HotSync";
365
+
break;
366
+
case VISOR_FUNCTION_CONSOLE:
367
+
string = "Console";
368
+
break;
369
+
case VISOR_FUNCTION_REMOTE_FILE_SYS:
370
+
string = "Remote File System";
371
+
break;
372
+
default:
373
+
string = "unknown";
374
+
break;
375
+
}
376
+
dev_info(dev, "%s: port %d, is for %s use\n",
377
+
serial->type->description,
378
+
connection_info->connections[i].port, string);
379
+
}
379
380
dev_info(dev, "%s: Number of ports: %d\n", serial->type->description,
380
381
num_ports);
381
382
+1
drivers/usb/typec/tcpm.c
+1
drivers/usb/typec/tcpm.c
···
3725
3725
for (i = 0; i < ARRAY_SIZE(port->port_altmode); i++)
3726
3726
typec_unregister_altmode(port->port_altmode[i]);
3727
3727
typec_unregister_port(port->typec_port);
3728
+
usb_role_switch_put(port->role_sw);
3728
3729
tcpm_debugfs_exit(port);
3729
3730
destroy_workqueue(port->wq);
3730
3731
}
+39
-8
drivers/usb/typec/tps6598x.c
+39
-8
drivers/usb/typec/tps6598x.c
···
73
73
struct device *dev;
74
74
struct regmap *regmap;
75
75
struct mutex lock; /* device lock */
76
+
u8 i2c_protocol:1;
76
77
77
78
struct typec_port *port;
78
79
struct typec_partner *partner;
···
81
80
struct typec_capability typec_cap;
82
81
};
83
82
83
+
static int
84
+
tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len)
85
+
{
86
+
u8 data[len + 1];
87
+
int ret;
88
+
89
+
if (!tps->i2c_protocol)
90
+
return regmap_raw_read(tps->regmap, reg, val, len);
91
+
92
+
ret = regmap_raw_read(tps->regmap, reg, data, sizeof(data));
93
+
if (ret)
94
+
return ret;
95
+
96
+
if (data[0] < len)
97
+
return -EIO;
98
+
99
+
memcpy(val, &data[1], len);
100
+
return 0;
101
+
}
102
+
84
103
static inline int tps6598x_read16(struct tps6598x *tps, u8 reg, u16 *val)
85
104
{
86
-
return regmap_raw_read(tps->regmap, reg, val, sizeof(u16));
105
+
return tps6598x_block_read(tps, reg, val, sizeof(u16));
87
106
}
88
107
89
108
static inline int tps6598x_read32(struct tps6598x *tps, u8 reg, u32 *val)
90
109
{
91
-
return regmap_raw_read(tps->regmap, reg, val, sizeof(u32));
110
+
return tps6598x_block_read(tps, reg, val, sizeof(u32));
92
111
}
93
112
94
113
static inline int tps6598x_read64(struct tps6598x *tps, u8 reg, u64 *val)
95
114
{
96
-
return regmap_raw_read(tps->regmap, reg, val, sizeof(u64));
115
+
return tps6598x_block_read(tps, reg, val, sizeof(u64));
97
116
}
98
117
99
118
static inline int tps6598x_write16(struct tps6598x *tps, u8 reg, u16 val)
···
142
121
struct tps6598x_rx_identity_reg id;
143
122
int ret;
144
123
145
-
ret = regmap_raw_read(tps->regmap, TPS_REG_RX_IDENTITY_SOP,
146
-
&id, sizeof(id));
124
+
ret = tps6598x_block_read(tps, TPS_REG_RX_IDENTITY_SOP,
125
+
&id, sizeof(id));
147
126
if (ret)
148
127
return ret;
149
128
···
245
224
} while (val);
246
225
247
226
if (out_len) {
248
-
ret = regmap_raw_read(tps->regmap, TPS_REG_DATA1,
249
-
out_data, out_len);
227
+
ret = tps6598x_block_read(tps, TPS_REG_DATA1,
228
+
out_data, out_len);
250
229
if (ret)
251
230
return ret;
252
231
val = out_data[0];
253
232
} else {
254
-
ret = regmap_read(tps->regmap, TPS_REG_DATA1, &val);
233
+
ret = tps6598x_block_read(tps, TPS_REG_DATA1, &val, sizeof(u8));
255
234
if (ret)
256
235
return ret;
257
236
}
···
405
384
return ret;
406
385
if (!vid)
407
386
return -ENODEV;
387
+
388
+
/*
389
+
* Checking can the adapter handle SMBus protocol. If it can not, the
390
+
* driver needs to take care of block reads separately.
391
+
*
392
+
* FIXME: Testing with I2C_FUNC_I2C. regmap-i2c uses I2C protocol
393
+
* unconditionally if the adapter has I2C_FUNC_I2C set.
394
+
*/
395
+
if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C))
396
+
tps->i2c_protocol = true;
408
397
409
398
ret = tps6598x_read32(tps, TPS_REG_STATUS, &status);
410
399
if (ret < 0)
+1
-1
include/linux/usb/composite.h
+1
-1
include/linux/usb/composite.h
···
52
52
#define USB_GADGET_DELAYED_STATUS 0x7fff /* Impossibly large value */
53
53
54
54
/* big enough to hold our biggest descriptor */
55
-
#define USB_COMP_EP0_BUFSIZ 1024
55
+
#define USB_COMP_EP0_BUFSIZ 4096
56
56
57
57
/* OS feature descriptor length <= 4kB */
58
58
#define USB_COMP_EP0_OS_DESC_BUFSIZ 4096