1. 19 Dec, 2018 3 commits
    • Jia-Ju Bai's avatar
      usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() · c85400f8
      Jia-Ju Bai authored
      The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may
      be concurrently executed.
      The two functions both access a possible shared variable "hep->hcpriv".
      
      This shared variable is freed by r8a66597_endpoint_disable() via the
      call path:
      r8a66597_endpoint_disable
        kfree(hep->hcpriv) (line 1995 in Linux-4.19)
      
      This variable is read by r8a66597_urb_enqueue() via the call path:
      r8a66597_urb_enqueue
        spin_lock_irqsave(&r8a66597->lock)
        init_pipe_info
          enable_r8a66597_pipe
            pipe = hep->hcpriv (line 802 in Linux-4.19)
      
      The read operation is protected by a spinlock, but the free operation
      is not protected by this spinlock, thus a concurrency use-after-free bug
      may occur.
      
      To fix this bug, the spin-lock and spin-unlock function calls in
      r8a66597_endpoint_disable() are moved to protect the free operation.
      Signed-off-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c85400f8
    • Kyle Tso's avatar
      usb: typec: tcpm: Extend the matching rules on PPS APDO selection · c710d0bb
      Kyle Tso authored
      Current matching rules ensure that the voltage range of selected Source
      Capability is entirely within the range defined in one of the Sink
      Capabilities. This is reasonable but not practical because Sink may not
      support wide range of voltage when sinking power while Source could
      advertise its capabilities in relatively wider range. For example, a
      Source PDO advertising 3.3V-11V@3A (9V Prog of Fixed Nominal Voltage)
      will not be selected if the Sink requires 5V-12V@3A PPS power. However,
      the Sink could work well if the requested voltage range in RDOs is
      5V-11V@3A.
      
      Currently accepted:
      		|--------- source -----|
      	|----------- sink ---------------|
      
      Currently not accepted:
      			|--------- source -----|
      	|----------- sink ---------------|
      
      	|--------- source -----|
      		|----------- sink ---------------|
      
      	|--------- source -----------------|
      		|------ sink -------|
      
      To improve the usability, change the matching rules to what listed
      below:
      a. The Source PDO is selectable if any portion of the voltage range
         overlaps one of the Sink PDO's voltage range.
      b. The maximum operational voltage will be the lower one between the
         selected Source PDO and the matching Sink PDO.
      c. The maximum power will be the maximum operational voltage times the
         maximum current defined in the selected Source PDO
      d. Select the Source PDO with the highest maximum power
      Signed-off-by: default avatarKyle Tso <kyletso@google.com>
      Acked-by: default avatarAdam Thomson <Adam.Thomson.Opensource@diasemi.com>
      Reviewed-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c710d0bb
    • Heikki Krogerus's avatar
      usb: typec: Improve Alt Mode documentation · 28ce5539
      Heikki Krogerus authored
      Adding the document to the usb index file and fixing a few
      references. Also, exposing the code examples as "literal
      blocks" so they are more easy to read.
      Signed-off-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      28ce5539
  2. 18 Dec, 2018 2 commits
    • Bin Liu's avatar
      usb: musb: dsps: fix runtime pm for peripheral mode · 54578ee8
      Bin Liu authored
      Since the runtime PM support was added in musb, dsps relies on the timer
      calling otg_timer() to activate the usb subsystem. However the driver
      doesn't enable the timer for peripheral port, then the peripheral port is
      unable to be enumerated by a host if the other usb port is disabled or in
      peripheral mode too.
      
      So let's start the timer for peripheral port too.
      
      Fixes: ea2f35c0 ("usb: musb: Fix sleeping function called from invalid context for hdrc glue")
      Acked-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarBin Liu <b-liu@ti.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      54578ee8
    • Bin Liu's avatar
      usb: musb: dsps: fix otg state machine · 6010abf2
      Bin Liu authored
      Due to lack of ID pin interrupt event on AM335x devices, the musb dsps
      driver uses polling to detect usb device attach for dual-role port.
      
      But in the case if a micro-A cable adapter is attached without a USB device
      attached to the cable, the musb state machine gets stuck in a_wait_vrise
      state waiting for the MUSB_CONNECT interrupt which won't happen due to the
      usb device is not attached. The state is stuck in a_wait_vrise even after
      the micro-A cable is detached, which could cause VBUS retention if then the
      dual-role port is attached to a host port.
      
      To fix the problem, make a_wait_vrise as a transient state, then move the
      state to either a_wait_bcon for host port or a_idle state for dual-role
      port, if no usb device is attached to the port.
      Signed-off-by: default avatarBin Liu <b-liu@ti.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6010abf2
  3. 17 Dec, 2018 4 commits
  4. 12 Dec, 2018 31 commits