[PATCH] usb: misc: sisusbvga: Avoid NULL pointer dereference from sisusb

From: Colin Ian King colin.k...@canonical.com A failed kzalloc() is reported with a dev_err that dereferences the null sisusb, this will cause a NULL pointer deference error. Instead, pass dev-dev to the dev_err() rather than sisusb-sisusb_dev-dev Smatch analysis:

[PATCH] usb: usb3503: return correct error return on failure

From: Colin Ian King colin.k...@canonical.com Fix warning: drivers/usb/misc/usb3503.c:195:11: warning: 'err' may be used uninitialized in this function [-Wmaybe-uninitialized] err is not initialized, the error return should be PTR_ERR(clk) Signed-off-by: Colin Ian King

[PATCH][V2] drivers/usb/serial/mos7840.c: remove unused code

From: Colin Ian King colin.k...@canonical.com There is old, unused code that is #defined out by the use of NOTMOS7840 and NOTMCS7840 - these are not defined anywhere. If NOTMOS7840 is defined then the code will break on null pointer dereferences on mos7840_port. So the code is currently unused,

[PATCH] drivers/usb/serial/mos7840.c: remove unused code

From: Colin Ian King colin.k...@canonical.com There is old, unused code that is #defined out by the use of NOTMOS7840 - this is not defined anywhere. If NOTMOS7840 is defined then the code will break on null pointer dereferences on mos7840_port. So the code is currently unused, and broken

[PATCH][V3] usb: isp1760: check for null return from kzalloc

From: Colin Ian King colin.k...@canonical.com isp1760_ep_alloc_request allocates a structure with kzalloc without checking for NULL and then returns a pointer to one of the structure fields. As the field happens to be the first in the structure the caller can properly check for NULL, but this

[PATCH] usb: isp1760: fix null dereference if kzalloc returns null

From: Colin Ian King colin.k...@canonical.com If kzalloc returns null then isp1760_ep_alloc_request performs a null pointer deference on req. Check for null to avoid this. Detected with smatch static analysis: drivers/usb/isp1760/isp1760-udc.c:816 isp1760_ep_alloc_request() error: potential

[PATCH][V2] usb: isp1760: fix null dereference if kzalloc returns null

From: Colin Ian King colin.k...@canonical.com If kzalloc returns null then isp1760_ep_alloc_request performs a null pointer dereference on req. Check for null to avoid this. Detected with smatch static analysis: drivers/usb/isp1760/isp1760-udc.c:816 isp1760_ep_alloc_request() error: potential

[PATCH] usb: gadget: bdc: fix spelling mistake: "allocted" -> "allocated"

From: Colin Ian King trivial fix to spelling mistake Signed-off-by: Colin Ian King --- drivers/usb/gadget/udc/bdc/bdc_ep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c

[PATCH] usb: hcd: do not call whc_clean_up on wch_init call failure

From: Colin Ian King whc_init already calls whc_clean_up if an error occurs during the initialization, so calling it again if whc_init fails at the end of wch_probe will cause double free errors. Fix this by bailing out on an whc_init failure to a new label that avoids

[PATCH] asix: do not free array priv->mdio->irq

From: Colin Ian King Used to be allocated and required freeing, but now priv->mdio->irq is now a fixed sized array and should no longer be free'd. Issue detected using static analysis with CoverityScan Fixes: e7f4dc3536a400 ("mdio: Move allocation of interrupts into

[PATCH] usb/host/fotg210: remove dead code in create_sysfs_files

From: Colin Ian King The goto in create_sysfs_files is never executed, so remove it and clean up the code. Signed-off-by: Colin Ian King --- drivers/usb/host/fotg210-hcd.c | 8 +--- 1 file changed, 1 insertion(+), 7 deletions(-) diff

[PATCH] usb: gadget: remove redundant self assignment

From: Colin Ian King The assignment ret = ret is redundant and can be removed. Signed-off-by: Colin Ian King --- drivers/usb/gadget/udc/core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git

[PATCH] usb: misc: adutux: remove redundant error check on copy_to_user return code

From: Colin Ian King The 2nd check for a non-zero return from copy_to_user is redundant as it is has already been made a few lines earlier. This check was made redundant because of previous fix to the copy_to_user error return check. Detected by CoverityScan,

[PATCH] usb: storage: fix infinite wait loop by incrementing loop counter

From: Colin Ian King If jumpshot_get_status continues to return a failed result then the wait loop will spin forever because the waitcount counter is never being incremented and we don't ever timeout. Fix this by incrementing waitcount. Cc:

[PATCH] HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL

From: Colin Ian King Quirking the following AMI USB device with ALWAYS_POLL fixes an AMI virtual keyboard and mouse from not responding and timing out when it is attached to a ppc64el Power 8 system and when we have some rapid open/closes on the mouse device. usb 1-3:

[PATCH] usb: misc: usbtest: remove redundant check on retval < 0

From: Colin Ian King The check for retval being less than zero is always true since retval equal to -EPIPE at that point. Replace the existing conditional with just return retval. Detected with CoverityScan, CID#114349 ("Logically dead code") Signed-off-by: Colin Ian

[PATCH] net: usb: asix_devices: fix missing return code check on call to asix_write_medium_mode

From: Colin Ian King The call to asix_write_medium_mode is not updating the return code ret and yet ret is being checked for an error. Fix this by assigning ret to the return code from the call asix_write_medium_mode. Detected by CoverityScan, CID#1357148 ("Logically

[PATCH] usb: gadget: prevent potenial null pointer dereference on skb->len

From: Colin Ian King An earlier fix partially fixed the null pointer dereference on skb->len by moving the assignment of len after the check on skb being non-null, however it failed to remove the erroneous dereference when assigning len. Correctly fix this by removing

[PATCH] USB: wusbcore: add in missing white space in error message text

From: Colin Ian King A dev_err message spans two lines and the literal string is missing a white space between words. Add the white space. Signed-off-by: Colin Ian King --- drivers/usb/wusbcore/cbaf.c | 2 +- 1 file changed, 1 insertion(+),

[PATCH][V2] USB: wusbcore: add in missing white space in error message text

From: Colin Ian King A dev_err message spans two lines and the literal string is missing a white space between words. Add the white space and reformat the message to not span multiple lines. Signed-off-by: Colin Ian King ---

[PATCH] usb: gadget: remove variable ret and remove unnecessary if statement

From: Colin Ian King the if statement in lb_modinit is unnecessary so we can totally remove the variable ret and just return the return value from the call to usb_function_register. Signed-off-by: Colin Ian King ---

[PATCH] usb: phy: ab8500-usb: fix spelling mistake "regester" -> "register"

From: Colin Ian King Trivial fix to spelling mistakes in dev_err messages. Signed-off-by: Colin Ian King --- drivers/usb/phy/phy-ab8500-usb.c | 8 1 file changed, 4 insertions(+), 4 deletions(-) diff --git

[PATCH] usb: gadget: net2280: fix typo: "Inavlid" -> "Invalid"

From: Colin Ian King trivial typo fix in dev_err message Signed-off-by: Colin Ian King --- drivers/usb/gadget/udc/net2280.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/udc/net2280.c

[PATCH] usb: renesas_usbhs: mod_host: fix typo: "connecte" -> "connected"

From: Colin Ian King trivial fix to typo in dev_dbg message Signed-off-by: Colin Ian King --- drivers/usb/renesas_usbhs/mod_host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/renesas_usbhs/mod_host.c

[PATCH] usb: gadget: pch_udc: don't update td->next after it has been released to the pool

From: Colin Ian King Writing to td->next should be avoided after td has been freed using dma_pool_free. The intent was to nullify the next pointer, but this is potentially dangerous once it is back in the pool. Remove it. Detected by CoverityScan, CID#1091173 ("Write

[PATCH] usb: gadget: udc: remove redundant initial assignments to the pointer 's'

From: Colin Ian King The initial setting of pointer s to the driver name or to the literal string "(none)" is redundant as later it is always set to point to a different literal string before it is printed log. Remove this redundant code. Detected with CoverityScan,

[PATCH] usb: gadget: dummy: fix infinite loop because of missing loop decrement

From: Colin Ian King The while loop never terminates because the loop counter i is never decremented. Fix this by decrementing i. Detected by CoverityScan, CID#751073 ("Infinite Loop") Signed-off-by: Colin Ian King ---

[PATCH] usb: renesas_usbhs: make array type_array static const

From: Colin Ian King Array type_array can be made static const rather than being populated on the stack. Makes the object code smaller: Before: textdata bss dec hex filename 80871496 09583256f drivers/usb/renesas_usbhs/pipe.o

[PATCH] usb: atm: ueagle-atm: fix spelling mistake: "submition" -> "submission"

From: Colin Ian King Trivial fix to spelling mistake in uea_err error message Signed-off-by: Colin Ian King --- drivers/usb/atm/ueagle-atm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/atm/ueagle-atm.c

[PATCH] usb: storage: return on error to avoid a null pointer dereference

From: Colin Ian King When us->extra is null the driver is not initialized, however, a later call to osd200_scsi_to_ata is made that dereferences us->extra, causing a null pointer dereference. The code currently detects and reports that the driver is not initialized;

[PATCH][V2] usb: storage: return on error to avoid a null pointer dereference

From: Colin Ian King When us->extra is null the driver is not initialized, however, a later call to osd200_scsi_to_ata is made that dereferences us->extra, causing a null pointer dereference. The code currently detects and reports that the driver is not initialized;

[PATCH] fsl_udc_core: fix spelling mistake: "Dectected" -> "Detected"

From: Colin Ian King Trivial fix to spelling mistake in seq_printf text Signed-off-by: Colin Ian King --- drivers/usb/gadget/udc/fsl_udc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git

[PATCH] usb: typec: wcove: fix uninitialized usbc_irq1 and usbc_irq2

From: Colin Ian King Calls to regmap_read may fail with an -EINVAL return without setting usbc_irq1 and usbc_irq2. The error handling clean up expects these to have been set (or zero on a failure) and currently may try to clear the wrong IRQs if the uninitalized

[PATCH] usb: storage: make const arrays static, reduces object code size

From: Colin Ian King Don't populate const arrays on the stack, instead make them static. Makes the object code smaller by over 1070 bytes: Before: textdata bss dec hex filename 3505 880 043851121 drivers/usb/storage/option_ms.o

[PATCH] USB: gadget: udc: fix spelling mistake "unexpect" -> "unexpected"

From: Colin Ian King Trival fix to spelling mistake in ERR message Signed-off-by: Colin Ian King --- drivers/usb/gadget/udc/fsl_udc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git

[PATCH] USB: atm: use setup_timer instead of init_timer

From: Colin Ian King Use setup_timer function instead of initializing timer with the function and data fields. Signed-off-by: Colin Ian King --- drivers/usb/atm/usbatm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git

[PATCH] USB: gadget: legacy: remove redundant zero assignment to variable 'value'

From: Colin Ian King The variable value is being assigned to zero but that value is never being read. Either value is being reassigned in the following if condition, or it is never read and the function returns. In both cases the assignment is redundant and can be

[PATCH] USB: usbip: fix spelling mistake: "synchronuously" -> "synchronously"

From: Colin Ian King Trivial fix to spelling mistake in error message text Signed-off-by: Colin Ian King --- drivers/usb/usbip/vhci_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/usbip/vhci_rx.c

[PATCH] USB: gadget: don't dereference g until after it has been null checked

From: Colin Ian King Avoid dereferencing pointer g until after g has been sanity null checked; move the assignment of cdev much later when it is required into a more local scope. Detected by CoverityScan, CID#1222135 ("Dereference before null check") Fixes:

[PATCH] USB: serial: iuu_phoenix: remove redundant assignment of DIV to itself

From: Colin Ian King The assignment of DIV to itself is redundant and can be removed. Signed-off-by: Colin Ian King --- drivers/usb/serial/iuu_phoenix.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/usb/serial/iuu_phoenix.c

[PATCH] USB: c67x00: remove redundant pointer urbp

From: Colin Ian King Pointer urbp is assigned but is never read, hence it is redundant and can be removed. Cleans up clang warning: drivers/usb/c67x00/c67x00-sched.c:975:2: warning: Value stored to 'urbp' is never read Signed-off-by: Colin Ian King

[PATCH] usb: gadget: udc: renesas_usb3: make const array max_packet_array static

From: Colin Ian King Don't populate the const array max_packet_array on the stack, instead make it static. Makes the object code smaller by over 90 bytes: Before: textdata bss dec hex filename 343375612 128 400779c8d renesas_usb3.o

[PATCH] USB: remove redundant assignment to temp

From: Colin Ian King The variable temp is being set at the end of each loop iteration but this value is never read, it is either being updated in just the case 1 block or at the end of the loop. Thus the assignment is redundant and can be removed. Cleans up clang

[PATCH] USB: adutux: remove redundant variable minor

From: Colin Ian King Variable minor is being assigned but never read, hence it is redundant and can be removed. Cleans up clang warning: drivers/usb/misc/adutux.c:770:2: warning: Value stored to 'minor' is never read Signed-off-by: Colin Ian King

[PATCH] usb: host: isp1362-hcd: remove a couple of redundant assignments

From: Colin Ian King Variable index is being initialized and the value is never read, it is being updated a few statements later, so remove the redundant initialization. Variable total is being updated but the value is never read, so this is also redundant and can be

[PATCH] USB: host: whci: remove redundant variable t

From: Colin Ian King Variable t is assigned but never read, it is redundant and therefore can be removed. Cleans up clang warning: drivers/usb/host/whci/asl.c:106:3: warning: Value stored to 't' is never read Signed-off-by: Colin Ian King

[PATCH] usb: gadget: udc-xilinx: remove redundant pointer udc

From: Colin Ian King Pointer udc is assigned but never read, hence it is redundant and can be removed. Cleans up clang warning: drivers/usb/gadget/udc/udc-xilinx.c:974:2: warning: Value stored to 'udc' is never read Signed-off-by: Colin Ian King

[PATCH] usb: gadget: pxa27x: Remove redundant assignment to is_short

From: Colin Ian King Variable is set to zero but this value is never read as it is overwritten with a new value later on, hence it is a redundant assignment and can be removed. Cleans up clang warning: drivers/usb/gadget/udc/pxa27x_udc.c:1141:2: warning: Value stored

[PATCH][V2] usb: gadget: pxa27x: Remove redundant assignment to is_short and dev

From: Colin Ian King Variable is_short is set to zero but this value is never read as it is overwritten with a new value later on, hence it is a redundant assignment and can be removed. Pointer dev is assigned a value that is not read and it is updated a few statements

[PATCH] usb: host: fix incorrect updating of offset

From: Colin Ian King The variable temp is incorrectly being updated, instead it should be offset otherwise the loop just reads the same capability value and loops forever. Thanks to Alan Stern for pointing out the correct fix to my original fix. Fix also cleans up

[PATCH][usb-next] usb: xhci: make function xhci_dbc_free_req static

From: Colin Ian King Function xhci_dbc_free_req is local to the source and does not need to be in global scope, so make it static. Cleans up sparse warning: symbol 'xhci_dbc_free_req' was not declared. Should it be static? Signed-off-by: Colin Ian King

[PATCH] net: hso: remove redundant unused variable dev

From: Colin Ian King The pointer dev is being assigned but is never used, hence it is redundant and can be removed. Cleans up clang warning: drivers/net/usb/hso.c:2280:2: warning: Value stored to 'dev' is never read Signed-off-by: Colin Ian King

[PATCH] usb-misc: sisusbvga: fix spelling mistake: "asymmeric" -> "asymmetric"

From: Colin Ian King Trivial fix to spelling mistake in text string Signed-off-by: Colin Ian King --- drivers/usb/misc/sisusbvga/sisusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/misc/sisusbvga/sisusb.c

[PATCH] usb: gadget: tcm: fix spelling mistake: "Manufactor" -> "Manufacturer"

From: Colin Ian King Trivial fix to spelling mistake in usbg_us_strings array Signed-off-by: Colin Ian King --- drivers/usb/gadget/legacy/tcm_usb_gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git

[PATCH] USB: wusbcore: remove redundant re-assignment to pointer 'dev'

From: Colin Ian King Pointer dev is initialized and then re-assigned with the same value a little later, hence the second assignment is redundant and can be removed. Cleans up clang warning: drivers/usb/wusbcore/wa-nep.c:88:17: warning: Value stored to 'dev' during its

[PATCH] USB: gadget: function: remove redundant initialization of 'tv_nexus'

From: Colin Ian King Pointer tv_nexus is being initialized a value and this is never read and is later being updated with the same value. Remove the redundant initialization so that the assignment to tv_nexus is performed later and more local to when it is being read.

[PATCH] usbip: vudc: fix null pointer dereference on udc->lock

From: Colin Ian King Currently the driver attempts to spin lock on udc->lock before a NULL pointer check is performed on udc, hence there is a potential null pointer dereference on udc->lock. Fix this by moving the null check on udc before the lock occurs. Fixes:

[PATCH][next] usbip: vhci: fix spelling mistake: "synchronuously" -> "synchronously"

From: Colin Ian King Trivial fix to spelling mistake in dev_dbg debug message. Signed-off-by: Colin Ian King --- drivers/usb/usbip/vhci_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/usbip/vhci_rx.c

[PATCH] USB: serial: remove redundant initializations of 'mos_parport'

From: Colin Ian King The pointer mos_parport is being initialized to pp->private_data and then the assignment is duplicated after a spin lock. Remove the initialization as it occurs before the spin lock and it is a redundant assignment. Cleans up clang warnings:

[PATCH][usb-next] usb: dwc2: ix spelling mistake: "genereted" -> "generated"

From: Colin Ian King Trivial fix to spelling mistake in dev_warn warning message text. Signed-off-by: Colin Ian King --- drivers/usb/dwc2/hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/dwc2/hcd.c

[PATCH] net/usb/kalmia: use ARRAY_SIZE for various array sizing calculations

From: Colin Ian King Use the ARRAY_SIZE macro on a couple of arrays to determine size of the arrays. Also fix up alignment to clean up a checkpatch warning. Improvement suggested by Coccinelle. Signed-off-by: Colin Ian King ---

[PATCH] usb: usbtmc: check size before allocating buffer and remove duplicated allocation

From: Colin Ian King Currently the allocation of a buffer is performed before a sanity check on the required buffer size and if the buffer size is too large the error exit return leaks the allocated buffer. Fix this by checking the size before allocating. Also, the same buffer is allocated