Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7b70a64 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge tag 'usb-4.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 

I wrote:
  "USB fixes for 4.19-final

   Here are a small number of last-minute USB driver fixes

   Included here are:
     - spectre fix for usb storage gadgets
     - xhci fixes
     - cdc-acm fixes
     - usbip fixes for reported problems

   All of these have been in linux-next with no reported issues."

* tag 'usb-4.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: gadget: storage: Fix Spectre v1 vulnerability
  USB: fix the usbfs flag sanitization for control transfers
  usb: xhci: pci: Enable Intel USB role mux on Apollo Lake platforms
  usb: roles: intel_xhci: Fix Unbalanced pm_runtime_enable
  cdc-acm: correct counting of UART states in serial state notification
  cdc-acm: do not reset notification buffer index upon urb unlinking
  cdc-acm: fix race between reset and control messaging
  usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control()
  selftests: usbip: add wait after attach and before checking port status
parents b2a205ff 9ae24af3

drivers/usb/class/cdc-acm.c

+8 −8
Original line number Diff line number Diff line
@@ -310,17 +310,17 @@ static void acm_process_notification(struct acm *acm, unsigned char *buf) 


		if (difference & ACM_CTRL_DSR)

			acm->iocount.dsr++;

		if (difference & ACM_CTRL_BRK)

			acm->iocount.brk++;

		if (difference & ACM_CTRL_RI)

			acm->iocount.rng++;

		if (difference & ACM_CTRL_DCD)

			acm->iocount.dcd++;

		if (difference & ACM_CTRL_FRAMING)

		if (newctrl & ACM_CTRL_BRK)

			acm->iocount.brk++;

		if (newctrl & ACM_CTRL_RI)

			acm->iocount.rng++;

		if (newctrl & ACM_CTRL_FRAMING)

			acm->iocount.frame++;

		if (difference & ACM_CTRL_PARITY)

		if (newctrl & ACM_CTRL_PARITY)

			acm->iocount.parity++;

		if (difference & ACM_CTRL_OVERRUN)

		if (newctrl & ACM_CTRL_OVERRUN)

			acm->iocount.overrun++;

		spin_unlock_irqrestore(&acm->read_lock, flags);
@@ -355,7 +355,6 @@ static void acm_ctrl_irq(struct urb *urb) 
	case -ENOENT:

	case -ESHUTDOWN:

		/* this urb is terminated, clean up */

		acm->nb_index = 0;

		dev_dbg(&acm->control->dev,

			"%s - urb shutting down with status: %d\n",

			__func__, status);
@@ -1642,6 +1641,7 @@ static int acm_pre_reset(struct usb_interface *intf) 
	struct acm *acm = usb_get_intfdata(intf);



	clear_bit(EVENT_RX_STALL, &acm->flags);

	acm->nb_index = 0; /* pending control transfers are lost */



	return 0;

}

drivers/usb/core/devio.c

+2 −2
Original line number Diff line number Diff line
@@ -1474,8 +1474,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb 
	u = 0;

	switch (uurb->type) {

	case USBDEVFS_URB_TYPE_CONTROL:

		if (is_in)

			allow_short = true;

		if (!usb_endpoint_xfer_control(&ep->desc))

			return -EINVAL;

		/* min 8 byte setup packet */
@@ -1505,6 +1503,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb 
			is_in = 0;

			uurb->endpoint &= ~USB_DIR_IN;

		}

		if (is_in)

			allow_short = true;

		snoop(&ps->dev->dev, "control urb: bRequestType=%02x "

			"bRequest=%02x wValue=%04x "

			"wIndex=%04x wLength=%04x\n",

drivers/usb/gadget/function/f_mass_storage.c

+3 −0
Original line number Diff line number Diff line
@@ -221,6 +221,8 @@ 
#include <linux/usb/gadget.h>

#include <linux/usb/composite.h>



#include <linux/nospec.h>



#include "configfs.h"
@@ -3152,6 +3154,7 @@ static struct config_group *fsg_lun_make(struct config_group *group, 
	fsg_opts = to_fsg_opts(&group->cg_item);

	if (num >= FSG_MAX_LUNS)

		return ERR_PTR(-ERANGE);

	num = array_index_nospec(num, FSG_MAX_LUNS);



	mutex_lock(&fsg_opts->lock);

	if (fsg_opts->refcnt || fsg_opts->common->luns[num]) {

drivers/usb/host/xhci-pci.c

+4 −2
Original line number Diff line number Diff line
@@ -179,10 +179,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) 
		xhci->quirks |= XHCI_PME_STUCK_QUIRK;

	}

	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&

		 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) {

	    pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)

		xhci->quirks |= XHCI_SSIC_PORT_UNUSED;

	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&

	    (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||

	     pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))

		xhci->quirks |= XHCI_INTEL_USB_ROLE_SW;

	}

	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&

	    (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||

	     pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||

drivers/usb/roles/intel-xhci-usb-role-switch.c

+2 −0
Original line number Diff line number Diff line
@@ -161,6 +161,8 @@ static int intel_xhci_usb_remove(struct platform_device *pdev) 
{

	struct intel_xhci_usb_data *data = platform_get_drvdata(pdev);



	pm_runtime_disable(&pdev->dev);



	usb_role_switch_unregister(data->role_sw);

	return 0;

}