Merge tag 'fixes-for-v5.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

gregkh · gregkh · commit 87be92b903ab · 2019-03-29T12:56:14.000+01:00
Felipe writes:

usb: fixes for v5.1-rc2

One deadlock fix on f_hid. NET2280 got a fix on its dequeue
implementation and a fix for overrun of OUT messages.

DWC3 learned about another Intel product: Comment Lake PCH.

NET2272 got a similar fix to NET2280 on its dequeue implementation.

* tag 'fixes-for-v5.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb:
  USB: gadget: f_hid: fix deadlock in f_hidg_write()
  usb: gadget: net2272: Fix net2272_dequeue()
  usb: gadget: net2280: Fix net2280_dequeue()
  usb: gadget: net2280: Fix overrun of OUT messages
  usb: dwc3: pci: add support for Comet Lake PCH ID
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
@@ -29,6 +29,7 @@
 #define PCI_DEVICE_ID_INTEL_BXT_M		0x1aaa
 #define PCI_DEVICE_ID_INTEL_APL			0x5aaa
 #define PCI_DEVICE_ID_INTEL_KBP			0xa2b0
+#define PCI_DEVICE_ID_INTEL_CMLH		0x02ee
 #define PCI_DEVICE_ID_INTEL_GLK			0x31aa
 #define PCI_DEVICE_ID_INTEL_CNPLP		0x9dee
 #define PCI_DEVICE_ID_INTEL_CNPH		0xa36e
@@ -305,6 +306,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MRFLD),
 	  (kernel_ulong_t) &dwc3_pci_mrfld_properties, },
 
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLH),
+	  (kernel_ulong_t) &dwc3_pci_intel_properties, },
+
 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_SPTLP),
 	  (kernel_ulong_t) &dwc3_pci_intel_properties, },
 
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
@@ -391,20 +391,20 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
 	req->complete = f_hidg_req_complete;
 	req->context  = hidg;
 
+	spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+
 	status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
 	if (status < 0) {
 		ERROR(hidg->func.config->cdev,
 			"usb_ep_queue error on int endpoint %zd\n", status);
-		goto release_write_pending_unlocked;
+		goto release_write_pending;
 	} else {
 		status = count;
 	}
-	spin_unlock_irqrestore(&hidg->write_spinlock, flags);
 
 	return status;
 release_write_pending:
 	spin_lock_irqsave(&hidg->write_spinlock, flags);
-release_write_pending_unlocked:
 	hidg->write_pending = 0;
 	spin_unlock_irqrestore(&hidg->write_spinlock, flags);
 
diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
@@ -945,6 +945,7 @@ net2272_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 			break;
 	}
 	if (&req->req != _req) {
+		ep->stopped = stopped;
 		spin_unlock_irqrestore(&ep->dev->lock, flags);
 		return -EINVAL;
 	}
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
@@ -866,9 +866,6 @@ static void start_queue(struct net2280_ep *ep, u32 dmactl, u32 td_dma)
 	(void) readl(&ep->dev->pci->pcimstctl);
 
 	writel(BIT(DMA_START), &dma->dmastat);
-
-	if (!ep->is_in)
-		stop_out_naking(ep);
 }
 
 static void start_dma(struct net2280_ep *ep, struct net2280_request *req)
@@ -907,6 +904,7 @@ static void start_dma(struct net2280_ep *ep, struct net2280_request *req)
 			writel(BIT(DMA_START), &dma->dmastat);
 			return;
 		}
+		stop_out_naking(ep);
 	}
 
 	tmp = dmactl_default;
@@ -1275,9 +1273,9 @@ static int net2280_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 			break;
 	}
 	if (&req->req != _req) {
+		ep->stopped = stopped;
 		spin_unlock_irqrestore(&ep->dev->lock, flags);
-		dev_err(&ep->dev->pdev->dev, "%s: Request mismatch\n",
-								__func__);
+		ep_dbg(ep->dev, "%s: Request mismatch\n", __func__);
 		return -EINVAL;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -945,6 +945,7 @@ net2272_dequeue(struct usb_ep _ep, struct usb_request _req)`
`945`	`945`	`break;`
`946`	`946`	`}`
`947`	`947`	`if (&req->req != _req) {`
	`948`	`+ ep->stopped = stopped;`
`948`	`949`	`spin_unlock_irqrestore(&ep->dev->lock, flags);`
`949`	`950`	`return -EINVAL;`
`950`	`951`	`}`
Original file line number	Diff line number	Diff line change
`@@ -866,9 +866,6 @@ static void start_queue(struct net2280_ep *ep, u32 dmactl, u32 td_dma)`
`866`	`866`	`(void) readl(&ep->dev->pci->pcimstctl);`
`867`	`867`
`868`	`868`	`writel(BIT(DMA_START), &dma->dmastat);`
`869`		`-`
`870`		`- if (!ep->is_in)`
`871`		`- stop_out_naking(ep);`
`872`	`869`	`}`
`873`	`870`
`874`	`871`	`static void start_dma(struct net2280_ep ep, struct net2280_request req)`
`@@ -907,6 +904,7 @@ static void start_dma(struct net2280_ep ep, struct net2280_request req)`
`907`	`904`	`writel(BIT(DMA_START), &dma->dmastat);`
`908`	`905`	`return;`
`909`	`906`	`}`
	`907`	`+ stop_out_naking(ep);`
`910`	`908`	`}`
`911`	`909`
`912`	`910`	`tmp = dmactl_default;`
`@@ -1275,9 +1273,9 @@ static int net2280_dequeue(struct usb_ep _ep, struct usb_request _req)`
`1275`	`1273`	`break;`
`1276`	`1274`	`}`
`1277`	`1275`	`if (&req->req != _req) {`
	`1276`	`+ ep->stopped = stopped;`
`1278`	`1277`	`spin_unlock_irqrestore(&ep->dev->lock, flags);`
`1279`		`- dev_err(&ep->dev->pdev->dev, "%s: Request mismatch\n",`
`1280`		`- __func__);`
	`1278`	`+ ep_dbg(ep->dev, "%s: Request mismatch\n", __func__);`
`1281`	`1279`	`return -EINVAL;`
`1282`	`1280`	`}`
`1283`	`1281`