Merge tag 'usb-3.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg Kroah-Hartman:
 "Here are a number of USB fixes that resolve issues that have been
  reported against 3.9-rc3."

* tag 'usb-3.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (37 commits)
  USB: ti_usb_3410_5052: fix use-after-free in TIOCMIWAIT
  USB: ssu100: fix use-after-free in TIOCMIWAIT
  USB: spcp8x5: fix use-after-free in TIOCMIWAIT
  USB: quatech2: fix use-after-free in TIOCMIWAIT
  USB: pl2303: fix use-after-free in TIOCMIWAIT
  USB: oti6858: fix use-after-free in TIOCMIWAIT
  USB: mos7840: fix use-after-free in TIOCMIWAIT
  USB: mos7840: fix broken TIOCMIWAIT
  USB: mct_u232: fix use-after-free in TIOCMIWAIT
  USB: io_ti: fix use-after-free in TIOCMIWAIT
  USB: io_edgeport: fix use-after-free in TIOCMIWAIT
  USB: ftdi_sio: fix use-after-free in TIOCMIWAIT
  USB: f81232: fix use-after-free in TIOCMIWAIT
  USB: cypress_m8: fix use-after-free in TIOCMIWAIT
  USB: ch341: fix use-after-free in TIOCMIWAIT
  USB: ark3116: fix use-after-free in TIOCMIWAIT
  USB: serial: add modem-status-change wait queue
  USB: serial: fix interface refcounting
  USB: io_ti: fix get_icount for two port adapters
  USB: garmin_gps: fix memory leak on disconnect
  ...

36 files changed, 202 insertions, 115 deletions

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 8ac25adf31b4..387dc6c8ad25 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -593,7 +593,6 @@ static void acm_port_destruct(struct tty_port *port)
 
         dev_dbg(&acm->control->dev, "%s\n", __func__);
 
-        tty_unregister_device(acm_tty_driver, acm->minor);
         acm_release_minor(acm);
         usb_put_intf(acm->control);
         kfree(acm->country_codes);
@@ -977,6 +976,8 @@ static int acm_probe(struct usb_interface *intf,
         int num_rx_buf;
         int i;
         int combined_interfaces = 0;
+        struct device *tty_dev;
+        int rv = -ENOMEM;
 
         /* normal quirks */
         quirks = (unsigned long)id->driver_info;
@@ -1339,11 +1340,24 @@ skip_countries:
         usb_set_intfdata(data_interface, acm);
 
         usb_get_intf(control_interface);
-        tty_port_register_device(&acm->port, acm_tty_driver, minor,
+        tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor,
                         &control_interface->dev);
+        if (IS_ERR(tty_dev)) {
+                rv = PTR_ERR(tty_dev);
+                goto alloc_fail8;
+        }
 
         return 0;
+alloc_fail8:
+        if (acm->country_codes) {
+                device_remove_file(&acm->control->dev,
+                                &dev_attr_wCountryCodes);
+                device_remove_file(&acm->control->dev,
+                                &dev_attr_iCountryCodeRelDate);
+        }
+        device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
 alloc_fail7:
+        usb_set_intfdata(intf, NULL);
         for (i = 0; i < ACM_NW; i++)
                 usb_free_urb(acm->wb[i].urb);
 alloc_fail6:
@@ -1359,7 +1373,7 @@ alloc_fail2:
         acm_release_minor(acm);
         kfree(acm);
 alloc_fail:
-        return -ENOMEM;
+        return rv;
 }
 
 static void stop_data_traffic(struct acm *acm)
@@ -1411,6 +1425,8 @@ static void acm_disconnect(struct usb_interface *intf)
 
         stop_data_traffic(acm);
 
+        tty_unregister_device(acm_tty_driver, acm->minor);
+
         usb_free_urb(acm->ctrlurb);
         for (i = 0; i < ACM_NW; i++)
                 usb_free_urb(acm->wb[i].urb);
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 622b4a48e732..2b487d4797bd 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
         struct hc_driver        *driver;
         struct usb_hcd          *hcd;
         int                     retval;
+        int                     hcd_irq = 0;
 
         if (usb_disabled())
                 return -ENODEV;
@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                 return -ENODEV;
         dev->current_state = PCI_D0;
 
-        /* The xHCI driver supports MSI and MSI-X,
-         * so don't fail if the BIOS doesn't provide a legacy IRQ.
+        /*
+         * The xHCI driver has its own irq management
+         * make sure irq setup is not touched for xhci in generic hcd code
          */
-        if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {
-                dev_err(&dev->dev,
-                        "Found HC with no IRQ.  Check BIOS/PCI %s setup!\n",
-                        pci_name(dev));
-                retval = -ENODEV;
-                goto disable_pci;
+        if ((driver->flags & HCD_MASK) != HCD_USB3) {
+                if (!dev->irq) {
+                        dev_err(&dev->dev,
+                        "Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
+                                pci_name(dev));
+                        retval = -ENODEV;
+                        goto disable_pci;
+                }
+                hcd_irq = dev->irq;
         }
 
         hcd = usb_create_hcd(driver, &dev->dev, pci_name(dev));
@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 
         pci_set_master(dev);
 
-        retval = usb_add_hcd(hcd, dev->irq, IRQF_SHARED);
+        retval = usb_add_hcd(hcd, hcd_irq, IRQF_SHARED);
         if (retval != 0)
                 goto unmap_registers;
         set_hs_companion(dev, hcd);
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index 71beeb833558..cc9c49c57c80 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -447,14 +447,13 @@ static void rndis_response_complete(struct usb_ep *ep, struct usb_request *req)
 static void rndis_command_complete(struct usb_ep *ep, struct usb_request *req)
 {
         struct f_rndis                  *rndis = req->context;
-        struct usb_composite_dev        *cdev = rndis->port.func.config->cdev;
         int                             status;
 
         /* received RNDIS command from USB_CDC_SEND_ENCAPSULATED_COMMAND */
 //      spin_lock(&dev->lock);
         status = rndis_msg_parser(rndis->config, (u8 *) req->buf);