1. 25 5月, 2018 3 次提交
  2. 15 5月, 2018 2 次提交
  3. 14 5月, 2018 1 次提交
    • M
      xhci: Fix USB3 NULL pointer dereference at logical disconnect. · 2278446e
      Mathias Nyman 提交于
      Hub driver will try to disable a USB3 device twice at logical disconnect,
      racing with xhci_free_dev() callback from the first port disable.
      
      This can be triggered with "udisksctl power-off --block-device <disk>"
      or by writing "1" to the "remove" sysfs file for a USB3 device
      in 4.17-rc4.
      
      USB3 devices don't have a similar disabled link state as USB2 devices,
      and use a U3 suspended link state instead. In this state the port
      is still enabled and connected.
      
      hub_port_connect() first disconnects the device, then later it notices
      that device is still enabled (due to U3 states) it will try to disable
      the port again (set to U3).
      
      The xhci_free_dev() called during device disable is async, so checking
      for existing xhci->devs[i] when setting link state to U3 the second time
      was successful, even if device was being freed.
      
      The regression was caused by, and whole thing revealed by,
      Commit 44a182b9 ("xhci: Fix use-after-free in xhci_free_virt_device")
      which sets xhci->devs[i]->udev to NULL before xhci_virt_dev() returned.
      and causes a NULL pointer dereference the second time we try to set U3.
      
      Fix this by checking xhci->devs[i]->udev exists before setting link state.
      
      The original patch went to stable so this fix needs to be applied there as
      well.
      
      Fixes: 44a182b9 ("xhci: Fix use-after-free in xhci_free_virt_device")
      Cc: <stable@vger.kernel.org>
      Reported-by: NJordan Glover <Golden_Miller83@protonmail.ch>
      Tested-by: NJordan Glover <Golden_Miller83@protonmail.ch>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2278446e
  4. 05 5月, 2018 1 次提交
    • G
      Revert "usb: host: ehci: Use dma_pool_zalloc()" · 43b78f11
      Greg Kroah-Hartman 提交于
      This reverts commit 22072e83 as it is
      broken.
      
      Alan writes:
      	What you can't see just from reading the patch is that in both
      	cases (ehci->itd_pool and ehci->sitd_pool) there are two
      	allocation paths -- the two branches of an "if" statement -- and
      	only one of the paths calls dma_pool_[z]alloc.  However, the
      	memset is needed for both paths, and so it can't be eliminated.
      	Given that it must be present, there's no advantage to calling
      	dma_pool_zalloc rather than dma_pool_alloc.
      Reported-by: NErick Cafferata <erick@cafferata.me>
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Cc: Souptick Joarder <jrdr.linux@gmail.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      43b78f11
  5. 03 5月, 2018 1 次提交
  6. 23 4月, 2018 2 次提交
  7. 22 4月, 2018 5 次提交
    • G
      usb: host: xhci-plat: Fix clock resource by adding a register clock · 0fd2060a
      Gregory CLEMENT 提交于
      On Armada 7K/8K we need to explicitly enable the register clock. This
      clock is optional because not all the SoCs using this IP need it but at
      least for Armada 7K/8K it is actually mandatory.
      
      The change was done at xhci-plat level and not at a xhci-mvebu.c because,
      it is expected that other SoC would have this kind of constraint.
      
      The binding documentation is updating accordingly.
      Signed-off-by: NGregory CLEMENT <gregory.clement@bootlin.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      0fd2060a
    • G
      usb: host: xhci-plat: Remove useless test before clk_disable_unprepare · 3e29109f
      Gregory CLEMENT 提交于
      clk_disable_unprepare() already checks that the clock pointer is valid.
      No need to test it before calling it.
      Signed-off-by: NGregory CLEMENT <gregory.clement@bootlin.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      3e29109f
    • J
      USB: ehci-omap: drop unused legacy phy support · e90308a6
      Johan Hovold 提交于
      Drop support for looking up legacy phys defined by board files,
      something which hasn't been used by a mainline kernel since commit
      9080b8dc ("ARM: OMAP2+: Remove legacy usb-host.c platform init
      code"). Specifically, since that commit usb_get_phy_dev() have always
      returned -ENODEV and consequently this code has not been used.
      Signed-off-by: NJohan Hovold <johan@kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e90308a6
    • Z
      xhci: Fix Kernel oops in xhci dbgtty · 7fc65d4c
      Zhengjun Xing 提交于
      tty_unregister_driver may be called more than 1 time in some
      hotplug cases,it will cause the kernel oops. This patch checked
      dbc_tty_driver to make sure it is unregistered only 1 time.
      
      [  175.741404] BUG: unable to handle kernel NULL pointer dereference at 0000000000000034
      [  175.742309] IP: tty_unregister_driver+0x9/0x70
      [  175.743148] PGD 0 P4D 0
      [  175.743981] Oops: 0000 [#1] SMP PTI
      [  175.753904] RIP: 0010:tty_unregister_driver+0x9/0x70
      [  175.754817] RSP: 0018:ffffa8ff831d3bb0 EFLAGS: 00010246
      [  175.755753] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
      [  175.756685] RDX: ffff92089c616000 RSI: ffffe64fe1b26080 RDI: 0000000000000000
      [  175.757608] RBP: ffff92086c988230 R08: 000000006c982701 R09: 00000001801e0016
      [  175.758533] R10: ffffa8ff831d3b48 R11: ffff92086c982100 R12: ffff92086c98827c
      [  175.759462] R13: ffff92086c988398 R14: 0000000000000060 R15: ffff92089c5e9b40
      [  175.760401] FS:  0000000000000000(0000) GS:ffff9208a0100000(0000) knlGS:0000000000000000
      [  175.761334] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  175.762270] CR2: 0000000000000034 CR3: 000000011800a003 CR4: 00000000003606e0
      [  175.763225] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  175.764164] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  175.765091] Call Trace:
      [  175.766014]  xhci_dbc_tty_unregister_driver+0x11/0x30
      [  175.766960]  xhci_dbc_exit+0x2a/0x40
      [  175.767889]  xhci_stop+0x57/0x1c0
      [  175.768824]  usb_remove_hcd+0x100/0x250
      [  175.769708]  usb_hcd_pci_remove+0x68/0x130
      [  175.770574]  pci_device_remove+0x3b/0xc0
      [  175.771435]  device_release_driver_internal+0x157/0x230
      [  175.772343]  pci_stop_bus_device+0x74/0xa0
      [  175.773205]  pci_stop_bus_device+0x2b/0xa0
      [  175.774061]  pci_stop_bus_device+0x2b/0xa0
      [  175.774907]  pci_stop_bus_device+0x2b/0xa0
      [  175.775741]  pci_stop_bus_device+0x2b/0xa0
      [  175.776618]  pci_stop_bus_device+0x2b/0xa0
      [  175.777452]  pci_stop_bus_device+0x2b/0xa0
      [  175.778273]  pci_stop_bus_device+0x2b/0xa0
      [  175.779092]  pci_stop_bus_device+0x2b/0xa0
      [  175.779908]  pci_stop_bus_device+0x2b/0xa0
      [  175.780750]  pci_stop_bus_device+0x2b/0xa0
      [  175.781543]  pci_stop_and_remove_bus_device+0xe/0x20
      [  175.782338]  pciehp_unconfigure_device+0xb8/0x160
      [  175.783128]  pciehp_disable_slot+0x4f/0xd0
      [  175.783920]  pciehp_power_thread+0x82/0xa0
      [  175.784766]  process_one_work+0x147/0x3c0
      [  175.785564]  worker_thread+0x4a/0x440
      [  175.786376]  kthread+0xf8/0x130
      [  175.787174]  ? rescuer_thread+0x360/0x360
      [  175.787964]  ? kthread_associate_blkcg+0x90/0x90
      [  175.788798]  ret_from_fork+0x35/0x40
      
      Cc: <stable@vger.kernel.org> # 4.16
      Fixes: dfba2174 ("usb: xhci: Add DbC support in xHCI driver")
      Signed-off-by: NZhengjun Xing <zhengjun.xing@linux.intel.com>
      Tested-by: NChristian Kellner <christian@kellner.me>
      Reviewed-by: NChristian Kellner <christian@kellner.me>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7fc65d4c
    • G
      Revert "xhci: plat: Register shutdown for xhci_plat" · c20f53c5
      Greg Kroah-Hartman 提交于
      This reverts commit b07c1251
      
      It is incomplete and causes hangs on devices when shutting down.  It
      needs a much more "complete" fix in order to work properly.  As that fix
      has not been merged, revert this patch for now before it causes any more
      problems.
      
      Cc: Greg Hackmann <ghackmann@google.com>
      Cc: Adam Wallis <awallis@codeaurora.org>
      Cc: Mathias Nyman <mathias.nyman@intel.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c20f53c5
  8. 20 4月, 2018 3 次提交
  9. 26 3月, 2018 3 次提交
  10. 22 3月, 2018 2 次提交
  11. 16 3月, 2018 9 次提交
  12. 10 3月, 2018 8 次提交