BMC/Intel-BMC/linux.git/drivers/usb/gadget, branch dev

usb: udc: core: add device_del() call to error pathway

2015-08-03T14:54:18+00:00

This patch fixes a bug in the error pathway of usb_add_gadget_udc_release() in udc-core.c. If the udc registration fails, the gadget registration is not fully undone; there's a put_device(&gadget->dev) call but no device_del(). CC: Acked-by: Peter Chen Signed-off-by: Alan Stern Signed-off-by: Felipe Balbi

usb: gadget: f_printer: actually limit the number of instances

2015-07-27T15:19:50+00:00

There is a predefined maximum number of printer instances, currently 4. A chrdev region is allocated accordingly, but with configfs the user can create as many printer function directories as they like. To make the number of printer instances consistent with the number of allocated minors, the limit is enforced at directory creation time. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi

usb: gadget: f_hid: actually limit the number of instances

2015-07-27T15:19:50+00:00

There is a predefined maximum number of hid instances, currently 4. A chrdev region is allocated accordingly, but with configfs the user can create as many hid function directories as they like. To make the number of hid instances consistent with the number of allocated minors, the limit is enforced at directory creation time. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi

usb: gadget: f_uac2: fix calculation of uac2->p_interval

2015-07-27T15:18:06+00:00

The p_interval should be less if the 'bInterval' at the descriptor is larger, eg, if 'bInterval' is 5 for HS, the p_interval should be 8000 / 16 = 500. It fixes the patch 9bb87f168931 ("usb: gadget: f_uac2: send reasonably sized packets") Cc: # v3.18+ Fixes: 9bb87f168931 ("usb: gadget: f_uac2: send reasonably sized packets") Acked-by: Daniel Mack Signed-off-by: Peter Chen Signed-off-by: Felipe Balbi

usb: gadget: bdc: fix a driver crash on disconnect

2015-07-27T15:15:06+00:00

ep_dequeue() in bdc_ep.c was capturing the hw dequeue pointer incorrectly by reading the wrong register for the upper 32 bits. Signed-off-by: Al Cooper Signed-off-by: Felipe Balbi

usb: gadget: udc: core: Fix argument of dma_map_single for IOMMU

2015-07-20T17:57:46+00:00

The dma_map_single and dma_unmap_single should set "gadget->dev.parent" instead of "&gadget->dev" in the first argument because the parent has a udc controller's device pointer. Otherwise, iommu functions are not called in ARM environment. Signed-off-by: Yoshihiro Shimoda Signed-off-by: Felipe Balbi

usb: gadget: mv_udc_core: fix phy_regs I/O memory leak

2015-07-20T17:57:46+00:00

There was an omission in transition to devm_xxx resource handling. iounmap(udc->phy_regs) were removed, but ioremap() was left without devm_. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Fixes: 3517c31a8ece6 ("usb: gadget: mv_udc: use devm_xxx for probe") Signed-off-by: Felipe Balbi

configfs: fix kernel infoleak through user-controlled format string

2015-07-17T23:39:53+00:00

Some modules call config_item_init_type_name() and config_group_init_type_name() with parameter "name" directly controlled by userspace. These two functions call config_item_set_name() with this name used as a format string, which can be used to leak information such as content of the stack to userspace. For example, make_netconsole_target() in netconsole module calls config_item_init_type_name() with the name of a newly-created directory. This means that the following commands give some unexpected output, with configfs mounted in /sys/kernel/config/ and on a system with a configured eth0 ethernet interface: # modprobe netconsole # mkdir /sys/kernel/config/netconsole/target_%lx # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name # echo 1 > /sys/kernel/config/netconsole/target_%lx/enabled # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name # dmesg |tail -n1 [ 142.697668] netconsole: target (target_ffffffffc0ae8080) is enabled, disable to update parameters The directory name is correct but %lx has been interpreted in the internal item name, displayed here in the error message used by store_dev_name() in drivers/net/netconsole.c. To fix this, update every caller of config_item_set_name to use "%s" when operating on untrusted input. This issue was found using -Wformat-security gcc flag, once a __printf attribute has been added to config_item_set_name(). Signed-off-by: Nicolas Iooss Acked-by: Greg Kroah-Hartman Acked-by: Felipe Balbi Acked-by: Joel Becker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

usb: gadget: f_midi: fix error recovery path

2015-07-06T17:34:08+00:00

In case kstrdup() fails the resources to release are midi->in_port[] and midi. No cards have been registered, so no need to unregister any. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi

usb: gadget: udc: fix free_irq() after request_irq() failed

2015-07-06T17:34:08+00:00

My static checker detected the mistake. I fix this by changing "goto err_irq" to "goto err_req". The label err_irq is not used now so this patch also removes it. Signed-off-by: Takeshi Yoshimura Signed-off-by: Felipe Balbi