* [PATCH AUTOSEL 4.14 098/371] usb: phy: twl6030-usb: fix possible use-after-free on remove
[not found] <20200116172403.18149-1-sashal@kernel.org>
@ 2020-01-16 17:19 ` Sasha Levin
2020-01-16 17:19 ` [PATCH AUTOSEL 4.14 106/371] cdc-wdm: pass return value of recover_from_urb_loss Sasha Levin
` (4 subsequent siblings)
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2020-01-16 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sven Van Asbroeck, Tony Lindgren, Bin Liu, Sven Van Asbroeck,
Felipe Balbi, Sasha Levin, linux-usb
From: Sven Van Asbroeck <thesven73@gmail.com>
[ Upstream commit 5895d311d28f2605e2f71c1a3e043ed38f3ac9d2 ]
In remove(), use cancel_delayed_work_sync() to cancel the
delayed work. Otherwise there's a chance that this work
will continue to run until after the device has been removed.
This issue was detected with the help of Coccinelle.
Cc: Tony Lindgren <tony@atomide.com>
Cc: Bin Liu <b-liu@ti.com>
Fixes: b6a619a883c3 ("usb: phy: Check initial state for twl6030")
Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/phy/phy-twl6030-usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index b5dc077ed7d3..8e14fa221191 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -413,7 +413,7 @@ static int twl6030_usb_remove(struct platform_device *pdev)
{
struct twl6030_usb *twl = platform_get_drvdata(pdev);
- cancel_delayed_work(&twl->get_status_work);
+ cancel_delayed_work_sync(&twl->get_status_work);
twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
REG_INT_MSK_LINE_C);
twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH AUTOSEL 4.14 106/371] cdc-wdm: pass return value of recover_from_urb_loss
[not found] <20200116172403.18149-1-sashal@kernel.org>
2020-01-16 17:19 ` [PATCH AUTOSEL 4.14 098/371] usb: phy: twl6030-usb: fix possible use-after-free on remove Sasha Levin
@ 2020-01-16 17:19 ` Sasha Levin
2020-01-16 17:20 ` [PATCH AUTOSEL 4.14 178/371] usb: gadget: fsl: fix link error against usb-gadget module Sasha Levin
` (3 subsequent siblings)
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2020-01-16 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: YueHaibing, Greg Kroah-Hartman, Sasha Levin, linux-usb
From: YueHaibing <yuehaibing@huawei.com>
[ Upstream commit 0742a338f5b3446a26de551ad8273fb41b2787f2 ]
'rv' is the correct return value, pass it upstream instead of 0
Fixes: 17d80d562fd7 ("USB: autosuspend for cdc-wdm")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/class/cdc-wdm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index a593cdfc897f..d5d42dccda10 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -1085,7 +1085,7 @@ static int wdm_post_reset(struct usb_interface *intf)
rv = recover_from_urb_loss(desc);
mutex_unlock(&desc->wlock);
mutex_unlock(&desc->rlock);
- return 0;
+ return rv;
}
static struct usb_driver wdm_driver = {
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH AUTOSEL 4.14 178/371] usb: gadget: fsl: fix link error against usb-gadget module
[not found] <20200116172403.18149-1-sashal@kernel.org>
2020-01-16 17:19 ` [PATCH AUTOSEL 4.14 098/371] usb: phy: twl6030-usb: fix possible use-after-free on remove Sasha Levin
2020-01-16 17:19 ` [PATCH AUTOSEL 4.14 106/371] cdc-wdm: pass return value of recover_from_urb_loss Sasha Levin
@ 2020-01-16 17:20 ` Sasha Levin
2020-01-16 17:20 ` [PATCH AUTOSEL 4.14 179/371] dwc2: gadget: Fix completed transfer size calculation in DDMA Sasha Levin
` (2 subsequent siblings)
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2020-01-16 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Arnd Bergmann, Felipe Balbi, Sasha Levin, linux-usb
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 2100e3ca3676e894fa48b8f6f01d01733387fe81 ]
The dependency to ensure this driver links correctly fails since
it can not be a loadable module:
drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_set_peripheral':
phy-fsl-usb.c:(.text+0x2224): undefined reference to `usb_gadget_vbus_disconnect'
Make the option 'tristate' so it can work correctly.
Fixes: 5a8d651a2bde ("usb: gadget: move gadget API functions to udc-core")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/phy/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 85a92d0813dd..440238061edd 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -20,7 +20,7 @@ config AB8500_USB
in host mode, low speed.
config FSL_USB2_OTG
- bool "Freescale USB OTG Transceiver Driver"
+ tristate "Freescale USB OTG Transceiver Driver"
depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
select USB_PHY
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH AUTOSEL 4.14 179/371] dwc2: gadget: Fix completed transfer size calculation in DDMA
[not found] <20200116172403.18149-1-sashal@kernel.org>
` (2 preceding siblings ...)
2020-01-16 17:20 ` [PATCH AUTOSEL 4.14 178/371] usb: gadget: fsl: fix link error against usb-gadget module Sasha Levin
@ 2020-01-16 17:20 ` Sasha Levin
2020-01-16 17:22 ` [PATCH AUTOSEL 4.14 253/371] usb: host: xhci-hub: fix extra endianness conversion Sasha Levin
2020-01-16 17:23 ` [PATCH AUTOSEL 4.14 321/371] USB: usb-skeleton: fix use-after-free after driver unbind Sasha Levin
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2020-01-16 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Minas Harutyunyan, Minas Harutyunyan, Felipe Balbi, Sasha Levin,
linux-usb
From: Minas Harutyunyan <minas.harutyunyan@synopsys.com>
[ Upstream commit 5acb4b970184d189d901192d075997c933b82260 ]
Fix calculation of transfer size on completion in function
dwc2_gadget_get_xfersize_ddma().
Added increment of descriptor pointer to move to next descriptor in
the loop.
Fixes: aa3e8bc81311 ("usb: dwc2: gadget: DDMA transfer start and complete")
Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc2/gadget.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index e164439b2154..4af9a1c652ed 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -2276,6 +2276,7 @@ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
if (status & DEV_DMA_STS_MASK)
dev_err(hsotg->dev, "descriptor %d closed with %x\n",
i, status & DEV_DMA_STS_MASK);
+ desc++;
}
return bytes_rem;
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH AUTOSEL 4.14 253/371] usb: host: xhci-hub: fix extra endianness conversion
[not found] <20200116172403.18149-1-sashal@kernel.org>
` (3 preceding siblings ...)
2020-01-16 17:20 ` [PATCH AUTOSEL 4.14 179/371] dwc2: gadget: Fix completed transfer size calculation in DDMA Sasha Levin
@ 2020-01-16 17:22 ` Sasha Levin
2020-01-16 17:23 ` [PATCH AUTOSEL 4.14 321/371] USB: usb-skeleton: fix use-after-free after driver unbind Sasha Levin
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2020-01-16 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ruslan Bilovol, Mathias Nyman, Greg Kroah-Hartman, Sasha Levin,
linux-usb
From: Ruslan Bilovol <ruslan.bilovol@gmail.com>
[ Upstream commit 6269e4c76eacabaea0d0099200ae1a455768d208 ]
Don't do extra cpu_to_le32 conversion for
put_unaligned_le32 because it is already implemented
in this function.
Fixes sparse error:
xhci-hub.c:1152:44: warning: incorrect type in argument 1 (different base types)
xhci-hub.c:1152:44: expected unsigned int [usertype] val
xhci-hub.c:1152:44: got restricted __le32 [usertype]
Fixes: 395f540 "xhci: support new USB 3.1 hub request to get extended port status"
Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Link: https://lore.kernel.org/r/1562501839-26522-1-git-send-email-ruslan.bilovol@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index d1363f3fabfa..3bb38d9dc45b 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1118,7 +1118,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
}
port_li = readl(port_array[wIndex] + PORTLI);
status = xhci_get_ext_port_status(temp, port_li);
- put_unaligned_le32(cpu_to_le32(status), &buf[4]);
+ put_unaligned_le32(status, &buf[4]);
}
break;
case SetPortFeature:
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH AUTOSEL 4.14 321/371] USB: usb-skeleton: fix use-after-free after driver unbind
[not found] <20200116172403.18149-1-sashal@kernel.org>
` (4 preceding siblings ...)
2020-01-16 17:22 ` [PATCH AUTOSEL 4.14 253/371] usb: host: xhci-hub: fix extra endianness conversion Sasha Levin
@ 2020-01-16 17:23 ` Sasha Levin
5 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2020-01-16 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johan Hovold, Greg Kroah-Hartman, Sasha Levin, linux-usb
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 6353001852776e7eeaab4da78922d4c6f2b076af ]
The driver failed to stop its read URB on disconnect, something which
could lead to a use-after-free in the completion handler after driver
unbind in case the character device has been closed.
Fixes: e7389cc9a7ff ("USB: skel_read really sucks royally")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009170944.30057-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/usb-skeleton.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/usb-skeleton.c b/drivers/usb/usb-skeleton.c
index 7140d06ae04f..baf047c0be6c 100644
--- a/drivers/usb/usb-skeleton.c
+++ b/drivers/usb/usb-skeleton.c
@@ -575,6 +575,7 @@ static void skel_disconnect(struct usb_interface *interface)
dev->disconnected = 1;
mutex_unlock(&dev->io_mutex);
+ usb_kill_urb(dev->bulk_in_urb);
usb_kill_anchored_urbs(&dev->submitted);
/* decrement our usage count */
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-01-16 18:32 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20200116172403.18149-1-sashal@kernel.org>
2020-01-16 17:19 ` [PATCH AUTOSEL 4.14 098/371] usb: phy: twl6030-usb: fix possible use-after-free on remove Sasha Levin
2020-01-16 17:19 ` [PATCH AUTOSEL 4.14 106/371] cdc-wdm: pass return value of recover_from_urb_loss Sasha Levin
2020-01-16 17:20 ` [PATCH AUTOSEL 4.14 178/371] usb: gadget: fsl: fix link error against usb-gadget module Sasha Levin
2020-01-16 17:20 ` [PATCH AUTOSEL 4.14 179/371] dwc2: gadget: Fix completed transfer size calculation in DDMA Sasha Levin
2020-01-16 17:22 ` [PATCH AUTOSEL 4.14 253/371] usb: host: xhci-hub: fix extra endianness conversion Sasha Levin
2020-01-16 17:23 ` [PATCH AUTOSEL 4.14 321/371] USB: usb-skeleton: fix use-after-free after driver unbind Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).