1. 25 5月, 2018 10 次提交
  2. 15 5月, 2018 2 次提交
  3. 14 5月, 2018 1 次提交
    • M
      xhci: Fix USB3 NULL pointer dereference at logical disconnect. · 2278446e
      Mathias Nyman 提交于
      Hub driver will try to disable a USB3 device twice at logical disconnect,
      racing with xhci_free_dev() callback from the first port disable.
      
      This can be triggered with "udisksctl power-off --block-device <disk>"
      or by writing "1" to the "remove" sysfs file for a USB3 device
      in 4.17-rc4.
      
      USB3 devices don't have a similar disabled link state as USB2 devices,
      and use a U3 suspended link state instead. In this state the port
      is still enabled and connected.
      
      hub_port_connect() first disconnects the device, then later it notices
      that device is still enabled (due to U3 states) it will try to disable
      the port again (set to U3).
      
      The xhci_free_dev() called during device disable is async, so checking
      for existing xhci->devs[i] when setting link state to U3 the second time
      was successful, even if device was being freed.
      
      The regression was caused by, and whole thing revealed by,
      Commit 44a182b9 ("xhci: Fix use-after-free in xhci_free_virt_device")
      which sets xhci->devs[i]->udev to NULL before xhci_virt_dev() returned.
      and causes a NULL pointer dereference the second time we try to set U3.
      
      Fix this by checking xhci->devs[i]->udev exists before setting link state.
      
      The original patch went to stable so this fix needs to be applied there as
      well.
      
      Fixes: 44a182b9 ("xhci: Fix use-after-free in xhci_free_virt_device")
      Cc: <stable@vger.kernel.org>
      Reported-by: NJordan Glover <Golden_Miller83@protonmail.ch>
      Tested-by: NJordan Glover <Golden_Miller83@protonmail.ch>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2278446e
  4. 05 5月, 2018 1 次提交
    • G
      Revert "usb: host: ehci: Use dma_pool_zalloc()" · 43b78f11
      Greg Kroah-Hartman 提交于
      This reverts commit 22072e83 as it is
      broken.
      
      Alan writes:
      	What you can't see just from reading the patch is that in both
      	cases (ehci->itd_pool and ehci->sitd_pool) there are two
      	allocation paths -- the two branches of an "if" statement -- and
      	only one of the paths calls dma_pool_[z]alloc.  However, the
      	memset is needed for both paths, and so it can't be eliminated.
      	Given that it must be present, there's no advantage to calling
      	dma_pool_zalloc rather than dma_pool_alloc.
      Reported-by: NErick Cafferata <erick@cafferata.me>
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Cc: Souptick Joarder <jrdr.linux@gmail.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      43b78f11
  5. 03 5月, 2018 1 次提交
  6. 23 4月, 2018 2 次提交
  7. 22 4月, 2018 5 次提交
    • G
      usb: host: xhci-plat: Fix clock resource by adding a register clock · 0fd2060a
      Gregory CLEMENT 提交于
      On Armada 7K/8K we need to explicitly enable the register clock. This
      clock is optional because not all the SoCs using this IP need it but at
      least for Armada 7K/8K it is actually mandatory.
      
      The change was done at xhci-plat level and not at a xhci-mvebu.c because,
      it is expected that other SoC would have this kind of constraint.
      
      The binding documentation is updating accordingly.
      Signed-off-by: NGregory CLEMENT <gregory.clement@bootlin.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      0fd2060a
    • G
      usb: host: xhci-plat: Remove useless test before clk_disable_unprepare · 3e29109f
      Gregory CLEMENT 提交于
      clk_disable_unprepare() already checks that the clock pointer is valid.
      No need to test it before calling it.
      Signed-off-by: NGregory CLEMENT <gregory.clement@bootlin.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      3e29109f
    • J
      USB: ehci-omap: drop unused legacy phy support · e90308a6
      Johan Hovold 提交于
      Drop support for looking up legacy phys defined by board files,
      something which hasn't been used by a mainline kernel since commit
      9080b8dc ("ARM: OMAP2+: Remove legacy usb-host.c platform init
      code"). Specifically, since that commit usb_get_phy_dev() have always
      returned -ENODEV and consequently this code has not been used.
      Signed-off-by: NJohan Hovold <johan@kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e90308a6
    • Z
      xhci: Fix Kernel oops in xhci dbgtty · 7fc65d4c
      Zhengjun Xing 提交于
      tty_unregister_driver may be called more than 1 time in some
      hotplug cases,it will cause the kernel oops. This patch checked
      dbc_tty_driver to make sure it is unregistered only 1 time.
      
      [  175.741404] BUG: unable to handle kernel NULL pointer dereference at 0000000000000034
      [  175.742309] IP: tty_unregister_driver+0x9/0x70
      [  175.743148] PGD 0 P4D 0
      [  175.743981] Oops: 0000 [#1] SMP PTI
      [  175.753904] RIP: 0010:tty_unregister_driver+0x9/0x70
      [  175.754817] RSP: 0018:ffffa8ff831d3bb0 EFLAGS: 00010246
      [  175.755753] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
      [  175.756685] RDX: ffff92089c616000 RSI: ffffe64fe1b26080 RDI: 0000000000000000
      [  175.757608] RBP: ffff92086c988230 R08: 000000006c982701 R09: 00000001801e0016
      [  175.758533] R10: ffffa8ff831d3b48 R11: ffff92086c982100 R12: ffff92086c98827c
      [  175.759462] R13: ffff92086c988398 R14: 0000000000000060 R15: ffff92089c5e9b40
      [  175.760401] FS:  0000000000000000(0000) GS:ffff9208a0100000(0000) knlGS:0000000000000000
      [  175.761334] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  175.762270] CR2: 0000000000000034 CR3: 000000011800a003 CR4: 00000000003606e0
      [  175.763225] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  175.764164] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  175.765091] Call Trace:
      [  175.766014]  xhci_dbc_tty_unregister_driver+0x11/0x30
      [  175.766960]  xhci_dbc_exit+0x2a/0x40
      [  175.767889]  xhci_stop+0x57/0x1c0
      [  175.768824]  usb_remove_hcd+0x100/0x250
      [  175.769708]  usb_hcd_pci_remove+0x68/0x130
      [  175.770574]  pci_device_remove+0x3b/0xc0
      [  175.771435]  device_release_driver_internal+0x157/0x230
      [  175.772343]  pci_stop_bus_device+0x74/0xa0
      [  175.773205]  pci_stop_bus_device+0x2b/0xa0
      [  175.774061]  pci_stop_bus_device+0x2b/0xa0
      [  175.774907]  pci_stop_bus_device+0x2b/0xa0
      [  175.775741]  pci_stop_bus_device+0x2b/0xa0
      [  175.776618]  pci_stop_bus_device+0x2b/0xa0
      [  175.777452]  pci_stop_bus_device+0x2b/0xa0
      [  175.778273]  pci_stop_bus_device+0x2b/0xa0
      [  175.779092]  pci_stop_bus_device+0x2b/0xa0
      [  175.779908]  pci_stop_bus_device+0x2b/0xa0
      [  175.780750]  pci_stop_bus_device+0x2b/0xa0
      [  175.781543]  pci_stop_and_remove_bus_device+0xe/0x20
      [  175.782338]  pciehp_unconfigure_device+0xb8/0x160
      [  175.783128]  pciehp_disable_slot+0x4f/0xd0
      [  175.783920]  pciehp_power_thread+0x82/0xa0
      [  175.784766]  process_one_work+0x147/0x3c0
      [  175.785564]  worker_thread+0x4a/0x440
      [  175.786376]  kthread+0xf8/0x130
      [  175.787174]  ? rescuer_thread+0x360/0x360
      [  175.787964]  ? kthread_associate_blkcg+0x90/0x90
      [  175.788798]  ret_from_fork+0x35/0x40
      
      Cc: <stable@vger.kernel.org> # 4.16
      Fixes: dfba2174 ("usb: xhci: Add DbC support in xHCI driver")
      Signed-off-by: NZhengjun Xing <zhengjun.xing@linux.intel.com>
      Tested-by: NChristian Kellner <christian@kellner.me>
      Reviewed-by: NChristian Kellner <christian@kellner.me>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7fc65d4c
    • G
      Revert "xhci: plat: Register shutdown for xhci_plat" · c20f53c5
      Greg Kroah-Hartman 提交于
      This reverts commit b07c1251
      
      It is incomplete and causes hangs on devices when shutting down.  It
      needs a much more "complete" fix in order to work properly.  As that fix
      has not been merged, revert this patch for now before it causes any more
      problems.
      
      Cc: Greg Hackmann <ghackmann@google.com>
      Cc: Adam Wallis <awallis@codeaurora.org>
      Cc: Mathias Nyman <mathias.nyman@intel.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c20f53c5
  8. 20 4月, 2018 3 次提交
  9. 26 3月, 2018 3 次提交
  10. 22 3月, 2018 2 次提交
  11. 16 3月, 2018 9 次提交
  12. 10 3月, 2018 1 次提交
    • F
      USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM · d6c931ea
      Fredrik Noring 提交于
      Scatter-gather needs to be disabled when using dma_declare_coherent_memory
      and HCD_LOCAL_MEM. Andrea Righi made the equivalent fix for EHCI drivers
      in commit 4307a28e "USB: EHCI: fix NULL pointer dererence in HCDs
      that use HCD_LOCAL_MEM".
      
      The following NULL pointer WARN_ON_ONCE triggered with OHCI drivers:
      
      ------------[ cut here ]------------
      WARNING: CPU: 0 PID: 49 at drivers/usb/core/hcd.c:1379 hcd_alloc_coherent+0x4c/0xc8
      Modules linked in:
      CPU: 0 PID: 49 Comm: usb-storage Not tainted 4.15.0+ #1014
      Stack : 00000000 00000000 805a78d2 0000003a 81f5c2cc 8053d367 804d77fc 00000031
              805a3a08 00000563 81ee9400 805a0000 00000000 10058c00 81f61b10 805c0000
              00000000 00000000 805a0000 00d9038e 00000004 803ee818 00000006 312e3420
              805c0000 00000000 00000073 81f61958 00000000 00000000 802eb380 804fd538
              00000009 00000563 81ee9400 805a0000 00000002 80056148 00000000 805a0000
              ...
      Call Trace:
      [<578af360>] show_stack+0x74/0x104
      [<2f3702c6>] __warn+0x118/0x120
      [<ae93fc9e>] warn_slowpath_null+0x44/0x58
      [<a891a517>] hcd_alloc_coherent+0x4c/0xc8
      [<3578fa36>] usb_hcd_map_urb_for_dma+0x4d8/0x534
      [<110bc94c>] usb_hcd_submit_urb+0x82c/0x834
      [<02eb5baf>] usb_sg_wait+0x14c/0x1a0
      [<ccd09e85>] usb_stor_bulk_transfer_sglist.part.1+0xac/0x124
      [<87a5c34c>] usb_stor_bulk_srb+0x40/0x60
      [<ff1792ac>] usb_stor_Bulk_transport+0x160/0x37c
      [<b9e2709c>] usb_stor_invoke_transport+0x3c/0x500
      [<004754f4>] usb_stor_control_thread+0x258/0x28c
      [<22edf42e>] kthread+0x134/0x13c
      [<a419ffd0>] ret_from_kernel_thread+0x14/0x1c
      ---[ end trace bcdb825805eefdcc ]---
      Signed-off-by: NFredrik Noring <noring@nocrew.org>
      Acked-by: NAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d6c931ea