Commit Graph

15848 Commits

Author SHA1 Message Date
Robert Dobrowolski
e86103a757 usb: hcd: out of bounds access in for_each_companion
On BXT platform Host Controller and Device Controller figure as
same PCI device but with different device function. HCD should
not pass data to Device Controller but only to Host Controllers.
Checking if companion device is Host Controller, otherwise skip.

Cc: <stable@vger.kernel.org>
Signed-off-by: Robert Dobrowolski <robert.dobrowolski@linux.intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 12:06:18 -07:00
Hans de Goede
1363074667 USB: uas: Add a new NO_REPORT_LUNS quirk
Add a new NO_REPORT_LUNS quirk and set it for Seagate drives with
an usb-id of: 0bc2:331a, as these will fail to respond to a
REPORT_LUNS command.

Cc: stable@vger.kernel.org
Reported-and-tested-by: David Webb <djw@noc.ac.uk>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 12:02:28 -07:00
Hans de Goede
198de51dbc USB: uas: Limit qdepth at the scsi-host level
Commit 64d513ac31 ("scsi: use host wide tags by default") causes
the SCSI core to queue more commands then we can handle on devices with
multiple LUNs, limit the queue depth at the scsi-host level instead of
per slave to fix this.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1315013
Cc: stable@vger.kernel.org # 4.4.x and 4.5.x
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 12:02:28 -07:00
Peter Griffin
f9a85f6e61 usb: host: xhci-plat: Make enum xhci_plat_type start at a non zero value
Otherwise generic-xhci and xhci-platform which have no data get wrongly
detected as XHCI_PLAT_TYPE_MARVELL_ARMADA by xhci_plat_type_is().

This fixes a regression in v4.5 for STiH407 family SoC's which use the
synopsis dwc3 IP, whereby the disable_clk error path gets taken due to
wrongly being detected as XHCI_PLAT_TYPE_MARVELL_ARMADA and the hcd never
gets added.

I suspect this will also fix other dwc3 DT platforms such as Exynos,
although I've only tested on STih410 SoC.

Fixes: 4efb2f6941 ("usb: host: xhci-plat: add struct xhci_plat_priv")
Cc: stable@vger.kernel.org
Cc: gregory.clement@free-electrons.com
Cc: yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 11:58:02 -07:00
Mathias Nyman
98d74f9cea xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers
PCI hotpluggable xhci controllers such as some Alpine Ridge solutions will
remove the xhci controller from the PCI bus when the last USB device is
disconnected.

Add a flag to indicate that the host is being removed to avoid queueing
configure_endpoint commands for the dropped endpoints.
For PCI hotplugged controllers this will prevent 5 second command timeouts
For static xhci controllers the configure_endpoint command is not needed
in the removal case as everything will be returned, freed, and the
controller is reset.

For now the flag is only set for PCI connected host controllers.

Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 11:55:56 -07:00
Lu Baolu
71504062a7 usb: xhci: fix wild pointers in xhci_mem_cleanup
This patch fixes some wild pointers produced by xhci_mem_cleanup.
These wild pointers will cause system crash if xhci_mem_cleanup()
is called twice.

Reported-and-tested-by: Pengcheng Li <lpc.li@hisilicon.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 11:55:56 -07:00
Yoshihiro Shimoda
5ad3b03e49 usb: host: xhci-plat: fix cannot work if R-Car Gen2/3 run on above 4GB phys
This patch fixes an issue that cannot work if R-Car Gen2/3 run on
above 4GB physical memory environment to use a quirk XHCI_NO_64BIT_SUPPORT.

Cc: <stable@vger.kernel.org>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 11:55:56 -07:00
Yoshihiro Shimoda
0a380be823 usb: host: xhci: add a new quirk XHCI_NO_64BIT_SUPPORT
On some xHCI controllers (e.g. R-Car SoCs), the AC64 bit (bit 0) of
HCCPARAMS1 is set to 1. However, the xHCs don't support 64-bit
address memory pointers actually. So, in this case, this driver should
call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in xhci_gen_setup().
Otherwise, the xHCI controller will be died after a usb device is
connected if it runs on above 4GB physical memory environment.

So, this patch adds a new quirk XHCI_NO_64BIT_SUPPORT to resolve
such an issue.

Cc: <stable@vger.kernel.org>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 11:55:56 -07:00
Mathias Nyman
671ffdff5b xhci: resume USB 3 roothub first
Give USB3 devices a better chance to enumerate at USB 3 speeds if
they are connected to a suspended host.
Solves an issue with NEC uPD720200 host hanging when partially
enumerating a USB3 device as USB2 after host controller runtime resume.

Cc: <stable@vger.kernel.org>
Tested-by: Mike Murdoch <main.haarp@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 11:55:56 -07:00
Rafal Redzimski
0d46faca6f usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host
Broxton B0 also requires XHCI_PME_STUCK_QUIRK.
Adding PCI device ID for Broxton B and adding to quirk.

Cc: <stable@vger.kernel.org>
Signed-off-by: Rafal Redzimski <rafal.f.redzimski@intel.com>
Signed-off-by: Robert Dobrowolski <robert.dobrowolski@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 11:55:56 -07:00
Oliver Neukum
2a14759a03 cdc-acm: fix crash if flushed with nothing buffered
Under some circumstances acm_tty_flush_chars() is called
with no buffer to flush. We simply need to do nothing.

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
Reported-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-13 11:53:07 -07:00
Linus Torvalds
ffb927d1dc USB fixes for 4.6-rc3
Here are some USB fixes and new device ids for 4.6-rc3.
 
 Nothing major, the normal USB gadget fixes and usb-serial driver ids,
 along with some other fixes mixed in.  All except the USB serial ids
 have been tested in linux-next, the id additions should be fine as they
 are "trivial".
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlcJLLUACgkQMUfUDdst+ym3wgCeNSzb74ZskDbGsXUooE0XhYRc
 iPoAnRpn/ahoBTzmkKiQXQ1+Br8pAUtN
 =vyU/
 -----END PGP SIGNATURE-----

Merge tag 'usb-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some USB fixes and new device ids for 4.6-rc3.

  Nothing major, the normal USB gadget fixes and usb-serial driver ids,
  along with some other fixes mixed in.  All except the USB serial ids
  have been tested in linux-next, the id additions should be fine as
  they are 'trivial'"

* tag 'usb-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
  USB: option: add "D-Link DWM-221 B1" device id
  USB: serial: cp210x: Adding GE Healthcare Device ID
  USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices
  usb: dwc3: keystone: drop dma_mask configuration
  usb: gadget: udc-core: remove manual dma configuration
  usb: dwc3: pci: add ID for one more Intel Broxton platform
  usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done()
  usb: dwc2: do not override forced dr_mode in gadget setup
  usb: gadget: f_midi: unlock on error
  USB: digi_acceleport: do sanity checking for the number of ports
  USB: cypress_m8: add endpoint sanity check
  USB: mct_u232: add sanity checking in probe
  usb: fix regression in SuperSpeed endpoint descriptor parsing
  USB: usbip: fix potential out-of-bounds write
  usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
  usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
  usb: gadget: f_midi: Fixed a bug when buflen was smaller than wMaxPacketSize
  usb: phy: qcom-8x16: fix regulator API abuse
  usb: ch9: Fix SSP Device Cap wFunctionalitySupport type
  usb: gadget: composite: Access SSP Dev Cap fields properly
  ...
2016-04-09 12:23:02 -07:00
Greg Kroah-Hartman
636c8a8d85 USB-serial fixes for v4.6-rc3
Here are some new device ids.
 
 Signed-off-by: Johan Hovold <johan@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJXB7dGAAoJEEEN5E/e4bSVmqsQALLjUGRr+eM/JE8XbeyATSE7
 5sYuxgX+9Yzp3+ePCmbxZvmKd/7ZRyrloCsE9e292AT1fx4XynArnJeX0Ad4SSuj
 bNpN9gB2culcZuUQ8T7BOieBwlj+gzYLmsaCrnl7Pf7XwrMcsHhY3fuyWs+YaC6W
 b6hJ9KgWm5CzRKGrBJjV43tOb2LZKemQmFuccu33igsGmdTKuGrPPewrPHriVsgr
 +yUWDdCNs0t00436I8Z18YSRGiKFi1RxmOPleWRL8FVsr9GoZNUV2xlc1cKblqSd
 msgfAgmj5FB/0aUog648K1IV+hdqvpSP4SXD3sytKfFCL4qFCVzy0hzMt9dJMl5A
 WQBZUhN1j2AJ7qMtAyQDjR4Y/QbX+rBIKjBgRgbdB5dLonoQ+lw++zacz4Al9FK2
 vKwCuBl5nr/ReXd7zqZ3YBnlo6Kdu17Ba4HkNurk/zqG8tOZFWyDrqPw/KmrOwQW
 1UPIjjWGR7o4zDJa5H+XIQCTPsGoeQJuncJG3akGAwRzVe0+jmaCWnkwnJRgtXZl
 kwpa41VaP6nXUIty+/xRFvOU/wMo0pVSda+ok/2TWUfifKomkxcju397bIe2MT82
 31aMNmbZyf+Zz/K5Hy+Sg+5Gat+82yDn7og57T+K3i+8m4/eVTFdHSCGf3B5iJxd
 6ALqRa//5lfGa8mkHutv
 =vUqa
 -----END PGP SIGNATURE-----

Merge tag 'usb-serial-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

Johan writes:

USB-serial fixes for v4.6-rc3

Here are some new device ids.

Signed-off-by: Johan Hovold <johan@kernel.org>
2016-04-08 15:41:58 -07:00
Greg Kroah-Hartman
39ec5cbed0 usb: fixes for v4.6-rc3
We have two more fixes to f_midi. It should now
 behave much better.
 
 dwc3-keystone.c has gotten a fix which now allows it
 to work on keystone device when running in
 peripheral mode. A similar fix for DMA configuration
 was made for udc-core, too.
 
 We have a new PCI ID for Intel's Broxton
 platform. DWC3 can run on those platforms as well.
 
 And we also have some dwc2 got a fix for dr_mode
 usage, while renesas controller got 3 important
 fixes: a NULL pointer deref fix, IRQ <-> DMA race
 fix, and a fix to prevent a situation where we would
 queue a request to a disabled endpoint.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJXBjgnAAoJEIaOsuA1yqREXl0P/iP7ZyyVj5QEflgcOCWVN5lt
 JHB9Ek0Ykmt4l/fd+ixcYMOdEGeLWBZPBEy8Jz25ZYnYDGBy0BosbeN/Au4eQjr7
 BrDh1AzIgCuqvP0XWzh+BZCUgFCf3ltPBat/sCXcc74hPCkWs0OcOfEEOOC9Kkjr
 qA4Nm/JKjmcQszchvmYkPIPn5V3hMyA33Wm4JBXDBHJerMIGBORBoqw2/+s29xRT
 cKlyFuX9Ce+4NqOAV0MAvXr1Jk0KyJhFOK/TdNfKAsg9QodUk/xwU23v1MGScgQc
 oeBUEAzpqnA/pebE8vm0jRrlxZ1HqBYo3C5qJAgMmBumFMw1YmtFwZiiEq2qE3me
 +W2hsI3rmIH5o/3fzQEOclV8HOFp3hUm4jZtSnD7CJcjP4eahGqQ8QzOLY2kq+NS
 ykmDIXqTqG7mKFquuuwBn0kj49AfGUTmB2dinHUcxEb2KKfyNO2fU8MH6GAU8dlm
 f8TCINbnXvUQkQMGBTGY+pY5GhtWb66CxCLzyGzt70bmLNtNFgzmkzrFl7xY9DSZ
 sWn8o2AvzlyoCbm8WIJQ0LwUonRK32qZZgBgubPwTD8IVgn4NEKqSObA8DUCagdO
 XrzUzYF4fnrTT+wGMA0ECFEZEuX4doG/6P9BgS+TQT2sPwOls8t733O5DgBTPP1f
 bXp5L1goyUA3wt3WJ4xt
 =QLLF
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-v4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

Felipe writes:

usb: fixes for v4.6-rc3

We have two more fixes to f_midi. It should now
behave much better.

dwc3-keystone.c has gotten a fix which now allows it
to work on keystone device when running in
peripheral mode. A similar fix for DMA configuration
was made for udc-core, too.

We have a new PCI ID for Intel's Broxton
platform. DWC3 can run on those platforms as well.

And we also have some dwc2 got a fix for dr_mode
usage, while renesas controller got 3 important
fixes: a NULL pointer deref fix, IRQ <-> DMA race
fix, and a fix to prevent a situation where we would
queue a request to a disabled endpoint.
2016-04-07 08:31:43 -07:00
Bjørn Mork
d48d5691eb USB: option: add "D-Link DWM-221 B1" device id
Thomas reports:
"Windows:

00 diagnostics
01 modem
02 at-port
03 nmea
04 nic

Linux:

T:  Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2001 ProdID=7e19 Rev=02.32
S:  Manufacturer=Mobile Connect
S:  Product=Mobile Connect
S:  SerialNumber=0123456789ABCDEF
C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage"

Reported-by: Thomas Schäfer <tschaefer@t-online.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Johan Hovold <johan@kernel.org>
2016-04-07 12:12:09 +02:00
Martyn Welch
cddc9434e3 USB: serial: cp210x: Adding GE Healthcare Device ID
The CP2105 is used in the GE Healthcare Remote Alarm Box, with the
Manufacturer ID of 0x1901 and Product ID of 0x0194.

Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
2016-04-07 11:41:01 +02:00
Josh Boyer
ea6db90e75 USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices
A Fedora user reports that the ftdi_sio driver works properly for the
ICP DAS I-7561U device.  Further, the user manual for these devices
instructs users to load the driver and add the ids using the sysfs
interface.

Add support for these in the driver directly so that the devices work
out of the box instead of needing manual configuration.

Reported-by: <thesource@mail.ru>
CC: stable <stable@vger.kernel.org>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
2016-04-07 11:12:55 +02:00
Grygorii Strashko
adf9a3ab90 usb: dwc3: keystone: drop dma_mask configuration
The Keystone 2 supports DT-boot only, as result dma_mask will be
always configured properly from DT -
of_platform_device_create_pdata()->of_dma_configure(). More over,
dwc3-keystone.c can be built as module and in this case it's unsafe to
assign local variable as dma_mask.

Hence, remove dma_mask configuration code.

Cc: Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-04-06 16:36:01 +03:00
Grygorii Strashko
79171e9b90 usb: gadget: udc-core: remove manual dma configuration
Since commit 7ace8fc821 ("usb: gadget: udc: core: Fix argument of
dma_map_single for IOMMU") it is not necessary to configure DMA for
usb_gadget device manually, because all DMA operation are performed
using parent/controller device.

Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-04-06 16:36:01 +03:00
Heikki Krogerus
1ffb4d5cc7 usb: dwc3: pci: add ID for one more Intel Broxton platform
BXT-M is a Intel Broxton SoC based platform with unique PCI ID.

Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-04-06 16:28:08 +03:00
Kirill A. Shutemov
09cbfeaf1a mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros
PAGE_CACHE_{SIZE,SHIFT,MASK,ALIGN} macros were introduced *long* time
ago with promise that one day it will be possible to implement page
cache with bigger chunks than PAGE_SIZE.

This promise never materialized.  And unlikely will.

We have many places where PAGE_CACHE_SIZE assumed to be equal to
PAGE_SIZE.  And it's constant source of confusion on whether
PAGE_CACHE_* or PAGE_* constant should be used in a particular case,
especially on the border between fs and mm.

Global switching to PAGE_CACHE_SIZE != PAGE_SIZE would cause to much
breakage to be doable.

Let's stop pretending that pages in page cache are special.  They are
not.

The changes are pretty straight-forward:

 - <foo> << (PAGE_CACHE_SHIFT - PAGE_SHIFT) -> <foo>;

 - <foo> >> (PAGE_CACHE_SHIFT - PAGE_SHIFT) -> <foo>;

 - PAGE_CACHE_{SIZE,SHIFT,MASK,ALIGN} -> PAGE_{SIZE,SHIFT,MASK,ALIGN};

 - page_cache_get() -> get_page();

 - page_cache_release() -> put_page();

This patch contains automated changes generated with coccinelle using
script below.  For some reason, coccinelle doesn't patch header files.
I've called spatch for them manually.

The only adjustment after coccinelle is revert of changes to
PAGE_CAHCE_ALIGN definition: we are going to drop it later.

There are few places in the code where coccinelle didn't reach.  I'll
fix them manually in a separate patch.  Comments and documentation also
will be addressed with the separate patch.

virtual patch

@@
expression E;
@@
- E << (PAGE_CACHE_SHIFT - PAGE_SHIFT)
+ E

@@
expression E;
@@
- E >> (PAGE_CACHE_SHIFT - PAGE_SHIFT)
+ E

@@
@@
- PAGE_CACHE_SHIFT
+ PAGE_SHIFT

@@
@@
- PAGE_CACHE_SIZE
+ PAGE_SIZE

@@
@@
- PAGE_CACHE_MASK
+ PAGE_MASK

@@
expression E;
@@
- PAGE_CACHE_ALIGN(E)
+ PAGE_ALIGN(E)

@@
expression E;
@@
- page_cache_get(E)
+ get_page(E)

@@
expression E;
@@
- page_cache_release(E)
+ put_page(E)

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-04-04 10:41:08 -07:00
Yoshihiro Shimoda
4fccb0767f usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done()
This patch fixes an issue that usbhsg_queue_done() may cause kernel
panic when dma callback is running and usb_ep_disable() is called
by interrupt handler. (Especially, we can reproduce this issue using
g_audio with usb-dmac driver.)

For example of a flow:
 usbhsf_dma_complete (on tasklet)
  --> usbhsf_pkt_handler (on tasklet)
   --> usbhsg_queue_done (on tasklet)
    *** interrupt happened and usb_ep_disable() is called ***
    --> usbhsg_queue_pop (on tasklet)
     Then, oops happened.

Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-04-04 15:18:48 +03:00
Przemek Rudy
ecd9a7ad45 usb: dwc2: do not override forced dr_mode in gadget setup
The host/device mode set with dr_mode should be kept all the time,
not being changed to OTG in gadget setup (by overriding CFGUSB_FORCEDEVMODE
and CFGUSB_FORCEHOSTMODE bits).

Acked-by: John Youn <johnyoun@synopsys.com>
Tested-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Przemek Rudy <prudy1@o2.pl>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-04-04 15:18:48 +03:00
Dan Carpenter
4fc50ba596 usb: gadget: f_midi: unlock on error
We added some new locking here, but missed an error path where we need
to unlock.

Fixes: 9acdf4df2f ('usb: gadget: f_midi: added spinlock on transmit function')
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Acked-by: Felipe F. Tonello <eu@felipetonello.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-04-04 15:18:37 +03:00
Oliver Neukum
5a07975ad0 USB: digi_acceleport: do sanity checking for the number of ports
The driver can be crashed with devices that expose crafted descriptors
with too few endpoints.

See: http://seclists.org/bugtraq/2016/Mar/61

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
[johan: fix OOB endpoint check and add error messages ]
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-31 09:28:46 -07:00
Oliver Neukum
c55aee1bf0 USB: cypress_m8: add endpoint sanity check
An attack using missing endpoints exists.

CVE-2016-3137

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-31 09:28:46 -07:00
Oliver Neukum
4e9a0b0525 USB: mct_u232: add sanity checking in probe
An attack using the lack of sanity checking in probe is known. This
patch checks for the existence of a second port.

CVE-2016-3136

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
[johan: add error message ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-31 09:28:46 -07:00
Mathias Nyman
59b9023c35 usb: fix regression in SuperSpeed endpoint descriptor parsing
commit b37d83a6a4 ("usb: Parse the new USB 3.1 SuperSpeedPlus Isoc
endpoint companion descriptor") caused a regression in 4.6-rc1 and fails
to parse SuperSpeed endpoint companion descriptors.

The new SuperSpeedPlus Isoc endpoint companion parsing code incorrectly
decreased the the remaining buffer size before comparing the size with the
expected length of the descriptor.

This lead to possible failure in reading the SuperSpeed endpoint companion
descriptor of the last endpoint, displaying a message like:

"No SuperSpeed endpoint companion for config 1 interface 0 altsetting 0
 ep 129: using minimum values"

Fix it by decreasing the size after comparing it.
Also finish all the SS endpoint companion parsing before calling SSP isoc
endpoint parsing function.

Fixes: b37d83a6a4
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-30 21:57:58 -07:00
Ignat Korchagin
b348d7dddb USB: usbip: fix potential out-of-bounds write
Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.

Signed-off-by: Ignat Korchagin <ignat.korchagin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-30 21:55:36 -07:00
Yoshihiro Shimoda
6490865c67 usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
This patch adds a code to surely disable TX IRQ of the pipe before
starting TX DMAC transfer. Otherwise, a lot of unnecessary TX IRQs
may happen in rare cases when DMAC is used.

Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-03-30 16:02:53 +03:00
Yoshihiro Shimoda
894f2fc44f usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
When unexpected situation happened (e.g. tx/rx irq happened while
DMAC is used), the usbhsf_pkt_handler() was possible to cause NULL
pointer dereference like the followings:

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 80000007 [#1] SMP ARM
Modules linked in: usb_f_acm u_serial g_serial libcomposite
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.5.0-rc6-00842-gac57066-dirty #63
Hardware name: Generic R8A7790 (Flattened Device Tree)
task: c0729c00 ti: c0724000 task.ti: c0724000
PC is at 0x0
LR is at usbhsf_pkt_handler+0xac/0x118
pc : [<00000000>]    lr : [<c03257e0>]    psr: 60000193
sp : c0725db8  ip : 00000000  fp : c0725df4
r10: 00000001  r9 : 00000193  r8 : ef3ccab4
r7 : ef3cca10  r6 : eea4586c  r5 : 00000000  r4 : ef19ceb4
r3 : 00000000  r2 : 0000009c  r1 : c0725dc4  r0 : ef19ceb4

This patch adds a condition to avoid the dereference.

Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-03-30 16:02:37 +03:00
Felipe F. Tonello
03d27ade49 usb: gadget: f_midi: Fixed a bug when buflen was smaller than wMaxPacketSize
buflen by default (256) is smaller than wMaxPacketSize (512) in high-speed
devices.

That caused the OUT endpoint to freeze if the host send any data packet of
length greater than 256 bytes.

This is an example dump of what happended on that enpoint:
HOST:   [DATA][Length=260][...]
DEVICE: [NAK]
HOST:   [PING]
DEVICE: [NAK]
HOST:   [PING]
DEVICE: [NAK]
...
HOST:   [PING]
DEVICE: [NAK]

This patch fixes this problem by setting the minimum usb_request's buffer size
for the OUT endpoint as its wMaxPacketSize.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe F. Tonello <eu@felipetonello.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-03-30 13:49:56 +03:00
Arnd Bergmann
7e8ac87a44 usb: phy: qcom-8x16: fix regulator API abuse
gcc warns about the use of regulators in phy_8x16_probe:

    drivers/usb/phy/phy-qcom-8x16-usb.c: In function 'phy_8x16_probe':
    drivers/usb/phy/phy-qcom-8x16-usb.c:284:13: error: 'regs[0].consumer' may be used uninitialized in this function [-Werror=maybe-uninitialized]
    drivers/usb/phy/phy-qcom-8x16-usb.c:285:13: error: 'regs[1].consumer' may be used uninitialized in this function [-Werror=maybe-uninitialized]
    drivers/usb/phy/phy-qcom-8x16-usb.c:286:12: error: 'regs[2].consumer' may be used uninitialized in this function [-Werror=maybe-uninitialized]

According to Mark Brown, this is the result of various abuses
of the PHY interfaces [1], so let's fix the driver instead.

This puts the regulator bulk data into the device structure so it
gets properly initialized and lets us call regulator_bulk_enable()
and regulator_bulk_disable() rather than open-coding them.

Setting the voltages the way the driver does is rather pointless
because for each regulator there is only one valid voltage
range, so that can just get set up in the DT. As there doesn't
seem to be any user of the newly added driver yet, we can simply
make sure the DTs are setting this up right when they get added.

I'm also fixing the handling of regulator_bulk_enable() failure.
Right now, the driver just ignores any failure, which doesn't make
sense, so I'm changing it to loudly complain (in case we actually
had a bug here) and error out.

Doing a fly-by review of the driver, I notice a couple of other
problems that I'm not addressing here:

- It really should not have been written as a USB PHY driver, but
  instead should use the PHY subsystem.

- The DT compatible string does not follow the usual conventions,
  and it should have a proper identifier in it rather than a wildcard.

- The example in the devicetree binding lists a register address
  that is the same as the actual EHCI host controller in the SoC
  as well as the otg-snps and the ci-hdrc device, which indicates
  that these are probably not even distinct devices (or all but
  one of them are wrong), and if more than one of them tries to
  request the resources correctly, they fail.

[1] https://lkml.org/lkml/2016/1/26/267

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-03-30 13:34:04 +03:00
John Youn
08f8cabf71 usb: gadget: composite: Access SSP Dev Cap fields properly
Access multi-byte fields of the SSP Dev Cap descriptor using the correct
endianness.

Fixes: f228a8de24 ("usb: gadget: composite: Return SSP Dev Cap descriptor")
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-03-29 13:25:57 +03:00
Felipe Balbi
38e58986e6 usb: gadget: udc: atmel: don't disable enpdoints we don't own
UDC driver should NEVER do anything behind
udc-core's back, so let's stop disabling endpoints
we don't exactly own - rather we provide as
resources for gadget drivers. This fixes the
regression reported by Gil.

Reported-by: Gil Weber <gil.weber@servelec-technologies.com>
Tested-by: Gil Weber <gil.weber@servelec-technologies.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-03-29 09:30:31 +03:00
Felipe Balbi
e901aa159d usb: dwc3: gadget: fix endpoint renaming
We were exitting the function before actually
renaming anything. While at that, also always leave
control endpoint un-renamed.

Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-03-29 09:30:31 +03:00
Jiebing Li
ad14d4e030 usb: dwc3: gadget: release spin lock during gadget resume
It's a requirement that we release controller's lock
while calling gadget API function pointers. This
patch just fixes that long standing bug.

Signed-off-by: Jiebing Li <jiebing.li@intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-03-29 09:30:31 +03:00
Felipe Balbi
f59dcab176 usb: dwc3: core: improve reset sequence
According to Synopsys Databook, we shouldn't be
relying on GCTL.CORESOFTRESET bit as that's only for
debugging purposes. Instead, let's use DCTL.CSFTRST
if we're OTG or PERIPHERAL mode.

Host side block will be reset by XHCI driver if
necessary. Note that this reduces amount of time
spent on dwc3_probe() by a long margin.

We're still gonna wait for reset to finish for a
long time (default to 1ms max), but tests show that
the reset polling loop executed at most 19 times
(modprobe dwc3 && modprobe -r dwc3 executed 1000
times in a row).

Suggested-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-03-29 09:30:31 +03:00
Felipe F. Tonello
9acdf4df2f usb: gadget: f_midi: added spinlock on transmit function
Since f_midi_transmit is called by both ALSA and USB sub-systems, it can
potentially cause a race condition between both calls because f_midi_transmit
is not reentrant nor thread-safe. This is due to an implementation detail that
the transmit function looks for the next available usb request from the fifo
and only enqueues it if there is data to send, otherwise just re-uses it. So,
if both ALSA and USB frameworks calls this function at the same time,
kfifo_seek() will return the same usb_request, which will cause a race
condition.

To solve this problem a syncronization mechanism is necessary. In this case it
is used a spinlock since f_midi_transmit is also called by usb_request->complete
callback in interrupt context.

Cc: <stable@vger.kernel.org> # v4.5+
Fixes: e1e3d7ec5d ("usb: gadget: f_midi: pre-allocate IN requests")
Signed-off-by: Felipe F. Tonello <eu@felipetonello.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2016-03-29 09:30:31 +03:00
Linus Torvalds
33c1f638a0 The clk changes for this release cycle are mostly dominated by
new device support in terms of LoC, but there has been some cleanup
 in the core as well as the usual minor clk additions to various
 drivers.
 
 Core:
 
  - parent tracking has been simplified
 
  - CLK_IS_ROOT is now a no-op flag, cleaning up drivers has started
 
  - of_clk_init() doesn't consider disabled DT nodes anymore
 
  - clk_unregister() had an error path bug squashed
 
  - of_clk_get_parent_count() has been fixed to only return unsigned ints
 
  - HAVE_MACH_CLKDEV is removed now that the last arch user (ARM) is gone
 
 New Drivers:
 
  - NXP LPC18xx creg
 
  - QCOM IPQ4019 GCC
 
  - TI dm814x ADPLL
 
  - i.MX6QP
 
 Updates:
 
  - Cyngus audio clks found on Broadcom iProc devices
 
  - Non-critical fixes for BCM2385 PLLs
 
  - Samsung exynos5433 updates for clk id errors, HDMI support,
    suspend/resume simplifications
 
  - USB, CAN, LVDS, and FCP clks on shmobile devices
 
  - sunxi got support for more clks on new SoCs and went through a minor
    refactoring/rewrite to use a simpler factor clk construct
 
  - rockchip added some more clk ids and added suport for fraction dividers
 
  - QCOM GDSCs in msm8996
 
  - A new devm helper to make adding custom actions simpler (acked by Greg)
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABCAAGBQJW8fPZAAoJENidgRMleOc9sc0P/2b4k8FiFwjMXiiXI1rcEjiz
 ZjeVxzyAcwBiYoL8a2XONd+pihjLNcAbDbjk8SGUzmKDDz7elQbrhby/6o1dPlW/
 fQEQFa8Xa8zhZgidO1AFc1DmIcPg/u/Z58wHbjIcqDjvzKA63213Ud34NJsRtF6y
 +EJrIUZiTtj5q1pJgDmqlOv6ImmQtgW/AN51vNXCNNCyS9OsSgQm0DK5/f485HNc
 2y5NE5hpijso69HFet5chuT3DiDLz/0dxmgCm/w9CRRzkHxYl3lxV/v07B+rZBo5
 cWplFfvJqX7PvQtcP0sPPzZUfGT/vOeTboWprQwI4R3RObS18xLqlq6DEvOTmnqW
 Jh+9uNBq4+kwSz5GcYjpwvj7+W0FPgIaBVRHrEW9qeXkgDpYloPtnEt8C8GmO6Bt
 O0bgIzETq9mnRTA+VesIfjmTa4IYRDDUoDwGTw5CnW3jaZmtYJh8GhgZulMfPfyK
 vfWQkY2OesXFwct0rU8tFiswTPeTRgXqL3AsPYjTPAHx1kfBpvfOQTCzzT7eSBr7
 jykd9EXsXrYb/rpIxW7j6KjPpaWu+EouK06wc4TIBGrrWVTIV0ZvybzOBgf0FnpS
 UDx87OyQb8x9TDMrfKf6bmJyly8y1dXkutFYY4XKIGUydlXIf0kn7AnIXW6SR7mX
 fTEdLFMZ03ViCojtah5r
 =bZFY
 -----END PGP SIGNATURE-----

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk updates from Stephen Boyd:
 "The clk changes for this release cycle are mostly dominated by new
  device support in terms of LoC, but there has been some cleanup in the
  core as well as the usual minor clk additions to various drivers.

  Core:
   - parent tracking has been simplified
   - CLK_IS_ROOT is now a no-op flag, cleaning up drivers has started
   - of_clk_init() doesn't consider disabled DT nodes anymore
   - clk_unregister() had an error path bug squashed
   - of_clk_get_parent_count() has been fixed to only return unsigned ints
   - HAVE_MACH_CLKDEV is removed now that the last arch user (ARM) is gone

  New Drivers:
   - NXP LPC18xx creg
   - QCOM IPQ4019 GCC
   - TI dm814x ADPLL
   - i.MX6QP

  Updates:
   - Cyngus audio clks found on Broadcom iProc devices
   - Non-critical fixes for BCM2385 PLLs
   - Samsung exynos5433 updates for clk id errors, HDMI support,
     suspend/resume simplifications
   - USB, CAN, LVDS, and FCP clks on shmobile devices
   - sunxi got support for more clks on new SoCs and went through a
     minor refactoring/rewrite to use a simpler factor clk construct
   - rockchip added some more clk ids and added suport for fraction
     dividers
   - QCOM GDSCs in msm8996
   - A new devm helper to make adding custom actions simpler (acked by Greg)"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (197 commits)
  clk: bcm2835: fix check of error code returned by devm_ioremap_resource()
  clk: renesas: div6: use RENESAS for #define
  clk: renesas: Rename header file renesas.h
  clk: max77{686,802}: Remove CLK_IS_ROOT
  clk: versatile: Remove CLK_IS_ROOT
  clk: sunxi: Remove use of variable length array
  clk: fixed-rate: Remove CLK_IS_ROOT
  clk: qcom: Remove CLK_IS_ROOT
  doc: dt: add documentation for lpc1850-creg-clk driver
  clk: add lpc18xx creg clk driver
  clk: lpc32xx: fix compilation warning
  clk: xgene: Add missing parenthesis when clearing divider value
  clk: mb86s7x: Remove CLK_IS_ROOT
  clk: x86: Remove clkdev.h and clk.h includes
  clk: x86: Remove CLK_IS_ROOT
  clk: mvebu: Remove CLK_IS_ROOT
  clk: renesas: move drivers to renesas directory
  clk: si5{14,351,70}: Remove CLK_IS_ROOT
  clk: scpi: Remove CLK_IS_ROOT
  clk: s2mps11: Remove CLK_IS_ROOT
  ...
2016-03-23 06:06:45 -07:00
Linus Torvalds
5266e5b12c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull SCSI target updates from Nicholas Bellinger:
 "The highlights this round include:

   - Add target_alloc_session() w/ callback helper for doing se_session
     allocation + tag + se_node_acl lookup.  (HCH + nab)

   - Tree-wide fabric driver conversion to use target_alloc_session()

   - Convert sbp-target to use percpu_ida tag pre-allocation, and
     TARGET_SCF_ACK_KREF I/O krefs (Chris Boot + nab)

   - Convert usb-gadget to use percpu_ida tag pre-allocation, and
     TARGET_SCF_ACK_KREF I/O krefs (Andrzej Pietrasiewicz + nab)

   - Convert xen-scsiback to use percpu_ida tag pre-allocation, and
     TARGET_SCF_ACK_KREF I/O krefs (Juergen Gross + nab)

   - Convert tcm_fc to use TARGET_SCF_ACK_KREF I/O + TMR krefs

   - Convert ib_srpt to use percpu_ida tag pre-allocation

   - Add DebugFS node for qla2xxx target sess list (Quinn)

   - Rework iser-target connection termination (Jenny + Sagi)

   - Convert iser-target to new CQ API (HCH)

   - Add pass-through WRITE_SAME support for IBLOCK (Mike Christie)

   - Introduce data_bitmap for asynchronous access of data area (Sheng
     Yang + Andy)

   - Fix target_release_cmd_kref shutdown comp leak (Himanshu Madhani)

  Also, there is a separate PULL request coming for cxgb4 NIC driver
  prerequisites for supporting hw iscsi segmentation offload (ISO), that
  will be the base for a number of v4.7 developments involving
  iscsi-target hw offloads"

* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (36 commits)
  target: Fix target_release_cmd_kref shutdown comp leak
  target: Avoid DataIN transfers for non-GOOD SAM status
  target/user: Report capability of handling out-of-order completions to userspace
  target/user: Fix size_t format-spec build warning
  target/user: Don't free expired command when time out
  target/user: Introduce data_bitmap, replace data_length/data_head/data_tail
  target/user: Free data ring in unified function
  target/user: Use iovec[] to describe continuous area
  target: Remove enum transport_lunflags_table
  target/iblock: pass WRITE_SAME to device if possible
  iser-target: Kill the ->isert_cmd back pointer in struct iser_tx_desc
  iser-target: Kill struct isert_rdma_wr
  iser-target: Convert to new CQ API
  iser-target: Split and properly type the login buffer
  iser-target: Remove ISER_RECV_DATA_SEG_LEN
  iser-target: Remove impossible condition from isert_wait_conn
  iser-target: Remove redundant wait in release_conn
  iser-target: Rework connection termination
  iser-target: Separate flows for np listeners and connections cma events
  iser-target: Add new state ISER_CONN_BOUND to isert_conn
  ...
2016-03-22 12:41:14 -07:00
Linus Torvalds
46e595a17d ARM: SoC driver updates for v4.6
Driver updates for ARM SoCs, these contain various things that touch
 the drivers/ directory but got merged through arm-soc for practical
 reasons:
 
 - Rockchip rk3368 gains power domain support
 - Small updates for the ARM spmi driver
 - The Atmel PMC driver saw a larger rework, touching both
   arch/arm/mach-at91 and drivers/clk/at91
 - All reset controller driver changes alway get merged through
   arm-soc, though this time the largest change is the addition
   of a MIPS pistachio reset driver
 - One bugfix for the NXP (formerly Freescale) i.MX weim bus driver
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIVAwUAVu67OmCrR//JCVInAQJ64hAAqNemdAMloJhh8mk4O74egd/XNE8GLK3v
 gGefpZNi0TC8u/GWMhU1aFCElaCmbNlL0IlqaRrU/vydOmQcZYht7Fg3bAm4r3ck
 TlKijGTJap4sdHhxSeui+7bhaBToxcklQTdcrKFgOwsype7CAWJCl5otIC/GHO5L
 fn4QSjQbqr5kqH1XfuVIphj/fJjDKRRze5D7zn0nExq46OyoYyjc2lm/QkLgeeS2
 vDpzOULYXcjf5GfsPknCJGGjenISD7cIAwZukGvJXFh8WrXkEPZZ7B7bBI/8ZeBU
 MkdWvOm9fHEWpIPnuTcLeQNlfdzQ0Z0zijgJqnXjwSYXK2Es1UKEoIFvZUyGA9zG
 uyLtddFcKbP4QBDUKVMbyYM6x4Cj7LO96dB2pe8iH5rvnoLS32EjJ/4glnbPQFB7
 75JKb7eU1pijoy9c3x/G10vINHzbPjyUN3sYTFKMomPFzEF4OVQ3GDclSuD7jjDr
 GnqmAqlj29+qGU6iQBBHp9TfLTxwrs/4MKPEZ+tTGvtINnzOpLGA3TUnji7nVFQc
 BYy3qaEvg9MfHI3uXhAl2L4CGCVvHfqFs5B7giZfAkbbcTNAHs9PkZ6gMYH+GG3p
 tEbTf/dMHmkkqttSz4f7LZS7D56cSfm3cD8kFCRJPLKifmGAk3w1HZ7JoCXdjr1K
 22HSKRMxlhU=
 =HS4G
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC driver updates from Arnd Bergmann:
 "Driver updates for ARM SoCs, these contain various things that touch
  the drivers/ directory but got merged through arm-soc for practical
  reasons:

   - Rockchip rk3368 gains power domain support
   - Small updates for the ARM spmi driver
   - The Atmel PMC driver saw a larger rework, touching both
     arch/arm/mach-at91 and drivers/clk/at91
   - All reset controller driver changes alway get merged through
     arm-soc, though this time the largest change is the addition of a
     MIPS pistachio reset driver
   - One bugfix for the NXP (formerly Freescale) i.MX weim bus driver"

* tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (43 commits)
  bus: imx-weim: Take the 'status' property value into account
  clk: at91: remove useless includes
  clk: at91: pmc: remove useless capacities handling
  clk: at91: pmc: drop at91_pmc_base
  usb: gadget: atmel: access the PMC using regmap
  ARM: at91: remove useless includes and function prototypes
  ARM: at91: pm: move idle functions to pm.c
  ARM: at91: pm: find and remap the pmc
  ARM: at91: pm: simply call at91_pm_init
  clk: at91: pmc: move pmc structures to C file
  clk: at91: pmc: merge at91_pmc_init in atmel_pmc_probe
  clk: at91: remove IRQ handling and use polling
  clk: at91: make use of syscon/regmap internally
  clk: at91: make use of syscon to share PMC registers in several drivers
  hwmon: (scpi) add energy meter support
  firmware: arm_scpi: add support for 64-bit sensor values
  firmware: arm_scpi: decrease Tx timeout to 20ms
  firmware: arm_scpi: fix send_message and sensor_get_value for big-endian
  reset: sti: Make reset_control_ops const
  reset: zynq: Make reset_control_ops const
  ...
2016-03-20 15:40:32 -07:00
Linus Torvalds
814a2bf957 Merge branch 'akpm' (patches from Andrew)
Merge second patch-bomb from Andrew Morton:

 - a couple of hotfixes

 - the rest of MM

 - a new timer slack control in procfs

 - a couple of procfs fixes

 - a few misc things

 - some printk tweaks

 - lib/ updates, notably to radix-tree.

 - add my and Nick Piggin's old userspace radix-tree test harness to
   tools/testing/radix-tree/.  Matthew said it was a godsend during the
   radix-tree work he did.

 - a few code-size improvements, switching to __always_inline where gcc
   screwed up.

 - partially implement character sets in sscanf

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (118 commits)
  sscanf: implement basic character sets
  lib/bug.c: use common WARN helper
  param: convert some "on"/"off" users to strtobool
  lib: add "on"/"off" support to kstrtobool
  lib: update single-char callers of strtobool()
  lib: move strtobool() to kstrtobool()
  include/linux/unaligned: force inlining of byteswap operations
  include/uapi/linux/byteorder, swab: force inlining of some byteswap operations
  include/asm-generic/atomic-long.h: force inlining of some atomic_long operations
  usb: common: convert to use match_string() helper
  ide: hpt366: convert to use match_string() helper
  ata: hpt366: convert to use match_string() helper
  power: ab8500: convert to use match_string() helper
  power: charger_manager: convert to use match_string() helper
  drm/edid: convert to use match_string() helper
  pinctrl: convert to use match_string() helper
  device property: convert to use match_string() helper
  lib/string: introduce match_string() helper
  radix-tree tests: add test for radix_tree_iter_next
  radix-tree tests: add regression3 test
  ...
2016-03-18 19:26:54 -07:00
Linus Torvalds
040e3abbb9 USB fixes for 4.6-rc1
Here is a USB fix for the reported issue with 69bec72598 "USB: core:
 let USB device know device node" as well as some other issues that have
 been reported so far with this merge.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlbsjB8ACgkQMUfUDdst+yn5BACeK0uVt+S/pr+HQE30j67b4UV6
 TcMAn25xKshM73AFDm9ok9qKnWEEvkEt
 =UgYu
 -----END PGP SIGNATURE-----

Merge tag 'usb-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here is a USB fix for the reported issue with commit 69bec72598
  ("USB: core: let USB device know device node") as well as some other
  issues that have been reported so far with this merge window"

* tag 'usb-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: uas: Reduce can_queue to MAX_CMNDS
  USB: cdc-acm: more sanity checking
  USB: usb_driver_claim_interface: add sanity checking
  usb/core: usb_alloc_dev(): fix setting of ->portnum
  USB: iowarrior: fix oops with malicious USB descriptors
2016-03-18 16:19:15 -07:00
Hans de Goede
55ff8cfbc4 USB: uas: Reduce can_queue to MAX_CMNDS
The uas driver can never queue more then MAX_CMNDS (- 1) tags and tags
are shared between luns, so there is no need to claim that we can_queue
some random large number.

Not claiming that we can_queue 65536 commands, fixes the uas driver
failing to initialize while allocating the tag map with a "Page allocation
failure (order 7)" error on systems which have been running for a while
and thus have fragmented memory.

Cc: stable@vger.kernel.org
Reported-and-tested-by: Yves-Alexis Perez <corsac@corsac.net>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-18 09:19:02 -07:00
Oliver Neukum
8835ba4a39 USB: cdc-acm: more sanity checking
An attack has become available which pretends to be a quirky
device circumventing normal sanity checks and crashes the kernel
by an insufficient number of interfaces. This patch adds a check
to the code path for quirky devices.

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-18 09:19:02 -07:00
Oliver Neukum
0b818e3956 USB: usb_driver_claim_interface: add sanity checking
Attacks that trick drivers into passing a NULL pointer
to usb_driver_claim_interface() using forged descriptors are
known. This thwarts them by sanity checking.

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-18 09:19:02 -07:00
Nicolai Stange
7222c83225 usb/core: usb_alloc_dev(): fix setting of ->portnum
With commit 69bec72598 ("USB: core: let USB device know device node"),
the port1 argument of usb_alloc_dev() gets overwritten as follows:

  ... usb_alloc_dev(..., unsigned port1)
  {
    ...
    if (!parent->parent) {
      port1 = usb_hcd_find_raw_port_number(..., port1);
    }
    ...
  }

Later on, this now overwritten port1 gets assigned to ->portnum:

  dev->portnum = port1;

However, since xhci_find_raw_port_number() isn't idempotent, the
aforementioned commit causes a number of KASAN splats like the following:

  BUG: KASAN: slab-out-of-bounds in xhci_find_raw_port_number+0x98/0x170
                                       at addr ffff8801d9311670
  Read of size 8 by task kworker/2:1/87
  [...]
  Workqueue: usb_hub_wq hub_event
   0000000000000188 000000005814b877 ffff8800cba17588 ffffffff8191447e
   0000000041b58ab3 ffffffff82a03209 ffffffff819143a2 ffffffff82a252f4
   ffff8801d93115e0 0000000000000188 ffff8801d9311628 ffff8800cba17588
  Call Trace:
   [<ffffffff8191447e>] dump_stack+0xdc/0x15e
   [<ffffffff819143a2>] ? _atomic_dec_and_lock+0xa2/0xa2
   [<ffffffff814e2cd1>] ? print_section+0x61/0xb0
   [<ffffffff814e4939>] print_trailer+0x179/0x2c0
   [<ffffffff814f0d84>] object_err+0x34/0x40
   [<ffffffff814f4388>] kasan_report_error+0x2f8/0x8b0
   [<ffffffff814eb91e>] ? __slab_alloc+0x5e/0x90
   [<ffffffff812178c0>] ? __lock_is_held+0x90/0x130
   [<ffffffff814f5091>] kasan_report+0x71/0xa0
   [<ffffffff814ec082>] ? kmem_cache_alloc_trace+0x212/0x560
   [<ffffffff81d99468>] ? xhci_find_raw_port_number+0x98/0x170
   [<ffffffff814f33d4>] __asan_load8+0x64/0x70
   [<ffffffff81d99468>] xhci_find_raw_port_number+0x98/0x170
   [<ffffffff81db0105>] xhci_setup_addressable_virt_dev+0x235/0xa10
   [<ffffffff81d9ea51>] xhci_setup_device+0x3c1/0x1430
   [<ffffffff8121cddd>] ? trace_hardirqs_on+0xd/0x10
   [<ffffffff81d9fac0>] ? xhci_setup_device+0x1430/0x1430
   [<ffffffff81d9fad3>] xhci_address_device+0x13/0x20
   [<ffffffff81d2081a>] hub_port_init+0x55a/0x1550
   [<ffffffff81d28705>] hub_event+0xef5/0x24d0
   [<ffffffff81d27810>] ? hub_port_debounce+0x2f0/0x2f0
   [<ffffffff8195e1ee>] ? debug_object_deactivate+0x1be/0x270
   [<ffffffff81210203>] ? print_rt_rq+0x53/0x2d0
   [<ffffffff8121657d>] ? trace_hardirqs_off+0xd/0x10
   [<ffffffff8226acfb>] ? _raw_spin_unlock_irqrestore+0x5b/0x60
   [<ffffffff81250000>] ? irq_domain_set_hwirq_and_chip+0x30/0xb0
   [<ffffffff81256339>] ? debug_lockdep_rcu_enabled+0x39/0x40
   [<ffffffff812178c0>] ? __lock_is_held+0x90/0x130
   [<ffffffff81196877>] process_one_work+0x567/0xec0
  [...]

Afterwards, xhci reports some functional errors:

  xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion
                                code 0x11.
  xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion
                                code 0x11.
  usb 4-3: device not accepting address 2, error -22

Fix this by not overwriting the port1 argument in usb_alloc_dev(), but
storing the raw port number as required by OF in an additional variable,
raw_port.

Fixes: 69bec72598 ("USB: core: let USB device know device node")
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-18 09:19:02 -07:00
Josh Boyer
4ec0ef3a82 USB: iowarrior: fix oops with malicious USB descriptors
The iowarrior driver expects at least one valid endpoint.  If given
malicious descriptors that specify 0 for the number of endpoints,
it will crash in the probe function.  Ensure there is at least
one endpoint on the interface before using it.

The full report of this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/87

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-18 09:19:02 -07:00
Linus Torvalds
49dc2b7173 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
Pull trivial tree updates from Jiri Kosina.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial:
  drivers/rtc: broken link fix
  drm/i915 Fix typos in i915_gem_fence.c
  Docs: fix missing word in REPORTING-BUGS
  lib+mm: fix few spelling mistakes
  MAINTAINERS: add git URL for APM driver
  treewide: Fix typo in printk
2016-03-17 21:38:27 -07:00