Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8f46c507 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'usb-3.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 

Pull USB fixes from Greg Kroah-Hartman:
 "Here are a number of USB fixes that resolve issues that have been
  reported against 3.9-rc3."

* tag 'usb-3.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (37 commits)
  USB: ti_usb_3410_5052: fix use-after-free in TIOCMIWAIT
  USB: ssu100: fix use-after-free in TIOCMIWAIT
  USB: spcp8x5: fix use-after-free in TIOCMIWAIT
  USB: quatech2: fix use-after-free in TIOCMIWAIT
  USB: pl2303: fix use-after-free in TIOCMIWAIT
  USB: oti6858: fix use-after-free in TIOCMIWAIT
  USB: mos7840: fix use-after-free in TIOCMIWAIT
  USB: mos7840: fix broken TIOCMIWAIT
  USB: mct_u232: fix use-after-free in TIOCMIWAIT
  USB: io_ti: fix use-after-free in TIOCMIWAIT
  USB: io_edgeport: fix use-after-free in TIOCMIWAIT
  USB: ftdi_sio: fix use-after-free in TIOCMIWAIT
  USB: f81232: fix use-after-free in TIOCMIWAIT
  USB: cypress_m8: fix use-after-free in TIOCMIWAIT
  USB: ch341: fix use-after-free in TIOCMIWAIT
  USB: ark3116: fix use-after-free in TIOCMIWAIT
  USB: serial: add modem-status-change wait queue
  USB: serial: fix interface refcounting
  USB: io_ti: fix get_icount for two port adapters
  USB: garmin_gps: fix memory leak on disconnect
  ...
parents 70dc52fa fc98ab87

drivers/usb/class/cdc-acm.c

+19 −3
Original line number Diff line number Diff line
@@ -593,7 +593,6 @@ static void acm_port_destruct(struct tty_port *port) 


	dev_dbg(&acm->control->dev, "%s\n", __func__);



	tty_unregister_device(acm_tty_driver, acm->minor);

	acm_release_minor(acm);

	usb_put_intf(acm->control);

	kfree(acm->country_codes);
@@ -977,6 +976,8 @@ static int acm_probe(struct usb_interface *intf, 
	int num_rx_buf;

	int i;

	int combined_interfaces = 0;

	struct device *tty_dev;

	int rv = -ENOMEM;



	/* normal quirks */

	quirks = (unsigned long)id->driver_info;
@@ -1339,11 +1340,24 @@ static int acm_probe(struct usb_interface *intf, 
	usb_set_intfdata(data_interface, acm);



	usb_get_intf(control_interface);

	tty_port_register_device(&acm->port, acm_tty_driver, minor,

	tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor,

			&control_interface->dev);

	if (IS_ERR(tty_dev)) {

		rv = PTR_ERR(tty_dev);

		goto alloc_fail8;

	}



	return 0;

alloc_fail8:

	if (acm->country_codes) {

		device_remove_file(&acm->control->dev,

				&dev_attr_wCountryCodes);

		device_remove_file(&acm->control->dev,

				&dev_attr_iCountryCodeRelDate);

	}

	device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);

alloc_fail7:

	usb_set_intfdata(intf, NULL);

	for (i = 0; i < ACM_NW; i++)

		usb_free_urb(acm->wb[i].urb);

alloc_fail6:
@@ -1359,7 +1373,7 @@ static int acm_probe(struct usb_interface *intf, 
	acm_release_minor(acm);

	kfree(acm);

alloc_fail:

	return -ENOMEM;

	return rv;

}



static void stop_data_traffic(struct acm *acm)
@@ -1411,6 +1425,8 @@ static void acm_disconnect(struct usb_interface *intf) 


	stop_data_traffic(acm);



	tty_unregister_device(acm_tty_driver, acm->minor);



	usb_free_urb(acm->ctrlurb);

	for (i = 0; i < ACM_NW; i++)

		usb_free_urb(acm->wb[i].urb);

drivers/usb/core/hcd-pci.c

+14 −9
Original line number Diff line number Diff line
@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) 
	struct hc_driver	*driver;

	struct usb_hcd		*hcd;

	int			retval;

	int			hcd_irq = 0;



	if (usb_disabled())

		return -ENODEV;
@@ -187,16 +188,20 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) 
		return -ENODEV;

	dev->current_state = PCI_D0;



	/* The xHCI driver supports MSI and MSI-X,

	 * so don't fail if the BIOS doesn't provide a legacy IRQ.

	/*

	 * The xHCI driver has its own irq management

	 * make sure irq setup is not touched for xhci in generic hcd code

	 */

	if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {

	if ((driver->flags & HCD_MASK) != HCD_USB3) {

		if (!dev->irq) {

			dev_err(&dev->dev,

			"Found HC with no IRQ. Check BIOS/PCI %s setup!\n",

				pci_name(dev));

			retval = -ENODEV;

			goto disable_pci;

		}

		hcd_irq = dev->irq;

	}



	hcd = usb_create_hcd(driver, &dev->dev, pci_name(dev));

	if (!hcd) {
@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) 


	pci_set_master(dev);



	retval = usb_add_hcd(hcd, dev->irq, IRQF_SHARED);

	retval = usb_add_hcd(hcd, hcd_irq, IRQF_SHARED);

	if (retval != 0)

		goto unmap_registers;

	set_hs_companion(dev, hcd);

drivers/usb/gadget/f_rndis.c

+1 −2
Original line number Diff line number Diff line
@@ -447,14 +447,13 @@ static void rndis_response_complete(struct usb_ep *ep, struct usb_request *req) 
static void rndis_command_complete(struct usb_ep *ep, struct usb_request *req)

{

	struct f_rndis			*rndis = req->context;

	struct usb_composite_dev	*cdev = rndis->port.func.config->cdev;

	int				status;



	/* received RNDIS command from USB_CDC_SEND_ENCAPSULATED_COMMAND */

//	spin_lock(&dev->lock);

	status = rndis_msg_parser(rndis->config, (u8 *) req->buf);

	if (status < 0)

		ERROR(cdev, "RNDIS command error %d, %d/%d\n",

		pr_err("RNDIS command error %d, %d/%d\n",

			status, req->actual, req->length);

//	spin_unlock(&dev->lock);

}

drivers/usb/gadget/g_ffs.c

+2 −2
Original line number Diff line number Diff line
@@ -357,7 +357,7 @@ static int gfs_bind(struct usb_composite_dev *cdev) 
		goto error;

	gfs_dev_desc.iProduct = gfs_strings[USB_GADGET_PRODUCT_IDX].id;



	for (i = func_num; --i; ) {

	for (i = func_num; i--; ) {

		ret = functionfs_bind(ffs_tab[i].ffs_data, cdev);

		if (unlikely(ret < 0)) {

			while (++i < func_num)
@@ -413,7 +413,7 @@ static int gfs_unbind(struct usb_composite_dev *cdev) 
		gether_cleanup();

	gfs_ether_setup = false;



	for (i = func_num; --i; )

	for (i = func_num; i--; )

		if (ffs_tab[i].ffs_data)

			functionfs_unbind(ffs_tab[i].ffs_data);

drivers/usb/gadget/net2272.c

+8 −1
Original line number Diff line number Diff line
@@ -59,7 +59,7 @@ static const char * const ep_name[] = { 
};



#define DMA_ADDR_INVALID	(~(dma_addr_t)0)

#ifdef CONFIG_USB_GADGET_NET2272_DMA

#ifdef CONFIG_USB_NET2272_DMA

/*

 * use_dma: the NET2272 can use an external DMA controller.

 * Note that since there is no generic DMA api, some functions,
@@ -1495,6 +1495,13 @@ stop_activity(struct net2272 *dev, struct usb_gadget_driver *driver) 
	for (i = 0; i < 4; ++i)

		net2272_dequeue_all(&dev->ep[i]);



	/* report disconnect; the driver is already quiesced */

	if (driver) {

		spin_unlock(&dev->lock);

		driver->disconnect(&dev->gadget);

		spin_lock(&dev->lock);

	}



	net2272_usb_reinit(dev);

}