Commit 3001c355 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'usb-5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 

Pull USB and Thunderbolt driver fixes from Greg KH:
 "Here are some small Thunderbolt and USB driver fixes for some reported
  issues:

   - thunderbolt fixes for minor problems

   - typec fixes for power issues

   - usb-storage quirk addition

   - usbip bugfix

   - dwc3 bugfix when stopping transfers

   - cdnsp bugfix for isoc transfers

   - gadget use-after-free fix

  All have been in linux-next this week with no reported issues"

* tag 'usb-5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: typec: tcpm: Skip sink_cap query only when VDM sm is busy
  usb: dwc3: gadget: Prevent EP queuing while stopping transfers
  usb: typec: tcpm: Invoke power_supply_changed for tcpm-source-psy-
  usb: typec: Remove vdo[3] part of tps6598x_rx_identity_reg struct
  usb-storage: Add quirk to defeat Kindle's automatic unload
  usb: gadget: configfs: Fix KASAN use-after-free
  usbip: Fix incorrect double assignment to udc->ud.tcp_rx
  usb: cdnsp: Fixes incorrect value in ISOC TRB
  thunderbolt: Increase runtime PM reference count on DP tunnel discovery
  thunderbolt: Initialize HopID IDAs in tb_switch_alloc()
parents 5ee96fa9 2b8c956e

drivers/thunderbolt/switch.c

+8 −10
Original line number Diff line number Diff line
@@ -768,12 +768,6 @@ static int tb_init_port(struct tb_port *port) 


	tb_dump_port(port->sw->tb, &port->config);



	/* Control port does not need HopID allocation */

	if (port->port) {

		ida_init(&port->in_hopids);

		ida_init(&port->out_hopids);

	}



	INIT_LIST_HEAD(&port->list);

	return 0;
@@ -1842,11 +1836,9 @@ static void tb_switch_release(struct device *dev) 
	dma_port_free(sw->dma_port);



	tb_switch_for_each_port(sw, port) {

		if (!port->disabled) {

		ida_destroy(&port->in_hopids);

		ida_destroy(&port->out_hopids);

	}

	}



	kfree(sw->uuid);

	kfree(sw->device_name);
@@ -2025,6 +2017,12 @@ struct tb_switch *tb_switch_alloc(struct tb *tb, struct device *parent, 
		/* minimum setup for tb_find_cap and tb_drom_read to work */

		sw->ports[i].sw = sw;

		sw->ports[i].port = i;



		/* Control port does not need HopID allocation */

		if (i) {

			ida_init(&sw->ports[i].in_hopids);

			ida_init(&sw->ports[i].out_hopids);

		}

	}



	ret = tb_switch_find_vse_cap(sw, TB_VSE_CAP_PLUG_EVENTS);

drivers/thunderbolt/tb.c

+4 −0
Original line number Diff line number Diff line
@@ -138,6 +138,10 @@ static void tb_discover_tunnels(struct tb_switch *sw) 
				parent->boot = true;

				parent = tb_switch_parent(parent);

			}

		} else if (tb_tunnel_is_dp(tunnel)) {

			/* Keep the domain from powering down */

			pm_runtime_get_sync(&tunnel->src_port->sw->dev);

			pm_runtime_get_sync(&tunnel->dst_port->sw->dev);

		}



		list_add_tail(&tunnel->list, &tcm->tunnel_list);

drivers/usb/cdns3/cdnsp-ring.c

+4 −1
Original line number Diff line number Diff line
@@ -2197,7 +2197,10 @@ static int cdnsp_queue_isoc_tx(struct cdnsp_device *pdev, 
	 * inverted in the first TDs isoc TRB.

	 */

	field = TRB_TYPE(TRB_ISOC) | TRB_TLBPC(last_burst_pkt) |

		start_cycle ? 0 : 1 | TRB_SIA | TRB_TBC(burst_count);

		TRB_SIA | TRB_TBC(burst_count);



	if (!start_cycle)

		field |= TRB_CYCLE;



	/* Fill the rest of the TRB fields, and remaining normal TRBs. */

	for (i = 0; i < trbs_per_td; i++) {

drivers/usb/dwc3/gadget.c

+5 −6
Original line number Diff line number Diff line
@@ -783,8 +783,6 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) 


	trace_dwc3_gadget_ep_disable(dep);



	dwc3_remove_requests(dwc, dep);



	/* make sure HW endpoint isn't stalled */

	if (dep->flags & DWC3_EP_STALL)

		__dwc3_gadget_ep_set_halt(dep, 0, false);
@@ -803,6 +801,8 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) 
		dep->endpoint.desc = NULL;

	}



	dwc3_remove_requests(dwc, dep);



	return 0;

}
@@ -1617,7 +1617,7 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req) 
{

	struct dwc3		*dwc = dep->dwc;



	if (!dep->endpoint.desc || !dwc->pullups_connected) {

	if (!dep->endpoint.desc || !dwc->pullups_connected || !dwc->connected) {

		dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n",

				dep->name);

		return -ESHUTDOWN;
@@ -2247,6 +2247,7 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) 
	if (!is_on) {

		u32 count;



		dwc->connected = false;

		/*

		 * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a

		 * Section 4.1.8 Table 4-7, it states that for a device-initiated
@@ -2271,7 +2272,6 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) 
			dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) %

						dwc->ev_buf->length;

		}

		dwc->connected = false;

	} else {

		__dwc3_gadget_start(dwc);

	}
@@ -3321,8 +3321,6 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) 
{

	u32			reg;



	dwc->connected = true;



	/*

	 * WORKAROUND: DWC3 revisions <1.88a have an issue which

	 * would cause a missing Disconnect Event if there's a
@@ -3362,6 +3360,7 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) 
	 * transfers."

	 */

	dwc3_stop_active_transfers(dwc);

	dwc->connected = true;



	reg = dwc3_readl(dwc->regs, DWC3_DCTL);

	reg &= ~DWC3_DCTL_TSTCTRL_MASK;

drivers/usb/gadget/configfs.c

+10 −4
Original line number Diff line number Diff line
@@ -97,6 +97,8 @@ struct gadget_config_name { 
	struct list_head list;

};



#define USB_MAX_STRING_WITH_NULL_LEN	(USB_MAX_STRING_LEN+1)



static int usb_string_copy(const char *s, char **s_copy)

{

	int ret;
@@ -106,12 +108,16 @@ static int usb_string_copy(const char *s, char **s_copy) 
	if (ret > USB_MAX_STRING_LEN)

		return -EOVERFLOW;



	str = kstrdup(s, GFP_KERNEL);

	if (copy) {

		str = copy;

	} else {

		str = kmalloc(USB_MAX_STRING_WITH_NULL_LEN, GFP_KERNEL);

		if (!str)

			return -ENOMEM;

	}

	strcpy(str, s);

	if (str[ret - 1] == '\n')

		str[ret - 1] = '\0';

	kfree(copy);

	*s_copy = str;

	return 0;

}