kernel/linux.git/drivers/usb/usbip, branch linux-6.0.y

usbip: vudc: Don't enable IRQs prematurely

2022-06-10T09:48:19+00:00

This code does: spin_unlock_irq(&udc->ud.lock); spin_unlock_irqrestore(&udc->lock, flags); which does not make sense. In theory, the first unlock could enable IRQs and then the second _irqrestore could disable them again. There would be a brief momemt where IRQs were enabled improperly. In real life, however, this function is always called with IRQs enabled and the bug does not affect runtime. Reviewed-by: Shuah Khan Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Yo4hVWcZNYzKEkIQ@kili Signed-off-by: Greg Kroah-Hartman

USB: usbip: clean up mixed use of _irq() and _irqsave()

2022-06-10T09:48:15+00:00

It generally doesn't make sense to use _irq() and _irqsave() in the same function because either some of the callers have disabled IRQs or they haven't. In this case, the v_recv_cmd_submit() appears to always be called with IRQs enabled so the code works fine. That means I could convert it to either _irq() or _irqsave() but I chose to use _irqsave() because it's more conservative and easier to review. Reviewed-by: Shuah Khan Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Yo4gqLPtHO6XKMLn@kili Signed-off-by: Greg Kroah-Hartman

usb: usbip: add missing device lock on tweak configuration cmd

2022-04-21T17:01:25+00:00

The function documentation of usb_set_configuration says that its callers should hold the device lock. This lock is held for all callsites except tweak_set_configuration_cmd. The code path can be executed for example when attaching a remote USB device. The solution is to surround the call by the device lock. This bug was found using my experimental own-developed static analysis tool, which reported the missing lock on v5.17.2. I manually verified this bug report by doing code review as well. I runtime checked that the required lock is not held. I compiled and runtime tested this on x86_64 with a USB mouse. After applying this patch, my analyser no longer reports this potential bug. Fixes: 2c8c98158946 ("staging: usbip: let client choose device configuration") Reviewed-by: Shuah Khan Signed-off-by: Niels Dossche Link: https://lore.kernel.org/r/20220412165055.257113-1-dossche.niels@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: usbip: fix a refcount leak in stub_probe()

2022-04-21T17:01:22+00:00

usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference. Fix this by moving usb_put_dev() to sdev_free error path handling. Find this by code review. Fixes: 3ff67445750a ("usbip: fix error handling in stub_probe()") Reviewed-by: Shuah Khan Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20220412020257.9767-1-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: usbip: eliminate anonymous module_init & module_exit

2022-03-18T11:52:56+00:00

Eliminate anonymous module_init() and module_exit(), which can lead to confusion or ambiguity when reading System.map, crashes/oops/bugs, or an initcall_debug log. Give each of these init and exit functions unique driver-specific names to eliminate the anonymous names. Example 1: (System.map) ffffffff832fc78c t init ffffffff832fc79e t init ffffffff832fc8f8 t init Example 2: (initcall_debug log) calling init+0x0/0x12 @ 1 initcall init+0x0/0x12 returned 0 after 15 usecs calling init+0x0/0x60 @ 1 initcall init+0x0/0x60 returned 0 after 2 usecs calling init+0x0/0x9a @ 1 initcall init+0x0/0x9a returned 0 after 74 usecs Fixes: 80fd9cd52de6 ("usbip: vudc: Add VUDC main file") Signed-off-by: Randy Dunlap Cc: Krzysztof Opasiak Cc: Igor Kotrasinski Cc: Valentina Manea Cc: Shuah Khan Cc: Shuah Khan Cc: linux-usb@vger.kernel.org Link: https://lore.kernel.org/r/20220316192010.19001-8-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman

usbip: vudc: Make use of the helper macro LIST_HEAD()

2022-02-14T11:49:38+00:00

Replace "struct list_head head = LIST_HEAD_INIT(head)" with "LIST_HEAD(head)" to simplify the code. LIST_HEAD() helps to clean up the code "struct list_head vudc_devices =", only to care about the variable 'vudc_devices'. Reviewed-by: Shuah Khan Signed-off-by: Cai Huoqing Link: https://lore.kernel.org/r/20220211012807.7415-1-cai.huoqing@linux.dev Signed-off-by: Greg Kroah-Hartman

usb: Remove redundant 'flush_workqueue()' calls

2021-11-17T13:36:57+00:00

'destroy_workqueue()' already drains the queue before destroying it, so there is no need to flush it explicitly. Remove the redundant 'flush_workqueue()' calls. This was generated with coccinelle: @@ expression E; @@ - flush_workqueue(E); destroy_workqueue(E); Acked-by: Shuah Khan Acked-by: Peter Chen # for chipidea part Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/563123a8117d6cafae3f134e497587bd2b8bb7f4.1636734453.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

usbip:vhci_hcd USB port can get stuck in the disabled state

2021-08-26T11:29:27+00:00

When a remote usb device is attached to the local Virtual USB Host Controller Root Hub port, the bound device driver may send a port reset command. vhci_hcd accepts port resets only when the device doesn't have port address assigned to it. When reset happens device is in assigned/used state and vhci_hcd rejects it leaving the port in a stuck state. This problem was found when a blue-tooth or xbox wireless dongle was passed through using usbip. A few drivers reset the port during probe including mt76 driver specific to this bug report. Fix the problem with a change to honor reset requests when device is in used state (VDEV_ST_USED). Reported-and-tested-by: Michael Suggested-by: Michael Signed-off-by: Shuah Khan Link: https://lore.kernel.org/r/20210819225937.41037-1-skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

usbip: clean up code in vhci_device_unlink_cleanup

2021-08-26T11:29:10+00:00

The cleanup code for unlink_tx and unlink_rx lists is almost the same. So, extract it into a new function and call it for both unlink_rx and unlink_tx. Also, remove unnecessary log messages. Signed-off-by: Anirudh Rayabharam Link: https://lore.kernel.org/r/20210820190122.16379-3-mail@anirudhrb.com Signed-off-by: Greg Kroah-Hartman

usbip: give back URBs for unsent unlink requests during cleanup

2021-08-26T11:29:10+00:00

In vhci_device_unlink_cleanup(), the URBs for unsent unlink requests are not given back. This sometimes causes usb_kill_urb to wait indefinitely for that urb to be given back. syzbot has reported a hung task issue [1] for this. To fix this, give back the urbs corresponding to unsent unlink requests (unlink_tx list) similar to how urbs corresponding to unanswered unlink requests (unlink_rx list) are given back. [1]: https://syzkaller.appspot.com/bug?id=08f12df95ae7da69814e64eb5515d5a85ed06b76 Reported-by: syzbot+74d6ef051d3d2eacf428@syzkaller.appspotmail.com Tested-by: syzbot+74d6ef051d3d2eacf428@syzkaller.appspotmail.com Reviewed-by: Shuah Khan Signed-off-by: Anirudh Rayabharam Link: https://lore.kernel.org/r/20210820190122.16379-2-mail@anirudhrb.com Signed-off-by: Greg Kroah-Hartman