kernel/linux.git/drivers/usb/core/message.c, branch linux-2.6.35.y

USB: disable endpoints after unbinding interfaces, not before

2010-11-22T19:00:00+00:00

commit 80f0cf3947889014d3a3dc0ad60fb87cfda4b12a upstream. This patch (as1430) fixes a bug in usbcore. When a device configuration change occurs or a device is removed, the endpoints for the old config should be completely disabled. However it turns out they aren't; this is because usb_unbind_interface() calls usb_enable_interface() or usb_set_interface() to put interfaces back in altsetting 0, which re-enables the interfaces' endpoints. As a result, when a device goes through a config change or is unconfigured, the ep_in[] and ep_out[] arrays may be left holding old pointers to usb_host_endpoint structures. If the device is deauthorized these structures get freed, and the stale pointers cause errors when the the device is eventually unplugged. The solution is to disable the endpoints after unbinding the interfaces instead of before. This isn't as large a change as it sounds, since usb_unbind_interface() disables all the interface's endpoints anyway before calling the driver's disconnect routine, unless the driver claims to support "soft" unbind. This fixes Bugzilla #19192. Thanks to "Tom" Lei Ming for diagnosing the underlying cause of the problem. Signed-off-by: Alan Stern Tested-by: Carsten Sommer Signed-off-by: Greg Kroah-Hartman

USB: fix bug in initialization of interface minor numbers

2010-10-29T04:51:06+00:00

commit 0026e00523a85b90a92a93ddf6660939ecef3e54 upstream. Recent changes in the usbhid layer exposed a bug in usbcore. If CONFIG_USB_DYNAMIC_MINORS is enabled then an interface may be assigned a minor number of 0. However interfaces that aren't registered as USB class devices also have their minor number set to 0, during initialization. As a result usb_find_interface() may return the wrong interface, leading to a crash. This patch (as1418) fixes the problem by initializing every interface's minor number to -1. It also cleans up the usb_register_dev() function, which besides being somewhat awkwardly written, does not unwind completely on all its error paths. Signed-off-by: Alan Stern Tested-by: Philip J. Turmel Tested-by: Gabriel Craciunescu Tested-by: Alex Riesen Tested-by: Matthias Bayer CC: Jiri Kosina Signed-off-by: Greg Kroah-Hartman

usb: allow drivers to use allocated bandwidth until unbound

2010-09-20T20:36:20+00:00

commit 0791971ba8fbc44e4f476079f856335ed45e6324 upstream. When using the remove sysfs file, the device configuration is set to -1 (unconfigured). This eventually unbind drivers with the bandwidth_mutex held. Some drivers may call functions that hold said mutex, like usb_reset_device. This is the case for rtl8187, for example. This will lead to the same process holding the mutex twice, which deadlocks. Besides, according to Alan Stern: "The deadlock problem probably could be handled somehow, but there's a separate issue: Until the usb_disable_device call finishes unbinding the drivers, the drivers are free to continue using their allocated bandwidth. We musn't change the bandwidth allocations until after the unbinding is done. So this patch is indeed necessary." Unbinding the driver before holding the bandwidth_mutex solves the problem. If any operation after that fails, drivers are not bound again. But that would be a problem anyway that the user may solve resetting the device configuration to one that works, just like he would need to do in most other failure cases. Signed-off-by: Thadeu Lima de Souza Cascardo Cc: Alan Stern Cc: Sarah Sharp Signed-off-by: Greg Kroah-Hartman

USB: fix oops in usb_sg_init()

2010-06-30T15:16:06+00:00

This patch (as1401) fixes a bug in usb_sg_init() that can cause an invalid pointer dereference. An inner loop reuses some local variables in an unsafe manner, so new variables are introduced. Signed-off-by: Alan Stern Tested-by: Ajay Kumar Gupta Signed-off-by: Greg Kroah-Hartman

USB: simplify usb_sg_init()

2010-05-20T20:21:42+00:00

This patch (as1377) simplifies the code in usb_sg_init(), without changing its functionality. It also removes a couple of unused fields from the usb_sg_request structure. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman

USB: Change the scatterlist type in struct urb

2010-05-20T20:21:41+00:00

Change the type of the URB's 'sg' pointer from a usb_sg_request to a scatterlist. This allows drivers to submit scatter-gather lists without using the usb_sg_wait() interface. It has the added benefit of removing the typecasts that were added as part of patch as1368 (and slightly decreasing the number of pointer dereferences). Signed-off-by: Matthew Wilcox Reviewed-by: Alan Stern Tested-by: Alan Stern Signed-off-by: Greg Kroah-Hartman

USB: Add a usb_pipe_endpoint() convenience function

2010-05-20T20:21:41+00:00

Converting a pipe number to a struct usb_host_endpoint pointer is a little messy. Introduce a new convenience function to hide the mess. Signed-off-by: Matthew Wilcox Signed-off-by: Greg Kroah-Hartman

USB: fix usbmon and DMA mapping for scatter-gather URBs

2010-05-20T20:21:37+00:00

This patch (as1368) fixes a rather obscure bug in usbmon: When tracing URBs sent by the scatter-gather library, it accesses the data buffers while they are still mapped for DMA. The solution is to move the mapping and unmapping out of the s-g library and into the usual place in hcd.c. This requires the addition of new URB flag bits to describe the kind of mapping needed, since we have to call dma_map_sg() if the HCD supports native scatter-gather operation and dma_map_page() if it doesn't. The nice thing about having the new flags is that they simplify the testing for unmapping. The patch removes the only caller of usb_buffer_[un]map_sg(), so those functions are #if'ed out. A later patch will remove them entirely. As a result of this change, urb->sg will be set in situations where it wasn't set previously. Hence the xhci and whci drivers are adjusted to test urb->num_sgs instead, which retains its original meaning and is nonzero only when the HCD has to handle a scatterlist. Finally, even when a submission error occurs we don't want to hand URBs to usbmon before they are unmapped. The submission path is rearranged so that map_urb_for_dma() is called only for non-root-hub URBs and unmap_urb_for_dma() is called immediately after a submission error. This simplifies the error handling. Signed-off-by: Alan Stern CC: Signed-off-by: Greg Kroah-Hartman

USB: make hcd.h public (drivers dependency)

2010-05-20T20:21:30+00:00

The usbcore headers: hcd.h and hub.h are shared between usbcore, HCDs and a couple of other drivers (e.g. USBIP modules). So, it makes sense to move them into a more public location and to cleanup dependency of those modules on kernel internal headers. This patch moves hcd.h from drivers/usb/core into include/linux/usb/ Signed-of-by: Eric Lescouet Cc: Alan Stern Signed-off-by: Greg Kroah-Hartman

USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

2010-03-02T22:55:10+00:00

While looping over the interfaces, if usb_hcd_alloc_bandwidth() fails it calls hcd->driver->reset_bandwidth(), so there was no need to reinstate the interface again. If no break occurred, the index equals config->desc.bNumInterfaces. A subsequent usb_control_msg() failure resulted in a read from config->interface[config->desc.bNumInterfaces] at label reset_old_alts. In either case the last interface should be skipped. Signed-off-by: Roel Kluin Acked-by: Alan Stern Acked-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman