[PATCH] usbip: tools: Install all headers needed for libusbip development

[Ben Hutchings]

usbip_host_driver.h now depends on several additional headers, which
need to be installed along with it.

Fixes: 021aed845303 ("staging: usbip: userspace: migrate usbip_host_driver ...")
Fixes: 3391ba0e2792 ("usbip: tools: Extract generic code to be shared with ...")
Signed-off-by: Ben Hutchings 
---
I don't know of any external users of libusbip, but if it is going to
install headers to support such users it should do so properly.

Ben.

 tools/usb/usbip/Makefile.am | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/usb/usbip/Makefile.am b/tools/usb/usbip/Makefile.am
index 66f8bf038c9f..45eaa70a71e0 100644
--- a/tools/usb/usbip/Makefile.am
+++ b/tools/usb/usbip/Makefile.am
@@ -1,6 +1,7 @@
 SUBDIRS := libsrc src
 includedir = @includedir@/usbip
 include_HEADERS := $(addprefix libsrc/, \
-usbip_common.h vhci_driver.h usbip_host_driver.h)
+usbip_common.h vhci_driver.h usbip_host_driver.h \
+list.h sysfs_utils.h usbip_host_common.h)
 
 dist_man_MANS := $(addprefix doc/, usbip.8 usbipd.8)


signature.asc
Description: Digital signature

Re: [PATCH] usb: misc: usbtest: Fix overflow in usbtest_do_ioctl()

[Deepa Dinamani]

On Sat, Sep 30, 2017 at 1:15 AM, Dan Carpenter  wrote:
> There used to be a test against "if (param->sglen > MAX_SGLEN)" but it
> was removed during a refactor.  It leads to an integer overflow and a
> stack overflow in test_queue() if we try to create a too large urbs[]
> array on the stack.
>
> There is a second integer overflow in test_queue() as well if
> "param->iterations" is too high.  I don't immediately see that it's
> harmful but I've added a check to prevent it and silence the static
> checker warning.
>
> Fixes: 18fc4ebdc705 ("usb: misc: usbtest: Remove timeval usage")
> Signed-off-by: Dan Carpenter 
>
> diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
> index eee82ca55b7b..113e38bfe0ef 100644
> --- a/drivers/usb/misc/usbtest.c
> +++ b/drivers/usb/misc/usbtest.c
> @@ -1964,6 +1964,9 @@ test_queue(struct usbtest_dev *dev, struct 
> usbtest_param_32 *param,
> int status = 0;
> struct urb  *urbs[param->sglen];
>
> +   if (!param->sglen || param->iterations > UINT_MAX / param->sglen)

Would adding a comment here that we are checking for overflow of
context.count make sense?
It takes some time to figure out that context.count is unsigned and
hence the check is against UINT_MAX here.

> +   return -EINVAL;
> +
> memset(, 0, sizeof(context));
> context.count = param->iterations * param->sglen;
> context.dev = dev;
> @@ -2087,6 +2090,8 @@ usbtest_do_ioctl(struct usb_interface *intf, struct 
> usbtest_param_32 *param)
>
> if (param->iterations <= 0)
> return -EINVAL;
> +   if (param->sglen > MAX_SGLEN)
> +   return -EINVAL;

Right. I seem to have missed this. Thanks.

Acked-by: Deepa Dinamani 

-Deepa
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCHv2 2/7] usb: dwc2: add support for STM32F7 USB OTG HS

[John Youn]

On 09/29/2017 07:22 AM, Amelie DELAUNAY wrote:
> Hi,
>
> Gentle ping for driver review submitted on August 28th.
>
> Thanks,
> Amelie
>
> On 08/28/2017 04:20 PM, Amelie Delaunay wrote:
>> This patch adds the dwc2_set_params function for STM32F7 USB OTG HS.
>>
>> Signed-off-by: Amelie Delaunay 
>> ---
>>   drivers/usb/dwc2/params.c | 11 +++
>>   1 file changed, 11 insertions(+)
>>
>> diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
>> index a3ffe97..d5b672d 100644
>> --- a/drivers/usb/dwc2/params.c
>> +++ b/drivers/usb/dwc2/params.c
>> @@ -136,6 +136,15 @@ static void dwc2_set_stm32f4x9_fsotg_params(struct 
>> dwc2_hsotg *hsotg)
>>  p->activate_stm_fs_transceiver = true;
>>   }
>>
>> +static void dwc2_set_stm32f7_hsotg_params(struct dwc2_hsotg *hsotg)
>> +{
>> +struct dwc2_core_params *p = >params;
>> +
>> +p->host_rx_fifo_size = 622;
>> +p->host_nperio_tx_fifo_size = 128;
>> +p->host_perio_tx_fifo_size = 256;
>> +}
>> +
>>   const struct of_device_id dwc2_of_match_table[] = {
>>  { .compatible = "brcm,bcm2835-usb", .data = dwc2_set_bcm_params },
>>  { .compatible = "hisilicon,hi6220-usb", .data = dwc2_set_his_params  },
>> @@ -154,6 +163,8 @@ const struct of_device_id dwc2_of_match_table[] = {
>>  { .compatible = "st,stm32f4x9-fsotg",
>>.data = dwc2_set_stm32f4x9_fsotg_params },
>>  { .compatible = "st,stm32f4x9-hsotg" },
>> +{ .compatible = "st,stm32f7-hsotg",
>> +  .data = dwc2_set_stm32f7_hsotg_params },
>>  {},
>>   };
>>   MODULE_DEVICE_TABLE(of, dwc2_of_match_table);
>>


Acked-by: John Youn 


John

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [RESEND x2][PATCH 0/3] dwc2 fixes for edge cases on hikey

[John Youn]

On 09/20/2017 12:57 PM, John Stultz wrote:
> So here are a few dwc2 fixes that I've been using with HiKey.
> I'm not totally sure these are all ideal, but they avoid edge case
> issues that we have been running into with switching between
> gadget mode and host mode.
>
> I'd guess the first two are potentially -stable material, and
> the last might be worth sending to -stable too, as its a relatively
> simple fix, but to my understanding the UDC state tracking has
> always been broken so its not really a regression. But still.
>
> I'd love to get some feedback on the patches and consideration
> to be merged upstream.
>
> thanks
> -john
>
> Cc: Wei Xu 
> Cc: Guodong Xu 
> Cc: Amit Pundir 
> Cc: YongQin Liu 
> Cc: John Youn 
> Cc: Minas Harutyunyan 
> Cc: Douglas Anderson 
> Cc: Chen Yu 
> Cc: Felipe Balbi 
> Cc: Greg Kroah-Hartman 
> Cc: linux-usb@vger.kernel.org
>
> John Stultz (3):
>   usb: dwc2: Improve gadget state disconnection handling
>   usb: dwc2: Error out of dwc2_hsotg_ep_disable() if we're in host mode
>   usb: dwc2: Fix UDC state tracking
>
>  drivers/usb/dwc2/gadget.c | 7 +++
>  drivers/usb/dwc2/hcd.c| 8 ++--
>  2 files changed, 13 insertions(+), 2 deletions(-)
>

Hi John,

I think we have something that fixes these issues.

Minas,

Could you take a look at this? I was not able to find the patches we
talked about. If possible, please post them so that John can try them
out.

Thanks,
John
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options

[Andrew Gabbasov]

KASAN enabled configuration reports an error

BUG: KASAN: use-after-free in usb_composite_overwrite_options+...
[libcomposite] at addr ...
Read of size 1 by task ...

when some driver is un-bound and then bound again.
For example, this happens with FunctionFS driver when "ffs-test"
test application is run several times in a row.

If the driver has empty manufacturer ID string in initial static data,
it is then replaced with generated string. After driver unbinding
the generated string is freed, but the driver data still keep that
pointer. And if the driver is then bound again, that pointer
is re-used for string emptiness check.

The fix is to clean up the driver string data upon its unbinding
to drop the pointer to freed memory.

Fixes: cc2683c318a5 ("usb: gadget: Provide a default implementation of default 
manufacturer string")
Cc: sta...@vger.kernel.org
Signed-off-by: Andrew Gabbasov 
---
 drivers/usb/gadget/composite.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index dd74c99..5d061b3 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2026,6 +2026,8 @@ static DEVICE_ATTR_RO(suspended);
 static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)
 {
struct usb_composite_dev*cdev = get_gadget_data(gadget);
+   struct usb_gadget_strings   *gstr = cdev->driver->strings[0];
+   struct usb_string   *dev_str = gstr->strings;
 
/* composite_disconnect() must already have been called
 * by the underlying peripheral controller driver!
@@ -2045,6 +2047,9 @@ static void __composite_unbind(struct usb_gadget *gadget, 
bool unbind_driver)
 
composite_dev_cleanup(cdev);
 
+   if (dev_str[USB_GADGET_MANUFACTURER_IDX].s == cdev->def_manufacturer)
+   dev_str[USB_GADGET_MANUFACTURER_IDX].s = "";
+
kfree(cdev->def_manufacturer);
kfree(cdev);
set_gadget_data(gadget, NULL);
-- 
2.1.0

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] usb: gadget: configfs: Fix memory leak of interface directory data

[Andrew Gabbasov]

Kmemleak checking configuration reports a memory leak in
usb_os_desc_prepare_interf_dir function when rndis function
instance is freed and then allocated again. For example, this
happens with FunctionFS driver with RNDIS function enabled
when "ffs-test" test application is run several times in a row.

The data for intermediate "os_desc" group for interface directories
is allocated as a single VLA chunk and (after a change of default
groups handling) is not ever freed and actually not stored anywhere
besides inside a list of default groups of a parent group.

The fix is to make usb_os_desc_prepare_interf_dir function return
a pointer to allocated data (as a pointer to the first VLA item)
instead of (an unused) integer and to make the caller component
(currently the only one is RNDIS function) responsible for storing
the pointer and freeing the memory when appropriate.

Fixes: 1ae1602de028 ("configfs: switch ->default groups to a linked list")
Cc: sta...@vger.kernel.org
Signed-off-by: Andrew Gabbasov 
---
 drivers/usb/gadget/configfs.c | 15 ---
 drivers/usb/gadget/configfs.h | 11 ++-
 drivers/usb/gadget/function/f_rndis.c | 12 ++--
 drivers/usb/gadget/function/u_rndis.h |  1 +
 4 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index a22a892..aeb9f3c 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1143,11 +1143,12 @@ static struct configfs_attribute *interf_grp_attrs[] = {
NULL
 };
 
-int usb_os_desc_prepare_interf_dir(struct config_group *parent,
-  int n_interf,
-  struct usb_os_desc **desc,
-  char **names,
-  struct module *owner)
+struct config_group *usb_os_desc_prepare_interf_dir(
+   struct config_group *parent,
+   int n_interf,
+   struct usb_os_desc **desc,
+   char **names,
+   struct module *owner)
 {
struct config_group *os_desc_group;
struct config_item_type *os_desc_type, *interface_type;
@@ -1159,7 +1160,7 @@ int usb_os_desc_prepare_interf_dir(struct config_group 
*parent,
 
char *vlabuf = kzalloc(vla_group_size(data_chunk), GFP_KERNEL);
if (!vlabuf)
-   return -ENOMEM;
+   return ERR_PTR(-ENOMEM);
 
os_desc_group = vla_ptr(vlabuf, data_chunk, os_desc_group);
os_desc_type = vla_ptr(vlabuf, data_chunk, os_desc_type);
@@ -1184,7 +1185,7 @@ int usb_os_desc_prepare_interf_dir(struct config_group 
*parent,
configfs_add_default_group(>group, os_desc_group);
}
 
-   return 0;
+   return os_desc_group;
 }
 EXPORT_SYMBOL(usb_os_desc_prepare_interf_dir);
 
diff --git a/drivers/usb/gadget/configfs.h b/drivers/usb/gadget/configfs.h
index 36c468c..540d5e9 100644
--- a/drivers/usb/gadget/configfs.h
+++ b/drivers/usb/gadget/configfs.h
@@ -5,11 +5,12 @@
 
 void unregister_gadget_item(struct config_item *item);
 
-int usb_os_desc_prepare_interf_dir(struct config_group *parent,
-  int n_interf,
-  struct usb_os_desc **desc,
-  char **names,
-  struct module *owner);
+struct config_group *usb_os_desc_prepare_interf_dir(
+   struct config_group *parent,
+   int n_interf,
+   struct usb_os_desc **desc,
+   char **names,
+   struct module *owner);
 
 static inline struct usb_os_desc *to_usb_os_desc(struct config_item *item)
 {
diff --git a/drivers/usb/gadget/function/f_rndis.c 
b/drivers/usb/gadget/function/f_rndis.c
index e1d5853..c7c5b3c 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -908,6 +908,7 @@ static void rndis_free_inst(struct usb_function_instance *f)
free_netdev(opts->net);
}
 
+   kfree(opts->rndis_interf_group);/* single VLA chunk */
kfree(opts);
 }
 
@@ -916,6 +917,7 @@ static struct usb_function_instance *rndis_alloc_inst(void)
struct f_rndis_opts *opts;
struct usb_os_desc *descs[1];
char *names[1];
+   struct config_group *rndis_interf_group;
 
opts = kzalloc(sizeof(*opts), GFP_KERNEL);
if (!opts)
@@ -940,8 +942,14 @@ static struct usb_function_instance *rndis_alloc_inst(void)
names[0] = "rndis";
config_group_init_type_name(>func_inst.group, "",
_func_type);
-   usb_os_desc_prepare_interf_dir(>func_inst.group, 1, descs,
-  names, THIS_MODULE);
+   rndis_interf_group =
+   usb_os_desc_prepare_interf_dir(>func_inst.group, 1, descs,
+  names, 

Re: [PATCH 01/12] usb: mtu3: fix error return code in ssusb_gadget_init()

[Sergei Shtylyov]

Hello!

On 9/28/2017 3:17 AM, Chunfeng Yun wrote:


When fail to get irq number, platform_get_irq() may return


   Failing. IRQ. :-)


-EPROBE_DEFER, but we ignore it and always return -ENODEV,
so fix it.

Signed-off-by: Chunfeng Yun 
---
  drivers/usb/mtu3/mtu3_core.c |4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
index 99c65b0..9475798 100644
--- a/drivers/usb/mtu3/mtu3_core.c
+++ b/drivers/usb/mtu3/mtu3_core.c
@@ -774,9 +774,9 @@ int ssusb_gadget_init(struct ssusb_mtk *ssusb)
return -ENOMEM;
  
  	mtu->irq = platform_get_irq(pdev, 0);

-   if (mtu->irq <= 0) {
+   if (mtu->irq < 0) {


   This is good as the function no longer returns 0 on error. Even when it 
did, 0 could mean a valid IRQ as well...



dev_err(dev, "fail to get irq number\n");
-   return -ENODEV;
+   return mtu->irq;
}
dev_info(dev, "irq %d\n", mtu->irq);
  


MBR, Sergei
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Type-C port on the Asmedia ASM1142

[Adrian Bocaniciu]

On Fri, 29 Sep 2017 09:06:16 +
David Laight  wrote:

> > The correct names used in the new specification for the 4 speeds that can 
> > be supported by a USB 3
> > interface are: .
> 
> I think I'd add the speed itself as well.
> 
>   David


I was reffering mostly to the identifiers and comments used in the kernel 
source code.

When the speeds are displayed to a user, e.g. in log messages or in the lsusb 
output, you are of course right, the numeric speeds should also be shown.

Nevertheless, there is a problem with that.

The correct speeds would be:
"Gen 1x1 (4 Gb/s)", "Gen 1x2 (8 Gb/s)", "Gen 2x1 (10 Gb/s)",  and "Gen 2x2 (20 
Gb/s)".

But we are forced to show "Gen 1x1 (5 Gb/s)", because this is what most users 
expect.


There is a stupid tradition started by someone at Intel, I suppose from 
marketing, who had the mean idea of presenting SATA 1.0 as 1.5 Gb/s and PCIe 
1.0 as 2.5 Gb/s.

Before that, nobody thought that it would be right to present, e.g. Gigabit 
Ethernet as having a speed of 1.25 Gb/s.

This deceitful method was used since then for all SATA and SAS, and also for 
PCIe 2.0 and for USB 3.0.


In my opinion, we should display the USB 3 speeds so:

"Gen 1x1 (5 Gb/s)", "Gen 1x2 (8 Gb/s)", "Gen 2x1 (10 Gb/s)",  and "Gen 2x2 (20 
Gb/s)".


While this might confuse some users about why Gen 1x2 is not shown as having a 
double speed, I believe that the confusion created by seeing "Gen 1x2 (10 
Gb/s)", i.e. as having the same speed as "Gen 2x1" will be worse, because the 
users would be fooled in believing that a "Gen 1x2" device is worth the same 
money as a "Gen 2x1" device, when in fact the latter is 25% faster.















--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] usb: misc: usbtest: Fix overflow in usbtest_do_ioctl()

[Dan Carpenter]

There used to be a test against "if (param->sglen > MAX_SGLEN)" but it
was removed during a refactor.  It leads to an integer overflow and a
stack overflow in test_queue() if we try to create a too large urbs[]
array on the stack.

There is a second integer overflow in test_queue() as well if
"param->iterations" is too high.  I don't immediately see that it's
harmful but I've added a check to prevent it and silence the static
checker warning.

Fixes: 18fc4ebdc705 ("usb: misc: usbtest: Remove timeval usage")
Signed-off-by: Dan Carpenter 

diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index eee82ca55b7b..113e38bfe0ef 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -1964,6 +1964,9 @@ test_queue(struct usbtest_dev *dev, struct 
usbtest_param_32 *param,
int status = 0;
struct urb  *urbs[param->sglen];
 
+   if (!param->sglen || param->iterations > UINT_MAX / param->sglen)
+   return -EINVAL;
+
memset(, 0, sizeof(context));
context.count = param->iterations * param->sglen;
context.dev = dev;
@@ -2087,6 +2090,8 @@ usbtest_do_ioctl(struct usb_interface *intf, struct 
usbtest_param_32 *param)
 
if (param->iterations <= 0)
return -EINVAL;
+   if (param->sglen > MAX_SGLEN)
+   return -EINVAL;
/*
 * Just a bunch of test cases that every HCD is expected to handle.
 *
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html