5 files changed, 35 insertions, 16 deletions

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index cfc3cff6e8d5..8e6ef671be9b 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -475,11 +475,11 @@ static void snoop_urb(struct usb_device *udev,
 
         if (userurb) {          /* Async */
                 if (when == SUBMIT)
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "length %u\n",
                                         userurb, ep, t, d, length);
                 else
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "actual_length %u status %d\n",
                                         userurb, ep, t, d, length,
                                         timeout_or_status);
@@ -1895,7 +1895,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -1912,7 +1912,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2043,7 +2043,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -2060,7 +2060,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2489,7 +2489,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
 #endif
 
         case USBDEVFS_DISCARDURB:
-                snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);
+                snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
                 ret = proc_unlinkurb(ps, p);
                 break;
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 49550790a3cb..5dea98358c05 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1723,7 +1723,7 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
                 if (retval == 0)
                         retval = -EINPROGRESS;
                 else if (retval != -EIDRM && retval != -EBUSY)
-                        dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
+                        dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n",
                                         urb, retval);
                 usb_put_dev(udev);
         }
@@ -1890,7 +1890,7 @@ rescan:
                 /* kick hcd */
                 unlink1(hcd, urb, -ESHUTDOWN);
                 dev_dbg (hcd->self.controller,
-                        "shutdown urb %p ep%d%s%s\n",
+                        "shutdown urb %pK ep%d%s%s\n",
                         urb, usb_endpoint_num(&ep->desc),
                         is_in ? "in" : "out",
                         ({      char *s;
@@ -2520,6 +2520,7 @@ struct usb_hcd *__usb_create_hcd(const struct hc_driver *driver,
                 hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex),
                                 GFP_KERNEL);
                 if (!hcd->bandwidth_mutex) {
+                        kfree(hcd->address0_mutex);
                         kfree(hcd);
                         dev_dbg(dev, "hcd bandwidth mutex alloc failed\n");
                         return NULL;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 9dca59ef18b3..b8bb20d7acdb 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -362,7 +362,8 @@ static void usb_set_lpm_parameters(struct usb_device *udev)
 }
 
 /* USB 2.0 spec Section 11.24.4.5 */
-static int get_hub_descriptor(struct usb_device *hdev, void *data)
+static int get_hub_descriptor(struct usb_device *hdev,
+                struct usb_hub_descriptor *desc)
 {
         int i, ret, size;
         unsigned dtype;
@@ -378,10 +379,18 @@ static int get_hub_descriptor(struct usb_device *hdev, void *data)
         for (i = 0; i < 3; i++) {
                 ret = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
                         USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
-                        dtype << 8, 0, data, size,
+                        dtype << 8, 0, desc, size,
                         USB_CTRL_GET_TIMEOUT);
-                if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2))
+                if (hub_is_superspeed(hdev)) {
+                        if (ret == size)
+                                return ret;
+                } else if (ret >= USB_DT_HUB_NONVAR_SIZE + 2) {
+                        /* Make sure we have the DeviceRemovable field. */
+                        size = USB_DT_HUB_NONVAR_SIZE + desc->bNbrPorts / 8 + 1;
+                        if (ret < size)
+                                return -EMSGSIZE;
                         return ret;
+                }
         }
         return -EINVAL;
 }
@@ -1313,7 +1322,7 @@ static int hub_configure(struct usb_hub *hub,
         }
         mutex_init(&hub->status_mutex);
 
-        hub->descriptor = kmalloc(sizeof(*hub->descriptor), GFP_KERNEL);
+        hub->descriptor = kzalloc(sizeof(*hub->descriptor), GFP_KERNEL);
         if (!hub->descriptor) {
                 ret = -ENOMEM;
                 goto fail;
@@ -1321,13 +1330,19 @@ static int hub_configure(struct usb_hub *hub,
 
         /* Request the entire hub descriptor.
          * hub->descriptor can handle USB_MAXCHILDREN ports,
-         * but the hub can/will return fewer bytes here.
+         * but a (non-SS) hub can/will return fewer bytes here.
          */
         ret = get_hub_descriptor(hdev, hub->descriptor);
         if (ret < 0) {
                 message = "can't read hub descriptor";
                 goto fail;
-        } else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) {
+        }
+
+        maxchild = USB_MAXCHILDREN;
+        if (hub_is_superspeed(hdev))
+                maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS);
+
+        if (hub->descriptor->bNbrPorts > maxchild) {
                 message = "hub has too many ports!";
                 ret = -ENODEV;
                 goto fail;
diff --git a/drivers/usb/core/of.c b/drivers/usb/core/of.c
index d787f195a9a6..d563cbcf76cf 100644
--- a/drivers/usb/core/of.c
+++ b/drivers/usb/core/of.c
@@ -53,6 +53,9 @@ EXPORT_SYMBOL_GPL(usb_of_get_child_node);
  *
  * Find the companion device from platform bus.
  *
+ * Takes a reference to the returned struct device which needs to be dropped
+ * after use.
+ *
  * Return: On success, a pointer to the companion device, %NULL on failure.
  */
 struct device *usb_of_get_companion_dev(struct device *dev)
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index d75cb8c0f7df..47903d510955 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -338,7 +338,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
         if (!urb || !urb->complete)
                 return -EINVAL;
         if (urb->hcpriv) {
-                WARN_ONCE(1, "URB %p submitted while active\n", urb);
+                WARN_ONCE(1, "URB %pK submitted while active\n", urb);
                 return -EBUSY;
         }