The syzkaller fuzzer reported a bug in the USB hub driver which turned
out to be caused by a negative runtime-PM usage counter. This allowed
a hub to be runtime suspended at a time when the driver did not expect
it. The symptom is a WARNING issued because the hub's status URB is
submitted while it is already active:
URB 0000000031fb463e submitted while active
WARNING: CPU: 0 PID: 2917 at drivers/usb/core/urb.c:363
The negative runtime-PM usage count was caused by an unfortunate
design decision made when runtime PM was first implemented for USB.
At that time, USB class drivers were allowed to unbind from their
interfaces without balancing the usage counter (i.e., leaving it with
a positive count). The core code would take care of setting the
counter back to 0 before allowing another driver to bind to the
interface.
Later on when runtime PM was implemented for the entire kernel, the
opposite decision was made: Drivers were required to balance their
runtime-PM get and put calls. In order to maintain backward
compatibility, however, the USB subsystem adapted to the new
implementation by keeping an independent usage counter for each
interface and using it to automatically adjust the normal usage
counter back to 0 whenever a driver was unbound.
This approach involves duplicating information, but what is worse, it
doesn't work properly in cases where a USB class driver delays
decrementing the usage counter until after the driver's disconnect()
routine has returned and the counter has been adjusted back to 0.
Doing so would cause the usage counter to become negative. There's
even a warning about this in the USB power management documentation!
As it happens, this is exactly what the hub driver does. The
kick_hub_wq() routine increments the runtime-PM usage counter, and the
corresponding decrement is carried out by hub_event() in the context
of the hub_wq work-queue thread. This work routine may sometimes run
after the driver has been unbound from its interface, and when it does
it causes the usage counter to go negative.
It is not possible for hub_disconnect() to wait for a pending
hub_event() call to finish, because hub_disconnect() is called with
the device lock held and hub_event() acquires that lock. The only
feasible fix is to reverse the original design decision: remove the
duplicate interface-specific usage counter and require USB drivers to
balance their runtime PM gets and puts. As far as I know, all
existing drivers currently do this.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+7634edaea4d0b341c625@syzkaller.appspotmail.com
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Now that the SPDX tag is in all USB files, that identifies the license
in a specific and legally-defined manner. So the extra GPL text wording
can be removed as it is no longer needed at all.
This is done on a quest to remove the 700+ different ways that files in
the kernel describe the GPL license text. And there's unneeded stuff
like the address (sometimes incorrect) for the FSF which is never
needed.
No copyright headers or other non-license-description text was removed.
Cc: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
It's good to have SPDX identifiers in all files to make it easier to
audit the kernel tree for correct licenses.
Update the drivers/usb/ and include/linux/usb* files with the correct
SPDX license identifier based on the license text in the file itself.
The SPDX identifier is a legally binding shorthand, which can be used
instead of the full boiler plate text.
This work is based on a script and data from Thomas Gleixner, Philippe
Ombredanne, and Kate Stewart.
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Acked-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
MODULE_VERSION is useless for in-kernel drivers, so remove the
use of it in the Realtek USB card reader driver.
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
No functional changes here, just making sure our
storage driver uses a consistent multi-line comment
style.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
While accessing a unusual usb storage (ums-alauda, ums-cypress, ...),
the module reference count is not incremented. Because these drivers
allocate scsi hosts with usb_stor_host_template defined in usb-storage
module. So these drivers always can be unloaded.
This fixes it by preparing scsi host template which is initialized
at module_init() for each ums-* driver. In order to minimize the
difference in ums-* drivers, introduce module_usb_stor_driver() helper
macro which is same as module_usb_driver() except that it also
initializes scsi host template.
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Vinayak Holikatti <vinholikatti@gmail.com>
Cc: Dolev Raviv <draviv@codeaurora.org>
Cc: Sujit Reddy Thumma <sthumma@codeaurora.org>
Cc: Subhash Jadavani <subhashj@codeaurora.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: "James E.J. Bottomley" <JBottomley@parallels.com>
Cc: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Hannes Reinecke <hare@suse.de>
Cc: linux-usb@vger.kernel.org
Cc: usb-storage@lists.one-eyed-alien.net
Cc: linux-scsi@vger.kernel.org
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Functions fw5895_init() and config_autodelink_before_power_down() are used
only when CONFIG_PM is defined.
drivers/usb/storage/realtek_cr.c:699:13: warning: 'fw5895_init' defined but not used [-Wunused-function]
drivers/usb/storage/realtek_cr.c:629:12: warning: 'config_autodelink_before_power_down' defined but not used [-Wunused-function]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixed typos in comments of various drivers/usb files
Signed-off-by: Mickael Maison <mickael.maison@gmail.com>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To fix the compile error when CONFIG_PM_RUNTIME is not enabled,
move the declaration of us out of CONFIG_REALTEK_AUTOPM macro in rts51x_chip.
drivers/usb/storage/realtek_cr.c: In function 'realtek_cr_destructor':
drivers/usb/storage/realtek_cr.c:942:11: error: 'struct rts51x_chip' has no member named 'us'
Signed-off-by: Wei WANG <wei_wang@realsil.com.cn>
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove unused local `us', which broke the build. Also nuke an unneeded
cast.
Repairs commit 191648d03d ("usb: storage: Convert US_DEBUGP to
usb_stor_dbg").
Cc: Joe Perches <joe@perches.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Use a more current logging style with dev_printk
where possible.
o Convert uses of US_DEBUGP to usb_stor_dbg
o Add "struct us_data *" to usb_stor_dbg uses
o usb_stor_dbg now uses struct device */dev_vprint_emit
o Removed embedded function names
o Coalesce formats
o Remove trailing whitespace
o Remove useless OOM messages
o Remove useless function entry/exit logging
o Convert some US_DEBUGP uses to dev_info and dev_dbg
Object size is slightly reduced when debugging
is enabled, slightly increased with no debugging
because some initialization and removal messages
are now always emitted.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Pull trivial branch from Jiri Kosina:
"Usual stuff -- comment/printk typo fixes, documentation updates, dead
code elimination."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (39 commits)
HOWTO: fix double words typo
x86 mtrr: fix comment typo in mtrr_bp_init
propagate name change to comments in kernel source
doc: Update the name of profiling based on sysfs
treewide: Fix typos in various drivers
treewide: Fix typos in various Kconfig
wireless: mwifiex: Fix typo in wireless/mwifiex driver
messages: i2o: Fix typo in messages/i2o
scripts/kernel-doc: check that non-void fcts describe their return value
Kernel-doc: Convention: Use a "Return" section to describe return values
radeon: Fix typo and copy/paste error in comments
doc: Remove unnecessary declarations from Documentation/accounting/getdelays.c
various: Fix spelling of "asynchronous" in comments.
Fix misspellings of "whether" in comments.
eisa: Fix spelling of "asynchronous".
various: Fix spelling of "registered" in comments.
doc: fix quite a few typos within Documentation
target: iscsi: fix comment typos in target/iscsi drivers
treewide: fix typo of "suport" in various comments and Kconfig
treewide: fix typo of "suppport" in various comments
...
"Whether" is misspelled in various comments across the tree; this
fixes them. No code changes.
Signed-off-by: Adam Buchbinder <adam.buchbinder@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
When rts51x_read_status() returns USB_STOR_TRANSPORT_ERROR,
an error happens. This patch fixes build warning as below:
drivers/usb/storage/realtek_cr.c: In function 'init_realtek_cr':
drivers/usb/storage/realtek_cr.c:476:33: warning: 'buf[15]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[15]' was declared here
drivers/usb/storage/realtek_cr.c:475:33: warning: 'buf[14]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[14]' was declared here
drivers/usb/storage/realtek_cr.c:474:50: warning: 'buf[13]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[13]' was declared here
drivers/usb/storage/realtek_cr.c:472:30: warning: 'buf[12]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[12]' was declared here
drivers/usb/storage/realtek_cr.c:471:31: warning: 'buf[11]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[11]' was declared here
drivers/usb/storage/realtek_cr.c:470:31: warning: 'buf[10]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[10]' was declared here
drivers/usb/storage/realtek_cr.c:469:30: warning: 'buf[9]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[9]' was declared here
drivers/usb/storage/realtek_cr.c:468:27: warning: 'buf[8]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[8]' was declared here
drivers/usb/storage/realtek_cr.c:468:43: warning: 'buf[7]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[7]' was declared here
drivers/usb/storage/realtek_cr.c:467:30: warning: 'buf[6]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[6]' was declared here
drivers/usb/storage/realtek_cr.c:466:30: warning: 'buf[5]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[5]' was declared here
drivers/usb/storage/realtek_cr.c:465:28: warning: 'buf[4]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[4]' was declared here
drivers/usb/storage/realtek_cr.c:464:24: warning: 'buf[3]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[3]' was declared here
drivers/usb/storage/realtek_cr.c:464:40: warning: 'buf[2]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[2]' was declared here
drivers/usb/storage/realtek_cr.c:463:24: warning: 'buf[1]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[1]' was declared here
drivers/usb/storage/realtek_cr.c:463:40: warning: 'buf[0]' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/storage/realtek_cr.c:455:5: note: 'buf[0]' was declared here
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The "Low Performance USB Block driver" has been removed which a user of
libusual. Now we have only the usb-storage driver as the only driver in
tree. This makes libusual needless.
This patch removes libusal, fixes up all users. The usual-table is now
linked into usb-storage.
usb_usual.h remains in public include directory because some staging
users seem to need it.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
US_BULK_FLAG_IN is defined as 1 and not used. The USB storage spec says
that bit 7 of flags within CBW defines the data direction. 1 is DATA-IN
(read from device) and 0 is the DATA-OUT. Bit 6 is obselete and bits 0-5
are reserved.
This patch redefines the unsued define US_BULK_FLAG_IN from 1 to 1 << 7
aka 0x80 and replaces the obvious users. In a following patch the
storage gadget will use it as well.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
__do_config_autodelink passes the data variable to the transport function.
If the calling functions pass a stack variable, this will eventually trigger
a DMA-API debug backtrace for mapping stack memory in the DMA buffer. Fix
this by calling kmemdup for the passed data instead.
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This is done to resolve a merge conflict with:
drivers/usb/class/cdc-wdm.c
and to better handle future patches for this driver as it is under
active development at the moment.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Storage subdrivers, like alauda, datafab and others, don't support
dynamic id currently, and it needs lots of work but with very little
gain to enable the feature, so disable them in the patch.
Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This converts the drivers in drivers/usb/* to use the
module_usb_driver() macro which makes the code smaller and a bit
simpler.
Added bonus is that it removes some unneeded kernel log messages about
drivers loading and/or unloading.
Cc: Simon Arlott <cxacru@fire.lp0.eu>
Cc: Duncan Sands <duncan.sands@free.fr>
Cc: Matthieu CASTET <castet.matthieu@free.fr>
Cc: Stanislaw Gruszka <stf_xl@wp.pl>
Cc: Pete Zaitcev <zaitcev@redhat.com>
Cc: Oliver Neukum <oliver@neukum.name>
Cc: Juergen Stuber <starblue@users.sourceforge.net>
Cc: Cesar Miquel <miquel@df.uba.ar>
Cc: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Cc: Matthew Wilcox <willy@linux.intel.com>
Cc: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Lucas De Marchi <lucas.demarchi@profusion.mobi>
Cc: Michael Hund <mhund@ld-didactic.de>
Cc: Zack Parsons <k3bacon@gmail.com>
Cc: Melchior FRANZ <mfranz@aon.at>
Cc: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
Cc: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Use kmemdup rather than duplicating its implementation
The semantic patch that makes this change is available
in scripts/coccinelle/api/memdup.cocci.
Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix the following sparse warnings:
| drivers/usb/storage/realtek_cr.c:821:6: warning: symbol
| 'rts51x_invoke_transport' was not declared. Should
| it be static?
|
| drivers/usb/storage/realtek_cr.c:980:5: warning: symbol
| 'realtek_cr_suspend' was not declared. Should it
| be static?
|
| drivers/usb/storage/realtek_cr.c:518:23: warning: cast
| truncates bits from constant value (fe47 becomes 47)
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* 'usb-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (260 commits)
usb: renesas_usbhs: fixup inconsistent return from usbhs_pkt_push()
usb/isp1760: Allow to optionally trigger low-level chip reset via GPIOLIB.
USB: gadget: midi: memory leak in f_midi_bind_config()
USB: gadget: midi: fix range check in f_midi_out_open()
QE/FHCI: fixed the CONTROL bug
usb: renesas_usbhs: tidyup for smatch warnings
USB: Fix USB Kconfig dependency problem on 85xx/QoirQ platforms
EHCI: workaround for MosChip controller bug
usb: gadget: file_storage: fix race on unloading
USB: ftdi_sio.c: Use ftdi async_icount structure for TIOCMIWAIT, as in other drivers
USB: ftdi_sio.c:Fill MSR fields of the ftdi async_icount structure
USB: ftdi_sio.c: Fill LSR fields of the ftdi async_icount structure
USB: ftdi_sio.c:Fill TX field of the ftdi async_icount structure
USB: ftdi_sio.c: Fill the RX field of the ftdi async_icount structure
USB: ftdi_sio.c: Basic icount infrastructure for ftdi_sio
usb/isp1760: Let OF bindings depend on general CONFIG_OF instead of PPC_OF .
USB: ftdi_sio: Support TI/Luminary Micro Stellaris BD-ICDI Board
USB: Fix runtime wakeup on OHCI
xHCI/USB: Make xHCI driver have a BOS descriptor.
usb: gadget: add new usb gadget for ACM and mass storage
...
After auto-delink command is triggered, the CSW won't be sent back
to host side, in which scenario, the USB Mass Storage driver will
wait for the completion of the URB for MAX_SCHEDULE_TIMEOUT.
Signed-off-by: edwin_rong <edwin_rong@realsil.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
It was pointed out by 'make versioncheck' that linux/version.h was not
always being included where needed and sometimes included needlessly
in drivers/usb/.
This patch fixes up the includes.
For the UVC gadget driver bits, this was ACK'ed by Laurent Pinchart.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This patch changes rts51x_read_mem, rts51x_write_mem, and rts51x_read_status to
allocate temporary buffers with kmalloc. This way stack addresses are not used
for DMA when these functions call rts51x_bulk_transport.
Signed-off-by: Adam Cozzette <acozzette@cs.hmc.edu>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The autosuspend function can be disabled by unchecking the Macro
CONFIG_REALTEK_AUTOPM in kernel config file, by default, this macro is
turned on.
Signed-off-by: edwin_rong <edwin_rong@realsil.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
ums_realtek is used to support the power-saving function
for Realtek RTS51xx USB card readers.
Signed-off-by: wwang <wei_wang@realsil.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Alan Stern