3 files changed, 77 insertions, 19 deletions

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 31ccdccd7a04..051163189810 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -171,6 +171,31 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
                                                         ep, buffer, size);
 }
 
+static const unsigned short low_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 8,
+        [USB_ENDPOINT_XFER_ISOC] = 0,
+        [USB_ENDPOINT_XFER_BULK] = 0,
+        [USB_ENDPOINT_XFER_INT] = 8,
+};
+static const unsigned short full_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 64,
+        [USB_ENDPOINT_XFER_ISOC] = 1023,
+        [USB_ENDPOINT_XFER_BULK] = 64,
+        [USB_ENDPOINT_XFER_INT] = 64,
+};
+static const unsigned short high_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 64,
+        [USB_ENDPOINT_XFER_ISOC] = 1024,
+        [USB_ENDPOINT_XFER_BULK] = 512,
+        [USB_ENDPOINT_XFER_INT] = 1023,
+};
+static const unsigned short super_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 512,
+        [USB_ENDPOINT_XFER_ISOC] = 1024,
+        [USB_ENDPOINT_XFER_BULK] = 1024,
+        [USB_ENDPOINT_XFER_INT] = 1024,
+};
+
 static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
     int asnum, struct usb_host_interface *ifp, int num_ep,
     unsigned char *buffer, int size)
@@ -179,6 +204,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
         struct usb_endpoint_descriptor *d;
         struct usb_host_endpoint *endpoint;
         int n, i, j, retval;
+        unsigned int maxp;
+        const unsigned short *maxpacket_maxes;
 
         d = (struct usb_endpoint_descriptor *) buffer;
         buffer += d->bLength;
@@ -286,6 +313,42 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                         endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
         }
 
+        /* Validate the wMaxPacketSize field */
+        maxp = usb_endpoint_maxp(&endpoint->desc);
+
+        /* Find the highest legal maxpacket size for this endpoint */
+        i = 0;          /* additional transactions per microframe */
+        switch (to_usb_device(ddev)->speed) {
+        case USB_SPEED_LOW:
+                maxpacket_maxes = low_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_FULL:
+                maxpacket_maxes = full_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_HIGH:
+                /* Bits 12..11 are allowed only for HS periodic endpoints */
+                if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
+                        i = maxp & (BIT(12) | BIT(11));
+                        maxp &= ~i;
+                }
+                /* fallthrough */
+        default:
+                maxpacket_maxes = high_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_SUPER:
+        case USB_SPEED_SUPER_PLUS:
+                maxpacket_maxes = super_speed_maxpacket_maxes;
+                break;
+        }
+        j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
+
+        if (maxp > j) {
+                dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
+                    cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
+                maxp = j;
+                endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
+        }
+
         /*
          * Some buggy high speed devices have bulk endpoints using
          * maxpacket sizes other than 512.  High speed HCDs may not
@@ -293,9 +356,6 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
          */
         if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
                         && usb_endpoint_xfer_bulk(d)) {
-                unsigned maxp;
-
-                maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
                 if (maxp != 512)
                         dev_warn(ddev, "config %d interface %d altsetting %d "
                                 "bulk endpoint 0x%X has invalid maxpacket %d\n",
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index e9f5043a2167..e6a6d67c8705 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -241,7 +241,8 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
                 goto error_decrease_mem;
         }
 
-        mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);
+        mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
+                        &dma_handle);
         if (!mem) {
                 ret = -ENOMEM;
                 goto error_free_usbm;
@@ -2582,7 +2583,9 @@ static unsigned int usbdev_poll(struct file *file,
         if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
                 mask |= POLLOUT | POLLWRNORM;
         if (!connected(ps))
-                mask |= POLLERR | POLLHUP;
+                mask |= POLLHUP;
+        if (list_empty(&ps->list))
+                mask |= POLLERR;
         return mask;
 }
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index bee13517676f..1d5fc32d06d0 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1052,14 +1052,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 
         /* Continue a partial initialization */
         if (type == HUB_INIT2 || type == HUB_INIT3) {
-                device_lock(hub->intfdev);
+                device_lock(&hdev->dev);
 
                 /* Was the hub disconnected while we were waiting? */
-                if (hub->disconnected) {
-                        device_unlock(hub->intfdev);
-                        kref_put(&hub->kref, hub_release);
-                        return;
-                }
+                if (hub->disconnected)
+                        goto disconnected;
                 if (type == HUB_INIT2)
                         goto init2;
                 goto init3;
@@ -1262,7 +1259,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                         queue_delayed_work(system_power_efficient_wq,
                                         &hub->init_work,
                                         msecs_to_jiffies(delay));
-                        device_unlock(hub->intfdev);
+                        device_unlock(&hdev->dev);
                         return;         /* Continues at init3: below */
                 } else {
                         msleep(delay);
@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
         /* Scan all ports that need attention */
         kick_hub_wq(hub);
 
-        /* Allow autosuspend if it was suppressed */
-        if (type <= HUB_INIT3)
+        if (type == HUB_INIT2 || type == HUB_INIT3) {
+                /* Allow autosuspend if it was suppressed */
+ disconnected:
                 usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
-
-        if (type == HUB_INIT2 || type == HUB_INIT3)
-                device_unlock(hub->intfdev);
+                device_unlock(&hdev->dev);
+        }
 
         kref_put(&hub->kref, hub_release);
 }
@@ -1315,8 +1312,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
         struct usb_device *hdev = hub->hdev;
         int i;
 
-        cancel_delayed_work_sync(&hub->init_work);
-
         /* hub_wq and related activity won't re-trigger */
         hub->quiescing = 1;