Merge tag 'usb-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are a number of small USB fixes for 4.12-rc2

  Most of them come from Johan, in his valiant quest to fix up all
  drivers that could be affected by "malicious" USB devices. There's
  also some fixes for more "obscure" drivers to handle some of the
  vmalloc stack fallout (which for USB drivers, was always the case, but
  very few people actually ran those systems...)

  Other than that, the normal set of xhci and gadget and musb driver
  fixes as well.

  All have been in linux-next with no reported issues"

* tag 'usb-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (42 commits)
  usb: musb: tusb6010_omap: Do not reset the other direction's packet size
  usb: musb: Fix trying to suspend while active for OTG configurations
  usb: host: xhci-plat: propagate return value of platform_get_irq()
  xhci: Fix command ring stop regression in 4.11
  xhci: remove GFP_DMA flag from allocation
  USB: xhci: fix lock-inversion problem
  usb: host: xhci-ring: don't need to clear interrupt pending for MSI enabled hcd
  usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
  xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
  usb: xhci: trace URB before giving it back instead of after
  USB: serial: qcserial: add more Lenovo EM74xx device IDs
  USB: host: xhci: use max-port define
  USB: hub: fix SS max number of ports
  USB: hub: fix non-SS hub-descriptor handling
  USB: hub: fix SS hub-descriptor handling
  USB: usbip: fix nonconforming hub descriptor
  USB: gadget: dummy_hcd: fix hub-descriptor removable fields
  doc-rst: fixed kernel-doc directives in usb/typec.rst
  USB: core: of: document reference taken by companion helper
  USB: ehci-platform: fix companion-device leak
  ...

38 files changed, 232 insertions, 126 deletions

diff --git a/Documentation/usb/typec.rst b/Documentation/usb/typec.rst
index b67a46779de9..8a7249f2ff04 100644
--- a/Documentation/usb/typec.rst
+++ b/Documentation/usb/typec.rst
@@ -114,8 +114,7 @@ the details during registration. The class offers the following API for
 registering/unregistering cables and their plugs:
 
 .. kernel-doc:: drivers/usb/typec/typec.c
-   :functions: typec_register_cable typec_unregister_cable typec_register_plug
-   typec_unregister_plug
+   :functions: typec_register_cable typec_unregister_cable typec_register_plug typec_unregister_plug
 
 The class will provide a handle to struct typec_cable and struct typec_plug if
 the registration is successful, or NULL if it isn't.
@@ -137,8 +136,7 @@ during connection of a partner or cable, the port driver must use the following
 APIs to report it to the class:
 
 .. kernel-doc:: drivers/usb/typec/typec.c
-   :functions: typec_set_data_role typec_set_pwr_role typec_set_vconn_role
-   typec_set_pwr_opmode
+   :functions: typec_set_data_role typec_set_pwr_role typec_set_vconn_role typec_set_pwr_opmode
 
 Alternate Modes
 ~~~~~~~~~~~~~~~
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index cfc3cff6e8d5..8e6ef671be9b 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -475,11 +475,11 @@ static void snoop_urb(struct usb_device *udev,
 
         if (userurb) {          /* Async */
                 if (when == SUBMIT)
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "length %u\n",
                                         userurb, ep, t, d, length);
                 else
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "actual_length %u status %d\n",
                                         userurb, ep, t, d, length,
                                         timeout_or_status);
@@ -1895,7 +1895,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -1912,7 +1912,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2043,7 +2043,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -2060,7 +2060,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2489,7 +2489,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
 #endif
 
         case USBDEVFS_DISCARDURB:
-                snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);
+                snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
                 ret = proc_unlinkurb(ps, p);
                 break;
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 49550790a3cb..5dea98358c05 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1723,7 +1723,7 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
                 if (retval == 0)
                         retval = -EINPROGRESS;
                 else if (retval != -EIDRM && retval != -EBUSY)
-                        dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
+                        dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n",
                                         urb, retval);
                 usb_put_dev(udev);
         }
@@ -1890,7 +1890,7 @@ rescan:
                 /* kick hcd */
                 unlink1(hcd, urb, -ESHUTDOWN);
                 dev_dbg (hcd->self.controller,
-                        "shutdown urb %p ep%d%s%s\n",
+                        "shutdown urb %pK ep%d%s%s\n",
                         urb, usb_endpoint_num(&ep->desc),
                         is_in ? "in" : "out",
                         ({      char *s;
@@ -2520,6 +2520,7 @@ struct usb_hcd *__usb_create_hcd(const struct hc_driver *driver,
                 hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex),
                                 GFP_KERNEL);
                 if (!hcd->bandwidth_mutex) {
+                        kfree(hcd->address0_mutex);
                         kfree(hcd);
                         dev_dbg(dev, "hcd bandwidth mutex alloc failed\n");