--- /dev/null
+From 2acf25f13ebe8beb40e97a1bbe76f36277c64f1e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 1 Feb 2020 09:05:30 +0100
+Subject: ALSA: dummy: Fix PCM format loop in proc output
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 2acf25f13ebe8beb40e97a1bbe76f36277c64f1e upstream.
+
+The loop termination for iterating over all formats should contain
+SNDRV_PCM_FORMAT_LAST, not less than it.
+
+Fixes: 9b151fec139d ("ALSA: dummy - Add debug proc file")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200201080530.22390-3-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/drivers/dummy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/drivers/dummy.c
++++ b/sound/drivers/dummy.c
+@@ -915,7 +915,7 @@ static void print_formats(struct snd_dum
+ {
+ int i;
+
+- for (i = 0; i < SNDRV_PCM_FORMAT_LAST; i++) {
++ for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) {
+ if (dummy->pcm_hw.formats & (1ULL << i))
+ snd_iprintf(buffer, " %s", snd_pcm_format_name(i));
+ }
--- /dev/null
+From d8f489355cff55b30731354317739a00cf1238bd Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 1 Feb 2020 09:05:29 +0100
+Subject: ALSA: usb-audio: Annotate endianess in Scarlett gen2 quirk
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit d8f489355cff55b30731354317739a00cf1238bd upstream.
+
+The Scarlett gen2 mixer quirk code defines a few record types to
+communicate via USB hub, and those must be all little-endian.
+This patch changes the field types to LE to annotate endianess
+properly. It also fixes the incorrect usage of leXX_to_cpu() in a
+couple of places, which was caught by sparse after this change.
+
+Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200201080530.22390-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer_scarlett_gen2.c | 46 ++++++++++++++++++++--------------------
+ 1 file changed, 23 insertions(+), 23 deletions(-)
+
+--- a/sound/usb/mixer_scarlett_gen2.c
++++ b/sound/usb/mixer_scarlett_gen2.c
+@@ -558,11 +558,11 @@ static const struct scarlett2_config
+
+ /* proprietary request/response format */
+ struct scarlett2_usb_packet {
+- u32 cmd;
+- u16 size;
+- u16 seq;
+- u32 error;
+- u32 pad;
++ __le32 cmd;
++ __le16 size;
++ __le16 seq;
++ __le32 error;
++ __le32 pad;
+ u8 data[];
+ };
+
+@@ -664,11 +664,11 @@ static int scarlett2_usb(
+ "Scarlett Gen 2 USB invalid response; "
+ "cmd tx/rx %d/%d seq %d/%d size %d/%d "
+ "error %d pad %d\n",
+- le16_to_cpu(req->cmd), le16_to_cpu(resp->cmd),
++ le32_to_cpu(req->cmd), le32_to_cpu(resp->cmd),
+ le16_to_cpu(req->seq), le16_to_cpu(resp->seq),
+ resp_size, le16_to_cpu(resp->size),
+- le16_to_cpu(resp->error),
+- le16_to_cpu(resp->pad));
++ le32_to_cpu(resp->error),
++ le32_to_cpu(resp->pad));
+ err = -EINVAL;
+ goto unlock;
+ }
+@@ -687,7 +687,7 @@ error:
+ /* Send SCARLETT2_USB_DATA_CMD SCARLETT2_USB_CONFIG_SAVE */
+ static void scarlett2_config_save(struct usb_mixer_interface *mixer)
+ {
+- u32 req = cpu_to_le32(SCARLETT2_USB_CONFIG_SAVE);
++ __le32 req = cpu_to_le32(SCARLETT2_USB_CONFIG_SAVE);
+
+ scarlett2_usb(mixer, SCARLETT2_USB_DATA_CMD,
+ &req, sizeof(u32),
+@@ -713,11 +713,11 @@ static int scarlett2_usb_set_config(
+ const struct scarlett2_config config_item =
+ scarlett2_config_items[config_item_num];
+ struct {
+- u32 offset;
+- u32 bytes;
+- s32 value;
++ __le32 offset;
++ __le32 bytes;
++ __le32 value;
+ } __packed req;
+- u32 req2;
++ __le32 req2;
+ int err;
+ struct scarlett2_mixer_data *private = mixer->private_data;
+
+@@ -753,8 +753,8 @@ static int scarlett2_usb_get(
+ int offset, void *buf, int size)
+ {
+ struct {
+- u32 offset;
+- u32 size;
++ __le32 offset;
++ __le32 size;
+ } __packed req;
+
+ req.offset = cpu_to_le32(offset);
+@@ -794,8 +794,8 @@ static int scarlett2_usb_set_mix(struct
+ const struct scarlett2_device_info *info = private->info;
+
+ struct {
+- u16 mix_num;
+- u16 data[SCARLETT2_INPUT_MIX_MAX];
++ __le16 mix_num;
++ __le16 data[SCARLETT2_INPUT_MIX_MAX];
+ } __packed req;
+
+ int i, j;
+@@ -850,9 +850,9 @@ static int scarlett2_usb_set_mux(struct
+ };
+
+ struct {
+- u16 pad;
+- u16 num;
+- u32 data[SCARLETT2_MUX_MAX];
++ __le16 pad;
++ __le16 num;
++ __le32 data[SCARLETT2_MUX_MAX];
+ } __packed req;
+
+ req.pad = 0;
+@@ -911,9 +911,9 @@ static int scarlett2_usb_get_meter_level
+ u16 *levels)
+ {
+ struct {
+- u16 pad;
+- u16 num_meters;
+- u32 magic;
++ __le16 pad;
++ __le16 num_meters;
++ __le32 magic;
+ } __packed req;
+ u32 resp[SCARLETT2_NUM_METERS];
+ int i, err;
--- /dev/null
+From f8e5f90b3a53bb75f05124ed19156388379a337d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 1 Feb 2020 09:05:28 +0100
+Subject: ALSA: usb-audio: Fix endianess in descriptor validation
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f8e5f90b3a53bb75f05124ed19156388379a337d upstream.
+
+I overlooked that some fields are words and need the converts from
+LE in the recently added USB descriptor validation code.
+This patch fixes those with the proper macro usages.
+
+Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200201080530.22390-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/validate.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/usb/validate.c
++++ b/sound/usb/validate.c
+@@ -110,7 +110,7 @@ static bool validate_processing_unit(con
+ default:
+ if (v->type == UAC1_EXTENSION_UNIT)
+ return true; /* OK */
+- switch (d->wProcessType) {
++ switch (le16_to_cpu(d->wProcessType)) {
+ case UAC_PROCESS_UP_DOWNMIX:
+ case UAC_PROCESS_DOLBY_PROLOGIC:
+ if (d->bLength < len + 1) /* bNrModes */
+@@ -125,7 +125,7 @@ static bool validate_processing_unit(con
+ case UAC_VERSION_2:
+ if (v->type == UAC2_EXTENSION_UNIT_V2)
+ return true; /* OK */
+- switch (d->wProcessType) {
++ switch (le16_to_cpu(d->wProcessType)) {
+ case UAC2_PROCESS_UP_DOWNMIX:
+ case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */
+ if (d->bLength < len + 1) /* bNrModes */
+@@ -142,7 +142,7 @@ static bool validate_processing_unit(con
+ len += 2; /* wClusterDescrID */
+ break;
+ }
+- switch (d->wProcessType) {
++ switch (le16_to_cpu(d->wProcessType)) {
+ case UAC3_PROCESS_UP_DOWNMIX:
+ if (d->bLength < len + 1) /* bNrModes */
+ return false;
--- /dev/null
+From 7ecacafc240638148567742cca41aa7144b4fe1e Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Thu, 5 Dec 2019 17:07:01 +0800
+Subject: Bluetooth: btusb: Disable runtime suspend on Realtek devices
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 7ecacafc240638148567742cca41aa7144b4fe1e upstream.
+
+After commit 9e45524a0111 ("Bluetooth: btusb: Fix suspend issue for
+Realtek devices") both WiFi and Bluetooth stop working after reboot:
+[ 34.322617] usb 1-8: reset full-speed USB device number 3 using xhci_hcd
+[ 34.450401] usb 1-8: device descriptor read/64, error -71
+[ 34.694375] usb 1-8: device descriptor read/64, error -71
+...
+[ 44.599111] rtw_pci 0000:02:00.0: failed to poll offset=0x5 mask=0x3 value=0x0
+[ 44.599113] rtw_pci 0000:02:00.0: mac power on failed
+[ 44.599114] rtw_pci 0000:02:00.0: failed to power on mac
+[ 44.599114] rtw_pci 0000:02:00.0: leave idle state failed
+[ 44.599492] rtw_pci 0000:02:00.0: failed to leave ips state
+[ 44.599493] rtw_pci 0000:02:00.0: failed to leave idle state
+
+That commit removed USB_QUIRK_RESET_RESUME, which not only resets the USB
+device after resume, it also prevents the device from being runtime
+suspended by USB core. My experiment shows if the Realtek btusb device
+ever runtime suspends once, the entire wireless module becomes useless
+after reboot.
+
+So let's explicitly disable runtime suspend on Realtek btusb device for
+now.
+
+Fixes: 9e45524a0111 ("Bluetooth: btusb: Fix suspend issue for Realtek devices")
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -3832,6 +3832,10 @@ static int btusb_probe(struct usb_interf
+ * (DEVICE_REMOTE_WAKEUP)
+ */
+ set_bit(BTUSB_WAKEUP_DISABLE, &data->flags);
++
++ err = usb_autopm_get_interface(intf);
++ if (err < 0)
++ goto out_free_dev;
+ }
+
+ if (id->driver_info & BTUSB_AMP) {
--- /dev/null
+From 3168c19d7eb17a0108a3b60ad8e8c1b18ea05c63 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 29 Nov 2019 17:36:35 +0000
+Subject: Bluetooth: btusb: fix memory leak on fw
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 3168c19d7eb17a0108a3b60ad8e8c1b18ea05c63 upstream.
+
+Currently the error return path when the call to btusb_mtk_hci_wmt_sync
+fails does not free fw. Fix this by returning via the error_release_fw
+label that performs the free'ing.
+
+Addresses-Coverity: ("Resource leak")
+Fixes: a1c49c434e15 ("Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -2867,7 +2867,7 @@ static int btusb_mtk_setup_firmware(stru
+ err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to send wmt rst (%d)", err);
+- return err;
++ goto err_release_fw;
+ }
+
+ /* Wait a few moments for firmware activation done */
--- /dev/null
+From 4282dc057d750c6a7dd92953564b15c26b54c22c Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Sat, 14 Dec 2019 19:51:14 -0600
+Subject: brcmfmac: Fix memory leak in brcmf_usbdev_qinit
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+commit 4282dc057d750c6a7dd92953564b15c26b54c22c upstream.
+
+In the implementation of brcmf_usbdev_qinit() the allocated memory for
+reqs is leaking if usb_alloc_urb() fails. Release reqs in the error
+handling path.
+
+Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -430,6 +430,7 @@ fail:
+ usb_free_urb(req->urb);
+ list_del(q->next);
+ }
++ kfree(reqs);
+ return NULL;
+
+ }
--- /dev/null
+From 1a3f540d63152b8db0a12de508bfa03776217d83 Mon Sep 17 00:00:00 2001
+From: Israel Rukshin <israelr@mellanox.com>
+Date: Tue, 4 Feb 2020 14:38:10 +0200
+Subject: nvmet: Fix controller use after free
+
+From: Israel Rukshin <israelr@mellanox.com>
+
+commit 1a3f540d63152b8db0a12de508bfa03776217d83 upstream.
+
+After nvmet_install_queue() sets sq->ctrl calling to nvmet_sq_destroy()
+reduces the controller refcount. In case nvmet_install_queue() fails,
+calling to nvmet_ctrl_put() is done twice (at nvmet_sq_destroy and
+nvmet_execute_io_connect/nvmet_execute_admin_connect) instead of once for
+the queue which leads to use after free of the controller. Fix this by set
+NULL at sq->ctrl in case of a failure at nvmet_install_queue().
+
+The bug leads to the following Call Trace:
+
+[65857.994862] refcount_t: underflow; use-after-free.
+[65858.108304] Workqueue: events nvmet_rdma_release_queue_work [nvmet_rdma]
+[65858.115557] RIP: 0010:refcount_warn_saturate+0xe5/0xf0
+[65858.208141] Call Trace:
+[65858.211203] nvmet_sq_destroy+0xe1/0xf0 [nvmet]
+[65858.216383] nvmet_rdma_release_queue_work+0x37/0xf0 [nvmet_rdma]
+[65858.223117] process_one_work+0x167/0x370
+[65858.227776] worker_thread+0x49/0x3e0
+[65858.232089] kthread+0xf5/0x130
+[65858.235895] ? max_active_store+0x80/0x80
+[65858.240504] ? kthread_bind+0x10/0x10
+[65858.244832] ret_from_fork+0x1f/0x30
+[65858.249074] ---[ end trace f82d59250b54beb7 ]---
+
+Fixes: bb1cc74790eb ("nvmet: implement valid sqhd values in completions")
+Fixes: 1672ddb8d691 ("nvmet: Add install_queue callout")
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/target/fabrics-cmd.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvme/target/fabrics-cmd.c
++++ b/drivers/nvme/target/fabrics-cmd.c
+@@ -109,6 +109,7 @@ static u16 nvmet_install_queue(struct nv
+ u16 qid = le16_to_cpu(c->qid);
+ u16 sqsize = le16_to_cpu(c->sqsize);
+ struct nvmet_ctrl *old;
++ u16 ret;
+
+ old = cmpxchg(&req->sq->ctrl, NULL, ctrl);
+ if (old) {
+@@ -119,7 +120,8 @@ static u16 nvmet_install_queue(struct nv
+ if (!sqsize) {
+ pr_warn("queue size zero!\n");
+ req->error_loc = offsetof(struct nvmf_connect_command, sqsize);
+- return NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
++ ret = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
++ goto err;
+ }
+
+ /* note: convert queue size from 0's-based value to 1's-based value */
+@@ -132,16 +134,19 @@ static u16 nvmet_install_queue(struct nv
+ }
+
+ if (ctrl->ops->install_queue) {
+- u16 ret = ctrl->ops->install_queue(req->sq);
+-
++ ret = ctrl->ops->install_queue(req->sq);
+ if (ret) {
+ pr_err("failed to install queue %d cntlid %d ret %x\n",
+ qid, ctrl->cntlid, ret);
+- return ret;
++ goto err;
+ }
+ }
+
+ return 0;
++
++err:
++ req->sq->ctrl = NULL;
++ return ret;
+ }
+
+ static void nvmet_execute_admin_connect(struct nvmet_req *req)
--- /dev/null
+From 0b87a2b795d66be7b54779848ef0f3901c5e46fc Mon Sep 17 00:00:00 2001
+From: Israel Rukshin <israelr@mellanox.com>
+Date: Tue, 4 Feb 2020 14:38:09 +0200
+Subject: nvmet: Fix error print message at nvmet_install_queue function
+
+From: Israel Rukshin <israelr@mellanox.com>
+
+commit 0b87a2b795d66be7b54779848ef0f3901c5e46fc upstream.
+
+Place the arguments in the correct order.
+
+Fixes: 1672ddb8d691 ("nvmet: Add install_queue callout")
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/target/fabrics-cmd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvme/target/fabrics-cmd.c
++++ b/drivers/nvme/target/fabrics-cmd.c
+@@ -136,7 +136,7 @@ static u16 nvmet_install_queue(struct nv
+
+ if (ret) {
+ pr_err("failed to install queue %d cntlid %d ret %x\n",
+- qid, ret, ctrl->cntlid);
++ qid, ctrl->cntlid, ret);
+ return ret;
+ }
+ }
--- /dev/null
+From 6ec14aa7a58a1c2fb303692f8cb1ff82d9abd10a Mon Sep 17 00:00:00 2001
+From: Olof Johansson <olof@lixom.net>
+Date: Mon, 20 Jan 2020 12:14:07 -0600
+Subject: objtool: Silence build output
+
+From: Olof Johansson <olof@lixom.net>
+
+commit 6ec14aa7a58a1c2fb303692f8cb1ff82d9abd10a upstream.
+
+The sync-check.sh script prints out the path due to a "cd -" at the end
+of the script, even on silent builds. This isn't even needed, since the
+script is executed in our build instead of sourced (so it won't change
+the working directory of the surrounding build anyway).
+
+Just remove the cd to make the build silent.
+
+Fixes: 2ffd84ae973b ("objtool: Update sync-check.sh from perf's check-headers.sh")
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/cb002857fafa8186cfb9c3e43fb62e4108a1bab9.1579543924.git.jpoimboe@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/objtool/sync-check.sh | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/tools/objtool/sync-check.sh
++++ b/tools/objtool/sync-check.sh
+@@ -48,5 +48,3 @@ check arch/x86/include/asm/inat.h '-
+ check arch/x86/include/asm/insn.h '-I "^#include [\"<]\(asm/\)*inat.h[\">]"'
+ check arch/x86/lib/inat.c '-I "^#include [\"<]\(../include/\)*asm/insn.h[\">]"'
+ check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]" -I "^#include [\"<]\(../include/\)*asm/emulate_prefix.h[\">]"'
+-
+-cd -
rcu-avoid-data-race-in-rcu_gp_fqs_check_wake.patch
srcu-apply-_once-to-srcu_last_gp_end.patch
rcu-use-read_once-for-expmask-in-rcu_read_unlock_special.patch
+nvmet-fix-error-print-message-at-nvmet_install_queue-function.patch
+nvmet-fix-controller-use-after-free.patch
+bluetooth-btusb-fix-memory-leak-on-fw.patch
+bluetooth-btusb-disable-runtime-suspend-on-realtek-devices.patch
+brcmfmac-fix-memory-leak-in-brcmf_usbdev_qinit.patch
+usb-dwc3-gadget-check-end_transfer-completion.patch
+usb-dwc3-gadget-delay-starting-transfer.patch
+usb-typec-tcpci-mask-event-interrupts-when-remove-driver.patch
+objtool-silence-build-output.patch
+usb-gadget-f_fs-set-req-num_sgs-as-0-for-non-sg-transfer.patch
+usb-gadget-legacy-set-max_speed-to-super-speed.patch
+usb-gadget-f_ncm-use-atomic_t-to-track-in-flight-request.patch
+usb-gadget-f_ecm-use-atomic_t-to-track-in-flight-request.patch
+alsa-usb-audio-fix-endianess-in-descriptor-validation.patch
+alsa-usb-audio-annotate-endianess-in-scarlett-gen2-quirk.patch
+alsa-dummy-fix-pcm-format-loop-in-proc-output.patch
--- /dev/null
+From c58d8bfc77a2c7f6ff6339b58c9fca7ae6f57e70 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Wed, 18 Dec 2019 18:14:44 -0800
+Subject: usb: dwc3: gadget: Check END_TRANSFER completion
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit c58d8bfc77a2c7f6ff6339b58c9fca7ae6f57e70 upstream.
+
+While the END_TRANSFER command is sent but not completed, any request
+dequeue during this time will cause the driver to issue the END_TRANSFER
+command. The driver needs to submit the command only once to stop the
+controller from processing further. The controller may take more time to
+process the same command multiple times unnecessarily. Let's add a flag
+DWC3_EP_END_TRANSFER_PENDING to check for this condition.
+
+Fixes: 3aec99154db3 ("usb: dwc3: gadget: remove DWC3_EP_END_TRANSFER_PENDING")
+Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/core.h | 1 +
+ drivers/usb/dwc3/ep0.c | 4 +++-
+ drivers/usb/dwc3/gadget.c | 6 +++++-
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -688,6 +688,7 @@ struct dwc3_ep {
+ #define DWC3_EP_STALL BIT(1)
+ #define DWC3_EP_WEDGE BIT(2)
+ #define DWC3_EP_TRANSFER_STARTED BIT(3)
++#define DWC3_EP_END_TRANSFER_PENDING BIT(4)
+ #define DWC3_EP_PENDING_REQUEST BIT(5)
+
+ /* This last one is specific to EP0 */
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -1136,8 +1136,10 @@ void dwc3_ep0_interrupt(struct dwc3 *dwc
+ case DWC3_DEPEVT_EPCMDCMPLT:
+ cmd = DEPEVT_PARAMETER_CMD(event->parameters);
+
+- if (cmd == DWC3_DEPCMD_ENDTRANSFER)
++ if (cmd == DWC3_DEPCMD_ENDTRANSFER) {
++ dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
+ dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
++ }
+ break;
+ }
+ }
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2625,6 +2625,7 @@ static void dwc3_endpoint_interrupt(stru
+ cmd = DEPEVT_PARAMETER_CMD(event->parameters);
+
+ if (cmd == DWC3_DEPCMD_ENDTRANSFER) {
++ dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
+ dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
+ dwc3_gadget_ep_cleanup_cancelled_requests(dep);
+ }
+@@ -2683,7 +2684,8 @@ static void dwc3_stop_active_transfer(st
+ u32 cmd;
+ int ret;
+
+- if (!(dep->flags & DWC3_EP_TRANSFER_STARTED))
++ if (!(dep->flags & DWC3_EP_TRANSFER_STARTED) ||
++ (dep->flags & DWC3_EP_END_TRANSFER_PENDING))
+ return;
+
+ /*
+@@ -2728,6 +2730,8 @@ static void dwc3_stop_active_transfer(st
+
+ if (!interrupt)
+ dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
++ else
++ dep->flags |= DWC3_EP_END_TRANSFER_PENDING;
+
+ if (dwc3_is_usb31(dwc) || dwc->revision < DWC3_REVISION_310A)
+ udelay(100);
--- /dev/null
+From da10bcdd6f70dc9977f2cf18f4783cf78520623a Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Wed, 18 Dec 2019 18:14:50 -0800
+Subject: usb: dwc3: gadget: Delay starting transfer
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit da10bcdd6f70dc9977f2cf18f4783cf78520623a upstream.
+
+If the END_TRANSFER command hasn't completed yet, then don't send the
+START_TRANSFER command. The controller may not be able to start if
+that's the case. Some controller revisions depend on this. See
+commit 76a638f8ac0d ("usb: dwc3: gadget: wait for End Transfer to
+complete"). Let's only send START_TRANSFER command after the
+END_TRANSFER command had completed.
+
+Fixes: 3aec99154db3 ("usb: dwc3: gadget: remove DWC3_EP_END_TRANSFER_PENDING")
+Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/core.h | 1 +
+ drivers/usb/dwc3/gadget.c | 11 +++++++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -690,6 +690,7 @@ struct dwc3_ep {
+ #define DWC3_EP_TRANSFER_STARTED BIT(3)
+ #define DWC3_EP_END_TRANSFER_PENDING BIT(4)
+ #define DWC3_EP_PENDING_REQUEST BIT(5)
++#define DWC3_EP_DELAY_START BIT(6)
+
+ /* This last one is specific to EP0 */
+ #define DWC3_EP0_DIR_IN BIT(31)
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1447,6 +1447,12 @@ static int __dwc3_gadget_ep_queue(struct
+ list_add_tail(&req->list, &dep->pending_list);
+ req->status = DWC3_REQUEST_STATUS_QUEUED;
+
++ /* Start the transfer only after the END_TRANSFER is completed */
++ if (dep->flags & DWC3_EP_END_TRANSFER_PENDING) {
++ dep->flags |= DWC3_EP_DELAY_START;
++ return 0;
++ }
++
+ /*
+ * NOTICE: Isochronous endpoints should NEVER be prestarted. We must
+ * wait for a XferNotReady event so we will know what's the current
+@@ -2628,6 +2634,11 @@ static void dwc3_endpoint_interrupt(stru
+ dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
+ dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
+ dwc3_gadget_ep_cleanup_cancelled_requests(dep);
++ if ((dep->flags & DWC3_EP_DELAY_START) &&
++ !usb_endpoint_xfer_isoc(dep->endpoint.desc))
++ __dwc3_gadget_kick_transfer(dep);
++
++ dep->flags &= ~DWC3_EP_DELAY_START;
+ }
+ break;
+ case DWC3_DEPEVT_STREAMEVT:
--- /dev/null
+From d710562e01c48d59be3f60d58b7a85958b39aeda Mon Sep 17 00:00:00 2001
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Date: Thu, 9 Jan 2020 13:17:22 +0000
+Subject: usb: gadget: f_ecm: Use atomic_t to track in-flight request
+
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+
+commit d710562e01c48d59be3f60d58b7a85958b39aeda upstream.
+
+Currently ecm->notify_req is used to flag when a request is in-flight.
+ecm->notify_req is set to NULL and when a request completes it is
+subsequently reset.
+
+This is fundamentally buggy in that the unbind logic of the ECM driver will
+unconditionally free ecm->notify_req leading to a NULL pointer dereference.
+
+Fixes: da741b8c56d6 ("usb ethernet gadget: split CDC Ethernet function")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_ecm.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_ecm.c
++++ b/drivers/usb/gadget/function/f_ecm.c
+@@ -52,6 +52,7 @@ struct f_ecm {
+ struct usb_ep *notify;
+ struct usb_request *notify_req;
+ u8 notify_state;
++ atomic_t notify_count;
+ bool is_open;
+
+ /* FIXME is_open needs some irq-ish locking
+@@ -380,7 +381,7 @@ static void ecm_do_notify(struct f_ecm *
+ int status;
+
+ /* notification already in flight? */
+- if (!req)
++ if (atomic_read(&ecm->notify_count))
+ return;
+
+ event = req->buf;
+@@ -420,10 +421,10 @@ static void ecm_do_notify(struct f_ecm *
+ event->bmRequestType = 0xA1;
+ event->wIndex = cpu_to_le16(ecm->ctrl_id);
+
+- ecm->notify_req = NULL;
++ atomic_inc(&ecm->notify_count);
+ status = usb_ep_queue(ecm->notify, req, GFP_ATOMIC);
+ if (status < 0) {
+- ecm->notify_req = req;
++ atomic_dec(&ecm->notify_count);
+ DBG(cdev, "notify --> %d\n", status);
+ }
+ }
+@@ -448,17 +449,19 @@ static void ecm_notify_complete(struct u
+ switch (req->status) {
+ case 0:
+ /* no fault */
++ atomic_dec(&ecm->notify_count);
+ break;
+ case -ECONNRESET:
+ case -ESHUTDOWN:
++ atomic_set(&ecm->notify_count, 0);
+ ecm->notify_state = ECM_NOTIFY_NONE;
+ break;
+ default:
+ DBG(cdev, "event %02x --> %d\n",
+ event->bNotificationType, req->status);
++ atomic_dec(&ecm->notify_count);
+ break;
+ }
+- ecm->notify_req = req;
+ ecm_do_notify(ecm);
+ }
+
+@@ -907,6 +910,11 @@ static void ecm_unbind(struct usb_config
+
+ usb_free_all_descriptors(f);
+
++ if (atomic_read(&ecm->notify_count)) {
++ usb_ep_dequeue(ecm->notify, ecm->notify_req);
++ atomic_set(&ecm->notify_count, 0);
++ }
++
+ kfree(ecm->notify_req->buf);
+ usb_ep_free_request(ecm->notify, ecm->notify_req);
+ }
--- /dev/null
+From d2450c6937018d40d4111fe830fa48d4ddceb8d0 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Thu, 12 Dec 2019 16:35:03 +0800
+Subject: usb: gadget: f_fs: set req->num_sgs as 0 for non-sg transfer
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit d2450c6937018d40d4111fe830fa48d4ddceb8d0 upstream.
+
+The UDC core uses req->num_sgs to judge if scatter buffer list is used.
+Eg: usb_gadget_map_request_by_dev. For f_fs sync io mode, the request
+is re-used for each request, so if the 1st request->length > PAGE_SIZE,
+and the 2nd request->length is <= PAGE_SIZE, the f_fs uses the 1st
+req->num_sgs for the 2nd request, it causes the UDC core get the wrong
+req->num_sgs value (The 2nd request doesn't use sg). For f_fs async
+io mode, it is not harm to initialize req->num_sgs as 0 either, in case,
+the UDC driver doesn't zeroed request structure.
+
+Cc: Jun Li <jun.li@nxp.com>
+Cc: stable <stable@vger.kernel.org>
+Fixes: 772a7a724f69 ("usb: gadget: f_fs: Allow scatter-gather buffers")
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_fs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1062,6 +1062,7 @@ static ssize_t ffs_epfile_io(struct file
+ req->num_sgs = io_data->sgt.nents;
+ } else {
+ req->buf = data;
++ req->num_sgs = 0;
+ }
+ req->length = data_len;
+
+@@ -1105,6 +1106,7 @@ static ssize_t ffs_epfile_io(struct file
+ req->num_sgs = io_data->sgt.nents;
+ } else {
+ req->buf = data;
++ req->num_sgs = 0;
+ }
+ req->length = data_len;
+
--- /dev/null
+From 5b24c28cfe136597dc3913e1c00b119307a20c7e Mon Sep 17 00:00:00 2001
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Date: Thu, 9 Jan 2020 13:17:21 +0000
+Subject: usb: gadget: f_ncm: Use atomic_t to track in-flight request
+
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+
+commit 5b24c28cfe136597dc3913e1c00b119307a20c7e upstream.
+
+Currently ncm->notify_req is used to flag when a request is in-flight.
+ncm->notify_req is set to NULL and when a request completes it is
+subsequently reset.
+
+This is fundamentally buggy in that the unbind logic of the NCM driver will
+unconditionally free ncm->notify_req leading to a NULL pointer dereference.
+
+Fixes: 40d133d7f542 ("usb: gadget: f_ncm: convert to new function interface with backward compatibility")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_ncm.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -53,6 +53,7 @@ struct f_ncm {
+ struct usb_ep *notify;
+ struct usb_request *notify_req;
+ u8 notify_state;
++ atomic_t notify_count;
+ bool is_open;
+
+ const struct ndp_parser_opts *parser_opts;
+@@ -547,7 +548,7 @@ static void ncm_do_notify(struct f_ncm *
+ int status;
+
+ /* notification already in flight? */
+- if (!req)
++ if (atomic_read(&ncm->notify_count))
+ return;
+
+ event = req->buf;
+@@ -587,7 +588,8 @@ static void ncm_do_notify(struct f_ncm *
+ event->bmRequestType = 0xA1;
+ event->wIndex = cpu_to_le16(ncm->ctrl_id);
+
+- ncm->notify_req = NULL;
++ atomic_inc(&ncm->notify_count);
++
+ /*
+ * In double buffering if there is a space in FIFO,
+ * completion callback can be called right after the call,
+@@ -597,7 +599,7 @@ static void ncm_do_notify(struct f_ncm *
+ status = usb_ep_queue(ncm->notify, req, GFP_ATOMIC);
+ spin_lock(&ncm->lock);
+ if (status < 0) {
+- ncm->notify_req = req;
++ atomic_dec(&ncm->notify_count);
+ DBG(cdev, "notify --> %d\n", status);
+ }
+ }
+@@ -632,17 +634,19 @@ static void ncm_notify_complete(struct u
+ case 0:
+ VDBG(cdev, "Notification %02x sent\n",
+ event->bNotificationType);
++ atomic_dec(&ncm->notify_count);
+ break;
+ case -ECONNRESET:
+ case -ESHUTDOWN:
++ atomic_set(&ncm->notify_count, 0);
+ ncm->notify_state = NCM_NOTIFY_NONE;
+ break;
+ default:
+ DBG(cdev, "event %02x --> %d\n",
+ event->bNotificationType, req->status);
++ atomic_dec(&ncm->notify_count);
+ break;
+ }
+- ncm->notify_req = req;
+ ncm_do_notify(ncm);
+ spin_unlock(&ncm->lock);
+ }
+@@ -1649,6 +1653,11 @@ static void ncm_unbind(struct usb_config
+ ncm_string_defs[0].id = 0;
+ usb_free_all_descriptors(f);
+
++ if (atomic_read(&ncm->notify_count)) {
++ usb_ep_dequeue(ncm->notify, ncm->notify_req);
++ atomic_set(&ncm->notify_count, 0);
++ }
++
+ kfree(ncm->notify_req->buf);
+ usb_ep_free_request(ncm->notify, ncm->notify_req);
+ }
--- /dev/null
+From 463f67aec2837f981b0a0ce8617721ff59685c00 Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Mon, 23 Dec 2019 08:47:35 +0200
+Subject: usb: gadget: legacy: set max_speed to super-speed
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit 463f67aec2837f981b0a0ce8617721ff59685c00 upstream.
+
+These interfaces do support super-speed so let's not
+limit maximum speed to high-speed.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/legacy/cdc2.c | 2 +-
+ drivers/usb/gadget/legacy/g_ffs.c | 2 +-
+ drivers/usb/gadget/legacy/multi.c | 2 +-
+ drivers/usb/gadget/legacy/ncm.c | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/legacy/cdc2.c
++++ b/drivers/usb/gadget/legacy/cdc2.c
+@@ -225,7 +225,7 @@ static struct usb_composite_driver cdc_d
+ .name = "g_cdc",
+ .dev = &device_desc,
+ .strings = dev_strings,
+- .max_speed = USB_SPEED_HIGH,
++ .max_speed = USB_SPEED_SUPER,
+ .bind = cdc_bind,
+ .unbind = cdc_unbind,
+ };
+--- a/drivers/usb/gadget/legacy/g_ffs.c
++++ b/drivers/usb/gadget/legacy/g_ffs.c
+@@ -149,7 +149,7 @@ static struct usb_composite_driver gfs_d
+ .name = DRIVER_NAME,
+ .dev = &gfs_dev_desc,
+ .strings = gfs_dev_strings,
+- .max_speed = USB_SPEED_HIGH,
++ .max_speed = USB_SPEED_SUPER,
+ .bind = gfs_bind,
+ .unbind = gfs_unbind,
+ };
+--- a/drivers/usb/gadget/legacy/multi.c
++++ b/drivers/usb/gadget/legacy/multi.c
+@@ -482,7 +482,7 @@ static struct usb_composite_driver multi
+ .name = "g_multi",
+ .dev = &device_desc,
+ .strings = dev_strings,
+- .max_speed = USB_SPEED_HIGH,
++ .max_speed = USB_SPEED_SUPER,
+ .bind = multi_bind,
+ .unbind = multi_unbind,
+ .needs_serial = 1,
+--- a/drivers/usb/gadget/legacy/ncm.c
++++ b/drivers/usb/gadget/legacy/ncm.c
+@@ -197,7 +197,7 @@ static struct usb_composite_driver ncm_d
+ .name = "g_ncm",
+ .dev = &device_desc,
+ .strings = dev_strings,
+- .max_speed = USB_SPEED_HIGH,
++ .max_speed = USB_SPEED_SUPER,
+ .bind = gncm_bind,
+ .unbind = gncm_unbind,
+ };
--- /dev/null
+From 3ba76256fc4e2a0d7fb26cc95459041ea0e88972 Mon Sep 17 00:00:00 2001
+From: Jun Li <jun.li@nxp.com>
+Date: Mon, 20 Jan 2020 06:43:19 +0000
+Subject: usb: typec: tcpci: mask event interrupts when remove driver
+
+From: Jun Li <jun.li@nxp.com>
+
+commit 3ba76256fc4e2a0d7fb26cc95459041ea0e88972 upstream.
+
+This is to prevent any possible events generated while unregister
+tpcm port.
+
+Fixes: 74e656d6b055 ("staging: typec: Type-C Port Controller Interface driver (tcpci)")
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/1579502333-4145-1-git-send-email-jun.li@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/tcpm/tcpci.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/typec/tcpm/tcpci.c
++++ b/drivers/usb/typec/tcpm/tcpci.c
+@@ -591,6 +591,12 @@ static int tcpci_probe(struct i2c_client
+ static int tcpci_remove(struct i2c_client *client)
+ {
+ struct tcpci_chip *chip = i2c_get_clientdata(client);
++ int err;
++
++ /* Disable chip interrupts before unregistering port */
++ err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0);
++ if (err < 0)
++ return err;
+
+ tcpci_unregister_port(chip->tcpci);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
