Commit Graph

2195 Commits

Author SHA1 Message Date
Greg Kroah-Hartman bdd78f22ff usb: fixes for v3.12-rc4
Here are some more fixes to musb's OTG support and a regression
 caused on latest merge window; pxa25x_udc and gpio-vbus learned
 to cope with deferred probe; s3c-hsotg got a fix for non-periodic
 endpoints write size and f_fs got an error handling fix for cases
 where ffs_do_descs() fail.
 
 Signed-of-by: Felipe Balbi <balbi@ti.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJSStwTAAoJEIaOsuA1yqREpMgP/2BbaC0hCO3wA6NPul2drke2
 lb1yKU9bKhk3R0McRWhV9iJGjStpIBYLlbE66sjAvu2r53JktMysb6xPwnPwgNPK
 RabFpQnNiS/voyaAKyLq69WIPC9dfT/LwUXS4NouwTgEjPJuYs3La69NJRZlHx8A
 iFXsQtgS2h6gIKm2r71TYamgO/jYmwZsetpwOrjCz1AlTt/6wjy5ilQthHs+F0de
 iNFRsvRYyuMO2BEmqI286U7FWPK4FAO3bsqwP4EWZ7VqTLBBHqxFA3jscbeidbB4
 U6qRbekMfYCrYjYkKwuQAsFpvt6WHh8peCsWLxJ9SnyugwcXG4UwimP4qqkS6GhC
 VJpyYhE8AAHiPnXSigEFUPo3uwcylXdwg3viybezlSI/7X/NlQvhGWJZBDdSESS2
 ThieH2sFuqtk5XkG8lXySCeab/qp3NUNVVJf81G0sIjsgU2kmkTkE9913ird0kN8
 k+fkggtrK5YqbPoEIhhIdhwloyM6dxL3pLe3LHCwkyZ8Aeze8Wv1nd31OHWU1uVh
 ZjHA202MzpkHnj2gykzKS808h12S8czzIe5jTyiPPAwOz87DIxx64MqG2OGM8Rtv
 +/N+E3K/b0//Fg/GGFN2du+7SrRW4U8cAhBX9mh9j9eI2X9Yd3HclviSNM9lVTcN
 iCIY3ivMFg29aTVFIYFC
 =BQeb
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-v3.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

Felipe writes:

usb: fixes for v3.12-rc4

Here are some more fixes to musb's OTG support and a regression
caused on latest merge window; pxa25x_udc and gpio-vbus learned
to cope with deferred probe; s3c-hsotg got a fix for non-periodic
endpoints write size and f_fs got an error handling fix for cases
where ffs_do_descs() fail.

Signed-of-by: Felipe Balbi <balbi@ti.com>
2013-10-01 14:22:05 -07:00
Robert Baldyga b377216bd2 usb: gadget: s3c-hsotg: fix can_write limit for non-periodic endpoints
Value of can_write variable in s3c_hsotg_write_fifo function should be limited
to 512 only for non-periodic endpoints. There was some discrepancy between
comment and code, because comment suggests correct behavior, but in the code
limit was applied to periodic endpoints too. So there is additional check
causing the limitation concerns only non-periodic endpoints.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-10-01 09:24:14 -05:00
Robert Baldyga 8854894c04 usb: gadget: f_fs: fix error handling
This patch add missing error check in ffs_func_bind() function, after
ffs_do_descs() function call for high speed descriptors. Without this
check it's possible that the module will try dereference incorrect
pointer.

[ balbi@ti.com : removed trailing empty line ]

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-10-01 09:04:22 -05:00
Al Viro 2606b28aab USB: Fix breakage in ffs_fs_mount()
There's a bunch of failure exits in ffs_fs_mount() with
seriously broken recovery logics.  Most of that appears to stem
from misunderstanding of the ->kill_sb() semantics; unlike
->put_super() it is called for *all* superblocks of given type,
no matter how (in)complete the setup had been.  ->put_super()
is called only if ->s_root is not NULL; any failure prior to
setting ->s_root will have the call of ->put_super() skipped.
->kill_sb(), OTOH, awaits every superblock that has come from
sget().

Current behaviour of ffs_fs_mount():

We have struct ffs_sb_fill_data data on stack there.  We do
	ffs_dev = functionfs_acquire_dev_callback(dev_name);
and store that in data.private_data.  Then we call mount_nodev(),
passing it ffs_sb_fill() as a callback.  That will either fail
outright, or manage to call ffs_sb_fill().  There we allocate an
instance of struct ffs_data, slap the value of ffs_dev (picked
from data.private_data) into ffs->private_data and overwrite
data.private_data by storing ffs into an overlapping member
(data.ffs_data).  Then we store ffs into sb->s_fs_info and attempt
to set the rest of the things up (root inode, root dentry, then
create /ep0 there).  Any of those might fail.  Should that
happen, we get ffs_fs_kill_sb() called before mount_nodev()
returns.  If mount_nodev() fails for any reason whatsoever,
we proceed to
	functionfs_release_dev_callback(data.ffs_data);

That's broken in a lot of ways.  Suppose the thing has failed in
allocation of e.g. root inode or dentry.  We have
	functionfs_release_dev_callback(ffs);
	ffs_data_put(ffs);
done by ffs_fs_kill_sb() (ffs accessed via sb->s_fs_info), followed by
	functionfs_release_dev_callback(ffs);
from ffs_fs_mount() (via data.ffs_data).  Note that the second
functionfs_release_dev_callback() has every chance to be done to freed memory.

Suppose we fail *before* root inode allocation.  What happens then?
ffs_fs_kill_sb() doesn't do anything to ffs (it's either not called at all,
or it doesn't have a pointer to ffs stored in sb->s_fs_info).  And
	functionfs_release_dev_callback(data.ffs_data);
is called by ffs_fs_mount(), but here we are in nasal daemon country - we
are reading from a member of union we'd never stored into.  In practice,
we'll get what we used to store into the overlapping field, i.e. ffs_dev.
And then we get screwed, since we treat it (struct gfs_ffs_obj * in
disguise, returned by functionfs_acquire_dev_callback()) as struct
ffs_data *, pick what would've been ffs_data ->private_data from it
(*well* past the actual end of the struct gfs_ffs_obj - struct ffs_data
is much bigger) and poke in whatever it points to.

FWIW, there's a minor leak on top of all that in case if ffs_sb_fill()
fails on kstrdup() - ffs is obviously forgotten.

The thing is, there is no point in playing all those games with union.
Just allocate and initialize ffs_data *before* calling mount_nodev() and
pass a pointer to it via data.ffs_data.  And once it's stored in
sb->s_fs_info, clear data.ffs_data, so that ffs_fs_mount() knows that
it doesn't need to kill the sucker manually - from that point on
we'll have it done by ->kill_sb().

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Cc: stable <stable@vger.kernel.org> # 3.3+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26 16:22:29 -07:00
Johan Hovold 8233729853 usb: gadget: pxa25x_udc: fix deferred probe from __init
Move probe out of __init section and don't use platform_driver_probe
which cannot be used with deferred probing.

Since commit e9354576 ("gpiolib: Defer failed gpio requests by default")
this driver might return -EPROBE_DEFER if a gpio_request fails.

Cc: Eric Miao <eric.y.miao@gmail.com>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Haojian Zhuang <haojian.zhuang@gmail.com>
Cc: Felipe Balbi <balbi@ti.com>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-09-23 14:29:49 -05:00
Greg Kroah-Hartman 42f4891ca2 usb: fixes for v3.12-rc2
Here's first set of fixes for v3.12-rc series, patches have
 been soaking in linux-usb for a while now.
 
 We have the usual sparse and build warnings, a Kconfig fix
 to a mismerge on dwc3 Kconfig, fix for a possible memory leak
 in dwc3, s3c-hsotg won't disconnect when bus goes idle, locking
 fix in mv_u3d_core, endpoint disable fix in f_mass_storage.
 
 We also have one device ID added to dwc3's PCI glue layer in order
 to support Intel's BayTrail devices.
 
 Signed-of-by: Felipe Balbi <balbi@ti.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJSOH9nAAoJEIaOsuA1yqRElTcQALIZuTv00Lg4Sts4tHHVO3KB
 qvQEcv9cBZFtQkD053ufAkJ7uRMkl7Ew5jzJj3AFhLwQ8d0eOY6O9lARG2mZdJf1
 99mCw/BgLAs9q9xgAQvuVOnmXNsi/+A5LQrbcfUG5hoecVZZhfPKZydkUGRE4+be
 UG7T0D72saa3GfnvuHGv1Z5i4IEijx6amzPaFuDQzsRNjpdEn28lqvp5nN/amKuw
 Bda++9o5DPEu/I+MseTx8eSUfrvqR7khFOxJeNlhJxkgoDQiEXaOQEbgIj1bLcEx
 bs7RF28r0Rs75seImD+0TiXlGJVr/kv2EJ5RI4qgZ+MRxu8lrfeUWHNCdIiAI62d
 rqwqnxL0AZiHuQdN2AEle9VJsoBaDw2sB8GiDQ3ZHms3InEVaVtAIpd+E0gXdf0y
 W713iZqf/9zcfuoTA0y8G/foCaWuUXr89kpv5mpGejAJBLbHRk/0hEQzW4Y/eeMb
 RbKjWFseD2bEWGlRqIcd2E73AKM8TccjmEc+khj/9kZzbrF+uoUbUrULhkKHp190
 4fBKVT/0y4s63zadmkebN91vUBpLtnYIykXU4sDm79GlImMXJA/RLmkbfCtaDyAQ
 7rEknrLEpvMVe6VbSMiitgmZb8qwy2kemhGCGbJ6e4jU7BKThUTE1gt8SlJhQm1M
 W2SoxhxQRKxXtQT/xkxt
 =51X+
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-v3.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

Felipe writes:

usb: fixes for v3.12-rc2

Here's first set of fixes for v3.12-rc series, patches have
been soaking in linux-usb for a while now.

We have the usual sparse and build warnings, a Kconfig fix
to a mismerge on dwc3 Kconfig, fix for a possible memory leak
in dwc3, s3c-hsotg won't disconnect when bus goes idle, locking
fix in mv_u3d_core, endpoint disable fix in f_mass_storage.

We also have one device ID added to dwc3's PCI glue layer in order
to support Intel's BayTrail devices.

Signed-of-by: Felipe Balbi <balbi@ti.com>
2013-09-17 13:00:43 -07:00
Dave Jones dfe2902032 USB: Faraday fotg210: fix email addresses
Update the MODULE_AUTHOR field of the Faraday OTG drivers to reflect
current maintainers email address.

Signed-off-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-17 09:36:10 -07:00
Chanho Park d3675e3a48 usb: s3c-hsotg: do not disconnect gadget when receiving ErlySusp intr
DWC2 databook indicates if the core sets "ErlySusp" bit, an idle state has been
detected on the USB for 3 ms. This situation can be occurred when waiting
a request from user daemon. So, we should keep the connection between udc and
gadget even though this interrupt is occurred.

Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-09-17 11:08:46 -05:00
Marek Szyprowski c8c10253d8 usb: s3c-hsotg: fix unregistration function
After driver conversion to udc_start/udc_stop infrastructure (commit
"usb:hsotg:samsung: Use new udc_start and udc_stop callbacks"
f65f0f1098) the gadget unregistration function is almost always called
with 'driver' parameter being NULL, what caused that the unregistration
code has not been executed at all. This is a leftover from the earlier
verison of this function (which used simple start/stop interface), where
driver parameter was obligatory.

This patch removes the NULL check for the 'driver' pointer and removes
all dereferences of it. It also moves disabling voltage regulators out
of the atomic context, because handling regulators (which are usually
i2c devices) might require sleeping.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-09-17 11:08:45 -05:00
Peter Oh 7f2ccc8cb2 usb: gadget: f_mass_storage: reset endpoint driver data when disabled
Gadgets endpoint driver data is a criteria to judge that
whether the endpoints are in use or not. When gadget gets
assigned an endpoint from endpoint list, they check its
driver data if the driver data is NULL.

If the driver data is not NULL then they regard it as in use.
Therefore all of gadgets should reset their endpoints driver
data to NULL as they are disabled. Otherwise it causes a leak
of endpoint resource.

Signed-off-by: Peter Oh <poh@broadcom.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-09-17 11:07:14 -05:00
Sachin Kamat 5c18a3636f usb: gadget: f_eem: Staticize eem_alloc
'eem_alloc' is local to this file. Make it static.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-09-17 11:06:50 -05:00
Sachin Kamat 0f0392f245 usb: gadget: f_ecm: Staticize ecm_alloc
'ecm_alloc' is local to this file. Make it static.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-09-17 11:06:44 -05:00
Chen Gang 780cc0f370 usb: gadget: add '__ref' for rndis_config_register() and cdc_config_register()
They are only called by '__ref' function multi_bind(), and they will
call '__init' functions, so recommend to let them '__ref' too.

The related warnings:

  WARNING: drivers/usb/gadget/g_multi.o(.text+0xded6): Section mismatch in reference from the variable .LM2921 to the variable .init.text:_rndis_do_config
  The function .LM2921() references
  the variable __init _rndis_do_config.
  This is often because .LM2921 lacks a __init
  annotation or the annotation of _rndis_do_config is wrong.

  WARNING: drivers/usb/gadget/g_multi.o(.text+0xdf16): Section mismatch in reference from the variable .LM2953 to the variable .init.text:_cdc_do_config
  The function .LM2953() references
  the variable __init _cdc_do_config.
  This is often because .LM2953 lacks a __init
  annotation or the annotation of _cdc_do_config is wrong.

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-09-17 10:59:19 -05:00
Andrzej Pietrasiewicz d2ff405960 usb: gadget: cdc2: fix conversion to new interface of f_ecm
This fixes commit a38a275030
(usb: gadget: cdc2: convert to new interface of f_ecm)

The invocation of usb_get_function_instance() is in cdc_bind()
and should not be repeated in cdc_do_config().

Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-09-17 10:38:52 -05:00
Alan Stern 5f5610f69b usb: gadget: fix a bug and a WARN_ON in dummy-hcd
This patch fixes a NULL pointer dereference and a WARN_ON in
dummy-hcd.  These things were the result of moving to the UDC core
framework, and possibly of changes to that framework.

Now unloading a gadget driver causes the UDC to be stopped after the
gadget driver is unbound, not before.  Therefore the "driver" argument
to dummy_udc_stop() can be NULL, so we must not try to print the
driver's name without checking first.

Also, the UDC framework automatically unregisters the gadget when the
UDC is deleted.  Therefore a sysfs attribute file attached to the
gadget must be removed before the UDC is deleted, not after.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-09-17 10:38:51 -05:00
Alexey Khoroshilov 2389df458b usb: gadget: mv_u3d_core: fix violation of locking discipline in mv_u3d_ep_disable()
mv_u3d_nuke() expects to be calles with ep->u3d->lock held,
because mv_u3d_done() does. But mv_u3d_ep_disable() calls it
without lock that can lead to unpleasant consequences.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-09-17 10:38:48 -05:00
Linus Torvalds 9bf12df31f Merge git://git.kvack.org/~bcrl/aio-next
Pull aio changes from Ben LaHaise:
 "First off, sorry for this pull request being late in the merge window.
  Al had raised a couple of concerns about 2 items in the series below.
  I addressed the first issue (the race introduced by Gu's use of
  mm_populate()), but he has not provided any further details on how he
  wants to rework the anon_inode.c changes (which were sent out months
  ago but have yet to be commented on).

  The bulk of the changes have been sitting in the -next tree for a few
  months, with all the issues raised being addressed"

* git://git.kvack.org/~bcrl/aio-next: (22 commits)
  aio: rcu_read_lock protection for new rcu_dereference calls
  aio: fix race in ring buffer page lookup introduced by page migration support
  aio: fix rcu sparse warnings introduced by ioctx table lookup patch
  aio: remove unnecessary debugging from aio_free_ring()
  aio: table lookup: verify ctx pointer
  staging/lustre: kiocb->ki_left is removed
  aio: fix error handling and rcu usage in "convert the ioctx list to table lookup v3"
  aio: be defensive to ensure request batching is non-zero instead of BUG_ON()
  aio: convert the ioctx list to table lookup v3
  aio: double aio_max_nr in calculations
  aio: Kill ki_dtor
  aio: Kill ki_users
  aio: Kill unneeded kiocb members
  aio: Kill aio_rw_vect_retry()
  aio: Don't use ctx->tail unnecessarily
  aio: io_cancel() no longer returns the io_event
  aio: percpu ioctx refcount
  aio: percpu reqs_available
  aio: reqs_active -> reqs_available
  aio: fix build when migration is disabled
  ...
2013-09-13 10:55:58 -07:00
Martin Schwidefsky 0244ad004a Remove GENERIC_HARDIRQ config option
After the last architecture switched to generic hard irqs the config
options HAVE_GENERIC_HARDIRQS & GENERIC_HARDIRQS and the related code
for !CONFIG_GENERIC_HARDIRQS can be removed.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2013-09-13 15:09:52 +02:00
Graham Williams d257221854 usb: acm gadget: Null termintate strings table
The gadget strings table should be null terminated.
usb_gadget_get_string() loops through the table
expecting a null at the end of the list.

Signed-off-by: Graham Williams <gwilli@broadcom.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-08-30 11:10:36 -07:00
Libo Chen 3cb40a590e usb: fotg210-udc: use platform_{get,set}_drvdata()
Use the wrapper functions for getting and setting the driver data using
platform_device instead of using dev_{get,set}_drvdata() with &pdev->dev,
so we can directly pass a struct platform_device.

Signed-off-by: Libo Chen <libo.chen@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-08-27 21:35:23 -07:00
Greg Kroah-Hartman 752e69555d usb: patches for v3.12 merge window (part 2)
Here's a set of important fixes for v3.12 merge
 window which have been pending in the mailing list
 for quite some time.
 
 We have use-after-free fixes, signedness fixes,
 more of HAS_DMA dependencies, fixes for NULL pointer
 deferences, build fixes and some other fixes to
 the musb driver caused by recent patches.
 
 Patches are quite small and contain valuable fixes
 which will give us a much better -rc1 release.
 
 Please consider merging
 
 Signed-of-by: Felipe Balbi <balbi@ti.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJSHQe5AAoJEIaOsuA1yqREgaUP/3wnPuYiP5lvNb60B/YcKlbV
 0Qyw/6yEz2+H0cbUsGWxqNTqX6bj72vPuNyAM4EGCs26ZJG8Jz6fFpJ7xIQCsGaY
 7iGo/RiGvCNQj15r/QBjM0mMIQSG8QwU/sFl45Ai/0g3sbUdKBdHVm4lRMV1Q9EG
 +vSUvmkuidXZ2PuF2k2goVofeQ7NOPJSxvP91Vt3DQK2CIICol8J+IXgMkJUGTOW
 xR7L5lRIMTj7F0PWY63x8HrEQdGqlXjvcq+/FQOd++ErUkDMcQ6q/G1vZeHqu9aD
 kSMDoJOrjYM2qwW29JH9rR7y4F1ac+XYQj3MoNd95GRWMWWx1mXqIGYbTc8gel/S
 1h0Vu2qVsFsWZTNRESY8wWSKb8ogoubMQX+PNpwZZnrqJBEk7/WpnX42gF209tLc
 xYnExU4ZIAES2j5QZ4eJbFAo5RiqWQ4EVVTscWTVZ1zFf06u6Bqa+Nk6GB+qS91U
 QOKonQi9SZRx4sMjt7H6kYbsNBIslplSZCqFcory6XTbtpDhoTlyx9e11rnWV8wC
 vSQPpc2fyVlPNaJE7UQhC2U2MHiXCsT9KGYr5CD5JKMaNmcBSSMVDGvUZQbuu5wA
 KutERTnU+x+KHwtnoA7QfcT97SR8cothVRa1+CrvzkPd8hQJGvai29RumLPjM3da
 DWqj5VmDljtX9e4kdDiq
 =QceB
 -----END PGP SIGNATURE-----

Merge tag 'usb-for-v3.12-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

Felipe writes:

usb: patches for v3.12 merge window (part 2)

Here's a set of important fixes for v3.12 merge
window which have been pending in the mailing list
for quite some time.

We have use-after-free fixes, signedness fixes,
more of HAS_DMA dependencies, fixes for NULL pointer
deferences, build fixes and some other fixes to
the musb driver caused by recent patches.

Patches are quite small and contain valuable fixes
which will give us a much better -rc1 release.

Please consider merging

Signed-of-by: Felipe Balbi <balbi@ti.com>
2013-08-27 14:07:31 -07:00
Dan Carpenter ffb62a14c7 usb: gadget: double unlocks on error in atmel_usba_start()
The "goto out" statements were wrong.  We aren't holding any locks at
that point so we should return directly.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-27 15:05:35 -05:00
Dan Carpenter df4989954a usb: gadget: gadgetfs: potential use after free in unbind()
ffs_data_put() can sometimes free "ffs" so I have moved the call down
a line below the dereference.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-27 15:03:32 -05:00
Dan Carpenter 1826e9b1bd usb: gadget: gadgetfs: use after free in dev_release()
The call to put_dev() releases "dev".  Hopefully, we don't need to set
the state to STATE_DEV_DISABLED anyway so I have removed those lines.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-27 15:03:28 -05:00
Greg Kroah-Hartman ce26bd23d4 USB: gadget: audit sysfs attribute permissions
Convert all USB gadget sysfs attributes to use the _RO or _RW variants,
to make them easier to audit and ensure that the permissions are
correct.

Note, two are left using the DEVICE_ATTR() macro, as there is no
DEVICE_ATTR_WO() in Linus's tree, that will happen after 3.12-rc1 is
out, a follow-on patch will be sent then.

Reviewed-by: Felipe Balbi <balbi@ti.com>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

--
 drivers/usb/gadget/composite.c      |    8 +++-----
 drivers/usb/gadget/dummy_hcd.c      |    8 ++++----
 drivers/usb/gadget/f_mass_storage.c |   14 ++++++--------
 drivers/usb/gadget/net2272.c        |    4 ++--
 drivers/usb/gadget/net2280.c        |   18 +++++++++---------
 drivers/usb/gadget/storage_common.c |   25 ++++++++++++-------------
 drivers/usb/gadget/udc-core.c       |   14 +++++++-------
 7 files changed, 43 insertions(+), 48 deletions(-)
2013-08-27 12:50:53 -07:00
Geert Uytterhoeven 272b05a988 usb: gadget: USB_NET2272_DMA should depend on HAS_DMA
If NO_DMA=y:

drivers/built-in.o: In function `net2272_done':
drivers/usb/gadget/net2272.c:386: undefined reference to `usb_gadget_unmap_request'
drivers/built-in.o: In function `net2272_queue':
drivers/usb/gadget/net2272.c:848: undefined reference to `usb_gadget_map_request'

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-27 14:17:01 -05:00
Geert Uytterhoeven 4ee4f23bb0 usb: gadget: USB_R8A66597 should depend on HAS_DMA
If NO_DMA=y:

drivers/built-in.o: In function `sudmac_free_channel':
drivers/usb/gadget/r8a66597-udc.c:676: undefined reference to `usb_gadget_unmap_request'
drivers/built-in.o: In function `sudmac_alloc_channel':
drivers/usb/gadget/r8a66597-udc.c:666: undefined reference to `usb_gadget_map_request'

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-27 14:17:00 -05:00
Geert Uytterhoeven b2fb945d60 usb: gadget: USB_FUSB300 should depend on HAS_DMA
If NO_DMA=y:

drivers/built-in.o: In function `fusb300_set_idma':
drivers/usb/gadget/fusb300_udc.c:946: undefined reference to `usb_gadget_map_request'
drivers/usb/gadget/fusb300_udc.c:958: undefined reference to `usb_gadget_unmap_request'

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-27 14:17:00 -05:00
Andrzej Pietrasiewicz 5a68e9b57b usb: gadget: configfs: keep a function if it is not successfully added
If usb_add_function() fails then the currently processed function
is already not in the list in struct config_usb_cfg, and neither is it
in the list in struct usb_configuration. At the err_purge_funcs label the
purge_config_funcs() is called, which iterates over all configurations,
and in each configuration it iterates over all _successfully_ added
functions, and moves them back from the list in struct usb_configuration
to the list in struct config_usb_cfg. BUT the function which has just
failed adding and caused the unwind process is not taken care of and
is effectively lost.

This patch modifies the configfs_composite_bind() function so that if
the usb_add_function() fails, then the currently processed function
is returned to the list in struct config_usb_cfg.

It would be tempting to delay the list_del() in question after
usb_add_function() invocation, but a struct list_head (&f->list) cannot be
stored in more than one list at the same time, so the list_del() must
be called before usb_add_function(). Hence, the solution is to list_add()
after usb_add_function() in case of error.

Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-27 14:06:08 -05:00
Philippe De Swert 9c1d696251 usb:gadget Fix comment for pointer to configfs
The documentation for the USB gadget fs is actually in
Documentation/usb/gadget_configfs.txt.

Signed-off-by: Philippe De Swert <philippe.deswert@jollamobile.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-08-19 17:02:11 -07:00
Greg Kroah-Hartman 165f60642a usb: patches for v3.12 merge window
All patches here have been pending on linux-usb
 and sitting in linux-next for a while now.
 
 The biggest things in this tag are:
 
 DWC3 learned proper usage of threaded IRQ
 handlers and now we spend very little time
 in hardirq context.
 
 MUSB now has proper support for BeagleBone and
 Beaglebone Black.
 
 Tegra's USB support also got quite a bit of love
 and is learning to use PHY layer and generic DT
 attributes.
 
 Other than that, the usual pack of cleanups and
 non-critical fixes follow.
 
 Signed-of-by: Felipe Balbi <balbi@ti.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJSCpApAAoJEIaOsuA1yqREJl0QAJ6SY4cOVcUrk0gMcbPcU6ah
 mhGJAzA5xcOrRzsrA/r9+mT4aN5zMtOmPtYNJGLgHxPxtmrkWDnUqnpUqBSCJXpt
 45GZTIY/TNbe0USteVg0sGz9y8FEokpcLsXk2bBpdnpb0eCC/6UiEl4kVgvNbtTu
 z8+vooY9O++Y5bcR6L5QJVBwm+YiIm/rReoLb17aYQCWVLkPvQ5J5dNdfRF/5FUS
 uzA4bZdcQCaUtzAAUroIL8z8TgVFOZUCrUalRCs7fE5+7gh9+i/JlVQKMuol/3rR
 1bfOdYwuG9XVu3iYKssRLSGUSUXU68ZviLBxwO24cz7EFkCxiKSF6+JT2PHrG1hj
 XPxPGuKx4zqn4Lol2KdE5iban9AdgN+2JgjwZ8w9hBob+O14HfRTafKRlwBc27Mt
 BiXJv+5mEVmAbi8Xya1w3J/mWHAh+Qxhi1SlPEyT5FfUG3b+2D/Kv1dgpApdVdYL
 BW3CFSBgkFK8+WYGifnkNYtjj0v8z0eDaEU0cPmpy2L1pKgL3czNMNv/rgSH6r2n
 ilF5kR05CkEYsP56ZpuYg0VYCkpchhW1REDwaMx/2Nt1W4GXRql15aAyN9CcS+v4
 Xq0HVOSDyOV4juEryi296DDJPid6COELP8UtsKQLD+3nmifQEB58/S0NdNXJWcqs
 GocgpeGXdnzyk5y14FdJ
 =3NS9
 -----END PGP SIGNATURE-----

Merge tag 'usb-for-v3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

Felipe writes:

usb: patches for v3.12 merge window

All patches here have been pending on linux-usb
and sitting in linux-next for a while now.

The biggest things in this tag are:

DWC3 learned proper usage of threaded IRQ
handlers and now we spend very little time
in hardirq context.

MUSB now has proper support for BeagleBone and
Beaglebone Black.

Tegra's USB support also got quite a bit of love
and is learning to use PHY layer and generic DT
attributes.

Other than that, the usual pack of cleanups and
non-critical fixes follow.

Signed-of-by: Felipe Balbi <balbi@ti.com>

Conflicts:
	drivers/usb/gadget/udc-core.c
	drivers/usb/host/ehci-tegra.c
	drivers/usb/musb/omap2430.c
	drivers/usb/musb/tusb6010.c
2013-08-13 15:28:01 -07:00
Laurent Pinchart ebe864a6cb usb: gadget: uvc: Fix error handling in uvc_queue_buffer()
The conversion to videobuf2 failed to check the return value of
vb2_qbuf(). Fix it.

Cc: stable@vger.kernel.org
Reported-by: Michael Grzeschik <mgr@pengutronix.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-By: Michael Grzeschik <mgr@pengutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-09 17:40:54 +03:00
Jingoo Han cf1dea73c7 usb: gadget: f_uac1: Staticize local functions
control_selector_init() is used only in this file.
audio_bind_config() is used only in audio.c file to which
f_uac1.c is included. Thus, these functions are staticized
to fix the following warnings.

drivers/usb/gadget/f_uac1.c:698:12: warning: symbol 'control_selector_init' was not declared. Should it be static?
drivers/usb/gadget/f_uac1.c:722:12: warning: symbol 'audio_bind_config' was not declared. Should it be static?

Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-09 16:34:19 +03:00
Jingoo Han 2419831c37 usb: gadget: u_uac1: add __user annotation
Added __user annotation to fix the following sparse warning.

drivers/usb/gadget/u_uac1.c:194:52: warning: incorrect type in argument 2 (different address spaces)
drivers/usb/gadget/u_uac1.c:194:52:    expected void const [noderef] <asn:1>*buf
drivers/usb/gadget/u_uac1.c:194:52:    got void *buf

Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-09 16:34:13 +03:00
Jingoo Han bf19647d8f usb: gadget: rndis: Staticize rndis_init()/rndis_exit()
rndis_init() and rndis_exit() are used only in this file.
Fix the following sparse warnings:

drivers/usb/gadget/rndis.c:1145:5: warning: symbol 'rndis_init' was not declared. Should it be static?
drivers/usb/gadget/rndis.c:1179:6: warning: symbol 'rndis_exit' was not declared. Should it be static?

Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-09 16:33:36 +03:00
Jingoo Han 136c489b1c usb: gadget: f_mass_storage: use NULL instead of 0
The local variables such as 'filename', 'vendor_name', and
'product_name' are pointers; thus, use NULL instead of 0 to fix
the following sparse warnings

drivers/usb/gadget/f_mass_storage.c:3046:27: warning: Using plain integer as NULL pointer
drivers/usb/gadget/f_mass_storage.c:3050:28: warning: Using plain integer as NULL pointer
drivers/usb/gadget/f_mass_storage.c:3051:29: warning: Using plain integer as NULL pointer

Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-09 16:33:34 +03:00
Alexey Khoroshilov ffcba5a510 usb: gadget: amd5536udc: unconditionally use GFP_ATOMIC in udc_queue()
As far as prep_dma() is called with spinlock held,
we have to pass GFP_ATOMIC regardless of gfp argument.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-09 16:33:31 +03:00
Greg Kroah-Hartman 5b146f7e01 Merge 3.11-rc4 into usb-next
We want those fixes in here also.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-08-05 08:36:14 +08:00
Boris BREZILLON c0aefc75ce usb: gadget: at91_udc: add usb_clk for transition to common clk framework
The AT91 PMC (Power Management Controller) provides an USB clock used by
USB Full Speed host (ohci) and USB Full Speed device (udc).
The usb drivers (ohci and udc) must configure this clock to 48Mhz.
This configuration was formely done in mach-at91/clock.c, but this
implementation will be removed when moving to common clk framework.

This patch adds support for usb clock retrieval and configuration, and is
backward compatible with the current at91 clk implementation (if usb clk
is not found, it does not configure/enable it).

Signed-off-by: Boris BREZILLON <b.brezillon@overkiz.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-02 15:17:03 +03:00
Boris BREZILLON 30ce198716 usb: gadget: at91_udc: add missing clk_put on fclk and iclk
This patch adds missing clk_put on fclk and iclk in case the probe function
fails after these clocks have been retrieved.

Signed-off-by: Boris BREZILLON <b.brezillon@overkiz.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-02 15:17:02 +03:00
Jingoo Han 93487aa163 usb: gadget: fusb300_udc: Staticize fusb300_rdcxf()
fusb300_rdcxf() used only in this file.
Fix the following sparse warning:

drivers/usb/gadget/fusb300_udc.c:560:6: warning: symbol 'fusb300_rdcxf' was not declared. Should it be static?

Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-02 11:19:52 +03:00
Jingoo Han 027ca0d2fe usb: gadget: goku_udc: use NULL instead of 0
'req' is a pointer; thus, use NULL instead of 0
to fix the following sparse warning:

drivers/usb/gadget/goku_udc.c:775:13: warning: Using plain integer as NULL pointer

Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-08-02 11:19:51 +03:00
Kent Overstreet 73a7075e3f aio: Kill aio_rw_vect_retry()
This code doesn't serve any purpose anymore, since the aio retry
infrastructure has been removed.

This change should be safe because aio_read/write are also used for
synchronous IO, and called from do_sync_read()/do_sync_write() - and
there's no looping done in the sync case (the read and write syscalls).

Signed-off-by: Kent Overstreet <koverstreet@google.com>
Cc: Zach Brown <zab@redhat.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Asai Thambi S P <asamymuthupa@micron.com>
Cc: Selvan Mani <smani@micron.com>
Cc: Sam Bradshaw <sbradshaw@micron.com>
Cc: Jeff Moyer <jmoyer@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Benjamin LaHaise <bcrl@kvack.org>
Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
2013-07-30 11:53:12 -04:00
Kent Overstreet bec68faaf3 aio: io_cancel() no longer returns the io_event
Originally, io_event() was documented to return the io_event if
cancellation succeeded - the io_event wouldn't be delivered via the ring
buffer like it normally would.

But this isn't what the implementation was actually doing; the only
driver implementing cancellation, the usb gadget code, never returned an
io_event in its cancel function. And aio_complete() was recently changed
to no longer suppress event delivery if the kiocb had been cancelled.

This gets rid of the unused io_event argument to kiocb_cancel() and
kiocb->ki_cancel(), and changes io_cancel() to return -EINPROGRESS if
kiocb->ki_cancel() returned success.

Also tweak the refcounting in kiocb_cancel() to make more sense.

Signed-off-by: Kent Overstreet <koverstreet@google.com>
Cc: Zach Brown <zab@redhat.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Asai Thambi S P <asamymuthupa@micron.com>
Cc: Selvan Mani <smani@micron.com>
Cc: Sam Bradshaw <sbradshaw@micron.com>
Cc: Jeff Moyer <jmoyer@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Benjamin LaHaise <bcrl@kvack.org>
Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
2013-07-30 11:53:11 -04:00
Jingoo Han e01ee9f509 usb: gadget: use dev_get_platdata()
Use the wrapper function for retrieving the platform data instead of
accessing dev->platform_data directly.

Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-07-30 11:18:46 +03:00
Greg Kroah-Hartman 78283dd29e Merge 3.11-rc3 into usb-next 2013-07-29 07:43:16 -07:00
Rong Wang 1894870eb4 usb: gadget: udc-core: fix the typo of udc state attribute
The name of udc state attribute file under sysfs is registered as
"state", while usb_gadget_set_state take it as "status" when it's
going to update. This patch fixes the typo.

Signed-off-by: Rong Wang <Rong.Wang@csr.com>
Signed-off-by: Barry Song <Baohua.Song@csr.com>
Cc: <stable@kernel.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-07-29 14:15:38 +03:00
Andrzej Pietrasiewicz 96edc98e78 usb: gadget: f_phonet: remove unused preprocessor conditional
The compatibility layer which the USBF_PHONET_INCLUDED was a part of
is no longer present - the USBF_PHONET_INCLUDED is not #defined by anyone
anymore, so the ifndef is always true. Removing it.

Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-07-29 14:15:23 +03:00
Andrzej Pietrasiewicz 8abc6fa163 usb: gadget: multi: fix error return code in cdc_do_config()
Fix to return a negative error code from the error handling
case instead of 0, as returned elsewhere in this function.

Introduced by commit 59835a (usb: gadget: multi: use
function framework for ACM.)

Make rndis_do_config() consistent with cdc_do_config() in the way it
handles returning the PTR_ERR(f_acm_*).

Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-07-29 14:15:18 +03:00
Boris BREZILLON 0d98b9d642 usb: gadget: atmel_usba: prepare clk before calling enable
Replace clk_enable/disable with clk_prepare_enable/disable_unprepare to
avoid common clk framework warnings.

Signed-off-by: Boris BREZILLON <b.brezillon@overkiz.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-07-29 13:58:13 +03:00