From: Greg Kroah-Hartman Date: Thu, 6 Feb 2020 15:21:54 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.19.103~139 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0e8c31ba86c5c40466bc740682ac4025a9affb1d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: alsa-dummy-fix-pcm-format-loop-in-proc-output.patch alsa-usb-audio-annotate-endianess-in-scarlett-gen2-quirk.patch alsa-usb-audio-fix-endianess-in-descriptor-validation.patch bluetooth-btusb-disable-runtime-suspend-on-realtek-devices.patch bluetooth-btusb-fix-memory-leak-on-fw.patch brcmfmac-fix-memory-leak-in-brcmf_usbdev_qinit.patch nvmet-fix-controller-use-after-free.patch nvmet-fix-error-print-message-at-nvmet_install_queue-function.patch objtool-silence-build-output.patch usb-dwc3-gadget-check-end_transfer-completion.patch usb-dwc3-gadget-delay-starting-transfer.patch usb-gadget-f_ecm-use-atomic_t-to-track-in-flight-request.patch usb-gadget-f_fs-set-req-num_sgs-as-0-for-non-sg-transfer.patch usb-gadget-f_ncm-use-atomic_t-to-track-in-flight-request.patch usb-gadget-legacy-set-max_speed-to-super-speed.patch usb-typec-tcpci-mask-event-interrupts-when-remove-driver.patch --- diff --git a/queue-5.4/alsa-dummy-fix-pcm-format-loop-in-proc-output.patch b/queue-5.4/alsa-dummy-fix-pcm-format-loop-in-proc-output.patch new file mode 100644 index 00000000000..32d704727f4 --- /dev/null +++ b/queue-5.4/alsa-dummy-fix-pcm-format-loop-in-proc-output.patch @@ -0,0 +1,33 @@ +From 2acf25f13ebe8beb40e97a1bbe76f36277c64f1e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 1 Feb 2020 09:05:30 +0100 +Subject: ALSA: dummy: Fix PCM format loop in proc output + +From: Takashi Iwai + +commit 2acf25f13ebe8beb40e97a1bbe76f36277c64f1e upstream. + +The loop termination for iterating over all formats should contain +SNDRV_PCM_FORMAT_LAST, not less than it. + +Fixes: 9b151fec139d ("ALSA: dummy - Add debug proc file") +Cc: +Link: https://lore.kernel.org/r/20200201080530.22390-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/drivers/dummy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/drivers/dummy.c ++++ b/sound/drivers/dummy.c +@@ -915,7 +915,7 @@ static void print_formats(struct snd_dum + { + int i; + +- for (i = 0; i < SNDRV_PCM_FORMAT_LAST; i++) { ++ for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) { + if (dummy->pcm_hw.formats & (1ULL << i)) + snd_iprintf(buffer, " %s", snd_pcm_format_name(i)); + } diff --git a/queue-5.4/alsa-usb-audio-annotate-endianess-in-scarlett-gen2-quirk.patch b/queue-5.4/alsa-usb-audio-annotate-endianess-in-scarlett-gen2-quirk.patch new file mode 100644 index 00000000000..8fa60125ec0 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-annotate-endianess-in-scarlett-gen2-quirk.patch @@ -0,0 +1,132 @@ +From d8f489355cff55b30731354317739a00cf1238bd Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 1 Feb 2020 09:05:29 +0100 +Subject: ALSA: usb-audio: Annotate endianess in Scarlett gen2 quirk + +From: Takashi Iwai + +commit d8f489355cff55b30731354317739a00cf1238bd upstream. + +The Scarlett gen2 mixer quirk code defines a few record types to +communicate via USB hub, and those must be all little-endian. +This patch changes the field types to LE to annotate endianess +properly. It also fixes the incorrect usage of leXX_to_cpu() in a +couple of places, which was caught by sparse after this change. + +Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") +Cc: +Link: https://lore.kernel.org/r/20200201080530.22390-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer_scarlett_gen2.c | 46 ++++++++++++++++++++-------------------- + 1 file changed, 23 insertions(+), 23 deletions(-) + +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -558,11 +558,11 @@ static const struct scarlett2_config + + /* proprietary request/response format */ + struct scarlett2_usb_packet { +- u32 cmd; +- u16 size; +- u16 seq; +- u32 error; +- u32 pad; ++ __le32 cmd; ++ __le16 size; ++ __le16 seq; ++ __le32 error; ++ __le32 pad; + u8 data[]; + }; + +@@ -664,11 +664,11 @@ static int scarlett2_usb( + "Scarlett Gen 2 USB invalid response; " + "cmd tx/rx %d/%d seq %d/%d size %d/%d " + "error %d pad %d\n", +- le16_to_cpu(req->cmd), le16_to_cpu(resp->cmd), ++ le32_to_cpu(req->cmd), le32_to_cpu(resp->cmd), + le16_to_cpu(req->seq), le16_to_cpu(resp->seq), + resp_size, le16_to_cpu(resp->size), +- le16_to_cpu(resp->error), +- le16_to_cpu(resp->pad)); ++ le32_to_cpu(resp->error), ++ le32_to_cpu(resp->pad)); + err = -EINVAL; + goto unlock; + } +@@ -687,7 +687,7 @@ error: + /* Send SCARLETT2_USB_DATA_CMD SCARLETT2_USB_CONFIG_SAVE */ + static void scarlett2_config_save(struct usb_mixer_interface *mixer) + { +- u32 req = cpu_to_le32(SCARLETT2_USB_CONFIG_SAVE); ++ __le32 req = cpu_to_le32(SCARLETT2_USB_CONFIG_SAVE); + + scarlett2_usb(mixer, SCARLETT2_USB_DATA_CMD, + &req, sizeof(u32), +@@ -713,11 +713,11 @@ static int scarlett2_usb_set_config( + const struct scarlett2_config config_item = + scarlett2_config_items[config_item_num]; + struct { +- u32 offset; +- u32 bytes; +- s32 value; ++ __le32 offset; ++ __le32 bytes; ++ __le32 value; + } __packed req; +- u32 req2; ++ __le32 req2; + int err; + struct scarlett2_mixer_data *private = mixer->private_data; + +@@ -753,8 +753,8 @@ static int scarlett2_usb_get( + int offset, void *buf, int size) + { + struct { +- u32 offset; +- u32 size; ++ __le32 offset; ++ __le32 size; + } __packed req; + + req.offset = cpu_to_le32(offset); +@@ -794,8 +794,8 @@ static int scarlett2_usb_set_mix(struct + const struct scarlett2_device_info *info = private->info; + + struct { +- u16 mix_num; +- u16 data[SCARLETT2_INPUT_MIX_MAX]; ++ __le16 mix_num; ++ __le16 data[SCARLETT2_INPUT_MIX_MAX]; + } __packed req; + + int i, j; +@@ -850,9 +850,9 @@ static int scarlett2_usb_set_mux(struct + }; + + struct { +- u16 pad; +- u16 num; +- u32 data[SCARLETT2_MUX_MAX]; ++ __le16 pad; ++ __le16 num; ++ __le32 data[SCARLETT2_MUX_MAX]; + } __packed req; + + req.pad = 0; +@@ -911,9 +911,9 @@ static int scarlett2_usb_get_meter_level + u16 *levels) + { + struct { +- u16 pad; +- u16 num_meters; +- u32 magic; ++ __le16 pad; ++ __le16 num_meters; ++ __le32 magic; + } __packed req; + u32 resp[SCARLETT2_NUM_METERS]; + int i, err; diff --git a/queue-5.4/alsa-usb-audio-fix-endianess-in-descriptor-validation.patch b/queue-5.4/alsa-usb-audio-fix-endianess-in-descriptor-validation.patch new file mode 100644 index 00000000000..13884136779 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-fix-endianess-in-descriptor-validation.patch @@ -0,0 +1,52 @@ +From f8e5f90b3a53bb75f05124ed19156388379a337d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 1 Feb 2020 09:05:28 +0100 +Subject: ALSA: usb-audio: Fix endianess in descriptor validation + +From: Takashi Iwai + +commit f8e5f90b3a53bb75f05124ed19156388379a337d upstream. + +I overlooked that some fields are words and need the converts from +LE in the recently added USB descriptor validation code. +This patch fixes those with the proper macro usages. + +Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units") +Cc: +Link: https://lore.kernel.org/r/20200201080530.22390-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/validate.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/usb/validate.c ++++ b/sound/usb/validate.c +@@ -110,7 +110,7 @@ static bool validate_processing_unit(con + default: + if (v->type == UAC1_EXTENSION_UNIT) + return true; /* OK */ +- switch (d->wProcessType) { ++ switch (le16_to_cpu(d->wProcessType)) { + case UAC_PROCESS_UP_DOWNMIX: + case UAC_PROCESS_DOLBY_PROLOGIC: + if (d->bLength < len + 1) /* bNrModes */ +@@ -125,7 +125,7 @@ static bool validate_processing_unit(con + case UAC_VERSION_2: + if (v->type == UAC2_EXTENSION_UNIT_V2) + return true; /* OK */ +- switch (d->wProcessType) { ++ switch (le16_to_cpu(d->wProcessType)) { + case UAC2_PROCESS_UP_DOWNMIX: + case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */ + if (d->bLength < len + 1) /* bNrModes */ +@@ -142,7 +142,7 @@ static bool validate_processing_unit(con + len += 2; /* wClusterDescrID */ + break; + } +- switch (d->wProcessType) { ++ switch (le16_to_cpu(d->wProcessType)) { + case UAC3_PROCESS_UP_DOWNMIX: + if (d->bLength < len + 1) /* bNrModes */ + return false; diff --git a/queue-5.4/bluetooth-btusb-disable-runtime-suspend-on-realtek-devices.patch b/queue-5.4/bluetooth-btusb-disable-runtime-suspend-on-realtek-devices.patch new file mode 100644 index 00000000000..bc9b6718de9 --- /dev/null +++ b/queue-5.4/bluetooth-btusb-disable-runtime-suspend-on-realtek-devices.patch @@ -0,0 +1,53 @@ +From 7ecacafc240638148567742cca41aa7144b4fe1e Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Thu, 5 Dec 2019 17:07:01 +0800 +Subject: Bluetooth: btusb: Disable runtime suspend on Realtek devices + +From: Kai-Heng Feng + +commit 7ecacafc240638148567742cca41aa7144b4fe1e upstream. + +After commit 9e45524a0111 ("Bluetooth: btusb: Fix suspend issue for +Realtek devices") both WiFi and Bluetooth stop working after reboot: +[ 34.322617] usb 1-8: reset full-speed USB device number 3 using xhci_hcd +[ 34.450401] usb 1-8: device descriptor read/64, error -71 +[ 34.694375] usb 1-8: device descriptor read/64, error -71 +... +[ 44.599111] rtw_pci 0000:02:00.0: failed to poll offset=0x5 mask=0x3 value=0x0 +[ 44.599113] rtw_pci 0000:02:00.0: mac power on failed +[ 44.599114] rtw_pci 0000:02:00.0: failed to power on mac +[ 44.599114] rtw_pci 0000:02:00.0: leave idle state failed +[ 44.599492] rtw_pci 0000:02:00.0: failed to leave ips state +[ 44.599493] rtw_pci 0000:02:00.0: failed to leave idle state + +That commit removed USB_QUIRK_RESET_RESUME, which not only resets the USB +device after resume, it also prevents the device from being runtime +suspended by USB core. My experiment shows if the Realtek btusb device +ever runtime suspends once, the entire wireless module becomes useless +after reboot. + +So let's explicitly disable runtime suspend on Realtek btusb device for +now. + +Fixes: 9e45524a0111 ("Bluetooth: btusb: Fix suspend issue for Realtek devices") +Signed-off-by: Kai-Heng Feng +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3819,6 +3819,10 @@ static int btusb_probe(struct usb_interf + * (DEVICE_REMOTE_WAKEUP) + */ + set_bit(BTUSB_WAKEUP_DISABLE, &data->flags); ++ ++ err = usb_autopm_get_interface(intf); ++ if (err < 0) ++ goto out_free_dev; + } + + if (id->driver_info & BTUSB_AMP) { diff --git a/queue-5.4/bluetooth-btusb-fix-memory-leak-on-fw.patch b/queue-5.4/bluetooth-btusb-fix-memory-leak-on-fw.patch new file mode 100644 index 00000000000..eeba26d6411 --- /dev/null +++ b/queue-5.4/bluetooth-btusb-fix-memory-leak-on-fw.patch @@ -0,0 +1,34 @@ +From 3168c19d7eb17a0108a3b60ad8e8c1b18ea05c63 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 29 Nov 2019 17:36:35 +0000 +Subject: Bluetooth: btusb: fix memory leak on fw + +From: Colin Ian King + +commit 3168c19d7eb17a0108a3b60ad8e8c1b18ea05c63 upstream. + +Currently the error return path when the call to btusb_mtk_hci_wmt_sync +fails does not free fw. Fix this by returning via the error_release_fw +label that performs the free'ing. + +Addresses-Coverity: ("Resource leak") +Fixes: a1c49c434e15 ("Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices") +Signed-off-by: Colin Ian King +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -2850,7 +2850,7 @@ static int btusb_mtk_setup_firmware(stru + err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); + if (err < 0) { + bt_dev_err(hdev, "Failed to send wmt rst (%d)", err); +- return err; ++ goto err_release_fw; + } + + /* Wait a few moments for firmware activation done */ diff --git a/queue-5.4/brcmfmac-fix-memory-leak-in-brcmf_usbdev_qinit.patch b/queue-5.4/brcmfmac-fix-memory-leak-in-brcmf_usbdev_qinit.patch new file mode 100644 index 00000000000..1693b0f2f73 --- /dev/null +++ b/queue-5.4/brcmfmac-fix-memory-leak-in-brcmf_usbdev_qinit.patch @@ -0,0 +1,32 @@ +From 4282dc057d750c6a7dd92953564b15c26b54c22c Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Sat, 14 Dec 2019 19:51:14 -0600 +Subject: brcmfmac: Fix memory leak in brcmf_usbdev_qinit + +From: Navid Emamdoost + +commit 4282dc057d750c6a7dd92953564b15c26b54c22c upstream. + +In the implementation of brcmf_usbdev_qinit() the allocated memory for +reqs is leaking if usb_alloc_urb() fails. Release reqs in the error +handling path. + +Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") +Signed-off-by: Navid Emamdoost +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +@@ -430,6 +430,7 @@ fail: + usb_free_urb(req->urb); + list_del(q->next); + } ++ kfree(reqs); + return NULL; + + } diff --git a/queue-5.4/nvmet-fix-controller-use-after-free.patch b/queue-5.4/nvmet-fix-controller-use-after-free.patch new file mode 100644 index 00000000000..acb4cbc26de --- /dev/null +++ b/queue-5.4/nvmet-fix-controller-use-after-free.patch @@ -0,0 +1,87 @@ +From 1a3f540d63152b8db0a12de508bfa03776217d83 Mon Sep 17 00:00:00 2001 +From: Israel Rukshin +Date: Tue, 4 Feb 2020 14:38:10 +0200 +Subject: nvmet: Fix controller use after free + +From: Israel Rukshin + +commit 1a3f540d63152b8db0a12de508bfa03776217d83 upstream. + +After nvmet_install_queue() sets sq->ctrl calling to nvmet_sq_destroy() +reduces the controller refcount. In case nvmet_install_queue() fails, +calling to nvmet_ctrl_put() is done twice (at nvmet_sq_destroy and +nvmet_execute_io_connect/nvmet_execute_admin_connect) instead of once for +the queue which leads to use after free of the controller. Fix this by set +NULL at sq->ctrl in case of a failure at nvmet_install_queue(). + +The bug leads to the following Call Trace: + +[65857.994862] refcount_t: underflow; use-after-free. +[65858.108304] Workqueue: events nvmet_rdma_release_queue_work [nvmet_rdma] +[65858.115557] RIP: 0010:refcount_warn_saturate+0xe5/0xf0 +[65858.208141] Call Trace: +[65858.211203] nvmet_sq_destroy+0xe1/0xf0 [nvmet] +[65858.216383] nvmet_rdma_release_queue_work+0x37/0xf0 [nvmet_rdma] +[65858.223117] process_one_work+0x167/0x370 +[65858.227776] worker_thread+0x49/0x3e0 +[65858.232089] kthread+0xf5/0x130 +[65858.235895] ? max_active_store+0x80/0x80 +[65858.240504] ? kthread_bind+0x10/0x10 +[65858.244832] ret_from_fork+0x1f/0x30 +[65858.249074] ---[ end trace f82d59250b54beb7 ]--- + +Fixes: bb1cc74790eb ("nvmet: implement valid sqhd values in completions") +Fixes: 1672ddb8d691 ("nvmet: Add install_queue callout") +Signed-off-by: Israel Rukshin +Reviewed-by: Max Gurtovoy +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/target/fabrics-cmd.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/nvme/target/fabrics-cmd.c ++++ b/drivers/nvme/target/fabrics-cmd.c +@@ -105,6 +105,7 @@ static u16 nvmet_install_queue(struct nv + u16 qid = le16_to_cpu(c->qid); + u16 sqsize = le16_to_cpu(c->sqsize); + struct nvmet_ctrl *old; ++ u16 ret; + + old = cmpxchg(&req->sq->ctrl, NULL, ctrl); + if (old) { +@@ -115,7 +116,8 @@ static u16 nvmet_install_queue(struct nv + if (!sqsize) { + pr_warn("queue size zero!\n"); + req->error_loc = offsetof(struct nvmf_connect_command, sqsize); +- return NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR; ++ ret = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR; ++ goto err; + } + + /* note: convert queue size from 0's-based value to 1's-based value */ +@@ -128,16 +130,19 @@ static u16 nvmet_install_queue(struct nv + } + + if (ctrl->ops->install_queue) { +- u16 ret = ctrl->ops->install_queue(req->sq); +- ++ ret = ctrl->ops->install_queue(req->sq); + if (ret) { + pr_err("failed to install queue %d cntlid %d ret %x\n", + qid, ctrl->cntlid, ret); +- return ret; ++ goto err; + } + } + + return 0; ++ ++err: ++ req->sq->ctrl = NULL; ++ return ret; + } + + static void nvmet_execute_admin_connect(struct nvmet_req *req) diff --git a/queue-5.4/nvmet-fix-error-print-message-at-nvmet_install_queue-function.patch b/queue-5.4/nvmet-fix-error-print-message-at-nvmet_install_queue-function.patch new file mode 100644 index 00000000000..798acebcdd5 --- /dev/null +++ b/queue-5.4/nvmet-fix-error-print-message-at-nvmet_install_queue-function.patch @@ -0,0 +1,33 @@ +From 0b87a2b795d66be7b54779848ef0f3901c5e46fc Mon Sep 17 00:00:00 2001 +From: Israel Rukshin +Date: Tue, 4 Feb 2020 14:38:09 +0200 +Subject: nvmet: Fix error print message at nvmet_install_queue function + +From: Israel Rukshin + +commit 0b87a2b795d66be7b54779848ef0f3901c5e46fc upstream. + +Place the arguments in the correct order. + +Fixes: 1672ddb8d691 ("nvmet: Add install_queue callout") +Signed-off-by: Israel Rukshin +Reviewed-by: Max Gurtovoy +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/target/fabrics-cmd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvme/target/fabrics-cmd.c ++++ b/drivers/nvme/target/fabrics-cmd.c +@@ -132,7 +132,7 @@ static u16 nvmet_install_queue(struct nv + + if (ret) { + pr_err("failed to install queue %d cntlid %d ret %x\n", +- qid, ret, ctrl->cntlid); ++ qid, ctrl->cntlid, ret); + return ret; + } + } diff --git a/queue-5.4/objtool-silence-build-output.patch b/queue-5.4/objtool-silence-build-output.patch new file mode 100644 index 00000000000..ef05d757fc1 --- /dev/null +++ b/queue-5.4/objtool-silence-build-output.patch @@ -0,0 +1,35 @@ +From 6ec14aa7a58a1c2fb303692f8cb1ff82d9abd10a Mon Sep 17 00:00:00 2001 +From: Olof Johansson +Date: Mon, 20 Jan 2020 12:14:07 -0600 +Subject: objtool: Silence build output + +From: Olof Johansson + +commit 6ec14aa7a58a1c2fb303692f8cb1ff82d9abd10a upstream. + +The sync-check.sh script prints out the path due to a "cd -" at the end +of the script, even on silent builds. This isn't even needed, since the +script is executed in our build instead of sourced (so it won't change +the working directory of the surrounding build anyway). + +Just remove the cd to make the build silent. + +Fixes: 2ffd84ae973b ("objtool: Update sync-check.sh from perf's check-headers.sh") +Signed-off-by: Olof Johansson +Signed-off-by: Josh Poimboeuf +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/cb002857fafa8186cfb9c3e43fb62e4108a1bab9.1579543924.git.jpoimboe@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + tools/objtool/sync-check.sh | 2 -- + 1 file changed, 2 deletions(-) + +--- a/tools/objtool/sync-check.sh ++++ b/tools/objtool/sync-check.sh +@@ -47,5 +47,3 @@ check arch/x86/include/asm/inat.h '- + check arch/x86/include/asm/insn.h '-I "^#include [\"<]\(asm/\)*inat.h[\">]"' + check arch/x86/lib/inat.c '-I "^#include [\"<]\(../include/\)*asm/insn.h[\">]"' + check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]"' +- +-cd - diff --git a/queue-5.4/series b/queue-5.4/series index 821993a1338..d6cb1a34905 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -29,3 +29,19 @@ rcu-use-_once-to-protect-lockless-expmask-accesses.patch rcu-avoid-data-race-in-rcu_gp_fqs_check_wake.patch srcu-apply-_once-to-srcu_last_gp_end.patch rcu-use-read_once-for-expmask-in-rcu_read_unlock_special.patch +nvmet-fix-error-print-message-at-nvmet_install_queue-function.patch +nvmet-fix-controller-use-after-free.patch +bluetooth-btusb-fix-memory-leak-on-fw.patch +bluetooth-btusb-disable-runtime-suspend-on-realtek-devices.patch +brcmfmac-fix-memory-leak-in-brcmf_usbdev_qinit.patch +usb-dwc3-gadget-check-end_transfer-completion.patch +usb-dwc3-gadget-delay-starting-transfer.patch +usb-typec-tcpci-mask-event-interrupts-when-remove-driver.patch +objtool-silence-build-output.patch +usb-gadget-f_fs-set-req-num_sgs-as-0-for-non-sg-transfer.patch +usb-gadget-legacy-set-max_speed-to-super-speed.patch +usb-gadget-f_ncm-use-atomic_t-to-track-in-flight-request.patch +usb-gadget-f_ecm-use-atomic_t-to-track-in-flight-request.patch +alsa-usb-audio-fix-endianess-in-descriptor-validation.patch +alsa-usb-audio-annotate-endianess-in-scarlett-gen2-quirk.patch +alsa-dummy-fix-pcm-format-loop-in-proc-output.patch diff --git a/queue-5.4/usb-dwc3-gadget-check-end_transfer-completion.patch b/queue-5.4/usb-dwc3-gadget-check-end_transfer-completion.patch new file mode 100644 index 00000000000..42f1bab8c88 --- /dev/null +++ b/queue-5.4/usb-dwc3-gadget-check-end_transfer-completion.patch @@ -0,0 +1,80 @@ +From c58d8bfc77a2c7f6ff6339b58c9fca7ae6f57e70 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Wed, 18 Dec 2019 18:14:44 -0800 +Subject: usb: dwc3: gadget: Check END_TRANSFER completion + +From: Thinh Nguyen + +commit c58d8bfc77a2c7f6ff6339b58c9fca7ae6f57e70 upstream. + +While the END_TRANSFER command is sent but not completed, any request +dequeue during this time will cause the driver to issue the END_TRANSFER +command. The driver needs to submit the command only once to stop the +controller from processing further. The controller may take more time to +process the same command multiple times unnecessarily. Let's add a flag +DWC3_EP_END_TRANSFER_PENDING to check for this condition. + +Fixes: 3aec99154db3 ("usb: dwc3: gadget: remove DWC3_EP_END_TRANSFER_PENDING") +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/core.h | 1 + + drivers/usb/dwc3/ep0.c | 4 +++- + drivers/usb/dwc3/gadget.c | 6 +++++- + 3 files changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -688,6 +688,7 @@ struct dwc3_ep { + #define DWC3_EP_STALL BIT(1) + #define DWC3_EP_WEDGE BIT(2) + #define DWC3_EP_TRANSFER_STARTED BIT(3) ++#define DWC3_EP_END_TRANSFER_PENDING BIT(4) + #define DWC3_EP_PENDING_REQUEST BIT(5) + + /* This last one is specific to EP0 */ +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -1136,8 +1136,10 @@ void dwc3_ep0_interrupt(struct dwc3 *dwc + case DWC3_DEPEVT_EPCMDCMPLT: + cmd = DEPEVT_PARAMETER_CMD(event->parameters); + +- if (cmd == DWC3_DEPCMD_ENDTRANSFER) ++ if (cmd == DWC3_DEPCMD_ENDTRANSFER) { ++ dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING; + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; ++ } + break; + } + } +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2625,6 +2625,7 @@ static void dwc3_endpoint_interrupt(stru + cmd = DEPEVT_PARAMETER_CMD(event->parameters); + + if (cmd == DWC3_DEPCMD_ENDTRANSFER) { ++ dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING; + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + dwc3_gadget_ep_cleanup_cancelled_requests(dep); + } +@@ -2683,7 +2684,8 @@ static void dwc3_stop_active_transfer(st + u32 cmd; + int ret; + +- if (!(dep->flags & DWC3_EP_TRANSFER_STARTED)) ++ if (!(dep->flags & DWC3_EP_TRANSFER_STARTED) || ++ (dep->flags & DWC3_EP_END_TRANSFER_PENDING)) + return; + + /* +@@ -2728,6 +2730,8 @@ static void dwc3_stop_active_transfer(st + + if (!interrupt) + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; ++ else ++ dep->flags |= DWC3_EP_END_TRANSFER_PENDING; + + if (dwc3_is_usb31(dwc) || dwc->revision < DWC3_REVISION_310A) + udelay(100); diff --git a/queue-5.4/usb-dwc3-gadget-delay-starting-transfer.patch b/queue-5.4/usb-dwc3-gadget-delay-starting-transfer.patch new file mode 100644 index 00000000000..93b3decbbab --- /dev/null +++ b/queue-5.4/usb-dwc3-gadget-delay-starting-transfer.patch @@ -0,0 +1,63 @@ +From da10bcdd6f70dc9977f2cf18f4783cf78520623a Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Wed, 18 Dec 2019 18:14:50 -0800 +Subject: usb: dwc3: gadget: Delay starting transfer + +From: Thinh Nguyen + +commit da10bcdd6f70dc9977f2cf18f4783cf78520623a upstream. + +If the END_TRANSFER command hasn't completed yet, then don't send the +START_TRANSFER command. The controller may not be able to start if +that's the case. Some controller revisions depend on this. See +commit 76a638f8ac0d ("usb: dwc3: gadget: wait for End Transfer to +complete"). Let's only send START_TRANSFER command after the +END_TRANSFER command had completed. + +Fixes: 3aec99154db3 ("usb: dwc3: gadget: remove DWC3_EP_END_TRANSFER_PENDING") +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/core.h | 1 + + drivers/usb/dwc3/gadget.c | 11 +++++++++++ + 2 files changed, 12 insertions(+) + +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -690,6 +690,7 @@ struct dwc3_ep { + #define DWC3_EP_TRANSFER_STARTED BIT(3) + #define DWC3_EP_END_TRANSFER_PENDING BIT(4) + #define DWC3_EP_PENDING_REQUEST BIT(5) ++#define DWC3_EP_DELAY_START BIT(6) + + /* This last one is specific to EP0 */ + #define DWC3_EP0_DIR_IN BIT(31) +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1447,6 +1447,12 @@ static int __dwc3_gadget_ep_queue(struct + list_add_tail(&req->list, &dep->pending_list); + req->status = DWC3_REQUEST_STATUS_QUEUED; + ++ /* Start the transfer only after the END_TRANSFER is completed */ ++ if (dep->flags & DWC3_EP_END_TRANSFER_PENDING) { ++ dep->flags |= DWC3_EP_DELAY_START; ++ return 0; ++ } ++ + /* + * NOTICE: Isochronous endpoints should NEVER be prestarted. We must + * wait for a XferNotReady event so we will know what's the current +@@ -2628,6 +2634,11 @@ static void dwc3_endpoint_interrupt(stru + dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING; + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + dwc3_gadget_ep_cleanup_cancelled_requests(dep); ++ if ((dep->flags & DWC3_EP_DELAY_START) && ++ !usb_endpoint_xfer_isoc(dep->endpoint.desc)) ++ __dwc3_gadget_kick_transfer(dep); ++ ++ dep->flags &= ~DWC3_EP_DELAY_START; + } + break; + case DWC3_DEPEVT_STREAMEVT: diff --git a/queue-5.4/usb-gadget-f_ecm-use-atomic_t-to-track-in-flight-request.patch b/queue-5.4/usb-gadget-f_ecm-use-atomic_t-to-track-in-flight-request.patch new file mode 100644 index 00000000000..7be7263132a --- /dev/null +++ b/queue-5.4/usb-gadget-f_ecm-use-atomic_t-to-track-in-flight-request.patch @@ -0,0 +1,91 @@ +From d710562e01c48d59be3f60d58b7a85958b39aeda Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Thu, 9 Jan 2020 13:17:22 +0000 +Subject: usb: gadget: f_ecm: Use atomic_t to track in-flight request + +From: Bryan O'Donoghue + +commit d710562e01c48d59be3f60d58b7a85958b39aeda upstream. + +Currently ecm->notify_req is used to flag when a request is in-flight. +ecm->notify_req is set to NULL and when a request completes it is +subsequently reset. + +This is fundamentally buggy in that the unbind logic of the ECM driver will +unconditionally free ecm->notify_req leading to a NULL pointer dereference. + +Fixes: da741b8c56d6 ("usb ethernet gadget: split CDC Ethernet function") +Cc: stable +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_ecm.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/function/f_ecm.c ++++ b/drivers/usb/gadget/function/f_ecm.c +@@ -52,6 +52,7 @@ struct f_ecm { + struct usb_ep *notify; + struct usb_request *notify_req; + u8 notify_state; ++ atomic_t notify_count; + bool is_open; + + /* FIXME is_open needs some irq-ish locking +@@ -380,7 +381,7 @@ static void ecm_do_notify(struct f_ecm * + int status; + + /* notification already in flight? */ +- if (!req) ++ if (atomic_read(&ecm->notify_count)) + return; + + event = req->buf; +@@ -420,10 +421,10 @@ static void ecm_do_notify(struct f_ecm * + event->bmRequestType = 0xA1; + event->wIndex = cpu_to_le16(ecm->ctrl_id); + +- ecm->notify_req = NULL; ++ atomic_inc(&ecm->notify_count); + status = usb_ep_queue(ecm->notify, req, GFP_ATOMIC); + if (status < 0) { +- ecm->notify_req = req; ++ atomic_dec(&ecm->notify_count); + DBG(cdev, "notify --> %d\n", status); + } + } +@@ -448,17 +449,19 @@ static void ecm_notify_complete(struct u + switch (req->status) { + case 0: + /* no fault */ ++ atomic_dec(&ecm->notify_count); + break; + case -ECONNRESET: + case -ESHUTDOWN: ++ atomic_set(&ecm->notify_count, 0); + ecm->notify_state = ECM_NOTIFY_NONE; + break; + default: + DBG(cdev, "event %02x --> %d\n", + event->bNotificationType, req->status); ++ atomic_dec(&ecm->notify_count); + break; + } +- ecm->notify_req = req; + ecm_do_notify(ecm); + } + +@@ -907,6 +910,11 @@ static void ecm_unbind(struct usb_config + + usb_free_all_descriptors(f); + ++ if (atomic_read(&ecm->notify_count)) { ++ usb_ep_dequeue(ecm->notify, ecm->notify_req); ++ atomic_set(&ecm->notify_count, 0); ++ } ++ + kfree(ecm->notify_req->buf); + usb_ep_free_request(ecm->notify, ecm->notify_req); + } diff --git a/queue-5.4/usb-gadget-f_fs-set-req-num_sgs-as-0-for-non-sg-transfer.patch b/queue-5.4/usb-gadget-f_fs-set-req-num_sgs-as-0-for-non-sg-transfer.patch new file mode 100644 index 00000000000..cc38281acc8 --- /dev/null +++ b/queue-5.4/usb-gadget-f_fs-set-req-num_sgs-as-0-for-non-sg-transfer.patch @@ -0,0 +1,47 @@ +From d2450c6937018d40d4111fe830fa48d4ddceb8d0 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Thu, 12 Dec 2019 16:35:03 +0800 +Subject: usb: gadget: f_fs: set req->num_sgs as 0 for non-sg transfer + +From: Peter Chen + +commit d2450c6937018d40d4111fe830fa48d4ddceb8d0 upstream. + +The UDC core uses req->num_sgs to judge if scatter buffer list is used. +Eg: usb_gadget_map_request_by_dev. For f_fs sync io mode, the request +is re-used for each request, so if the 1st request->length > PAGE_SIZE, +and the 2nd request->length is <= PAGE_SIZE, the f_fs uses the 1st +req->num_sgs for the 2nd request, it causes the UDC core get the wrong +req->num_sgs value (The 2nd request doesn't use sg). For f_fs async +io mode, it is not harm to initialize req->num_sgs as 0 either, in case, +the UDC driver doesn't zeroed request structure. + +Cc: Jun Li +Cc: stable +Fixes: 772a7a724f69 ("usb: gadget: f_fs: Allow scatter-gather buffers") +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1062,6 +1062,7 @@ static ssize_t ffs_epfile_io(struct file + req->num_sgs = io_data->sgt.nents; + } else { + req->buf = data; ++ req->num_sgs = 0; + } + req->length = data_len; + +@@ -1105,6 +1106,7 @@ static ssize_t ffs_epfile_io(struct file + req->num_sgs = io_data->sgt.nents; + } else { + req->buf = data; ++ req->num_sgs = 0; + } + req->length = data_len; + diff --git a/queue-5.4/usb-gadget-f_ncm-use-atomic_t-to-track-in-flight-request.patch b/queue-5.4/usb-gadget-f_ncm-use-atomic_t-to-track-in-flight-request.patch new file mode 100644 index 00000000000..9c475786314 --- /dev/null +++ b/queue-5.4/usb-gadget-f_ncm-use-atomic_t-to-track-in-flight-request.patch @@ -0,0 +1,97 @@ +From 5b24c28cfe136597dc3913e1c00b119307a20c7e Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Thu, 9 Jan 2020 13:17:21 +0000 +Subject: usb: gadget: f_ncm: Use atomic_t to track in-flight request + +From: Bryan O'Donoghue + +commit 5b24c28cfe136597dc3913e1c00b119307a20c7e upstream. + +Currently ncm->notify_req is used to flag when a request is in-flight. +ncm->notify_req is set to NULL and when a request completes it is +subsequently reset. + +This is fundamentally buggy in that the unbind logic of the NCM driver will +unconditionally free ncm->notify_req leading to a NULL pointer dereference. + +Fixes: 40d133d7f542 ("usb: gadget: f_ncm: convert to new function interface with backward compatibility") +Cc: stable +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_ncm.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/function/f_ncm.c ++++ b/drivers/usb/gadget/function/f_ncm.c +@@ -53,6 +53,7 @@ struct f_ncm { + struct usb_ep *notify; + struct usb_request *notify_req; + u8 notify_state; ++ atomic_t notify_count; + bool is_open; + + const struct ndp_parser_opts *parser_opts; +@@ -547,7 +548,7 @@ static void ncm_do_notify(struct f_ncm * + int status; + + /* notification already in flight? */ +- if (!req) ++ if (atomic_read(&ncm->notify_count)) + return; + + event = req->buf; +@@ -587,7 +588,8 @@ static void ncm_do_notify(struct f_ncm * + event->bmRequestType = 0xA1; + event->wIndex = cpu_to_le16(ncm->ctrl_id); + +- ncm->notify_req = NULL; ++ atomic_inc(&ncm->notify_count); ++ + /* + * In double buffering if there is a space in FIFO, + * completion callback can be called right after the call, +@@ -597,7 +599,7 @@ static void ncm_do_notify(struct f_ncm * + status = usb_ep_queue(ncm->notify, req, GFP_ATOMIC); + spin_lock(&ncm->lock); + if (status < 0) { +- ncm->notify_req = req; ++ atomic_dec(&ncm->notify_count); + DBG(cdev, "notify --> %d\n", status); + } + } +@@ -632,17 +634,19 @@ static void ncm_notify_complete(struct u + case 0: + VDBG(cdev, "Notification %02x sent\n", + event->bNotificationType); ++ atomic_dec(&ncm->notify_count); + break; + case -ECONNRESET: + case -ESHUTDOWN: ++ atomic_set(&ncm->notify_count, 0); + ncm->notify_state = NCM_NOTIFY_NONE; + break; + default: + DBG(cdev, "event %02x --> %d\n", + event->bNotificationType, req->status); ++ atomic_dec(&ncm->notify_count); + break; + } +- ncm->notify_req = req; + ncm_do_notify(ncm); + spin_unlock(&ncm->lock); + } +@@ -1649,6 +1653,11 @@ static void ncm_unbind(struct usb_config + ncm_string_defs[0].id = 0; + usb_free_all_descriptors(f); + ++ if (atomic_read(&ncm->notify_count)) { ++ usb_ep_dequeue(ncm->notify, ncm->notify_req); ++ atomic_set(&ncm->notify_count, 0); ++ } ++ + kfree(ncm->notify_req->buf); + usb_ep_free_request(ncm->notify, ncm->notify_req); + } diff --git a/queue-5.4/usb-gadget-legacy-set-max_speed-to-super-speed.patch b/queue-5.4/usb-gadget-legacy-set-max_speed-to-super-speed.patch new file mode 100644 index 00000000000..8a8f5753bf8 --- /dev/null +++ b/queue-5.4/usb-gadget-legacy-set-max_speed-to-super-speed.patch @@ -0,0 +1,68 @@ +From 463f67aec2837f981b0a0ce8617721ff59685c00 Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Mon, 23 Dec 2019 08:47:35 +0200 +Subject: usb: gadget: legacy: set max_speed to super-speed + +From: Roger Quadros + +commit 463f67aec2837f981b0a0ce8617721ff59685c00 upstream. + +These interfaces do support super-speed so let's not +limit maximum speed to high-speed. + +Cc: +Signed-off-by: Roger Quadros +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/legacy/cdc2.c | 2 +- + drivers/usb/gadget/legacy/g_ffs.c | 2 +- + drivers/usb/gadget/legacy/multi.c | 2 +- + drivers/usb/gadget/legacy/ncm.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/legacy/cdc2.c ++++ b/drivers/usb/gadget/legacy/cdc2.c +@@ -225,7 +225,7 @@ static struct usb_composite_driver cdc_d + .name = "g_cdc", + .dev = &device_desc, + .strings = dev_strings, +- .max_speed = USB_SPEED_HIGH, ++ .max_speed = USB_SPEED_SUPER, + .bind = cdc_bind, + .unbind = cdc_unbind, + }; +--- a/drivers/usb/gadget/legacy/g_ffs.c ++++ b/drivers/usb/gadget/legacy/g_ffs.c +@@ -149,7 +149,7 @@ static struct usb_composite_driver gfs_d + .name = DRIVER_NAME, + .dev = &gfs_dev_desc, + .strings = gfs_dev_strings, +- .max_speed = USB_SPEED_HIGH, ++ .max_speed = USB_SPEED_SUPER, + .bind = gfs_bind, + .unbind = gfs_unbind, + }; +--- a/drivers/usb/gadget/legacy/multi.c ++++ b/drivers/usb/gadget/legacy/multi.c +@@ -482,7 +482,7 @@ static struct usb_composite_driver multi + .name = "g_multi", + .dev = &device_desc, + .strings = dev_strings, +- .max_speed = USB_SPEED_HIGH, ++ .max_speed = USB_SPEED_SUPER, + .bind = multi_bind, + .unbind = multi_unbind, + .needs_serial = 1, +--- a/drivers/usb/gadget/legacy/ncm.c ++++ b/drivers/usb/gadget/legacy/ncm.c +@@ -197,7 +197,7 @@ static struct usb_composite_driver ncm_d + .name = "g_ncm", + .dev = &device_desc, + .strings = dev_strings, +- .max_speed = USB_SPEED_HIGH, ++ .max_speed = USB_SPEED_SUPER, + .bind = gncm_bind, + .unbind = gncm_unbind, + }; diff --git a/queue-5.4/usb-typec-tcpci-mask-event-interrupts-when-remove-driver.patch b/queue-5.4/usb-typec-tcpci-mask-event-interrupts-when-remove-driver.patch new file mode 100644 index 00000000000..ff06908aac1 --- /dev/null +++ b/queue-5.4/usb-typec-tcpci-mask-event-interrupts-when-remove-driver.patch @@ -0,0 +1,38 @@ +From 3ba76256fc4e2a0d7fb26cc95459041ea0e88972 Mon Sep 17 00:00:00 2001 +From: Jun Li +Date: Mon, 20 Jan 2020 06:43:19 +0000 +Subject: usb: typec: tcpci: mask event interrupts when remove driver + +From: Jun Li + +commit 3ba76256fc4e2a0d7fb26cc95459041ea0e88972 upstream. + +This is to prevent any possible events generated while unregister +tpcm port. + +Fixes: 74e656d6b055 ("staging: typec: Type-C Port Controller Interface driver (tcpci)") +Signed-off-by: Li Jun +Reviewed-by: Heikki Krogerus +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/1579502333-4145-1-git-send-email-jun.li@nxp.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/typec/tcpm/tcpci.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -591,6 +591,12 @@ static int tcpci_probe(struct i2c_client + static int tcpci_remove(struct i2c_client *client) + { + struct tcpci_chip *chip = i2c_get_clientdata(client); ++ int err; ++ ++ /* Disable chip interrupts before unregistering port */ ++ err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0); ++ if (err < 0) ++ return err; + + tcpci_unregister_port(chip->tcpci); +