Commit 6bfcc5fb authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'usb-6.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 

Pull USB fixes from Greg KH:
 "Here are some small USB driver fixes, and new device ids, for
  6.14-rc3. Lots of tiny stuff for reported problems, including:

   - new device ids and quirks

   - usb hub crash fix found by syzbot

   - dwc2 driver fix

   - dwc3 driver fixes

   - uvc gadget driver fix

   - cdc-acm driver fixes for a variety of different issues

   - other tiny bugfixes

  Almost all of these have been in linux-next this week, and all have
  passed 0-day testing"

* tag 'usb-6.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
  usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY
  usb: roles: set switch registered flag early on
  usb: gadget: uvc: Fix unstarted kthread worker
  USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
  usb: gadget: core: flush gadget workqueue after device removal
  USB: gadget: f_midi: f_midi_complete to call queue_work
  usb: core: fix pipe creation for get_bMaxPacketSize0
  usb: dwc3: Fix timeout issue during controller enter/exit from halt state
  USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
  USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
  usb: cdc-acm: Fix handling of oversized fragments
  usb: cdc-acm: Check control transfer buffer size before access
  usb: xhci: Restore xhci_pci support for Renesas HCs
  USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
  USB: serial: option: drop MeiG Smart defines
  USB: serial: option: fix Telit Cinterion FN990A name
  USB: serial: option: add Telit Cinterion FN990B compositions
  USB: serial: option: add MeiG Smart SLM828
  usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
  usb: dwc2: gadget: remove of_node reference upon udc_stop
  ...
parents ba643b6d 659f5d55

drivers/usb/class/cdc-acm.c

+21 −7
Original line number Diff line number Diff line
@@ -371,7 +371,7 @@ static void acm_process_notification(struct acm *acm, unsigned char *buf) 
static void acm_ctrl_irq(struct urb *urb)

{

	struct acm *acm = urb->context;

	struct usb_cdc_notification *dr = urb->transfer_buffer;

	struct usb_cdc_notification *dr;

	unsigned int current_size = urb->actual_length;

	unsigned int expected_size, copy_size, alloc_size;

	int retval;
@@ -398,14 +398,25 @@ static void acm_ctrl_irq(struct urb *urb) 


	usb_mark_last_busy(acm->dev);



	if (acm->nb_index)

	if (acm->nb_index == 0) {

		/*

		 * The first chunk of a message must contain at least the

		 * notification header with the length field, otherwise we

		 * can't get an expected_size.

		 */

		if (current_size < sizeof(struct usb_cdc_notification)) {

			dev_dbg(&acm->control->dev, "urb too short\n");

			goto exit;

		}

		dr = urb->transfer_buffer;

	} else {

		dr = (struct usb_cdc_notification *)acm->notification_buffer;



	}

	/* size = notification-header + (optional) data */

	expected_size = sizeof(struct usb_cdc_notification) +

					le16_to_cpu(dr->wLength);



	if (current_size < expected_size) {

	if (acm->nb_index != 0 || current_size < expected_size) {

		/* notification is transmitted fragmented, reassemble */

		if (acm->nb_size < expected_size) {

			u8 *new_buffer;
@@ -1727,13 +1738,16 @@ static const struct usb_device_id acm_ids[] = { 
	{ USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */

	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */

	},

	{ USB_DEVICE(0x045b, 0x023c),	/* Renesas USB Download mode */

	{ USB_DEVICE(0x045b, 0x023c),	/* Renesas R-Car H3 USB Download mode */

	.driver_info = DISABLE_ECHO,	/* Don't echo banner */

	},

	{ USB_DEVICE(0x045b, 0x0247),	/* Renesas R-Car D3 USB Download mode */

	.driver_info = DISABLE_ECHO,	/* Don't echo banner */

	},

	{ USB_DEVICE(0x045b, 0x0248),	/* Renesas USB Download mode */

	{ USB_DEVICE(0x045b, 0x0248),	/* Renesas R-Car M3-N USB Download mode */

	.driver_info = DISABLE_ECHO,	/* Don't echo banner */

	},

	{ USB_DEVICE(0x045b, 0x024D),	/* Renesas USB Download mode */

	{ USB_DEVICE(0x045b, 0x024D),	/* Renesas R-Car E3 USB Download mode */

	.driver_info = DISABLE_ECHO,	/* Don't echo banner */

	},

	{ USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */

drivers/usb/core/hub.c

+12 −2
Original line number Diff line number Diff line
@@ -1848,6 +1848,17 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) 
	desc = intf->cur_altsetting;

	hdev = interface_to_usbdev(intf);



	/*

	 * The USB 2.0 spec prohibits hubs from having more than one

	 * configuration or interface, and we rely on this prohibition.

	 * Refuse to accept a device that violates it.

	 */

	if (hdev->descriptor.bNumConfigurations > 1 ||

			hdev->actconfig->desc.bNumInterfaces > 1) {

		dev_err(&intf->dev, "Invalid hub with more than one config or interface\n");

		return -EINVAL;

	}



	/*

	 * Set default autosuspend delay as 0 to speedup bus suspend,

	 * based on the below considerations:
@@ -4698,7 +4709,6 @@ void usb_ep0_reinit(struct usb_device *udev) 
EXPORT_SYMBOL_GPL(usb_ep0_reinit);



#define usb_sndaddr0pipe()	(PIPE_CONTROL << 30)

#define usb_rcvaddr0pipe()	((PIPE_CONTROL << 30) | USB_DIR_IN)



static int hub_set_address(struct usb_device *udev, int devnum)

{
@@ -4804,7 +4814,7 @@ static int get_bMaxPacketSize0(struct usb_device *udev, 
	for (i = 0; i < GET_MAXPACKET0_TRIES; ++i) {

		/* Start with invalid values in case the transfer fails */

		buf->bDescriptorType = buf->bMaxPacketSize0 = 0;

		rc = usb_control_msg(udev, usb_rcvaddr0pipe(),

		rc = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),

				USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,

				USB_DT_DEVICE << 8, 0,

				buf, size,

drivers/usb/core/quirks.c

+6 −0
Original line number Diff line number Diff line
@@ -435,6 +435,9 @@ static const struct usb_device_id usb_quirk_list[] = { 
	{ USB_DEVICE(0x0c45, 0x7056), .driver_info =

			USB_QUIRK_IGNORE_REMOTE_WAKEUP },



	/* Sony Xperia XZ1 Compact (lilac) smartphone in fastboot mode */

	{ USB_DEVICE(0x0fce, 0x0dde), .driver_info = USB_QUIRK_NO_LPM },



	/* Action Semiconductor flash disk */

	{ USB_DEVICE(0x10d6, 0x2200), .driver_info =

			USB_QUIRK_STRING_FETCH_255 },
@@ -525,6 +528,9 @@ static const struct usb_device_id usb_quirk_list[] = { 
	/* Blackmagic Design UltraStudio SDI */

	{ USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },



	/* Teclast disk */

	{ USB_DEVICE(0x1f75, 0x0917), .driver_info = USB_QUIRK_NO_LPM },



	/* Hauppauge HVR-950q */

	{ USB_DEVICE(0x2040, 0x7200), .driver_info =

			USB_QUIRK_CONFIG_INTF_STRINGS },

drivers/usb/dwc2/gadget.c

+1 −0
Original line number Diff line number Diff line
@@ -4615,6 +4615,7 @@ static int dwc2_hsotg_udc_stop(struct usb_gadget *gadget) 
	spin_lock_irqsave(&hsotg->lock, flags);



	hsotg->driver = NULL;

	hsotg->gadget.dev.of_node = NULL;

	hsotg->gadget.speed = USB_SPEED_UNKNOWN;

	hsotg->enabled = 0;

drivers/usb/dwc3/core.h

+1 −0
Original line number Diff line number Diff line
@@ -717,6 +717,7 @@ struct dwc3_event_buffer { 
/**

 * struct dwc3_ep - device side endpoint representation

 * @endpoint: usb endpoint

 * @nostream_work: work for handling bulk NoStream

 * @cancelled_list: list of cancelled requests for this endpoint

 * @pending_list: list of pending requests for this endpoint

 * @started_list: list of started requests on this endpoint