Commit e536e0d4 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'usb-6.8-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 

Pull USB / Thunderbolt fixes from Greg KH:
 "Here are some small remaining fixes for USB and Thunderbolt drivers.
  Included in here are fixes for:

   - thunderbold NULL dereference fix

   - typec driver fixes

   - xhci driver regression fix

   - usb-storage divide-by-0 fix

   - ncm gadget driver fix

  All of these have been in linux-next with no reported issues"

* tag 'usb-6.8-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  xhci: Fix failure to detect ring expansion need.
  usb: port: Don't try to peer unused USB ports based on location
  usb: gadget: ncm: Fix handling of zero block length packets
  usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  usb: typec: tpcm: Fix PORT_RESET behavior for self powered devices
  usb: typec: ucsi: fix UCSI on SM8550 & SM8650 Qualcomm devices
  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()
parents 49deb280 b234c70f

drivers/thunderbolt/switch.c

+3 −0
Original line number Diff line number Diff line
@@ -1249,6 +1249,9 @@ int tb_port_update_credits(struct tb_port *port) 
	ret = tb_port_do_update_credits(port);

	if (ret)

		return ret;



	if (!port->dual_link_port)

		return 0;

	return tb_port_do_update_credits(port->dual_link_port);

}

drivers/usb/core/port.c

+3 −2
Original line number Diff line number Diff line
@@ -573,7 +573,7 @@ static int match_location(struct usb_device *peer_hdev, void *p) 
	struct usb_hub *peer_hub = usb_hub_to_struct_hub(peer_hdev);

	struct usb_device *hdev = to_usb_device(port_dev->dev.parent->parent);



	if (!peer_hub)

	if (!peer_hub || port_dev->connect_type == USB_PORT_NOT_USED)

		return 0;



	hcd = bus_to_hcd(hdev->bus);
@@ -584,7 +584,8 @@ static int match_location(struct usb_device *peer_hdev, void *p) 


	for (port1 = 1; port1 <= peer_hdev->maxchild; port1++) {

		peer = peer_hub->ports[port1 - 1];

		if (peer && peer->location == port_dev->location) {

		if (peer && peer->connect_type != USB_PORT_NOT_USED &&

		    peer->location == port_dev->location) {

			link_peers_report(port_dev, peer);

			return 1; /* done */

		}

drivers/usb/gadget/function/f_ncm.c

+1 −1
Original line number Diff line number Diff line
@@ -1346,7 +1346,7 @@ static int ncm_unwrap_ntb(struct gether *port, 
	if (to_process == 1 &&

	    (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) {

		to_process--;

	} else if (to_process > 0) {

	} else if ((to_process > 0) && (block_len != 0)) {

		ntb_ptr = (unsigned char *)(ntb_ptr + block_len);

		goto parse_ntb;

	}

drivers/usb/host/xhci-ring.c

+7 −1
Original line number Diff line number Diff line
@@ -326,7 +326,13 @@ static unsigned int xhci_ring_expansion_needed(struct xhci_hcd *xhci, struct xhc 
	/* how many trbs will be queued past the enqueue segment? */

	trbs_past_seg = enq_used + num_trbs - (TRBS_PER_SEGMENT - 1);



	if (trbs_past_seg <= 0)

	/*

	 * Consider expanding the ring already if num_trbs fills the current

	 * segment (i.e. trbs_past_seg == 0), not only when num_trbs goes into

	 * the next segment. Avoids confusing full ring with special empty ring

	 * case below

	 */

	if (trbs_past_seg < 0)

		return 0;



	/* Empty ring special case, enqueue stuck on link trb while dequeue advanced */

drivers/usb/storage/isd200.c

+18 −5
Original line number Diff line number Diff line
@@ -1105,7 +1105,7 @@ static void isd200_dump_driveid(struct us_data *us, u16 *id) 
static int isd200_get_inquiry_data( struct us_data *us )

{

	struct isd200_info *info = (struct isd200_info *)us->extra;

	int retStatus = ISD200_GOOD;

	int retStatus;

	u16 *id = info->id;



	usb_stor_dbg(us, "Entering isd200_get_inquiry_data\n");
@@ -1137,6 +1137,13 @@ static int isd200_get_inquiry_data( struct us_data *us ) 
				isd200_fix_driveid(id);

				isd200_dump_driveid(us, id);



				/* Prevent division by 0 in isd200_scsi_to_ata() */

				if (id[ATA_ID_HEADS] == 0 || id[ATA_ID_SECTORS] == 0) {

					usb_stor_dbg(us, "   Invalid ATA Identify data\n");

					retStatus = ISD200_ERROR;

					goto Done;

				}



				memset(&info->InquiryData, 0, sizeof(info->InquiryData));



				/* Standard IDE interface only supports disks */
@@ -1202,6 +1209,7 @@ static int isd200_get_inquiry_data( struct us_data *us ) 
		}

	}



 Done:

	usb_stor_dbg(us, "Leaving isd200_get_inquiry_data %08X\n", retStatus);



	return(retStatus);
@@ -1481,22 +1489,27 @@ static int isd200_init_info(struct us_data *us) 


static int isd200_Initialization(struct us_data *us)

{

	int rc = 0;



	usb_stor_dbg(us, "ISD200 Initialization...\n");



	/* Initialize ISD200 info struct */



	if (isd200_init_info(us) == ISD200_ERROR) {

	if (isd200_init_info(us) < 0) {

		usb_stor_dbg(us, "ERROR Initializing ISD200 Info struct\n");

		rc = -ENOMEM;

	} else {

		/* Get device specific data */



		if (isd200_get_inquiry_data(us) != ISD200_GOOD)

		if (isd200_get_inquiry_data(us) != ISD200_GOOD) {

			usb_stor_dbg(us, "ISD200 Initialization Failure\n");

		else

			rc = -EINVAL;

		} else {

			usb_stor_dbg(us, "ISD200 Initialization complete\n");

		}

	}



	return 0;

	return rc;

}