Merge tag 'usb-5.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB and Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver changes for
  5.17-rc1.

  Nothing major in here, just lots of little updates and cleanups. These
  include:

   - some USB header fixes picked from Ingo's header-splitup work

   - more USB4/Thunderbolt hardware support added

   - USB gadget driver updates and additions

   - USB typec additions (includes some acpi changes, which were acked
     by the ACPI maintainer)

   - core USB fixes as found by syzbot that were too late for 5.16-final

   - USB dwc3 driver updates

   - USB dwc2 driver updates

   - platform_get_irq() conversions of some USB drivers

   - other minor USB driver updates and additions

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-5.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (111 commits)
  docs: ABI: fixed formatting in configfs-usb-gadget-uac2
  usb: gadget: u_audio: Subdevice 0 for capture ctls
  usb: gadget: u_audio: fix calculations for small bInterval
  usb: dwc2: gadget: initialize max_speed from params
  usb: dwc2: do not gate off the hardware if it does not support clock gating
  usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe
  headers/deps: USB: Optimize <linux/usb/ch9.h> dependencies, remove <linux/device.h>
  USB: common: debug: add needed kernel.h include
  headers/prep: Fix non-standard header section: drivers/usb/host/ohci-tmio.c
  headers/prep: Fix non-standard header section: drivers/usb/cdns3/core.h
  headers/prep: usb: gadget: Fix namespace collision
  USB: core: Fix bug in resuming hub's handling of wakeup requests
  USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
  usb: dwc3: dwc3-qcom: Add missing platform_device_put() in dwc3_qcom_acpi_register_core
  usb: gadget: clear related members when goto fail
  usb: gadget: don't release an existing dev->buf
  usb: dwc2: Simplify a bitmap declaration
  usb: Remove usb_for_each_port()
  usb: typec: port-mapper: Convert to the component framework
  usb: Link the ports to the connectors they are attached to
  ...

1 files changed, 11 insertions, 7 deletions

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 3b58f4fc0a80..51f9d96827b1 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1242,7 +1242,7 @@ out:
 	return mask;
 }
 
-static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
+static long gadget_dev_ioctl (struct file *fd, unsigned code, unsigned long value)
 {
 	struct dev_data		*dev = fd->private_data;
 	struct usb_gadget	*gadget = dev->gadget;
@@ -1826,8 +1826,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 	spin_lock_irq (&dev->lock);
 	value = -EINVAL;
 	if (dev->buf) {
+		spin_unlock_irq(&dev->lock);
 		kfree(kbuf);
-		goto fail;
+		return value;
 	}
 	dev->buf = kbuf;
 
@@ -1874,8 +1875,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
 	value = usb_gadget_probe_driver(&gadgetfs_driver);
 	if (value != 0) {
-		kfree (dev->buf);
-		dev->buf = NULL;
+		spin_lock_irq(&dev->lock);
+		goto fail;
 	} else {
 		/* at this point "good" hardware has for the first time
 		 * let the USB the host see us.  alternatively, if users
@@ -1892,6 +1893,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 	return value;
 
 fail:
+	dev->config = NULL;
+	dev->hs_config = NULL;
+	dev->dev = NULL;
 	spin_unlock_irq (&dev->lock);
 	pr_debug ("%s: %s fail %zd, %p\n", shortname, __func__, value, dev);
 	kfree (dev->buf);
@@ -1900,7 +1904,7 @@ fail:
 }
 
 static int
-dev_open (struct inode *inode, struct file *fd)
+gadget_dev_open (struct inode *inode, struct file *fd)
 {
 	struct dev_data		*dev = inode->i_private;
 	int			value = -EBUSY;
@@ -1920,12 +1924,12 @@ dev_open (struct inode *inode, struct file *fd)
 static const struct file_operations ep0_operations = {
 	.llseek =	no_llseek,
 
-	.open =		dev_open,
+	.open =		gadget_dev_open,
 	.read =		ep0_read,
 	.write =	dev_config,
 	.fasync =	ep0_fasync,
 	.poll =		ep0_poll,
-	.unlocked_ioctl = dev_ioctl,
+	.unlocked_ioctl = gadget_dev_ioctl,
 	.release =	dev_release,
 };