[v2,0/9] Stop calling request_irq(), etc. with invalid IRQs in the USB drivers

Here are 9 patches against the 'usb-linus' branch of GregKH's 'usb.git' repo.
The affected drivers call platform_get_irq() but largely ignore its result --
they blithely pass the negative error codes to request_irq() (and its ilk)
which expects *unsinged* IRQ #s. Stop doing that by checking what exactly
platform_get_irq() returns.

[1/9] usb: dwc3: meson-g12a: add IRQ check
[2/9] usb: dwc3: qcom: add IRQ check
[3/6] usb: gadget: udc: at91: add IRQ check
[4/9] usb: gadget: udc: s3c2410: add IRQ check
[5/9] usb: host: ohci-tmio: add IRQ check
[6/9] usb: misc: brcmstb-usb-pinmap: add IRQ check
[7/9] usb: phy: fsl-usb: add IRQ check
[8/9] usb: phy: tahvo: add IRQ check
[9/9] usb: phy: twl6030: add IRQ checks

On Mon, Aug 09, 2021 at 11:41:59PM +0300, Sergey Shtylyov wrote:
> The driver neglects to check the  result of platform_get_irq()'s call and
> blithely passes the negative error codes to usb_add_hcd() (which takes
> *unsigned* IRQ #), causing request_irq() that it calls to fail with
> -EINVAL, overriding an original error code. Stop calling usb_add_hcd()
> with the invalid IRQ #s.
> 
> Fixes: 78c73414f4f6 ("USB: ohci: add support for tmio-ohci cell")
> Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
> 
> ---
>  drivers/usb/host/ohci-tmio.c |    2 ++
>  1 file changed, 2 insertions(+)
> 
> Index: usb/drivers/usb/host/ohci-tmio.c
> ===================================================================
> --- usb.orig/drivers/usb/host/ohci-tmio.c
> +++ usb/drivers/usb/host/ohci-tmio.c
> @@ -242,6 +242,8 @@ static int ohci_hcd_tmio_drv_probe(struc
>  	if (ret < 0)
>  		goto err_enable;
>  
> +	if (irq < 0)
> +		goto err_enable;
>  	ret = usb_add_hcd(hcd, irq, 0);
>  	if (ret)
>  		goto err_add_hcd;

Surely this test should be placed near the start of the function, before 
the call to usb_create_hcd().  There's no point in doing all the extra 
work if the irq value is already invalid.

Alan Stern

Sergey Shtylyov <s.shtylyov@omp.ru> writes:

> The driver neglects to check the result of platform_get_irq()'s call and

> blithely passes the negative error codes to request_irq() (which takes

> *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original

> error code. Stop calling request_irq() with the invalid IRQ #s.

>

> Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver")

> Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>


Acked-by: Felipe Balbi <balbi@kernel.org>


-- 
balbi

Sergey Shtylyov <s.shtylyov@omp.ru> writes:

> The driver neglects to check the result of platform_get_irq()'s calls and

> blithely passes the negative error codes to request_threaded_irq() (which

> takes *unsigned* IRQ #), causing them both to fail with -EINVAL, overriding

> an original error code.  Stop calling request_threaded_irq() with the

> invalid IRQ #s.

>

> Fixes: c33fad0c3748 ("usb: otg: Adding twl6030-usb transceiver driver for OMAP4430")

> Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>


Acked-by: Felipe Balbi <balbi@kernel.org>


-- 
balbi