Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'usb-4.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are some small USB fixes for 4.11-rc5.
The usual xhci fixes are here, as well as a fix for yet-another-bug-
found-by-KASAN, those developers are doing great stuff here.
And there's a phy build warning fix that showed up in 4.11-rc1.
All of these have been in linux-next with no reported issues"
* tag 'usb-4.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
usb: phy: isp1301: Fix build warning when CONFIG_OF is disabled
xhci: Manually give back cancelled URB if we can't queue it for cancel
xhci: Set URB actual length for stopped control transfers
xhci: plat: Register shutdown for xhci_plat
USB: fix linked-list corruption in rh_call_control()
+35
-21
+5
-2
drivers/usb/core/hcd.c
+5
-2
drivers/usb/core/hcd.c
···
520
520
*/
521
521
tbuf_size = max_t(u16, sizeof(struct usb_hub_descriptor), wLength);
522
522
tbuf = kzalloc(tbuf_size, GFP_KERNEL);
523
-
if (!tbuf)
524
-
return -ENOMEM;
523
+
if (!tbuf) {
524
+
status = -ENOMEM;
525
+
goto err_alloc;
526
+
}
525
527
526
528
bufp = tbuf;
527
529
···
736
734
}
737
735
738
736
kfree(tbuf);
737
+
err_alloc:
739
738
740
739
/* any errors get returned through the urb completion */
741
740
spin_lock_irq(&hcd_root_hub_lock);
+1
drivers/usb/host/xhci-plat.c
+1
drivers/usb/host/xhci-plat.c
+3
drivers/usb/host/xhci-ring.c
+3
drivers/usb/host/xhci-ring.c
···
1989
1989
case TRB_NORMAL:
1990
1990
td->urb->actual_length = requested - remaining;
1991
1991
goto finish_td;
1992
+
case TRB_STATUS:
1993
+
td->urb->actual_length = requested;
1994
+
goto finish_td;
1992
1995
default:
1993
1996
xhci_warn(xhci, "WARN: unexpected TRB Type %d\n",
1994
1997
trb_type);
+25
-18
drivers/usb/host/xhci.c
+25
-18
drivers/usb/host/xhci.c
···
1477
1477
struct xhci_ring *ep_ring;
1478
1478
struct xhci_virt_ep *ep;
1479
1479
struct xhci_command *command;
1480
+
struct xhci_virt_device *vdev;
1480
1481
1481
1482
xhci = hcd_to_xhci(hcd);
1482
1483
spin_lock_irqsave(&xhci->lock, flags);
···
1486
1485
1487
1486
/* Make sure the URB hasn't completed or been unlinked already */
1488
1487
ret = usb_hcd_check_unlink_urb(hcd, urb, status);
1489
-
if (ret || !urb->hcpriv)
1488
+
if (ret)
1490
1489
goto done;
1490
+
1491
+
/* give back URB now if we can't queue it for cancel */
1492
+
vdev = xhci->devs[urb->dev->slot_id];
1493
+
urb_priv = urb->hcpriv;
1494
+
if (!vdev || !urb_priv)
1495
+
goto err_giveback;
1496
+
1497
+
ep_index = xhci_get_endpoint_index(&urb->ep->desc);
1498
+
ep = &vdev->eps[ep_index];
1499
+
ep_ring = xhci_urb_to_transfer_ring(xhci, urb);
1500
+
if (!ep || !ep_ring)
1501
+
goto err_giveback;
1502
+
1491
1503
temp = readl(&xhci->op_regs->status);
1492
1504
if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_HALTED)) {
1493
1505
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
1494
1506
"HW died, freeing TD.");
1495
-
urb_priv = urb->hcpriv;
1496
1507
for (i = urb_priv->num_tds_done;
1497
-
i < urb_priv->num_tds && xhci->devs[urb->dev->slot_id];
1508
+
i < urb_priv->num_tds;
1498
1509
i++) {
1499
1510
td = &urb_priv->td[i];
1500
1511
if (!list_empty(&td->td_list))
···
1514
1501
if (!list_empty(&td->cancelled_td_list))
1515
1502
list_del_init(&td->cancelled_td_list);
1516
1503
}
1517
-
1518
-
usb_hcd_unlink_urb_from_ep(hcd, urb);
1519
-
spin_unlock_irqrestore(&xhci->lock, flags);
1520
-
usb_hcd_giveback_urb(hcd, urb, -ESHUTDOWN);
1521
-
xhci_urb_free_priv(urb_priv);
1522
-
return ret;
1504
+
goto err_giveback;
1523
1505
}
1524
1506
1525
-
ep_index = xhci_get_endpoint_index(&urb->ep->desc);
1526
-
ep = &xhci->devs[urb->dev->slot_id]->eps[ep_index];
1527
-
ep_ring = xhci_urb_to_transfer_ring(xhci, urb);
1528
-
if (!ep_ring) {
1529
-
ret = -EINVAL;
1530
-
goto done;
1531
-
}
1532
-
1533
-
urb_priv = urb->hcpriv;
1534
1507
i = urb_priv->num_tds_done;
1535
1508
if (i < urb_priv->num_tds)
1536
1509
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
···
1552
1553
}
1553
1554
done:
1554
1555
spin_unlock_irqrestore(&xhci->lock, flags);
1556
+
return ret;
1557
+
1558
+
err_giveback:
1559
+
if (urb_priv)
1560
+
xhci_urb_free_priv(urb_priv);
1561
+
usb_hcd_unlink_urb_from_ep(hcd, urb);
1562
+
spin_unlock_irqrestore(&xhci->lock, flags);
1563
+
usb_hcd_giveback_urb(hcd, urb, -ESHUTDOWN);
1555
1564
return ret;
1556
1565
}
1557
1566
+1
-1
drivers/usb/phy/phy-isp1301.c
+1
-1
drivers/usb/phy/phy-isp1301.c