Some modules call config_item_init_type_name() and config_group_init_type_name()
with parameter "name" directly controlled by userspace.  These two
functions call config_item_set_name() with this name used as a format
string, which can be used to leak information such as content of the
stack to userspace.

For example, make_netconsole_target() in netconsole module calls
config_item_init_type_name() with the name of a newly-created directory.
This means that the following commands give some unexpected output, with
configfs mounted in /sys/kernel/config/ and on a system with a
configured eth0 ethernet interface:

    # modprobe netconsole
    # mkdir /sys/kernel/config/netconsole/target_%lx
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # echo 1 > /sys/kernel/config/netconsole/target_%lx/enabled
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # dmesg |tail -n1
    [  142.697668] netconsole: target (target_ffffffffc0ae8080) is
    enabled, disable to update parameters

The directory name is correct but %lx has been interpreted in the
internal item name, displayed here in the error message used by
store_dev_name() in drivers/net/netconsole.c.

To fix this, update every caller of config_item_set_name to use "%s"
when operating on untrusted input.

This issue was found using -Wformat-security gcc flag, once a __printf
attribute has been added to config_item_set_name().
Signed-off-by: NNicolas Iooss <nicolas.iooss_linux@m4x.org>
Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: NFelipe Balbi <balbi@ti.com>
Acked-by: NJoel Becker <jlbec@evilplan.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Destroy serial_minors IDR on module exit, reclaiming the allocated memory.

This was detected by the following semantic patch (written by Luis
Rodriguez <mcgrof@suse.com>)

<SmPL>
@ defines_module_init @
declarer name module_init, module_exit;
declarer name DEFINE_IDR;
identifier init;
@@

module_init(init);

@ defines_module_exit @
identifier exit;
@@

module_exit(exit);

@ declares_idr depends on defines_module_init && defines_module_exit @
identifier idr;
@@

DEFINE_IDR(idr);

@ on_exit_calls_destroy depends on declares_idr && defines_module_exit @
identifier declares_idr.idr, defines_module_exit.exit;
@@

exit(void)
{
 ...
 idr_destroy(&idr);
 ...
}

@ missing_module_idr_destroy depends on declares_idr && defines_module_exit && !on_exit_calls_destroy @
identifier declares_idr.idr, defines_module_exit.exit;
@@

exit(void)
{
 ...
 +idr_destroy(&idr);
}
</SmPL>
Signed-off-by: NJohannes Thumshirn <jthumshirn@suse.de>
Cc: stable <stable@vger.kernel.org>	# v3.11
Signed-off-by: NJohan Hovold <johan@kernel.org>

In case kstrdup() fails the resources to release are
midi->in_port[] and midi. No cards have been registered,
so no need to unregister any.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Triggering suspend to RAM via sysfs on a i.MX28 causes a NULL pointer
dereference. This patch avoids the oops in mxs_phy_get_vbus_status()
by aborting since there is no syscon available.
Signed-off-by: NStefan Wahren <stefan.wahren@i2se.com>
Fixes: efdbd3a5 ("usb: phy: mxs: do not set PWD.RXPWD1PT1 for low speed connection")
CC: <stable@vger.kernel.org> # 4.0
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

My static checker detected the mistake. I fix this by changing "goto
err_irq" to "goto err_req". The label err_irq is not used now
so this patch also removes it.
Signed-off-by: NTakeshi Yoshimura <yos@sslab.ics.keio.ac.jp>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

commit f563d230 ("usb: gadget: composite: add req_match method
to usb_function") accesses cdev->config even before set config
is invoked causing a NULL pointer dereferencing error while running
Lecroy Mass Storage Compliance test.

Fix it here by accessing cdev->config only if it is non NULL.

Fixes: commit f563d230 ("usb: gadget: composite: add req_match
method to usb_function").
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

do not try to set cancel function in synchronous operations in
ffs_epfile_{read,write}_iter.

Cc: <stable@vger.kernel.org> # v4.0+
Acked-by: NAl Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: NRui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Mass storage function created via configfs always reports eight LUNs
to the hosts even if only one LUN has been configured.  Adjust the
number when the USB function is allocated based on LUNs that user
has created.

Cc: <stable@vger.kernel.org>
Tested-by: NGregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

commit 3e10a2ce ("usb: dwc3: add hsphy_interface
property") introduced a possible NULL pointer
dereference because dwc->hsphy_interface can be
NULL.

In order to fix it, all we have to do is guard
strncmp() against a NULL argument.

Fixes: 3e10a2ce ("usb: dwc3: add hsphy_interface property")
Tested-by: NMurali Karicheri <m-karicheri2@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Register backup function can be called from atomic context. Instead
of using atomic memory pool, embed backup storage space in
struct dwc2_hsotg.

Also add a valid flag in each struct as NULL pointer can't be used as
the content validity check any more.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Tested-by: NHeiko Stuebner <heiko@sntech.de>
Tested-by: NDoug Anderson <dianders@chromium.org>
Signed-off-by: NMian Yousaf Kaukab <yousaf.kaukab@intel.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

To avoid sleep while atomic bugs, allocate qtd before calling
dwc2_hcd_urb_enqueue. No need to pass mem_flags to
dwc2_hcd_urb_enqueue any more as no memory allocations are done in it.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Tested-by: NHeiko Stuebner <heiko@sntech.de>
Tested-by: NDoug Anderson <dianders@chromium.org>
Signed-off-by: NMian Yousaf Kaukab <yousaf.kaukab@intel.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

To avoid sleep while atomic bugs, allocate qh before calling
dwc2_hcd_urb_enqueue. qh pointer can be used directly now instead of
passing ep->hcpriv as double pointer.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Tested-by: NHeiko Stuebner <heiko@sntech.de>
Tested-by: NDoug Anderson <dianders@chromium.org>
Signed-off-by: NMian Yousaf Kaukab <yousaf.kaukab@intel.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Currently, we're calling musb_start() twice for DRD ports
in some situations. This has been observed to cause enumeration
issues after suspend/resume cycles with AM335x.

In order to fix the problem, we just have to fix the check
on musb_has_gadget() so that it only returns true if
current mode is Host and ignore the fact that we have or
not a gadget driver loaded.

Fixes: ae44df2e (usb: musb: call musb_start() only once in OTG mode)
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: <stable@vger.kernel.org> # v3.11+
Tested-by: NSekhar Nori <nsekhar@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Add the USB serial console device ID for Aruba Networks 7xxx series
controllers which have a USB port for their serial console.
Signed-off-by: NPeter Sanford <peter@sanford.io>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Some of the register names defined here are matching with registers
defined in other places. Like DCR is defined here and DCR is also
a register in mn10300 architecture. So when we are building this with
mn10300, build fails.
To avoid we rename all the registers.
Signed-off-by: NSudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Add device Olivetti Olicard 300 (Network Connect: MT6225) - IDs 2020:4000.

T:  Bus=01 Lev=02 Prnt=04 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2020 ProdID=4000 Rev=03.00
S:  Manufacturer=Network Connect
S:  Product=MT6225
C:  #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=option
I:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
Signed-off-by: NClaudio Cappelli <claudio.cappelli.linux@gmail.com>
Suggested-by: NLars Melin <larsm17@gmail.com>
Cc: stable <stable@vger.kernel.org>
[johan: amend commit message with devices info ]
Signed-off-by: NJohan Hovold <johan@kernel.org>

pratyush.anand@st.com email-id doesn't exist anymore as I have left the
company.  Replace ST's id with pratyush.anand@gmail.com.
Signed-off-by: NPratyush Anand <pratyush.anand@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Turn
	d_path(&file->f_path, ...);
into
	file_path(file, ...);
Signed-off-by: NMiklos Szeredi <mszeredi@suse.cz>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Add a "param_lock" mutex to each module, and update params.c to use
the correct built-in or module mutex while locking kernel params.
Remove the kparam_block_sysfs_r/w() macros, replace them with direct
calls to kernel_param_[un]lock(module).

The kernel param code currently uses a single mutex to protect
modification of any and all kernel params.  While this generally works,
there is one specific problem with it; a module callback function
cannot safely load another module, i.e. with request_module() or even
with indirect calls such as crypto_has_alg().  If the module to be
loaded has any of its params configured (e.g. with a /etc/modprobe.d/*
config file), then the attempt will result in a deadlock between the
first module param callback waiting for modprobe, and modprobe trying to
lock the single kernel param mutex to set the new module's param.

This fixes that by using per-module mutexes, so that each individual module
is protected against concurrent changes in its own kernel params, but is
not blocked by changes to other module params.  All built-in modules
continue to use the built-in mutex, since they will always be loaded at
runtime and references (e.g. request_module(), crypto_has_alg()) to them
will never cause load-time param changing.

This also simplifies the interface used by modules to block sysfs access
to their params; while there are currently functions to block and unblock
sysfs param access which are split up by read and write and expect a single
kernel param to be passed, their actual operation is identical and applies
to all params, not just the one passed to them; they simply lock and unlock
the global param mutex.  They are replaced with direct calls to
kernel_param_[un]lock(THIS_MODULE), which locks THIS_MODULE's param_lock, or
if the module is built-in, it locks the built-in mutex.
Suggested-by: NRusty Russell <rusty@rustcorp.com.au>
Signed-off-by: NDan Streetman <ddstreet@ieee.org>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>

The Octeon OHCI is now supported by the ohci-platform driver, and
USB_OCTEON_OHCI is marked as deprecated.  However, it is currently
still necessary to enable it in order to select
USB_OHCI_BIG_ENDIAN_MMIO.  Make CPU_CAVIUM_OCTEON select that as well,
so that USB_OCTEON_OHCI is really obsolete.

The old ohci-octeon and ehci-octeon drivers also only enabled big-endian
MMIO in case the CPU was big-endian.  Make the selections of
USB_EHCI_BIG_ENDIAN_MMIO and USB_OHCI_BIG_ENDIAN_MMIO conditional, to
match this.

Fixes: 2193dda5 ("USB: host: Remove ehci-octeon and ohci-octeon drivers")
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: linux-mips@linux-mips.org
Cc: David Daney <david.daney@cavium.com>
Cc: Chandrakala Chavva <cchavva@caviumnetworks.com>
Cc: Paul Martin <paul.martin@codethink.co.uk>
Patchwork: https://patchwork.linux-mips.org/patch/10178/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

This patch drops unnecessary target_core_fabric_ops parameter usage
for core_tpg_register() during fabric driver TFO->fabric_make_tpg()
se_portal_group creation callback execution.

Instead, use the existing se_wwn->wwn_tf->tf_ops pointer to ensure
fabric driver is really using the same TFO provided at module_init
time.

Also go ahead and drop the forward TFO declarations tree-wide, and
handling the special case for iscsi-target discovery TPG.

Cc: Christoph Hellwig <hch@lst.de>
Reviewed-by: NHannes Reinecke <hare@suse.de>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

The USB_DWC3_ULPI Kconfig entry uses a UTF-8 non-breaking space (0xca20)
instead of a regular ASCII space (0x20). Commit 2e0d737f ("kconfig:
don't silently ignore unhandled characters") exposes this by warning
about unhandled characters.
Signed-off-by: NThierry Reding <treding@nvidia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch just redefine the unique id of supported external connectors without
'enum extcon' type. Because unique id would be used on devictree file(*.dts) to
indicate the specific external connectors like key number of input framework.
So, I have the plan to move this definitions to following header file which
includes the unique id of supported external connectors.
- include/dt-bindings/extcon/extcon.h

Fixes: 2a9de9c0 ("extcon: Use the unique id for external connector instead of string")
Signed-off-by: NChanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The Marvell 28nm HSIC PHY requires the port to be forced to HS mode after
the port power is applied. This is done using the test mode in the PORTSC
register.

As HSIC is always HS, this work-around should be safe to do with all HSIC
PHYs and has been tested on i.MX6S.
Signed-off-by: NRob Herring <robh@kernel.org>
Tested-by: NPeter Chen <Peter.Chen@freescale.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently, ci_default_pdata is common to all instances of the driver and
gets modified by the core driver code. This is bad if there are multiple
instances of the device with different settings such as the phy type. Fix
this by making a copy of the default platform_data.
Signed-off-by: NRob Herring <robh@kernel.org>
Cc: Peter Chen <Peter.Chen@freescale.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Instead of manually handling the frees use devm. There was also a free
missing in the unregister call which is not needed with devm.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch makes bcma_hcd_create_pdev() not return NULL, but a prober
error code in case of an error.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

isp1760_ep_alloc_request allocates a structure with kzalloc without checking
for NULL and then returns a pointer to one of the structure fields. As the
field happens to be the first in the structure the caller can properly check
for NULL, but this is risky if the structure layout is changed later. Add an
explicit NULL check for the kzalloc return value

Detected with smatch static analysis:

drivers/usb/isp1760/isp1760-udc.c:816 isp1760_ep_alloc_request()
  error: potential null dereference 'req'.  (kzalloc returns null)

[ thanks to Laurent Pinchart for improved commit message ]
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

ATOL FPrint fiscal printers require usb_clear_halt to be executed
to work properly. Add quirk to fix the issue.
Signed-off-by: NAlexey Sokolov <sokolov@7pikes.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove unneeded semicolon.

The semantic patch that makes this change is available
in scripts/coccinelle/misc/semicolon.cocci.

More information about semantic patching is available at
http://coccinelle.lip6.fr/Signed-off-by: NFabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

Added the USB serial device ID for the HubZ dual ZigBee
and Z-Wave radio dongle.
Signed-off-by: NJohn D. Blair <johnb@candicontrols.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Only include SCSI initiator header files in target code that needs
these header files, namely the SCSI pass-through code and the tcm_loop
driver. Change SCSI_SENSE_BUFFERSIZE into TRANSPORT_SENSE_BUFFER in
target code because the former is intended for initiator code and the
latter for target code. With this patch the only initiator include
directives in target code that remain are as follows:

$ git grep -nHE 'include .scsi/(scsi.h|scsi_host.h|scsi_device.h|scsi_cmnd.h)' drivers/target drivers/infiniband/ulp/{isert,srpt} drivers/usb/gadget/legacy/tcm_*.[ch] drivers/{vhost,xen} include/{target,trace/events/target.h}
drivers/target/loopback/tcm_loop.c:29:#include <scsi/scsi.h>
drivers/target/loopback/tcm_loop.c:31:#include <scsi/scsi_host.h>
drivers/target/loopback/tcm_loop.c:32:#include <scsi/scsi_device.h>
drivers/target/loopback/tcm_loop.c:33:#include <scsi/scsi_cmnd.h>
drivers/target/target_core_pscsi.c:39:#include <scsi/scsi_device.h>
drivers/target/target_core_pscsi.c:40:#include <scsi/scsi_host.h>
drivers/xen/xen-scsiback.c:52:#include <scsi/scsi_host.h> /* SG_ALL */
Signed-off-by: NBart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NJames Bottomley <JBottomley@Odin.com>

Recently we purchased the Rigol DS6104 and when I try to operate it from
my Linux pc, everything works well with the default usbtmc driver,
except when I want to download a big datachunk like a screenshot. This
bitmapfile has a size of 1152054 bytes but I receive a smaller file and
no new packets can be read.

When I took a look at the driver source, I found this "Rigol quirk" and
I added the id of the new DS series oscilloscopes to this list. I
compiled it and loaded the new driver and now everything seems to work
fine.
Signed-off-by: NTeunis van Beelen <teuniz@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Use the timer API function setup_timer instead of structure field
assignments to initialize a timer.

A simplified version of the Coccinelle semantic patch that performs
this transformation is as follows:

@change@
expression e1, e2, e3, e4, a, b;
@@

-init_timer(&e1);
+setup_timer(&e1, a, b);

... when != a = e2
    when != b = e3

-e1.function = a;
... when != b = e4
-e1.data = b;
Signed-off-by: NVaishali Thakkar <vthakkar1994@gmail.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Removes Vernier Software & Technology devices from the ldusb
driver and the hid_ignore_list table of the usbhid driver in the
Linux tree.  These devices will now be supported via the hidraw
driver.

A user space driver for these devices will be found in the
Go! Software Development Kit from Vernier at
http://www.vernier.com/downloads/software-development-kits/go-sdk/.
These devices are also be supported by the LabQuest2 standalone
interface shown at http://www.vernier.com/products/interfaces/labq2/
and the LoggerPro for Linux software shown at
http://www.vernier.com/downloads/logger-pro-linux/.
Signed-off-by: NDennis O'Brien <dennis.obrien@eqware.net>
Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

'0' is now used as the default cmd_per_lun value,
so there's no need to explicitly set it to '1' in the
host template.
Signed-off-by: NHannes Reinecke <hare@suse.de>
Reviewed-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NJames Bottomley <JBottomley@Odin.com>

Fix compilation error in fsl ehci drv because ehci_reset()
and ehci_adjust_port_wakeup_flags() were not exported, and
are used when PM is enabled
Signed-off-by: NRamneek Mehresh <ramneek.mehresh@freescale.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch fixes an issue that sometimes this controller is not able
to complete the Control write status stage.

This driver should enable DCPCTR.CCPL and PID_BUF to complete the status
stage. However, if this driver detects the ctrl_stage interruption first
before the control write data is received, this driver will clear the
PID_BUF wrongly in the usbhsf_pio_try_pop(). To avoid this issue, this
patch doesn't clear the PID_BUF in the usbhsf_pio_try_pop().
(Since also the privious code doesn't disable the PID_BUF after a control
 transfer was finished, this patch doesn't have any side efforts.)
Signed-off-by: NYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch fixes an issue for control write. When usbhsf_prepare_pop()
is called after this driver called a gadget setup function, this controller
doesn't receive the control write data. So, this patch adds a code to clear
the fifo for control write in usbhsf_prepare_pop().
Signed-off-by: NKazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
Signed-off-by: NYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add support for USB controller version-2.5 used in
T4240 rev2.0, T1024, T1040, T2080, LS1021A
Signed-off-by: NNikhil Badola <nikhil.badola@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>