[PATCH v2 0/9] Stop calling devm_request_irq() with invalid IRQs in the USB drivers

[PATCH v2 0/9] Stop calling devm_request_irq() with invalid IRQs in the USB drivers

[Sergey Shtylyov]

Here are 9 patches against the 'usb-linus' branch of GregKH's 'usb.git' repo.
The affected drivers call platform_get_irq() but largely ignore its result --
they blithely pass the negative error codes to request_irq() (and its ilk)
which expects *unsinged* IRQ #s. Stop doing that by checking what exactly
platform_get_irq() returns.

[1/9] usb: dwc3: meson-g12a: add IRQ check
[2/9] usb: dwc3: qcom: add IRQ check
[3/61] usb: gadget: udc: at91: add IRQ check
[4/9] usb: gadget: udc: s3c2410: add IRQ check
[5/9] usb: host: ohci-tmio: add IRQ check
[6/9] usb: misc: brcmstb-usb-pinmap: add IRQ check
[7/9] usb: phy: fsl-usb: add IRQ check
[8/9] usb: phy: tahvo: add IRQ check
[9/9] usb: phy: twl6030: add IRQ checks

[PATCH 1/9] usb: dwc3: meson-g12a: add IRQ check

[Sergey Shtylyov]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to devm_request_threaded_irq()
(which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
an original error code. Stop calling devm_request_threaded_irq() with the
invalid IRQ #s.

Fixes: f90db10779ad ("usb: dwc3: meson-g12a: Add support for IRQ based OTG switching")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>

---
 drivers/usb/dwc3/dwc3-meson-g12a.c |    2 ++
 1 file changed, 2 insertions(+)

Index: usb/drivers/usb/dwc3/dwc3-meson-g12a.c
===================================================================
--- usb.orig/drivers/usb/dwc3/dwc3-meson-g12a.c
+++ usb/drivers/usb/dwc3/dwc3-meson-g12a.c
@@ -598,6 +598,8 @@ static int dwc3_meson_g12a_otg_init(stru
 				   USB_R5_ID_DIG_IRQ, 0);
 
 		irq = platform_get_irq(pdev, 0);
+		if (irq < 0)
+			return irq;
 		ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
 						dwc3_meson_g12a_irq_thread,
 						IRQF_ONESHOT, pdev->name, priv);

[PATCH 2/9] usb: dwc3: qcom: add IRQ check

[Sergey Shtylyov]

In dwc3_qcom_acpi_register_core(), the driver neglects to check the result
of platform_get_irq()'s call and blithely assigns the negative error codes
to the allocated child device's IRQ resource and then passing this resource
to platform_device_add_resources() and later causing dwc3_otg_get_irq() to
fail anyway.  Stop calling platform_device_add_resources() with the invalid
IRQ #s, so that there's less complexity in the IRQ error checking.

Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>

---
 drivers/usb/dwc3/dwc3-qcom.c |    4 ++++
 1 file changed, 4 insertions(+)

Index: usb/drivers/usb/dwc3/dwc3-qcom.c
===================================================================
--- usb.orig/drivers/usb/dwc3/dwc3-qcom.c
+++ usb/drivers/usb/dwc3/dwc3-qcom.c
@@ -614,6 +614,10 @@ static int dwc3_qcom_acpi_register_core(
 		qcom->acpi_pdata->dwc3_core_base_size;
 
 	irq = platform_get_irq(pdev_irq, 0);
+	if (irq < 0) {
+		ret = irq;
+		goto out;
+	}
 	child_res[1].flags = IORESOURCE_IRQ;
 	child_res[1].start = child_res[1].end = irq;
 

[PATCH 3/9] usb: gadget: udc: at91: add IRQ check

[Sergey Shtylyov]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to devm_request_irq() (which takes
*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
error code. Stop calling devm_request_irq() with the invalid IRQ #s.

Fixes: 8b2e76687b39 ("USB: AT91 UDC updates, mostly power management")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>

---
 drivers/usb/gadget/udc/at91_udc.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Index: usb/drivers/usb/gadget/udc/at91_udc.c
===================================================================
--- usb.orig/drivers/usb/gadget/udc/at91_udc.c
+++ usb/drivers/usb/gadget/udc/at91_udc.c
@@ -1876,7 +1876,9 @@ static int at91udc_probe(struct platform
 	clk_disable(udc->iclk);
 
 	/* request UDC and maybe VBUS irqs */
-	udc->udp_irq = platform_get_irq(pdev, 0);
+	udc->udp_irq = retval = platform_get_irq(pdev, 0);
+	if (retval < 0)
+		goto err_unprepare_iclk;
 	retval = devm_request_irq(dev, udc->udp_irq, at91_udc_irq, 0,
 				  driver_name, udc);
 	if (retval) {

Re: [PATCH 1/9] usb: dwc3: meson-g12a: add IRQ check

[Martin Blumenstingl]

Hi Sergey,

On Sun, Aug 8, 2021 at 10:37 PM Sergey Shtylyov <s.shtylyov@omp.ru> wrote:
>
> The driver neglects to check the result of platform_get_irq()'s call and
> blithely passes the negative error codes to devm_request_threaded_irq()
> (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
> an original error code. Stop calling devm_request_threaded_irq() with the
> invalid IRQ #s.
>
> Fixes: f90db10779ad ("usb: dwc3: meson-g12a: Add support for IRQ based OTG switching")
> Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Thanks for spotting and fixing this issue!
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>

[PATCH 4/9] usb: gadget: udc: s3c2410: add IRQ check

[Sergey Shtylyov]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to devm_request_irq() (which takes
*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
error code. Stop calling devm_request_irq() with the invalid IRQ #s.

Fixes: 8b2e76687b39 ("USB: AT91 UDC updates, mostly power management")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>

---
 drivers/usb/gadget/udc/at91_udc.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Index: usb/drivers/usb/gadget/udc/at91_udc.c
===================================================================
--- usb.orig/drivers/usb/gadget/udc/at91_udc.c
+++ usb/drivers/usb/gadget/udc/at91_udc.c
@@ -1876,7 +1876,9 @@ static int at91udc_probe(struct platform
 	clk_disable(udc->iclk);
 
 	/* request UDC and maybe VBUS irqs */
-	udc->udp_irq = platform_get_irq(pdev, 0);
+	udc->udp_irq = retval = platform_get_irq(pdev, 0);
+	if (retval < 0)
+		goto err_unprepare_iclk;
 	retval = devm_request_irq(dev, udc->udp_irq, at91_udc_irq, 0,
 				  driver_name, udc);
 	if (retval) {

Re: [PATCH 4/9] usb: gadget: udc: s3c2410: add IRQ check

[Sergey Shtylyov]

Oops, duplicate patch. Scratch the series, I'm going to restart posting tomorrow... :-)

Re: [PATCH 2/9] usb: dwc3: qcom: add IRQ check

[Felipe Balbi]

Sergey Shtylyov <s.shtylyov@omp.ru> writes:

> In dwc3_qcom_acpi_register_core(), the driver neglects to check the result
> of platform_get_irq()'s call and blithely assigns the negative error codes
> to the allocated child device's IRQ resource and then passing this resource
> to platform_device_add_resources() and later causing dwc3_otg_get_irq() to
> fail anyway.  Stop calling platform_device_add_resources() with the invalid
> IRQ #s, so that there's less complexity in the IRQ error checking.
>
> Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
> Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>

Acked-by: Felipe Balbi <balbi@kernel.org>

-- 
balbi

Re: [PATCH 3/9] usb: gadget: udc: at91: add IRQ check

[Felipe Balbi]

Sergey Shtylyov <s.shtylyov@omp.ru> writes:

> The driver neglects to check the result of platform_get_irq()'s call and
> blithely passes the negative error codes to devm_request_irq() (which takes
> *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
> error code. Stop calling devm_request_irq() with the invalid IRQ #s.
>
> Fixes: 8b2e76687b39 ("USB: AT91 UDC updates, mostly power management")
> Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
>
> ---
>  drivers/usb/gadget/udc/at91_udc.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> Index: usb/drivers/usb/gadget/udc/at91_udc.c
> ===================================================================
> --- usb.orig/drivers/usb/gadget/udc/at91_udc.c
> +++ usb/drivers/usb/gadget/udc/at91_udc.c
> @@ -1876,7 +1876,9 @@ static int at91udc_probe(struct platform
>  	clk_disable(udc->iclk);
>  
>  	/* request UDC and maybe VBUS irqs */
> -	udc->udp_irq = platform_get_irq(pdev, 0);
> +	udc->udp_irq = retval = platform_get_irq(pdev, 0);
> +	if (retval < 0)
> +		goto err_unprepare_iclk;

let's avoid multiple assignments in one line. How about:

	if (udc->udp_irq < 0) {
        	retval = udc->udp_irq;
                goto err_unprepare_iclk;
        }

-- 
balbi

Re: [PATCH 1/9] usb: dwc3: meson-g12a: add IRQ check

[Felipe Balbi]

Sergey Shtylyov <s.shtylyov@omp.ru> writes:

> The driver neglects to check the result of platform_get_irq()'s call and
> blithely passes the negative error codes to devm_request_threaded_irq()
> (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
> an original error code. Stop calling devm_request_threaded_irq() with the
> invalid IRQ #s.
>
> Fixes: f90db10779ad ("usb: dwc3: meson-g12a: Add support for IRQ based OTG switching")
> Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>

Acked-by: Felipe Balbi <balbi@kernel.org>


-- 
balbi

Re: [PATCH 4/9] usb: gadget: udc: s3c2410: add IRQ check

[Felipe Balbi]

Sergey Shtylyov <s.shtylyov@omp.ru> writes:

> The driver neglects to check the result of platform_get_irq()'s call and
> blithely passes the negative error codes to devm_request_irq() (which takes
> *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
> error code. Stop calling devm_request_irq() with the invalid IRQ #s.
>
> Fixes: 8b2e76687b39 ("USB: AT91 UDC updates, mostly power management")
> Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>

Acked-by: Felipe Balbi <balbi@kernel.org>

-- 
balbi

Re: [PATCH v2 0/9] Stop calling devm_request_irq() with invalid IRQs in the USB drivers

[Greg Kroah-Hartman]

On Sun, Aug 08, 2021 at 11:30:57PM +0300, Sergey Shtylyov wrote:
> Here are 9 patches against the 'usb-linus' branch of GregKH's 'usb.git' repo.
> The affected drivers call platform_get_irq() but largely ignore its result --
> they blithely pass the negative error codes to request_irq() (and its ilk)
> which expects *unsinged* IRQ #s. Stop doing that by checking what exactly
> platform_get_irq() returns.
> 
> [1/9] usb: dwc3: meson-g12a: add IRQ check
> [2/9] usb: dwc3: qcom: add IRQ check
> [3/61] usb: gadget: udc: at91: add IRQ check

61?

> [4/9] usb: gadget: udc: s3c2410: add IRQ check
> [5/9] usb: host: ohci-tmio: add IRQ check
> [6/9] usb: misc: brcmstb-usb-pinmap: add IRQ check
> [7/9] usb: phy: fsl-usb: add IRQ check
> [8/9] usb: phy: tahvo: add IRQ check
> [9/9] usb: phy: twl6030: add IRQ checks


I only see 4 patches in this series, and the 4th, did not apply to my
tree :(

Can you please fix this up and resend it correctly?

thanks,

greg k-h

Re: [PATCH v2 0/9] Stop calling devm_request_irq() with invalid IRQs in the USB drivers

[Greg Kroah-Hartman]

On Fri, Aug 13, 2021 at 08:58:58AM +0200, Greg Kroah-Hartman wrote:
> On Sun, Aug 08, 2021 at 11:30:57PM +0300, Sergey Shtylyov wrote:
> > Here are 9 patches against the 'usb-linus' branch of GregKH's 'usb.git' repo.
> > The affected drivers call platform_get_irq() but largely ignore its result --
> > they blithely pass the negative error codes to request_irq() (and its ilk)
> > which expects *unsinged* IRQ #s. Stop doing that by checking what exactly
> > platform_get_irq() returns.
> > 
> > [1/9] usb: dwc3: meson-g12a: add IRQ check
> > [2/9] usb: dwc3: qcom: add IRQ check
> > [3/61] usb: gadget: udc: at91: add IRQ check
> 
> 61?
> 
> > [4/9] usb: gadget: udc: s3c2410: add IRQ check
> > [5/9] usb: host: ohci-tmio: add IRQ check
> > [6/9] usb: misc: brcmstb-usb-pinmap: add IRQ check
> > [7/9] usb: phy: fsl-usb: add IRQ check
> > [8/9] usb: phy: tahvo: add IRQ check
> > [9/9] usb: phy: twl6030: add IRQ checks
> 
> 
> I only see 4 patches in this series, and the 4th, did not apply to my
> tree :(
> 
> Can you please fix this up and resend it correctly?

Ah, see your v2 now...