A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 03:01:39 -04:00
Code Issues Projects Releases Packages Wiki Activity

usb: fixes for v4.11-rc4

Browse source 
f_acm got an endianness fix by Oliver Neukum. This has been around for a
 long time but it's finally fixed.
 
 f_hid learned that it should never access hidg->req without first
 grabbing the spinlock.
 
 Roger Quadros fixed two bugs in the f_uvc function driver.
 
 Janusz Dziedzic fixed a very peculiar bug with EP0, one that's rather
 difficult to trigger. When we're dealing with bounced EP0 requests, we
 should delay unmap until after ->complete() is called.
 
 UDC class got a use-after-free fix.
 -----BEGIN PGP SIGNATURE-----
 
 iQJRBAABCAA7FiEElLzh7wn96CXwjh2IzL64meEamQYFAljTv0EdHGZlbGlwZS5i
 YWxiaUBsaW51eC5pbnRlbC5jb20ACgkQzL64meEamQbhehAAvauDyMvvL4S2PpCS
 zkarfhJfF4xOB8jzyewdz8oN57XogoUQIY6KOXFIIj9sWBt5Kx2zfA7uK3FBeflm
 lEaf2Mkbo3qXw9ChkrpUDEzpezYhnLPOpm7rMoXxseiVhew1Jt6AUjyzxMkOSG+I
 ng/bMRFvJY1Crp7V0kIba0PiR/owlVxZNTad5/C5Fi1wJQtpjd6Ry0cH7Pa/Eh1W
 KI5Mrdwgh0gZJUF8u8O1MZehyUXSTzkjvHeNV7lnL4TE19hoSGngQhvTYhnoU5lT
 XdphOntQ3m4p8rvNuEvqcwuS5BT2HQoW+BwyNdJF+FUtbbrNN2gUjbY5KD7ZuQtT
 cb67cLrQD04t0ig5zFo51SEZQiYei3rBfr8y0RXepY0RAqCzpqsSoXHxZJyfp1xb
 XzNnnYinbOe2bU3b/Ovs3mMQ4kfpygTHVDMT9iYsRJZmD7DGBhG9J6AR5jD+44Js
 etY82xW7pXiDazMm9OnQ4kuMii8nse3QDynhURU7H39Jw8ty4AdIgbngHgCjRvZA
 ulAeanjGtNNsDs0bsL9L3Q2gLUGiW/y5Ds+AQXKH6388FrwwoUYqCeqBIH5xI+wF
 LIErvqZyi3+Jd/SkmvKeubix3vTxgPZ72WY4xdO45vWznKWscyUWdj0OzXpdycLx
 gOK1mf6y9vRsyoyJ9l09JZ6CAsc=
 =BWuW
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-v4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

Felipe writes:

usb: fixes for v4.11-rc4

f_acm got an endianness fix by Oliver Neukum. This has been around for a
long time but it's finally fixed.

f_hid learned that it should never access hidg->req without first
grabbing the spinlock.

Roger Quadros fixed two bugs in the f_uvc function driver.

Janusz Dziedzic fixed a very peculiar bug with EP0, one that's rather
difficult to trigger. When we're dealing with bounced EP0 requests, we
should delay unmap until after ->complete() is called.

UDC class got a use-after-free fix.
This commit is contained in:
Greg Kroah-Hartman 2017-03-23 22:05:10 +01:00
commit 5617c05d44
372 changed files with 5757 additions and 2949 deletions
Download patch file Download diff file Expand all files Collapse all files

21
drivers/usb/dwc3/gadget.c
View file

@ -171,6 +171,7 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
int status)
{
struct dwc3 *dwc = dep->dwc;
unsigned int unmap_after_complete = false;
req->started = false;
list_del(&req->list);
@ -180,11 +181,19 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
if (req->request.status == -EINPROGRESS)
req->request.status = status;
if (dwc->ep0_bounced && dep->number <= 1)
/*
* NOTICE we don't want to unmap before calling ->complete() if we're
* dealing with a bounced ep0 request. If we unmap it here, we would end
* up overwritting the contents of req->buf and this could confuse the
* gadget driver.
*/
if (dwc->ep0_bounced && dep->number <= 1) {
dwc->ep0_bounced = false;
usb_gadget_unmap_request_by_dev(dwc->sysdev,
&req->request, req->direction);
unmap_after_complete = true;
} else {
usb_gadget_unmap_request_by_dev(dwc->sysdev,
&req->request, req->direction);
}
trace_dwc3_gadget_giveback(req);
@ -192,6 +201,10 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
usb_gadget_giveback_request(&dep->endpoint, &req->request);
spin_lock(&dwc->lock);
if (unmap_after_complete)
usb_gadget_unmap_request_by_dev(dwc->sysdev,
&req->request, req->direction);
if (dep->number > 1)
pm_runtime_put(dwc->dev);
}

8
drivers/usb/gadget/function/f_hid.c
View file

@ -367,7 +367,7 @@ try_again:
count = min_t(unsigned, count, hidg->report_length);
spin_unlock_irqrestore(&hidg->write_spinlock, flags);
status = copy_from_user(hidg->req->buf, buffer, count);
status = copy_from_user(req->buf, buffer, count);
if (status != 0) {
ERROR(hidg->func.config->cdev,
@ -378,9 +378,9 @@ try_again:
spin_lock_irqsave(&hidg->write_spinlock, flags);
/* we our function has been disabled by host */
/* when our function has been disabled by host */
if (!hidg->req) {
free_ep_req(hidg->in_ep, hidg->req);
free_ep_req(hidg->in_ep, req);
/*
* TODO
* Should we fail with error here?
@ -394,7 +394,7 @@ try_again:
req->complete = f_hidg_req_complete;
req->context = hidg;
status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC);
status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
if (status < 0) {
ERROR(hidg->func.config->cdev,
"usb_ep_queue error on int endpoint %zd\n", status);

10
drivers/usb/gadget/function/f_uvc.c
View file

@ -594,6 +594,14 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
opts->streaming_maxpacket = clamp(opts->streaming_maxpacket, 1U, 3072U);
opts->streaming_maxburst = min(opts->streaming_maxburst, 15U);
/* For SS, wMaxPacketSize has to be 1024 if bMaxBurst is not 0 */
if (opts->streaming_maxburst &&
(opts->streaming_maxpacket % 1024) != 0) {
opts->streaming_maxpacket = roundup(opts->streaming_maxpacket, 1024);
INFO(cdev, "overriding streaming_maxpacket to %d\n",
opts->streaming_maxpacket);
}
/* Fill in the FS/HS/SS Video Streaming specific descriptors from the
* module parameters.
*
@ -625,7 +633,7 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
uvc_ss_streaming_comp.bMaxBurst = opts->streaming_maxburst;
uvc_ss_streaming_comp.wBytesPerInterval =
cpu_to_le16(max_packet_size * max_packet_mult *
opts->streaming_maxburst);
(opts->streaming_maxburst + 1));
/* Allocate endpoints. */
ep = usb_ep_autoconfig(cdev->gadget, &uvc_control_ep);

1
drivers/usb/gadget/udc/pch_udc.c
View file

@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
td = phys_to_virt(addr);
addr2 = (dma_addr_t)td->next;
pci_pool_free(dev->data_requests, td, addr);
td->next = 0x00;
addr = addr2;
}
req->chain_len = 1;