kernel.git/drivers/usb/gadget/udc, branch linux-5.17.y

usb: gadget: tegra-xudc: Fix control endpoint's definitions

2022-04-13T17:27:09Z

[ Upstream commit 7bd42fb95eb4f98495ccadf467ad15124208ec49 ] According to the Tegra Technical Reference Manual, the seq_num field of control endpoint is not [31:24] but [31:27]. Bit 24 is reserved and bit 26 is splitxstate. The change fixes the wrong control endpoint's definitions. Signed-off-by: Wayne Chang Link: https://lore.kernel.org/r/20220107091349.149798-1-waynec@nvidia.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

usb: gadget: tegra-xudc: Do not program SPARAM

2022-04-13T17:27:08Z

[ Upstream commit 62fb61580eb48fc890b7bc9fb5fd263367baeca8 ] According to the Tegra Technical Reference Manual, SPARAM is a read-only register and should not be programmed in the driver. The change removes the wrong SPARAM usage. Signed-off-by: Wayne Chang Link: https://lore.kernel.org/r/20220107090443.149021-1-waynec@nvidia.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

usb: gadget: Fix use-after-free bug by not setting udc->dev.driver

2022-03-15T17:46:01Z

The syzbot fuzzer found a use-after-free bug: BUG: KASAN: use-after-free in dev_uevent+0x712/0x780 drivers/base/core.c:2320 Read of size 8 at addr ffff88802b934098 by task udevd/3689 CPU: 2 PID: 3689 Comm: udevd Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 dev_uevent+0x712/0x780 drivers/base/core.c:2320 uevent_show+0x1b8/0x380 drivers/base/core.c:2391 dev_attr_show+0x4b/0x90 drivers/base/core.c:2094 Although the bug manifested in the driver core, the real cause was a race with the gadget core. dev_uevent() does: if (dev->driver) add_uevent_var(env, "DRIVER=%s", dev->driver->name); and between the test and the dereference of dev->driver, the gadget core sets dev->driver to NULL. The race wouldn't occur if the gadget core registered its devices on a real bus, using the standard synchronization techniques of the driver core. However, it's not necessary to make such a large change in order to fix this bug; all we need to do is make sure that udc->dev.driver is always NULL. In fact, there is no reason for udc->dev.driver ever to be set to anything, let alone to the value it currently gets: the address of the gadget's driver. After all, a gadget driver only knows how to manage a gadget, not how to manage a UDC. This patch simply removes the statements in the gadget core that touch udc->dev.driver. Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class") CC: Reported-and-tested-by: syzbot+348b571beb5eeb70a582@syzkaller.appspotmail.com Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YiQgukfFFbBnwJ/9@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman

USB: gadget: validate endpoint index for xilinx udc

2022-02-24T10:00:07Z

Assure that host may not manipulate the index to point past endpoint array. Signed-off-by: Szymon Heidrich Cc: stable Signed-off-by: Greg Kroah-Hartman

usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition

2022-01-31T13:22:49Z

The support the external role switch a variety of situations were addressed, but the transition from USB_ROLE_HOST to USB_ROLE_NONE leaves the host up which can cause some error messages when switching from host to none, to gadget, to none, and then back to host again. xhci-hcd ee000000.usb: Abort failed to stop command ring: -110 xhci-hcd ee000000.usb: xHCI host controller not responding, assume dead xhci-hcd ee000000.usb: HC died; cleaning up usb 4-1: device not accepting address 6, error -108 usb usb4-port1: couldn't allocate usb_device After this happens it will not act as a host again. Fix this by releasing the host mode when transitioning to USB_ROLE_NONE. Fixes: 0604160d8c0b ("usb: gadget: udc: renesas_usb3: Enhance role switch support") Cc: stable Reviewed-by: Yoshihiro Shimoda Signed-off-by: Adam Ford Link: https://lore.kernel.org/r/20220128223603.2362621-1-aford173@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: at91_udc: fix incorrect print type

2022-01-26T12:45:42Z

Fix a build error observed with ARCH=arm DEFCONFIG=allmodconfig build. drivers/usb/gadget/udc/at91_udc.h:174:42: error: format '%d' expects argument of type 'int', but argument 3 has type 'struct gpio_desc *' [-Werror=format=] Fixes: 4a555f2b8d31 ("usb: gadget: at91_udc: Convert to GPIO descriptors") Reviewed-by: Macpaul Lin Signed-off-by: Miles Chen Link: https://lore.kernel.org/r/20220119020849.25732-1-miles.chen@mediatek.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: udc: pxa25x: propagate errors from platform_get_irq()

2021-12-17T15:54:23Z

The driver overrides the error codes returned by platform_get_irq() to -ENODEV for some strange reason. Switch to propagating the error codes upstream. Acked-by: Daniel Mack Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20211214204247.7172-3-s.shtylyov@omp.ru Signed-off-by: Greg Kroah-Hartman

usb: gadget: udc: bcm63xx: propagate errors from platform_get_irq()

2021-12-17T15:54:23Z

The driver overrides the error codes returned by platform_get_irq() to -ENXIO for some strange reason. Switch to propagating the error codes upstream. Acked-by: Florian Fainelli Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20211214204247.7172-2-s.shtylyov@omp.ru Signed-off-by: Greg Kroah-Hartman

usb: aspeed-vhub: support test mode feature

2021-12-13T14:01:58Z

Support aspeed usb vhub set feature to test mode. Signed-off-by: Neal Liu Acked-by: Benjamin Herrenschmidt Link: https://lore.kernel.org/r/20211208100545.1441397-5-neal_liu@aspeedtech.com Signed-off-by: Greg Kroah-Hartman

usb: aspeed-vhub: fix ep0 OUT ack received wrong length issue

2021-12-13T14:01:46Z

If multiple devices in vhub are enumerated simultaneously, ep0 OUT ack might received wrong data length. Using expected data length instead. Acked-by: Benjamin Herrenschmidt Signed-off-by: Neal Liu Link: https://lore.kernel.org/r/20211208100545.1441397-4-neal_liu@aspeedtech.com Signed-off-by: Greg Kroah-Hartman