linux/drivers/usb/class, branch v5.17

usb: usbtmc: Fix bug in pipe direction for control transfers

2022-03-15T17:45:31Z

The syzbot fuzzer reported a minor bug in the usbtmc driver: usb 5-1: BOGUS control dir, pipe 80001e80 doesn't match bRequestType 0 WARNING: CPU: 0 PID: 3813 at drivers/usb/core/urb.c:412 usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410 Modules linked in: CPU: 0 PID: 3813 Comm: syz-executor122 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0 ... Call Trace: usb_start_wait_urb+0x113/0x530 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1947 [inline] The problem is that usbtmc_ioctl_request() uses usb_rcvctrlpipe() for all of its transfers, whether they are in or out. It's easy to fix. CC: Reported-and-tested-by: syzbot+a48e3d1a875240cab5de@syzkaller.appspotmail.com Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YiEsYTPEE6lOCOA5@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman

tty: tty_io: Switch to vmalloc() fallback in case of TTY_NO_WRITE_SPLIT

2021-12-21T08:18:44Z

When TTY_NO_WRITE_SPLIT is set and 64 KiB chunks are used, allow vmalloc() fallback. Supply __GFP_RETRY_MAYFAIL to make kmalloc() preferable over vmalloc() since we may want a better performance. Note, both current users copy data to another buffer anyway, so the type of our allocation doesn't affect their expectations. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20211220133250.3070-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman

Merge 5.15-rc5 into usb-next

2021-10-11T05:39:38Z

We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman

USB: cdc-acm: fix break reporting

2021-10-05T11:50:52Z

A recent change that started reporting break events forgot to push the event to the line discipline, which meant that a detected break would not be reported until further characters had been receive (the port could even have been closed and reopened in between). Fixes: 08dff274edda ("cdc-acm: fix BREAK rx code path adding necessary calls") Cc: stable@vger.kernel.org Acked-by: Oliver Neukum Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210929090937.7410-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

USB: cdc-acm: fix racy tty buffer accesses

2021-10-05T11:50:52Z

A recent change that started reporting break events to the line discipline caused the tty-buffer insertions to no longer be serialised by inserting events also from the completion handler for the interrupt endpoint. Completion calls for distinct endpoints are not guaranteed to be serialised. For example, in case a host-controller driver uses bottom-half completion, the interrupt and bulk-in completion handlers can end up running in parallel on two CPUs (high-and low-prio tasklets, respectively) thereby breaking the tty layer's single producer assumption. Fix this by holding the read lock also when inserting characters from the bulk endpoint. Fixes: 08dff274edda ("cdc-acm: fix BREAK rx code path adding necessary calls") Cc: stable@vger.kernel.org Acked-by: Oliver Neukum Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210929090937.7410-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

usb: cdc-wdm: Fix check for WWAN

2021-10-05T11:49:23Z

CONFIG_WWAN_CORE was with CONFIG_WWAN in commit 89212e160b81 ("net: wwan: Fix WWAN config symbols"), but did not update all users of it. Change it back to use CONFIG_WWAN instead. Fixes: 89212e160b81 ("net: wwan: Fix WWAN config symbols") Cc: Signed-off-by: Rikard Falkeborn Acked-by: Oliver Neukum Link: https://lore.kernel.org/r/20210929194547.46954-2-rikard.falkeborn@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: cdc-wdm: Constify static struct wwan_port_ops

2021-10-05T10:58:17Z

The only usage of wdm_wwan_port_ops is to pass its address to wwan_create_port() which takes a pointer to const wwan_port_ops as argument. Make it const to allow the compiler to put it in read-only memory. Signed-off-by: Rikard Falkeborn Acked-by: Oliver Neukum Link: https://lore.kernel.org/r/20210929194547.46954-3-rikard.falkeborn@gmail.com Signed-off-by: Greg Kroah-Hartman

Merge 5.15-rc3 into usb-next

2021-09-27T14:34:40Z

We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman

USB: cdc-acm: remove duplicate USB device ID

2021-09-21T14:24:16Z

The device 0x00e9 (Nokia 5320 XpressMusic) is already on the list. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20210917091849.18692-3-krzysztof.kozlowski@canonical.com Signed-off-by: Greg Kroah-Hartman

USB: cdc-acm: fix minor-number release

2021-09-14T08:33:40Z

If the driver runs out of minor numbers it would release minor 0 and allow another device to claim the minor while still in use. Fortunately, registering the tty class device of the second device would fail (with a stack dump) due to the sysfs name collision so no memory is leaked. Fixes: cae2bc768d17 ("usb: cdc-acm: Decrement tty port's refcount if probe() fail") Cc: stable@vger.kernel.org # 4.19 Cc: Jaejoong Kim Acked-by: Oliver Neukum Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210907082318.7757-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman