Merge tag 'usb-4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
"Here are a handful of USB driver fixes for 4.14-rc5.

There is the "usual" usb-serial fixes and device ids, USB gadget
fixes, and some more fixes found by the fuzz testing that is happening
on the USB layer right now.

All of these have been in my tree this week with no reported issues"

* tag 'usb-4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
usb: usbtest: fix NULL pointer dereference
usb: gadget: configfs: Fix memory leak of interface directory data
usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options
usb: misc: usbtest: Fix overflow in usbtest_do_ioctl()
usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
USB: dummy-hcd: Fix deadlock caused by disconnect detection
usb: phy: tegra: Fix phy suspend for UDC
USB: serial: console: fix use-after-free after failed setup
USB: serial: console: fix use-after-free on disconnect
USB: serial: qcserial: add Dell DW5818, DW5819
USB: serial: cp210x: add support for ELV TFD500
USB: serial: cp210x: fix partnum regression
USB: serial: option: add support for TP-Link LTE module
USB: serial: ftdi_sio: add id for Cypress WICED dev board

+5
drivers/usb/gadget/composite.c
··· 2026 2026 static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver) 2027 2027 { 2028 2028 struct usb_composite_dev *cdev = get_gadget_data(gadget); 2029 + struct usb_gadget_strings *gstr = cdev->driver->strings[0]; 2030 + struct usb_string *dev_str = gstr->strings; 2029 2031 2030 2032 /* composite_disconnect() must already have been called 2031 2033 * by the underlying peripheral controller driver! ··· 2046 2044 cdev->driver->unbind(cdev); 2047 2045 2048 2046 composite_dev_cleanup(cdev); 2047 + 2048 + if (dev_str[USB_GADGET_MANUFACTURER_IDX].s == cdev->def_manufacturer) 2049 + dev_str[USB_GADGET_MANUFACTURER_IDX].s = ""; 2049 2050 2050 2051 kfree(cdev->def_manufacturer); 2051 2052 kfree(cdev);
+8 -7
drivers/usb/gadget/configfs.c
··· 1143 1143 NULL 1144 1144 }; 1145 1145 1146 - int usb_os_desc_prepare_interf_dir(struct config_group *parent, 1147 - int n_interf, 1148 - struct usb_os_desc **desc, 1149 - char **names, 1150 - struct module *owner) 1146 + struct config_group *usb_os_desc_prepare_interf_dir( 1147 + struct config_group *parent, 1148 + int n_interf, 1149 + struct usb_os_desc **desc, 1150 + char **names, 1151 + struct module *owner) 1151 1152 { 1152 1153 struct config_group *os_desc_group; 1153 1154 struct config_item_type *os_desc_type, *interface_type; ··· 1160 1159 1161 1160 char *vlabuf = kzalloc(vla_group_size(data_chunk), GFP_KERNEL); 1162 1161 if (!vlabuf) 1163 - return -ENOMEM; 1162 + return ERR_PTR(-ENOMEM); 1164 1163 1165 1164 os_desc_group = vla_ptr(vlabuf, data_chunk, os_desc_group); 1166 1165 os_desc_type = vla_ptr(vlabuf, data_chunk, os_desc_type); ··· 1185 1184 configfs_add_default_group(&d->group, os_desc_group); 1186 1185 } 1187 1186 1188 - return 0; 1187 + return os_desc_group; 1189 1188 } 1190 1189 EXPORT_SYMBOL(usb_os_desc_prepare_interf_dir); 1191 1190
+6 -5
drivers/usb/gadget/configfs.h
··· 5 5 6 6 void unregister_gadget_item(struct config_item *item); 7 7 8 - int usb_os_desc_prepare_interf_dir(struct config_group *parent, 9 - int n_interf, 10 - struct usb_os_desc **desc, 11 - char **names, 12 - struct module *owner); 8 + struct config_group *usb_os_desc_prepare_interf_dir( 9 + struct config_group *parent, 10 + int n_interf, 11 + struct usb_os_desc **desc, 12 + char **names, 13 + struct module *owner); 13 14 14 15 static inline struct usb_os_desc *to_usb_os_desc(struct config_item *item) 15 16 {
+10 -2
drivers/usb/gadget/function/f_rndis.c
··· 908 908 free_netdev(opts->net); 909 909 } 910 910 911 + kfree(opts->rndis_interf_group); /* single VLA chunk */ 911 912 kfree(opts); 912 913 } 913 914 ··· 917 916 struct f_rndis_opts *opts; 918 917 struct usb_os_desc *descs[1]; 919 918 char *names[1]; 919 + struct config_group *rndis_interf_group; 920 920 921 921 opts = kzalloc(sizeof(*opts), GFP_KERNEL); 922 922 if (!opts) ··· 942 940 names[0] = "rndis"; 943 941 config_group_init_type_name(&opts->func_inst.group, "", 944 942 &rndis_func_type); 945 - usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs, 946 - names, THIS_MODULE); 943 + rndis_interf_group = 944 + usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs, 945 + names, THIS_MODULE); 946 + if (IS_ERR(rndis_interf_group)) { 947 + rndis_free_inst(&opts->func_inst); 948 + return ERR_CAST(rndis_interf_group); 949 + } 950 + opts->rndis_interf_group = rndis_interf_group; 947 951 948 952 return &opts->func_inst; 949 953 }
+1
drivers/usb/gadget/function/u_rndis.h
··· 26 26 bool bound; 27 27 bool borrowed_net; 28 28 29 + struct config_group *rndis_interf_group; 29 30 struct usb_os_desc rndis_os_desc; 30 31 char rndis_ext_compat_id[16]; 31 32
+6 -3
drivers/usb/gadget/udc/dummy_hcd.c
··· 419 419 static void set_link_state(struct dummy_hcd *dum_hcd) 420 420 { 421 421 struct dummy *dum = dum_hcd->dum; 422 + unsigned int power_bit; 422 423 423 424 dum_hcd->active = 0; 424 425 if (dum->pullup) ··· 430 429 return; 431 430 432 431 set_link_state_by_speed(dum_hcd); 432 + power_bit = (dummy_hcd_to_hcd(dum_hcd)->speed == HCD_USB3 ? 433 + USB_SS_PORT_STAT_POWER : USB_PORT_STAT_POWER); 433 434 434 435 if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) == 0 || 435 436 dum_hcd->active) 436 437 dum_hcd->resuming = 0; 437 438 438 439 /* Currently !connected or in reset */ 439 - if ((dum_hcd->port_status & USB_PORT_STAT_CONNECTION) == 0 || 440 + if ((dum_hcd->port_status & power_bit) == 0 || 440 441 (dum_hcd->port_status & USB_PORT_STAT_RESET) != 0) { 441 - unsigned disconnect = USB_PORT_STAT_CONNECTION & 442 + unsigned int disconnect = power_bit & 442 443 dum_hcd->old_status & (~dum_hcd->port_status); 443 - unsigned reset = USB_PORT_STAT_RESET & 444 + unsigned int reset = USB_PORT_STAT_RESET & 444 445 (~dum_hcd->old_status) & dum_hcd->port_status; 445 446 446 447 /* Report reset and disconnect events to the driver */
+8 -2
drivers/usb/misc/usbtest.c
··· 202 202 return tmp; 203 203 } 204 204 205 - if (in) { 205 + if (in) 206 206 dev->in_pipe = usb_rcvbulkpipe(udev, 207 207 in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); 208 + if (out) 208 209 dev->out_pipe = usb_sndbulkpipe(udev, 209 210 out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); 210 - } 211 + 211 212 if (iso_in) { 212 213 dev->iso_in = &iso_in->desc; 213 214 dev->in_iso_pipe = usb_rcvisocpipe(udev, ··· 1965 1964 int status = 0; 1966 1965 struct urb *urbs[param->sglen]; 1967 1966 1967 + if (!param->sglen || param->iterations > UINT_MAX / param->sglen) 1968 + return -EINVAL; 1969 + 1968 1970 memset(&context, 0, sizeof(context)); 1969 1971 context.count = param->iterations * param->sglen; 1970 1972 context.dev = dev; ··· 2090 2086 int retval = -EOPNOTSUPP; 2091 2087 2092 2088 if (param->iterations <= 0) 2089 + return -EINVAL; 2090 + if (param->sglen > MAX_SGLEN) 2093 2091 return -EINVAL; 2094 2092 /* 2095 2093 * Just a bunch of test cases that every HCD is expected to handle.
+17
drivers/usb/phy/phy-tegra-usb.c
··· 329 329 unsigned long val; 330 330 void __iomem *base = phy->regs; 331 331 332 + /* 333 + * The USB driver may have already initiated the phy clock 334 + * disable so wait to see if the clock turns off and if not 335 + * then proceed with gating the clock. 336 + */ 337 + if (utmi_wait_register(base + USB_SUSP_CTRL, USB_PHY_CLK_VALID, 0) == 0) 338 + return; 339 + 332 340 if (phy->is_legacy_phy) { 333 341 val = readl(base + USB_SUSP_CTRL); 334 342 val |= USB_SUSP_SET; ··· 358 350 { 359 351 unsigned long val; 360 352 void __iomem *base = phy->regs; 353 + 354 + /* 355 + * The USB driver may have already initiated the phy clock 356 + * enable so wait to see if the clock turns on and if not 357 + * then proceed with ungating the clock. 358 + */ 359 + if (utmi_wait_register(base + USB_SUSP_CTRL, USB_PHY_CLK_VALID, 360 + USB_PHY_CLK_VALID) == 0) 361 + return; 361 362 362 363 if (phy->is_legacy_phy) { 363 364 val = readl(base + USB_SUSP_CTRL);
+1 -1
drivers/usb/renesas_usbhs/fifo.c
··· 857 857 fifo->name, usbhs_pipe_number(pipe), pkt->length, pkt->zero); 858 858 859 859 usbhs_pipe_running(pipe, 1); 860 - usbhsf_dma_start(pipe, fifo); 861 860 usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans); 862 861 dma_async_issue_pending(chan); 862 + usbhsf_dma_start(pipe, fifo); 863 863 usbhs_pipe_enable(pipe); 864 864 865 865 xfer_work_end:
+2 -1
drivers/usb/serial/console.c
··· 186 186 tty_kref_put(tty); 187 187 reset_open_count: 188 188 port->port.count = 0; 189 + info->port = NULL; 189 190 usb_autopm_put_interface(serial->interface); 190 191 error_get_interface: 191 192 usb_serial_put(serial); ··· 266 265 267 266 void usb_serial_console_disconnect(struct usb_serial *serial) 268 267 { 269 - if (serial->port[0] == usbcons_info.port) { 268 + if (serial->port[0] && serial->port[0] == usbcons_info.port) { 270 269 usb_serial_console_exit(); 271 270 usb_serial_put(serial); 272 271 }
+7 -6
drivers/usb/serial/cp210x.c
··· 177 177 { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ 178 178 { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ 179 179 { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ 180 + { USB_DEVICE(0x18EF, 0xE032) }, /* ELV TFD500 Data Logger */ 180 181 { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ 181 182 { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ 182 183 { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ ··· 353 352 #define CP210X_PARTNUM_CP2104 0x04 354 353 #define CP210X_PARTNUM_CP2105 0x05 355 354 #define CP210X_PARTNUM_CP2108 0x08 355 + #define CP210X_PARTNUM_UNKNOWN 0xFF 356 356 357 357 /* CP210X_GET_COMM_STATUS returns these 0x13 bytes */ 358 358 struct cp210x_comm_status { ··· 1493 1491 result = cp210x_read_vendor_block(serial, REQTYPE_DEVICE_TO_HOST, 1494 1492 CP210X_GET_PARTNUM, &priv->partnum, 1495 1493 sizeof(priv->partnum)); 1496 - if (result < 0) 1497 - goto err_free_priv; 1494 + if (result < 0) { 1495 + dev_warn(&serial->interface->dev, 1496 + "querying part number failed\n"); 1497 + priv->partnum = CP210X_PARTNUM_UNKNOWN; 1498 + } 1498 1499 1499 1500 usb_set_serial_data(serial, priv); 1500 1501 ··· 1510 1505 } 1511 1506 1512 1507 return 0; 1513 - err_free_priv: 1514 - kfree(priv); 1515 - 1516 - return result; 1517 1508 } 1518 1509 1519 1510 static void cp210x_disconnect(struct usb_serial *serial)
+2
drivers/usb/serial/ftdi_sio.c
··· 1015 1015 { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, 1016 1016 { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID), 1017 1017 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, 1018 + { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, 1019 + { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, 1018 1020 { } /* Terminating entry */ 1019 1021 }; 1020 1022
+7
drivers/usb/serial/ftdi_sio_ids.h
··· 610 610 #define ADI_GNICEPLUS_PID 0xF001 611 611 612 612 /* 613 + * Cypress WICED USB UART 614 + */ 615 + #define CYPRESS_VID 0x04B4 616 + #define CYPRESS_WICED_BT_USB_PID 0x009B 617 + #define CYPRESS_WICED_WL_USB_PID 0xF900 618 + 619 + /* 613 620 * Microchip Technology, Inc. 614 621 * 615 622 * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
+2
drivers/usb/serial/option.c
··· 522 522 523 523 /* TP-LINK Incorporated products */ 524 524 #define TPLINK_VENDOR_ID 0x2357 525 + #define TPLINK_PRODUCT_LTE 0x000D 525 526 #define TPLINK_PRODUCT_MA180 0x0201 526 527 527 528 /* Changhong products */ ··· 2012 2011 { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, 2013 2012 { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) }, 2014 2013 { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) }, 2014 + { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */ 2015 2015 { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180), 2016 2016 .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, 2017 2017 { USB_DEVICE(TPLINK_VENDOR_ID, 0x9000), /* TP-Link MA260 */
+4
drivers/usb/serial/qcserial.c
··· 174 174 {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ 175 175 {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */ 176 176 {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */ 177 + {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */ 178 + {DEVICE_SWI(0x413c, 0x81d0)}, /* Dell Wireless 5819 */ 179 + {DEVICE_SWI(0x413c, 0x81d1)}, /* Dell Wireless 5818 */ 180 + {DEVICE_SWI(0x413c, 0x81d2)}, /* Dell Wireless 5818 */ 177 181 178 182 /* Huawei devices */ 179 183 {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */