1. 19 May, 2017 1 commit
    • Greg Kroah-Hartman's avatar
      Merge tag 'usb-serial-4.12-rc2' of... · b51e0cee
      Greg Kroah-Hartman authored
      Merge tag 'usb-serial-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
      
      Johan writes:
      
      USB-serial fixes for v4.12-rc2
      
      Here's a fix for a long-standing issue in the ftdi_sio driver that
      prevented unprivileged users from updating the low-latency flag,
      something which became apparent after a recent change that restored the
      older setting of not using low-latency mode by default.
      
      A run of sparse revealed a couple of endianness issues that are now
      fixed, and addressed is also a user-triggerable division-by-zero in
      io_ti when debugging is enabled.
      
      Finally there are some new device ids, including a simplification of how
      we deal with a couple of older Olimex JTAG adapters.
      
      All have been in linux-next with no reported issues.
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      b51e0cee
  2. 18 May, 2017 10 commits
  3. 17 May, 2017 22 commits
  4. 16 May, 2017 6 commits
    • Pan Bian's avatar
      usb: dwc3: keystone: check return value · 018047a1
      Pan Bian authored
      Function devm_clk_get() returns an ERR_PTR when it fails. However, in
      function kdwc3_probe(), its return value is not checked, which may
      result in a bad memory access bug. This patch fixes the bug.
      Signed-off-by: default avatarPan Bian <bianpan2016@163.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      018047a1
    • William Wu's avatar
      usb: gadget: f_fs: avoid out of bounds access on comp_desc · b7f73850
      William Wu authored
      Companion descriptor is only used for SuperSpeed endpoints,
      if the endpoints are HighSpeed or FullSpeed, the Companion
      descriptor will not allocated, so we can only access it if
      gadget is SuperSpeed.
      
      I can reproduce this issue on Rockchip platform rk3368 SoC
      which supports USB 2.0, and use functionfs for ADB. Kernel
      build with CONFIG_KASAN=y and CONFIG_SLUB_DEBUG=y report
      the following BUG:
      
      ==================================================================
      BUG: KASAN: slab-out-of-bounds in ffs_func_set_alt+0x224/0x3a0 at addr ffffffc0601f6509
      Read of size 1 by task swapper/0/0
      ============================================================================
      BUG kmalloc-256 (Not tainted): kasan: bad access detected
      ----------------------------------------------------------------------------
      
      Disabling lock debugging due to kernel taint
      INFO: Allocated in ffs_func_bind+0x52c/0x99c age=1275 cpu=0 pid=1
      alloc_debug_processing+0x128/0x17c
      ___slab_alloc.constprop.58+0x50c/0x610
      __slab_alloc.isra.55.constprop.57+0x24/0x34
      __kmalloc+0xe0/0x250
      ffs_func_bind+0x52c/0x99c
      usb_add_function+0xd8/0x1d4
      configfs_composite_bind+0x48c/0x570
      udc_bind_to_driver+0x6c/0x170
      usb_udc_attach_driver+0xa4/0xd0
      gadget_dev_desc_UDC_store+0xcc/0x118
      configfs_write_file+0x1a0/0x1f8
      __vfs_write+0x64/0x174
      vfs_write+0xe4/0x200
      SyS_write+0x68/0xc8
      el0_svc_naked+0x24/0x28
      INFO: Freed in inode_doinit_with_dentry+0x3f0/0x7c4 age=1275 cpu=7 pid=247
      ...
      Call trace:
      [<ffffff900808aab4>] dump_backtrace+0x0/0x230
      [<ffffff900808acf8>] show_stack+0x14/0x1c
      [<ffffff90084ad420>] dump_stack+0xa0/0xc8
      [<ffffff90082157cc>] print_trailer+0x188/0x198
      [<ffffff9008215948>] object_err+0x3c/0x4c
      [<ffffff900821b5ac>] kasan_report+0x324/0x4dc
      [<ffffff900821aa38>] __asan_load1+0x24/0x50
      [<ffffff90089eb750>] ffs_func_set_alt+0x224/0x3a0
      [<ffffff90089d3760>] composite_setup+0xdcc/0x1ac8
      [<ffffff90089d7394>] android_setup+0x124/0x1a0
      [<ffffff90089acd18>] _setup+0x54/0x74
      [<ffffff90089b6b98>] handle_ep0+0x3288/0x4390
      [<ffffff90089b9b44>] dwc_otg_pcd_handle_out_ep_intr+0x14dc/0x2ae4
      [<ffffff90089be85c>] dwc_otg_pcd_handle_intr+0x1ec/0x298
      [<ffffff90089ad680>] dwc_otg_pcd_irq+0x10/0x20
      [<ffffff9008116328>] handle_irq_event_percpu+0x124/0x3ac
      [<ffffff9008116610>] handle_irq_event+0x60/0xa0
      [<ffffff900811af30>] handle_fasteoi_irq+0x10c/0x1d4
      [<ffffff9008115568>] generic_handle_irq+0x30/0x40
      [<ffffff90081159b4>] __handle_domain_irq+0xac/0xdc
      [<ffffff9008080e9c>] gic_handle_irq+0x64/0xa4
      ...
      Memory state around the buggy address:
        ffffffc0601f6400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        ffffffc0601f6480: 00 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc
       >ffffffc0601f6500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                             ^
        ffffffc0601f6580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
        ffffffc0601f6600: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
      ==================================================================
      Signed-off-by: default avatarWilliam Wu <william.wu@rock-chips.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      b7f73850
    • Bogdan Mirea's avatar
      usb: gadget: gserial: check if console kthread exists · 844cf8a9
      Bogdan Mirea authored
      Check for bad pointer that may result because of kthread_create failure.
      This check is needed since the gserial setup callback function
      (gs_console_setup()) is only freeing the info->con_buf in case of
      kthread_create failure which will result into bad info->console_thread
      pointer.
      Without checking info->console_thread pointer validity in the
      gserial_console_exit() function, before calling kthread_stop(), the
      rmmod will generate Kernel Oops.
      Signed-off-by: default avatarBogdan Mirea <Bogdan-Stefan_mirea@mentor.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      844cf8a9
    • Thinh Nguyen's avatar
      usb: dwc3: gadget: Prevent losing events in event cache · d325a1de
      Thinh Nguyen authored
      The dwc3 driver can overwite its previous events if its top-half IRQ
      handler (TH) gets invoked again before processing the events in the
      cache. We see this as a hang in the file transfer and the host will
      attempt to reset the device. TH gets the event count and deasserts the
      interrupt line by writing DWC3_GEVNTSIZ_INTMASK to DWC3_GEVNTSIZ. If
      there's a new event coming between reading the event count and interrupt
      deassertion, dwc3 will lose previous pending events. More generally, we
      will see 0 event count, which should not affect anything.
      
      This shouldn't be possible in the current dwc3 implementation. However,
      through testing and reading the PCIe trace, the TH occasionally still
      gets invoked one more time after HW interrupt deassertion. (With PCIe
      legacy interrupts, TH is called repeatedly as long as the interrupt line
      is asserted). We suspect that there is a small detection delay in the
      SW.
      
      To avoid this issue, Check DWC3_EVENT_PENDING flag to determine if the
      events are processed in the bottom-half IRQ handler. If not, return
      IRQ_HANDLED and don't process new event.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarThinh Nguyen <thinhn@synopsys.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      d325a1de
    • Roger Quadros's avatar
      usb: dwc3: gadget: Fix ISO transfer performance · f1d6826c
      Roger Quadros authored
      Commit 08a36b54 ("usb: dwc3: gadget: simplify __dwc3_gadget_ep_queue()")
      caused a small change in the way ISO transfer is handled in the case
      when XferInProgress event happens on Isoc EP with an active transfer.
      This caused a performance degradation of 50%. e.g. using g_webcam on DUT
      and luvcview on host the video frame rate dropped from 16fps to 8fps
      @high-speed.
      
      Make the ISO transfer handling equivalent to that prior to that commit
      to get back the original ISO performance numbers.
      
      Fixes: 08a36b54 ("usb: dwc3: gadget: simplify __dwc3_gadget_ep_queue()")
      Signed-off-by: default avatarRoger Quadros <rogerq@ti.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      f1d6826c
    • Heikki Krogerus's avatar
      usb: dwc3: pci: add Intel Cannonlake PCI IDs · 68217959
      Heikki Krogerus authored
      Intel Cannonlake PCH has the same DWC3 than Intel
      Sunrisepoint. Add the new IDs to the supported devices.
      Signed-off-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      68217959
  5. 15 May, 2017 1 commit