summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2022-07-27clocksource/drivers/timer-ti-dm: Add compatible for am6 SoCsTony Lindgren
Add compatible for ti,am654-timer to support the timers. For example, am654 has four timers in the MCU domain and 12 timers in the MAIN domain. Cc: Keerthy <j-keerthy@ti.com> Cc: Nishanth Menon <nm@ti.com> Cc: Vignesh Raghavendra <vigneshr@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com> Link: https://lore.kernel.org/r/20220408101715.43697-4-tony@atomide.com Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
2022-07-27clocksource/drivers/timer-ti-dm: Make timer selectable for ARCH_K3Tony Lindgren
Let's make timer-ti-dm selectable for ARCH_K3, and add a separate option for OMAP_DM_SYSTIMER as there should be no need for it on ARCH_K3. For older TI SoCs, we are already selecting OMAP_DM_TIMER in arch/arm/mach-omap*/Kconfig. For mach-omap2, we need to now also select OMAP_DM_SYSTIMER. Cc: Keerthy <j-keerthy@ti.com> Cc: Nishanth Menon <nm@ti.com> Cc: Vignesh Raghavendra <vigneshr@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com> Link: https://lore.kernel.org/r/20220408101715.43697-3-tony@atomide.com Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
2022-07-27clocksource/drivers/timer-ti-dm: Move inline functions to driver for am6Tony Lindgren
The __omap_dm_timer_* inline functions in the header are no longer needed outside the driver, and the header ifdefs prevent the driver working for ARCH_K3. Let's move the inline functions to the driver and drop the ifdefs and drop the unused functions __omap_dm_timer_override_errata() and __omap_dm_timer_load_start(). Cc: Keerthy <j-keerthy@ti.com> Cc: Nishanth Menon <nm@ti.com> Cc: Vignesh Raghavendra <vigneshr@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com> Link: https://lore.kernel.org/r/20220408101715.43697-2-tony@atomide.com Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
2022-07-27usb: misc: onboard_usb_hub: Add TI USB8041 hub supportAlexander Stein
This is a 4-port 3.0 USB hub. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Link: https://lore.kernel.org/r/20220727141117.909361-2-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: misc: onboard_usb_hub: Add reset-gpio supportAlexander Stein
Despite default reset upon probe, release reset line after powering up the hub and assert reset again before powering down. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Link: https://lore.kernel.org/r/20220727141117.909361-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27wifi: plfxlc: Use eth_zero_addr() to assign zero addressXu Qiang
Using eth_zero_addr() to assign zero address instead of memset(). Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Xu Qiang <xuqiang36@huawei.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220701082935.110924-1-xuqiang36@huawei.com
2022-07-27hwmon: (aquacomputer_d5next) Add support for Aquacomputer Quadro fan controllerAleksa Savic
Extend aquacomputer_d5next driver to expose hardware temperature sensors and fans of the Aquacomputer Quadro fan controller, which communicates through a proprietary USB HID protocol. Implemented by Jack Doan [1]. Four temperature sensors and PWM controllable fans are available. The liquid flow sensor is also exposed, implemented by Leonard Anderweit [2]. Additionally, serial number, firmware version and power-on count are exposed through debugfs. This driver has been tested on x86_64. [1] https://github.com/aleksamagicka/aquacomputer_d5next-hwmon/pull/5 [2] https://github.com/aleksamagicka/aquacomputer_d5next-hwmon/pull/9 Originally-from: Jack Doan <me@jackdoan.com> Originally-from: Leonard Anderweit <leonard.anderweit@gmail.com> Signed-off-by: Aleksa Savic <savicaleksa83@gmail.com> Link: https://lore.kernel.org/r/20220727100606.9328-1-savicaleksa83@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2022-07-27wifi: wilc1000: use existing iftype variable to store the interface typeAjay Singh
For consistency, use an existing 'iftype' element which was already having the interface type. Replace 'mode' with 'iftype' as it was used for the same purpose. Signed-off-by: Ajay Singh <ajay.kathat@microchip.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220720160302.231516-8-ajay.kathat@microchip.com
2022-07-27wifi: wilc1000: add 'isinit' flag for SDIO bus similar to SPIAjay Singh
Similar to SPI priv data, add 'isinit' variable in SDIO priv. Make use of the state to invoke hif_init() once, and acquire the lock before accessing hif function. Signed-off-by: Ajay Singh <ajay.kathat@microchip.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220720160302.231516-7-ajay.kathat@microchip.com
2022-07-27wifi: wilc1000: cancel the connect operation during interface downAjay Singh
Cancel the ongoing connection request to avoid any issue if the interface is set down before the connection request is completed. host_int_handle_disconnect was already available, so renamed it and used the same API for 'ndio_close' cb. Signed-off-by: Ajay Singh <ajay.kathat@microchip.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220720160302.231516-6-ajay.kathat@microchip.com
2022-07-27wifi: wilc1000: get correct length of string WID from received config packetAjay Singh
For string type WID packet, the data length is received as 16-bit value so use 'get_unaligned_le16' conversion API to extract the correct length. Signed-off-by: Ajay Singh <ajay.kathat@microchip.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220720160302.231516-5-ajay.kathat@microchip.com
2022-07-27wifi: wilc1000: set station_info flag only when signal value is validAjay Singh
Set station_info->filled to indicate signal level only when its value is received successfully using wilc_get_rssi(). Signed-off-by: Ajay Singh <ajay.kathat@microchip.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220720160302.231516-4-ajay.kathat@microchip.com
2022-07-27wifi: wilc1000: set correct value of 'close' variable in failure caseAjay Singh
Set 'close' variable to '1' to indicate closing operation when initialisation fails during wlan_initialize_threads() call. Signed-off-by: Ajay Singh <ajay.kathat@microchip.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220720160302.231516-3-ajay.kathat@microchip.com
2022-07-27wifi: wilc1000: add WID_TX_POWER WID in g_cfg_byte arrayAjay Singh
WID_TX_POWER WID value is fetched from the firmware so it should be added in'g_cfg_byte' array to store the data which is received from firmware. Signed-off-by: Ajay Singh <ajay.kathat@microchip.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220720160302.231516-2-ajay.kathat@microchip.com
2022-07-27wifi: b43: do not initialise static variable to 0Xin Gao
No need to initialise static variables to zero. Signed-off-by: Xin Gao <gaoxin@cdjrlc.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> [kvalo@kernel.org: improve commit log] Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220720194245.8442-1-gaoxin@cdjrlc.com
2022-07-27wifi: b43legacy: clean up one inconsistent indentingYang Li
Eliminate the follow smatch warning: drivers/net/wireless/broadcom/b43legacy/main.c:2947 b43legacy_wireless_core_stop() warn: inconsistent indenting Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220719075637.111716-1-yang.lee@linux.alibaba.com
2022-07-27wifi: rtl8xxxu: Fix the error handling of the probe functionZheyu Ma
When the driver fails at ieee80211_alloc_hw() at the probe time, the driver will free the 'hw' which is not allocated, causing a bug. The following log can reveal it: [ 15.981294] BUG: KASAN: user-memory-access in mutex_is_locked+0xe/0x40 [ 15.981558] Read of size 8 at addr 0000000000001ab0 by task modprobe/373 [ 15.982583] Call Trace: [ 15.984282] ieee80211_free_hw+0x22/0x390 [ 15.984446] rtl8xxxu_probe+0x3a1/0xab30 [rtl8xxxu] Fix the bug by changing the order of the error handling. Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220716130444.2950690-1-zheyuma97@gmail.com
2022-07-27wifi: wl12xx: Drop if with an always false conditionUwe Kleine-König
The remove callback is only called after probe completed successfully. In this case platform_set_drvdata() was called with a non-NULL argument (in wlcore_probe()) and so wl is never NULL. This is a preparation for making platform remove callbacks return void. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220715224619.ht7bbzzrmysielm7@pengutronix.de
2022-07-27wifi: libertas: Fix possible refcount leak in if_usb_probe()Hangyu Hua
usb_get_dev will be called before lbs_get_firmware_async which means that usb_put_dev need to be called when lbs_get_firmware_async fails. Fixes: ce84bb69f50e ("libertas USB: convert to asynchronous firmware loading") Signed-off-by: Hangyu Hua <hbh25y@gmail.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220620092350.39960-1-hbh25y@gmail.com Link: https://lore.kernel.org/r/20220622113402.16969-1-colin.i.king@gmail.com
2022-07-27USB: usbsevseg: convert sysfs snprintf to sysfs_emitXuezhi Zhang
Fix the following coccincheck warning: drivers/usb/misc/usbsevseg.c:170:8-16: WARNING: use scnprintf or sprintf Signed-off-by: Xuezhi Zhang <zhangxuezhi1@coolpad.com> Link: https://lore.kernel.org/r/20220727124415.8340-1-zhangxuezhi3@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27wifi: mwifiex: clean up one inconsistent indentingYang Li
Eliminate the follow smatch warning: drivers/net/wireless/marvell/mwifiex/pcie.c:3364 mwifiex_unregister_dev() warn: inconsistent indenting Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220615005316.9596-1-yang.lee@linux.alibaba.com
2022-07-27regulator: core: Allow drivers to define their init data as constDouglas Anderson
Drivers tend to want to define the names of their regulators somewhere in their source file as "static const". This means, inevitable, that every driver out there open codes something like this: static const char * const supply_names[] = { "vcc", "vccl", }; static int get_regulators(struct my_data *data) { int i; data->supplies = devm_kzalloc(...) if (!data->supplies) return -ENOMEM; for (i = 0; i < ARRAY_SIZE(supply_names); i++) data->supplies[i].supply = supply_names[i]; return devm_regulator_bulk_get(data->dev, ARRAY_SIZE(supply_names), data->supplies); } Let's make this more convenient by doing providing a helper that does the copy. I have chosen to have the "const" input structure here be the exact same structure as the normal one passed to devm_regulator_bulk_get(). This is slightly inefficent since the input data can't possibly have anything useful for "ret" or consumer and thus we waste 8 bytes per structure. This seems an OK tradeoff for not introducing an extra structure. Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://lore.kernel.org/r/20220726103631.v2.6.I38fc508a73135a5c1b873851f3553ff2a3a625f5@changeid Signed-off-by: Mark Brown <broonie@kernel.org>
2022-07-27regulator: core: Allow specifying an initial load w/ the bulk APIDouglas Anderson
There are a number of drivers that follow a pattern that looks like this: 1. Use the regulator bulk API to get a bunch of regulators. 2. Set the load on each of the regulators to use whenever the regulators are enabled. Let's make this easier by just allowing the drivers to pass the load in. As part of this change we need to move the error printing in regulator_bulk_get() around; let's switch to the new dev_err_probe() to simplify it. Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://lore.kernel.org/r/20220726103631.v2.4.Ie85f68215ada39f502a96dcb8a1f3ad977e3f68a@changeid Signed-off-by: Mark Brown <broonie@kernel.org>
2022-07-27usb: misc: onboard-hub: add support for Microchip USB2514B USB 2.0 hubFabrice Gasnier
Add support for Microchip USB2514B USB 2.0 hub to the onboard usb hub driver. Adopt the generic usb-device compatible ("usbVID,PID"). Some STM32MP1 boards have this hub on-board, with a supply that needs to be enabled for proper operation. Acked-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com> Link: https://lore.kernel.org/r/20220726080708.162547-3-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: ucsi: stm32g0: add bootloader supportFabrice Gasnier
STM32G0 comes with STM32 bootloader in its system memory. Add support for some I2C bootloader commands as described in application notes AN2606 and AN4221, to enable STM32G0 UCSI firmware update. Upon probing, the driver needs to know the STM32G0 state: - In bootloader mode, STM32 G0 answers at i2c addr 0x51. - In running mode, STM32 G0 firmware may answer at two address. - The main address specified in DT is used for UCSI. - 0x51 addr can be re-used for FW controls like getting software version or jump to booloader request. So probe using the main firmware i2c address first, before attempting bootloader address (e.g. check for blank, erased or previously aborted firmware update). Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com> Link: https://lore.kernel.org/r/20220713120842.560902-4-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: ucsi: stm32g0: add support for stm32g0 controllerFabrice Gasnier
STM32G0 provides an integrated USB Type-C and power delivery interface. It can be programmed with a firmware to handle UCSI protocol over I2C interface. A GPIO is used as an interrupt line. Type-C connector can be used as a wakeup source (typically to detect changes on the port, like attach or detach). PM suspend / resume routines are used to enable wake irqs, and signal a wakeup event in case the IRQ has fired while in suspend. The i2c core is doing the necessary initialization when the "wakeup-source" flag is provided. Note: the interrupt handler shouldn't be called before the i2c bus resumes. So, the interrupts are disabled during suspend period, and re-enabled upon resume, to avoid i2c transfer while suspended, from the irq handler. Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com> Link: https://lore.kernel.org/r/20220713120842.560902-3-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completionLinyu Yuan
We found PPM will not send any notification after it report error status and OPM issue GET_ERROR_STATUS command to read the details about error. According UCSI spec, PPM may clear the Error Status Data after the OPM has acknowledged the command completion. This change add operation to acknowledge the command completion from PPM. Fixes: bdc62f2bae8f (usb: typec: ucsi: Simplified registration and I/O API) Cc: <stable@vger.kernel.org> # 5.10 Signed-off-by: Jack Pham <quic_jackp@quicinc.com> Signed-off-by: Linyu Yuan <quic_linyyuan@quicinc.com> Link: https://lore.kernel.org/r/1658817949-4632-1-git-send-email-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: cdns3: change place of 'priv_ep' assignment in ↵Andrey Strachuk
cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() If 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer and its dereference with priv_ep->cdns3_dev may cause panic. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Acked-by: Peter Chen <peter.chen@kernel.org> Signed-off-by: Andrey Strachuk <strochuk@ispras.ru> Link: https://lore.kernel.org/r/20220718160052.4188-1-strochuk@ispras.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb/chipidea: fix repeated words in commentsJilin Yuan
Delete the redundant word 'power'. Acked-by: Peter Chen <peter.chen@kernel.org> Signed-off-by: Jilin Yuan <yuanjilin@cdjrlc.com> Link: https://lore.kernel.org/r/20220716131630.33151-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: renesas-xhci: Do not print any log while fw verif successChen Xingdi
When drivers are working properly, they should be quiet. Signed-off-by: Chen Xingdi <chenxingdi@huawei.com> Link: https://lore.kernel.org/r/20220727031146.19345-1-chenxingdi@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: retimer: Add missing id check in match callbackNícolas F. R. A. Prado
The fwnode_connection_find_match() function handles two cases: named references and graph endpoints. In the second case, the match function passed in is called with the id to check for the match. However, the match function for the recently added type-c retimer class assumes the connection has already been matched (which is only true for the first case). The result is that with that change, all type-c nodes with graph endpoints defer probe indefinitely, independently of having a retimer connection or not. Add the missing check, like is done by the type-c mux and usb role switch code, to fix the issue. Fixes: ddaf8d96f93b ("usb: typec: Add support for retimers") Reviewed-by: Prashant Malani <pmalani@chromium.org> Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> Link: https://lore.kernel.org/r/20220725203129.1973260-1-nfraprado@collabora.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27USB: xhci: Fix comment typoJason Wang
The double `the' is duplicated in the comment, remove one. Signed-off-by: Jason Wang <wangborong@cdjrlc.com> Link: https://lore.kernel.org/r/20220716041755.34016-1-wangborong@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb/typec/tcpm: fix repeated words in commentsJilin Yuan
Delete the redundant word 'to'. Reviewed-by: Guenter Roeck <linux@roeck-us.net> Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by: Jilin Yuan <yuanjilin@cdjrlc.com> Link: https://lore.kernel.org/r/20220716135642.52460-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb/musb: fix repeated words in commentsJilin Yuan
Delete the redundant word 'mode'. Delete the redundant word 'than'. Signed-off-by: Jilin Yuan <yuanjilin@cdjrlc.com> Link: https://lore.kernel.org/r/20220716134457.46535-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb/misc: fix repeated words in commentsJilin Yuan
Delete the redundant word 'with'. Signed-off-by: Jilin Yuan <yuanjilin@cdjrlc.com> Link: https://lore.kernel.org/r/20220716134105.44710-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb/image: fix repeated words in commentsJilin Yuan
Delete the redundant word 'the'. Signed-off-by: Jilin Yuan <yuanjilin@cdjrlc.com> Link: https://lore.kernel.org/r/20220716133825.43161-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb/host: fix repeated words in commentsJilin Yuan
Delete the redundant word 'the'. Delete the redundant word 'to'. Signed-off-by: Jilin Yuan <yuanjilin@cdjrlc.com> Link: https://lore.kernel.org/r/20220716133624.41994-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb/core: fix repeated words in commentsJilin Yuan
Delete the redundant word 'the'. Signed-off-by: Jilin Yuan <yuanjilin@cdjrlc.com> Link: https://lore.kernel.org/r/20220716132403.35270-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb/atm: fix repeated words in commentsJilin Yuan
Delete the redundant word 'was'. Signed-off-by: Jilin Yuan <yuanjilin@cdjrlc.com> Link: https://lore.kernel.org/r/20220716131312.31767-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27USB: gadget: Fix use-after-free Read in usb_udc_uevent()Alan Stern
The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug: --------------------------------------------------------------- BUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 Read of size 8 at addr ffff888078ce2050 by task udevd/2968 CPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 dev_uevent+0x290/0x770 drivers/base/core.c:2424 --------------------------------------------------------------- The bug occurs because usb_udc_uevent() dereferences udc->driver but does so without acquiring the udc_lock mutex, which protects this field. If the gadget driver is unbound from the udc concurrently with uevent processing, the driver structure may be accessed after it has been deallocated. To prevent the race, we make sure that the routine holds the mutex around the racing accesses. Link: <https://lore.kernel.org/all/0000000000004de90405a719c951@google.com> CC: stable@vger.kernel.org # fc274c1e9973 Reported-and-tested-by: syzbot+b0de012ceb1e2a97891b@syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/YtlrnhHyrHsSky9m@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27USB: HCD: Fix URB giveback issue in tasklet functionWeitao Wang
Usb core introduce the mechanism of giveback of URB in tasklet context to reduce hardware interrupt handling time. On some test situation(such as FIO with 4KB block size), when tasklet callback function called to giveback URB, interrupt handler add URB node to the bh->head list also. If check bh->head list again after finish all URB giveback of local_list, then it may introduce a "dynamic balance" between giveback URB and add URB to bh->head list. This tasklet callback function may not exit for a long time, which will cause other tasklet function calls to be delayed. Some real-time applications(such as KB and Mouse) will see noticeable lag. In order to prevent the tasklet function from occupying the cpu for a long time at a time, new URBS will not be added to the local_list even though the bh->head list is not empty. But also need to ensure the left URB giveback to be processed in time, so add a member high_prio for structure giveback_urb_bh to prioritize tasklet and schelule this tasklet again if bh->head list is not empty. At the same time, we are able to prioritize tasklet through structure member high_prio. So, replace the local high_prio_bh variable with this structure member in usb_hcd_giveback_urb. Fixes: 94dfd7edfd5c ("USB: HCD: support giveback of URB in tasklet context") Cc: stable <stable@kernel.org> Reviewed-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Weitao Wang <WeitaoWang-oc@zhaoxin.com> Link: https://lore.kernel.org/r/20220726074918.5114-1-WeitaoWang-oc@zhaoxin.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: xhci_plat_remove: avoid NULL dereferenceAlexey Sheplyakov
Since commit 4736ebd7fcaff1eb8481c140ba494962847d6e0a ("usb: host: xhci-plat: omit shared hcd if either root hub has no ports") xhci->shared_hcd can be NULL, which causes the following Oops on reboot: [ 710.124450] systemd-shutdown[1]: Rebooting. [ 710.298861] xhci-hcd xhci-hcd.2.auto: remove, state 4 [ 710.304217] usb usb3: USB disconnect, device number 1 [ 710.317441] xhci-hcd xhci-hcd.2.auto: USB bus 3 deregistered [ 710.323280] xhci-hcd xhci-hcd.2.auto: remove, state 1 [ 710.328401] usb usb2: USB disconnect, device number 1 [ 710.333515] usb 2-3: USB disconnect, device number 2 [ 710.467649] xhci-hcd xhci-hcd.2.auto: USB bus 2 deregistered [ 710.475450] Unable to handle kernel NULL pointer dereference at virtual address 00000000000003b8 [ 710.484425] Mem abort info: [ 710.487265] ESR = 0x0000000096000004 [ 710.491060] EC = 0x25: DABT (current EL), IL = 32 bits [ 710.496427] SET = 0, FnV = 0 [ 710.499525] EA = 0, S1PTW = 0 [ 710.502716] FSC = 0x04: level 0 translation fault [ 710.507648] Data abort info: [ 710.510577] ISV = 0, ISS = 0x00000004 [ 710.514462] CM = 0, WnR = 0 [ 710.517480] user pgtable: 4k pages, 48-bit VAs, pgdp=00000008b0050000 [ 710.523976] [00000000000003b8] pgd=0000000000000000, p4d=0000000000000000 [ 710.530961] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 710.536551] Modules linked in: rfkill input_leds snd_soc_simple_card snd_soc_simple_card_utils snd_soc_nau8822 designware_i2s snd_soc_core dw_hdmi_ahb_audio snd_pcm_dmaengine arm_ccn panfrost ac97_bus gpu_sched snd_pcm at24 fuse configfs sdhci_of_dwcmshc sdhci_pltfm sdhci nvme led_class mmc_core nvme_core bt1_pvt polynomial tp_serio snd_seq_midi snd_seq_midi_event snd_seq snd_timer snd_rawmidi snd_seq_device snd soundcore efivarfs ipv6 [ 710.575286] CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted 5.19.0-rc7-00043-gfd8619f4fd54 #1 [ 710.583822] Hardware name: T-Platforms TF307-MB/BM1BM1-A, BIOS 5.6 07/06/2022 [ 710.590972] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 710.597949] pc : usb_remove_hcd+0x34/0x1e4 [ 710.602067] lr : xhci_plat_remove+0x74/0x140 [ 710.606351] sp : ffff800009f3b7c0 [ 710.609674] x29: ffff800009f3b7c0 x28: ffff000800960040 x27: 0000000000000000 [ 710.616833] x26: ffff800008dc22a0 x25: 0000000000000000 x24: 0000000000000000 [ 710.623992] x23: 0000000000000000 x22: ffff000805465810 x21: ffff000805465800 [ 710.631149] x20: ffff000800f80000 x19: 0000000000000000 x18: ffffffffffffffff [ 710.638307] x17: ffff000805096000 x16: ffff00080633b800 x15: ffff000806537a1c [ 710.645465] x14: 0000000000000001 x13: 0000000000000000 x12: ffff00080378d6f0 [ 710.652621] x11: ffff00080041a900 x10: ffff800009b204e8 x9 : ffff8000088abaa4 [ 710.659779] x8 : ffff000800960040 x7 : ffff800009409000 x6 : 0000000000000001 [ 710.666936] x5 : ffff800009241000 x4 : ffff800009241440 x3 : 0000000000000000 [ 710.674094] x2 : ffff000800960040 x1 : ffff000800960040 x0 : 0000000000000000 [ 710.681251] Call trace: [ 710.683704] usb_remove_hcd+0x34/0x1e4 [ 710.687467] xhci_plat_remove+0x74/0x140 [ 710.691400] platform_remove+0x34/0x70 [ 710.695165] device_remove+0x54/0x90 [ 710.698753] device_release_driver_internal+0x200/0x270 [ 710.703992] device_release_driver+0x24/0x30 [ 710.708273] bus_remove_device+0xe0/0x16c [ 710.712293] device_del+0x178/0x390 [ 710.715797] platform_device_del.part.0+0x24/0x90 [ 710.720514] platform_device_unregister+0x30/0x50 [ 710.725232] dwc3_host_exit+0x20/0x30 [ 710.728907] dwc3_remove+0x174/0x1b0 [ 710.732494] platform_remove+0x34/0x70 [ 710.736254] device_remove+0x54/0x90 [ 710.739840] device_release_driver_internal+0x200/0x270 [ 710.745078] device_release_driver+0x24/0x30 [ 710.749359] bus_remove_device+0xe0/0x16c [ 710.753380] device_del+0x178/0x390 [ 710.756881] platform_device_del.part.0+0x24/0x90 [ 710.761598] platform_device_unregister+0x30/0x50 [ 710.766314] of_platform_device_destroy+0xe8/0x100 [ 710.771119] device_for_each_child_reverse+0x70/0xc0 [ 710.776099] of_platform_depopulate+0x48/0x90 [ 710.780468] __dwc3_of_simple_teardown+0x28/0xe0 [ 710.785099] dwc3_of_simple_shutdown+0x20/0x30 [ 710.789555] platform_shutdown+0x30/0x40 [ 710.793490] device_shutdown+0x138/0x32c [ 710.797425] __do_sys_reboot+0x1c4/0x2ac [ 710.801362] __arm64_sys_reboot+0x30/0x40 [ 710.805383] invoke_syscall+0x50/0x120 [ 710.809146] el0_svc_common.constprop.0+0x68/0x124 [ 710.813950] do_el0_svc+0x3c/0xcc [ 710.817275] el0_svc+0x60/0x12c [ 710.820428] el0t_64_sync_handler+0xc0/0x13c [ 710.824710] el0t_64_sync+0x18c/0x190 [ 710.828386] Code: a9025bf5 f942c420 f9001fe0 d2800000 (b943ba62) [ 710.834498] ---[ end trace 0000000000000000 ]--- [ 710.875958] pstore: crypto_comp_compress failed, ret = -22! [ 710.895047] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 710.902757] Kernel Offset: disabled [ 710.906255] CPU features: 0x800,00004811,00001082 [ 710.910971] Memory Limit: none [ 710.927474] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--- To avoid the problem check for NULL in usb_remove_hcd. Fixes: 4736ebd7fcaf ("usb: host: xhci-plat: omit shared hcd if either root hub has no ports") Signed-off-by: Alexey Sheplyakov <asheplyakov@basealt.ru> Link: https://lore.kernel.org/r/20220722141700.1271439-1-asheplyakov@basealt.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: anx7411: fix passing zero to 'PTR_ERR'Xin Ji
Fix anx7411_register_partner() warn: passing zero to 'PTR_ERR' Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Signed-off-by: Xin Ji <xji@analogixsemi.com> Link: https://lore.kernel.org/r/20220722081836.3380885-1-xji@analogixsemi.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: anx7411: Fix error return code in anx7411_i2c_probe()Yang Yingliang
Add mising error return code when failed to get interrupt or failed to register psy. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20220721071201.269344-3-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: anx7411: Fix return value check in ↵Yang Yingliang
anx7411_register_i2c_dummy_clients() If i2c_new_dummy_device() fails, it never return NULL pointer, replace NULL test with IS_ERR() to fix it. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20220721071201.269344-2-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: anx7411: Fix wrong pointer passed to PTR_ERR()Yang Yingliang
It should be 'ctx->typec.amode[i]' passed to PTR_ERR() when typec_partner_register_altmode() failed. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20220721071201.269344-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: anx7411: use semi-colons instead of commasDan Carpenter
Semi colons and commas are equivalent in this context but semi-colons are better style. Reviewed-by: Xin Ji <xji@analogixsemi.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/YtpD4MKBa43higNc@kili Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: anx7411: fix error checking in anx7411_get_gpio_irq()Dan Carpenter
This is a minor bug which means that certain error messages are not printed. The devm_gpiod_get_optional() function can return either error pointers or NULL. It returns error pointers if there is an allocation failure, or a similar issue. It returns NULL if no GPIO was assigned to the requested function. Print an error in either case. The gpiod_to_irq() function never returns zero. It either returns a positive IRQ number or a negative error code. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Reviewed-by: Xin Ji <xji@analogixsemi.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/YtpDs8VsWIbl/Smd@kili Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: typec: anx7411: Fix an array out of boundsDan Carpenter
This should be ARRAY_SIZE() instead of sizeof(). ARRAY_SIZE is 4 and sizeof is 8. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Reviewed-by: Xin Ji <xji@analogixsemi.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/YtpC5s4/AD8vFz+X@kili Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-27usb: phy: remove redundant store to variable var after & operationColin Ian King
There is no need to store the result of the & operation back to the variable var. The store is redundant, replace &= with just &. Cleans up clang scan warning: drivers/usb/phy/phy-keystone.c:62:5: warning: Although the value stored to 'val' is used in the enclosing expression, the value is never actually read from 'val' [deadcode.DeadStores] Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://lore.kernel.org/r/20220715225657.353828-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>