Merge tag 'usb-5.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH: "Here are some small USB fixes for a bunch of warnings/errors that the syzbot has been finding with it's new-found ability to stress-test the USB layer. All of these are tiny, but fix real issues, and are marked for stable as well. All of these have had lots of testing in linux-next as well" * tag 'usb-5.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: w1 ds2490: Fix bug caused by improper use of altsetting array USB: yurex: Fix protection fault after device removal usb: usbip: fix isoc packet num validation in get_pipe USB: core: Fix bug caused by duplicate interface PM usage counter USB: dummy-hcd: Fix failure to give back unlinked URBs USB: core: Fix unterminated string returned by usb_string()

Linus Torvalds committed 7 years ago

Commit bf3bd962 parents fea27bc c11494410 files · +46 −45Browse files

Unified · Split

10 files

Documentation/driver-api/usb/power-management.rst +9 −5
drivers/usb/core/driver.c +0 −13
drivers/usb/core/message.c +3 −1
drivers/usb/gadget/udc/dummy_hcd.c +15 −4
drivers/usb/misc/yurex.c +1 −0
drivers/usb/storage/realtek_cr.c +5 −8
drivers/usb/usbip/stub_rx.c +3 −9
drivers/usb/usbip/usbip_common.h +7 −0
drivers/w1/masters/ds2490.c +3 −3
include/linux/usb.h +0 −2

Documentation/driver-api/usb/power-management.rst+9−5

@@ -370,11 +370,15 @@ autosuspend the interface's device. When the usage counter is = 0 · 369 unmodified lines
370	then the interface is considered to be idle, and the kernel may	370	then the interface is considered to be idle, and the kernel may
371	autosuspend the device.	371	autosuspend the device.
372		372
373	Drivers need not be concerned about balancing changes to the usage	373	Drivers must be careful to balance their overall changes to the usage
374	counter; the USB core will undo any remaining "get"s when a driver	374	counter. Unbalanced "get"s will remain in effect when a driver is
375	is unbound from its interface. As a corollary, drivers must not call	375	unbound from its interface, preventing the device from going into
376	any of the ``usb_autopm_*`` functions after their ``disconnect``	376	runtime suspend should the interface be bound to a driver again. On
377	routine has returned.	377	the other hand, drivers are allowed to achieve this balance by calling
		378	the ``usb_autopm_*`` functions even after their ``disconnect`` routine
		379	has returned -- say from within a work-queue routine -- provided they
		380	retain an active reference to the interface (via ``usb_get_intf`` and
		381	``usb_put_intf``).
378		382
379	Drivers using the async routines are responsible for their own	383	Drivers using the async routines are responsible for their own
380	synchronization and mutual exclusion.	384	synchronization and mutual exclusion.

drivers/usb/core/driver.c+0−13

 		pm_runtime_disable(dev);
 	pm_runtime_set_suspended(dev);
-	/* Undo any residual pm_autopm_get_interface_* calls */
-	for (r = atomic_read(&intf->pm_usage_cnt); r > 0; --r)
-		usb_autopm_put_interface_no_suspend(intf);
-	atomic_set(&intf->pm_usage_cnt, 0);
 	if (!error)
 		usb_autosuspend_device(udev);
 	int			status;
 	usb_mark_last_busy(udev);
-	atomic_dec(&intf->pm_usage_cnt);
 	status = pm_runtime_put_sync(&intf->dev);
 	dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
 			__func__, atomic_read(&intf->dev.power.usage_count),
 	int			status;
 	usb_mark_last_busy(udev);
-	atomic_dec(&intf->pm_usage_cnt);
 	status = pm_runtime_put(&intf->dev);
 	dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
 			__func__, atomic_read(&intf->dev.power.usage_count),
 	struct usb_device	*udev = interface_to_usbdev(intf);
 	usb_mark_last_busy(udev);
-	atomic_dec(&intf->pm_usage_cnt);
 	pm_runtime_put_noidle(&intf->dev);
 }
 EXPORT_SYMBOL_GPL(usb_autopm_put_interface_no_suspend);
 	status = pm_runtime_get_sync(&intf->dev);
 	if (status < 0)
 		pm_runtime_put_sync(&intf->dev);
-	else
-		atomic_inc(&intf->pm_usage_cnt);
 	dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
 			__func__, atomic_read(&intf->dev.power.usage_count),
 			status);
 	status = pm_runtime_get(&intf->dev);
 	if (status < 0 && status != -EINPROGRESS)
 		pm_runtime_put_noidle(&intf->dev);
-	else
-		atomic_inc(&intf->pm_usage_cnt);
 	dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
 			__func__, atomic_read(&intf->dev.power.usage_count),
 			status);
 	struct usb_device	*udev = interface_to_usbdev(intf);
 	usb_mark_last_busy(udev);
-	atomic_inc(&intf->pm_usage_cnt);
 	pm_runtime_get_noresume(&intf->dev);
 }
 EXPORT_SYMBOL_GPL(usb_autopm_get_interface_no_resume);

drivers/usb/core/message.c+3−1

 	if (dev->state == USB_STATE_SUSPENDED)
 		return -EHOSTUNREACH;
-	if (size <= 0 || !buf || !index)
+	if (size <= 0 || !buf)
 		return -EINVAL;
 	buf[0] = 0;
+	if (index <= 0 || index >= 256)
+		return -EINVAL;
 	tbuf = kmalloc(256, GFP_NOIO);
 	if (!tbuf)
 		return -ENOMEM;

drivers/usb/gadget/udc/dummy_hcd.c+15−4

 	struct dummy_hcd	*dum_hcd = gadget_to_dummy_hcd(g);
 	struct dummy		*dum = dum_hcd->dum;
-	if (driver->max_speed == USB_SPEED_UNKNOWN)
+	switch (g->speed) {
+	/* All the speeds we support */
+	case USB_SPEED_LOW:
+	case USB_SPEED_FULL:
+	case USB_SPEED_HIGH:
+	case USB_SPEED_SUPER:
+		break;
+	default:
+		dev_err(dummy_dev(dum_hcd), "Unsupported driver max speed %d\n",
+				driver->max_speed);
 		return -EINVAL;
+	}
 	/*
 	 * SLAVE side init ... the layer above hardware, which
 		/* Bus speed is 500000 bytes/ms, so use a little less */
 		total = 490000;
 		break;
-	default:
+	default:	/* Can't happen */
 		dev_err(dummy_dev(dum_hcd), "bogus device speed\n");
-		return;
+		total = 0;
+		break;
 	}
 	/* FIXME if HZ != 1000 this will probably misbehave ... */
 		/* Used up this frame's bandwidth? */
 		if (total <= 0)
-			break;
+			continue;
 		/* find the gadget's ep for this request (if configured) */
 		address = usb_pipeendpoint (urb->pipe);

drivers/usb/misc/yurex.c+1−0

@@ -314,6 +314,7 @@ static void yurex_disconnect(struct usb_interface *interface) · 313 unmodified lines
314	usb_deregister_dev(interface, &yurex_class);	314	usb_deregister_dev(interface, &yurex_class);
315		315
316	/* prevent more I/O from starting */	316	/* prevent more I/O from starting */
		317	usb_poison_urb(dev->urb);
317	mutex_lock(&dev->io_mutex);	318	mutex_lock(&dev->io_mutex);
318	dev->interface = NULL;	319	dev->interface = NULL;
319	mutex_unlock(&dev->io_mutex);	320	mutex_unlock(&dev->io_mutex);

drivers/usb/storage/realtek_cr.c+5−8

 		break;
 	case RTS51X_STAT_IDLE:
 	case RTS51X_STAT_SS:
-		usb_stor_dbg(us, "RTS51X_STAT_SS, intf->pm_usage_cnt:%d, power.usage:%d\n",
+		usb_stor_dbg(us, "RTS51X_STAT_SS, power.usage:%d\n",
-			     atomic_read(&us->pusb_intf->pm_usage_cnt),
 			     atomic_read(&us->pusb_intf->dev.power.usage_count));
-		if (atomic_read(&us->pusb_intf->pm_usage_cnt) > 0) {
+		if (atomic_read(&us->pusb_intf->dev.power.usage_count) > 0) {
 			usb_stor_dbg(us, "Ready to enter SS state\n");
 			rts51x_set_stat(chip, RTS51X_STAT_SS);
 			/* ignore mass storage interface's children */
 			pm_suspend_ignore_children(&us->pusb_intf->dev, true);
 			usb_autopm_put_interface_async(us->pusb_intf);
-			usb_stor_dbg(us, "RTS51X_STAT_SS 01, intf->pm_usage_cnt:%d, power.usage:%d\n",
+			usb_stor_dbg(us, "RTS51X_STAT_SS 01, power.usage:%d\n",
-				     atomic_read(&us->pusb_intf->pm_usage_cnt),
 				     atomic_read(&us->pusb_intf->dev.power.usage_count));
 		}
 		break;
 	int ret;
 	if (working_scsi(srb)) {
-		usb_stor_dbg(us, "working scsi, intf->pm_usage_cnt:%d, power.usage:%d\n",
+		usb_stor_dbg(us, "working scsi, power.usage:%d\n",
-			     atomic_read(&us->pusb_intf->pm_usage_cnt),
 			     atomic_read(&us->pusb_intf->dev.power.usage_count));
-		if (atomic_read(&us->pusb_intf->pm_usage_cnt) <= 0) {
+		if (atomic_read(&us->pusb_intf->dev.power.usage_count) <= 0) {
 			ret = usb_autopm_get_interface(us->pusb_intf);
 			usb_stor_dbg(us, "working scsi, ret=%d\n", ret);
 		}

drivers/usb/usbip/stub_rx.c+3−9

 	}
 	if (usb_endpoint_xfer_isoc(epd)) {
-		/* validate packet size and number of packets */
+		/* validate number of packets */
-		unsigned int maxp, packets, bytes;
-		maxp = usb_endpoint_maxp(epd);
-		maxp *= usb_endpoint_maxp_mult(epd);
-		bytes = pdu->u.cmd_submit.transfer_buffer_length;
-		packets = DIV_ROUND_UP(bytes, maxp);
 		if (pdu->u.cmd_submit.number_of_packets < 0 ||
-		    pdu->u.cmd_submit.number_of_packets > packets) {
+		    pdu->u.cmd_submit.number_of_packets >
+		    USBIP_MAX_ISO_PACKETS) {
 			dev_err(&sdev->udev->dev,
 				"CMD_SUBMIT: isoc invalid num packets %d\n",
 				pdu->u.cmd_submit.number_of_packets);

drivers/usb/usbip/usbip_common.h+7−0

@@ -121,6 +121,13 @@ extern struct device_attribute dev_attr_usbip_debug; · 120 unmodified lines
121	#define USBIP_DIR_OUT 0x00	121	#define USBIP_DIR_OUT 0x00
122	#define USBIP_DIR_IN 0x01	122	#define USBIP_DIR_IN 0x01
123		123
		124	/*
		125	* Arbitrary limit for the maximum number of isochronous packets in an URB,
		126	* compare for example the uhci_submit_isochronous function in
		127	* drivers/usb/host/uhci-q.c
		128	*/
		129	#define USBIP_MAX_ISO_PACKETS 1024
		130
124	/**	131	/**
125	* struct usbip_header_basic - data pertinent to every request	132	* struct usbip_header_basic - data pertinent to every request
126	* @command: the usbip request type	133	* @command: the usbip request type

drivers/w1/masters/ds2490.c+3−3

@@ -1016,15 +1016,15 @@ static int ds_probe(struct usb_interface *intf, · 1015 unmodified lines
1016	/* alternative 3, 1ms interrupt (greatly speeds search), 64 byte bulk */	1016	/* alternative 3, 1ms interrupt (greatly speeds search), 64 byte bulk */
1017	alt = 3;	1017	alt = 3;
1018	err = usb_set_interface(dev->udev,	1018	err = usb_set_interface(dev->udev,
1019	intf->altsetting[alt].desc.bInterfaceNumber, alt);	1019	intf->cur_altsetting->desc.bInterfaceNumber, alt);
1020	if (err) {	1020	if (err) {
1021	dev_err(&dev->udev->dev, "Failed to set alternative setting %d "	1021	dev_err(&dev->udev->dev, "Failed to set alternative setting %d "
1022	"for %d interface: err=%d.\n", alt,	1022	"for %d interface: err=%d.\n", alt,
1023	intf->altsetting[alt].desc.bInterfaceNumber, err);	1023	intf->cur_altsetting->desc.bInterfaceNumber, err);
1024	goto err_out_clear;	1024	goto err_out_clear;
1025	}	1025	}
1026		1026
1027	iface_desc = &intf->altsetting[alt];	1027	iface_desc = intf->cur_altsetting;
1028	if (iface_desc->desc.bNumEndpoints != NUM_EP-1) {	1028	if (iface_desc->desc.bNumEndpoints != NUM_EP-1) {
1029	pr_info("Num endpoints=%d. It is not DS9490R.\n",	1029	pr_info("Num endpoints=%d. It is not DS9490R.\n",
1030	iface_desc->desc.bNumEndpoints);	1030	iface_desc->desc.bNumEndpoints);

include/linux/usb.h+0−2

  * @dev: driver model's view of this device
  * @usb_dev: if an interface is bound to the USB major, this will point
  *	to the sysfs representation for that device.
- * @pm_usage_cnt: PM usage counter for this interface
  * @reset_ws: Used for scheduling resets from atomic context.
  * @resetting_device: USB core reset the device, so use alt setting 0 as
  *	current; needs bandwidth alloc after reset.
 	struct device dev;		/* interface specific device info */
 	struct device *usb_dev;
-	atomic_t pm_usage_cnt;		/* usage counter for autosuspend */
 	struct work_struct reset_ws;	/* for resets in atomic context */
 };
 #define	to_usb_interface(d) container_of(d, struct usb_interface, dev)

Merge tag 'usb-5.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code