25 files changed, 198 insertions, 112 deletions
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 2092e46b1380..f8d0747810e7 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -250,6 +250,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
                val = dwc3_omap_read_utmi_ctrl(omap);
                val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG;
                dwc3_omap_write_utmi_ctrl(omap, val);
+                break;
        case OMAP_DWC3_VBUS_OFF:
                val = dwc3_omap_read_utmi_ctrl(omap);
@@ -392,7 +393,7 @@ static void dwc3_omap_set_utmi_mode(struct dwc3_omap *omap)
 {
        u32                     reg;
        struct device_node      *node = omap->dev->of_node;
-        int                     utmi_mode = 0;
+        u32                     utmi_mode = 0;
        reg = dwc3_omap_read_utmi_ctrl(omap);
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 4db97ecae885..0d75158e43fe 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1342,6 +1342,68 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
                if (r == req) {
                        /* wait until it is processed */
                        dwc3_stop_active_transfer(dwc, dep->number, true);
+                        /*
+                         * If request was already started, this means we had to
+                         * stop the transfer. With that we also need to ignore
+                         * all TRBs used by the request, however TRBs can only
+                         * be modified after completion of END_TRANSFER
+                         * command. So what we do here is that we wait for
+                         * END_TRANSFER completion and only after that, we jump
+                         * over TRBs by clearing HWO and incrementing dequeue
+                         * pointer.
+                         *
+                         * Note that we have 2 possible types of transfers here:
+                         *
+                         * i) Linear buffer request
+                         * ii) SG-list based request
+                         *
+                         * SG-list based requests will have r->num_pending_sgs
+                         * set to a valid number (> 0). Linear requests,
+                         * normally use a single TRB.
+                         *
+                         * For each of these two cases, if r->unaligned flag is
+                         * set, one extra TRB has been used to align transfer
+                         * size to wMaxPacketSize.
+                         *
+                         * All of these cases need to be taken into
+                         * consideration so we don't mess up our TRB ring
+                         * pointers.
+                         */
+                        wait_event_lock_irq(dep->wait_end_transfer,
+                                        !(dep->flags & DWC3_EP_END_TRANSFER_PENDING),
+                                        dwc->lock);
+                        if (!r->trb)
+                                goto out1;
+                        if (r->num_pending_sgs) {
+                                struct dwc3_trb *trb;
+                                int i = 0;
+                                for (i = 0; i < r->num_pending_sgs; i++) {
+                                        trb = r->trb + i;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+                                if (r->unaligned) {
+                                        trb = r->trb + r->num_pending_sgs + 1;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+                        } else {
+                                struct dwc3_trb *trb = r->trb;
+                                trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                dwc3_ep_inc_deq(dep);
+                                if (r->unaligned) {
+                                        trb = r->trb + 1;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+                        }
                        goto out1;
                }
                dev_err(dwc->dev, "request %p was not queued to %s\n",
@@ -1352,6 +1414,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
 out1:
        /* giveback the request */
+        dep->queued_requests--;
        dwc3_gadget_giveback(dep, req, -ECONNRESET);
 out0:
@@ -2126,12 +2189,12 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                return 1;
        }
-        if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
-                return 1;
        count = trb->size & DWC3_TRB_SIZE_MASK;
        req->remaining += count;
+        if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
+                return 1;
        if (dep->direction) {
                if (count) {
                        trb_status = DWC3_TRB_SIZE_TRBSTS(trb->size);
@@ -3228,15 +3291,10 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
 int dwc3_gadget_suspend(struct dwc3 *dwc)
 {
-        int ret;
        if (!dwc->gadget_driver)
                return 0;
-        ret = dwc3_gadget_run_stop(dwc, false, false);
+        dwc3_gadget_run_stop(dwc, false, false);
-        if (ret < 0)
-                return ret;
        dwc3_disconnect_gadget(dwc);
        __dwc3_gadget_stop(dwc);
diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
index 3129bcf74d7d..265e223ab645 100644
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -28,23 +28,23 @@ struct dwc3;
 #define gadget_to_dwc(g)        (container_of(g, struct dwc3, gadget))
 /* DEPCFG parameter 1 */
-#define DWC3_DEPCFG_INT_NUM(n)          ((n) << 0)
+#define DWC3_DEPCFG_INT_NUM(n)          (((n) & 0x1f) << 0)
 #define DWC3_DEPCFG_XFER_COMPLETE_EN    (1 << 8)
 #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN (1 << 9)
 #define DWC3_DEPCFG_XFER_NOT_READY_EN   (1 << 10)
 #define DWC3_DEPCFG_FIFO_ERROR_EN       (1 << 11)
 #define DWC3_DEPCFG_STREAM_EVENT_EN     (1 << 13)
-#define DWC3_DEPCFG_BINTERVAL_M1(n)     ((n) << 16)
+#define DWC3_DEPCFG_BINTERVAL_M1(n)     (((n) & 0xff) << 16)
 #define DWC3_DEPCFG_STREAM_CAPABLE      (1 << 24)
-#define DWC3_DEPCFG_EP_NUMBER(n)        ((n) << 25)
+#define DWC3_DEPCFG_EP_NUMBER(n)        (((n) & 0x1f) << 25)
 #define DWC3_DEPCFG_BULK_BASED          (1 << 30)
 #define DWC3_DEPCFG_FIFO_BASED          (1 << 31)
 /* DEPCFG parameter 0 */
-#define DWC3_DEPCFG_EP_TYPE(n)          ((n) << 1)
+#define DWC3_DEPCFG_EP_TYPE(n)          (((n) & 0x3) << 1)
-#define DWC3_DEPCFG_MAX_PACKET_SIZE(n)  ((n) << 3)
+#define DWC3_DEPCFG_MAX_PACKET_SIZE(n)  (((n) & 0x7ff) << 3)
-#define DWC3_DEPCFG_FIFO_NUMBER(n)      ((n) << 17)
+#define DWC3_DEPCFG_FIFO_NUMBER(n)      (((n) & 0x1f) << 17)
-#define DWC3_DEPCFG_BURST_SIZE(n)       ((n) << 22)
+#define DWC3_DEPCFG_BURST_SIZE(n)       (((n) & 0xf) << 22)
 #define DWC3_DEPCFG_DATA_SEQ_NUM(n)     ((n) << 26)
 /* This applies for core versions earlier than 1.94a */
 #define DWC3_DEPCFG_IGN_SEQ_NUM         (1 << 31)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 78c44979dde3..cbff3b02840d 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -269,6 +269,7 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item,
                ret = unregister_gadget(gi);
                if (ret)
                        goto err;
+                kfree(name);
        } else {
                if (gi->composite.gadget_driver.udc_name) {
                        ret = -EBUSY;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index a5b7cd615698..a0085571824d 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1834,11 +1834,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
        spin_lock_irqsave(&func->ffs->eps_lock, flags);
        while(count--) {
                struct usb_endpoint_descriptor *ds;
+                struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
+                int needs_comp_desc = false;
                int desc_idx;
-                if (ffs->gadget->speed == USB_SPEED_SUPER)
+                if (ffs->gadget->speed == USB_SPEED_SUPER) {
                        desc_idx = 2;
-                else if (ffs->gadget->speed == USB_SPEED_HIGH)
+                        needs_comp_desc = true;
+                } else if (ffs->gadget->speed == USB_SPEED_HIGH)
                        desc_idx = 1;
                else
                        desc_idx = 0;
@@ -1855,6 +1858,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
                ep->ep->driver_data = ep;
                ep->ep->desc = ds;
+                comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+                                USB_DT_ENDPOINT_SIZE);
+                ep->ep->maxburst = comp_desc->bMaxBurst + 1;
+                if (needs_comp_desc)
+                        ep->ep->comp_desc = comp_desc;
                ret = usb_ep_enable(ep->ep);
                if (likely(!ret)) {
                        epfile->ep = ep;
@@ -2253,7 +2264,7 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
                if (len < sizeof(*d) ||
                    d->bFirstInterfaceNumber >= ffs->interfaces_count ||
-                    d->Reserved1)
+                    !d->Reserved1)
                        return -EINVAL;
                for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
                        if (d->Reserved2[i])
diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index 27ed51b5082f..29b41b5dee04 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -258,13 +258,6 @@ uvc_function_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
        memcpy(&uvc_event->req, ctrl, sizeof(uvc_event->req));
        v4l2_event_queue(&uvc->vdev, &v4l2_event);
-        /* Pass additional setup data to userspace */
-        if (uvc->event_setup_out && uvc->event_length) {
-                uvc->control_req->length = uvc->event_length;
-                return usb_ep_queue(uvc->func.config->cdev->gadget->ep0,
-                        uvc->control_req, GFP_ATOMIC);
-        }
        return 0;
 }
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index a2615d64d07c..a2c916869293 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -84,8 +84,7 @@ static int ep_open(struct inode *, struct file *);
 /* /dev/gadget/$CHIP represents ep0 and the whole device */
 enum ep0_state {
-        /* DISBLED is the initial state.
+        /* DISABLED is the initial state. */
-         */
        STATE_DEV_DISABLED = 0,
        /* Only one open() of /dev/gadget/$CHIP; only one file tracks
@@ -1782,8 +1781,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        spin_lock_irq (&dev->lock);
        value = -EINVAL;
-        if (dev->buf)
+        if (dev->buf) {
+                kfree(kbuf);
                goto fail;
+        }
        dev->buf = kbuf;
        /* full or low speed config */
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 11bbce28bc23..2035906b8ced 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -610,7 +610,7 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 {
        struct usba_ep *ep = to_usba_ep(_ep);
        struct usba_udc *udc = ep->udc;
-        unsigned long flags, ept_cfg, maxpacket;
+        unsigned long flags, maxpacket;
        unsigned int nr_trans;
        DBG(DBG_GADGET, "%s: ep_enable: desc=%p\n", ep->ep.name, desc);
@@ -630,7 +630,7 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
        ep->is_in = 0;
        DBG(DBG_ERR, "%s: EPT_CFG = 0x%lx (maxpacket = %lu)\n",
-                        ep->ep.name, ept_cfg, maxpacket);
+                        ep->ep.name, ep->ept_cfg, maxpacket);
        if (usb_endpoint_dir_in(desc)) {
                ep->is_in = 1;
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index c60abe3a68f9..8cabc5944d5f 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -1031,6 +1031,8 @@ static int dummy_udc_probe(struct platform_device *pdev)
        int             rc;
        dum = *((void **)dev_get_platdata(&pdev->dev));
+        /* Clear usb_gadget region for new registration to udc-core */
+        memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
        dum->gadget.name = gadget_name;
        dum->gadget.ops = &dummy_ops;
        dum->gadget.max_speed = USB_SPEED_SUPER;
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 85504419ab31..3828c2ec8623 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -1146,15 +1146,15 @@ static int scan_dma_completions(struct net2280_ep *ep)
         */
        while (!list_empty(&ep->queue)) {
                struct net2280_request  *req;
-                u32                     tmp;
+                u32 req_dma_count;
                req = list_entry(ep->queue.next,
                                struct net2280_request, queue);
                if (!req->valid)
                        break;
                rmb();
-                tmp = le32_to_cpup(&req->td->dmacount);
+                req_dma_count = le32_to_cpup(&req->td->dmacount);
-                if ((tmp & BIT(VALID_BIT)) != 0)
+                if ((req_dma_count & BIT(VALID_BIT)) != 0)
                        break;
                /* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
@@ -1163,40 +1163,41 @@ static int scan_dma_completions(struct net2280_ep *ep)
                 */
                if (unlikely(req->td->dmadesc == 0)) {
                        /* paranoia */
-                        tmp = readl(&ep->dma->dmacount);
+                        u32 const ep_dmacount = readl(&ep->dma->dmacount);
-                        if (tmp & DMA_BYTE_COUNT_MASK)
+                        if (ep_dmacount & DMA_BYTE_COUNT_MASK)
                                break;
                        /* single transfer mode */
-                        dma_done(ep, req, tmp, 0);
+                        dma_done(ep, req, req_dma_count, 0);
                        num_completed++;
                        break;
                } else if (!ep->is_in &&
                           (req->req.length % ep->ep.maxpacket) &&
                           !(ep->dev->quirks & PLX_PCIE)) {
-                        tmp = readl(&ep->regs->ep_stat);
+                        u32 const ep_stat = readl(&ep->regs->ep_stat);
                        /* AVOID TROUBLE HERE by not issuing short reads from
                         * your gadget driver.  That helps avoids errata 0121,
                         * 0122, and 0124; not all cases trigger the warning.
                         */
-                        if ((tmp & BIT(NAK_OUT_PACKETS)) == 0) {
+                        if ((ep_stat & BIT(NAK_OUT_PACKETS)) == 0) {
                                ep_warn(ep->dev, "%s lost packet sync!\n",
                                                ep->ep.name);
                                req->req.status = -EOVERFLOW;
                        } else {
-                                tmp = readl(&ep->regs->ep_avail);
+                                u32 const ep_avail = readl(&ep->regs->ep_avail);
-                                if (tmp) {
+                                if (ep_avail) {
                                        /* fifo gets flushed later */
                                        ep->out_overflow = 1;
                                        ep_dbg(ep->dev,
                                                "%s dma, discard %d len %d\n",
-                                                ep->ep.name, tmp,
+                                                ep->ep.name, ep_avail,
                                                req->req.length);
                                        req->req.status = -EOVERFLOW;
                                }
                        }
                }
-                dma_done(ep, req, tmp, 0);
+                dma_done(ep, req, req_dma_count, 0);
                num_completed++;
        }
diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
index e1335ad5bce9..832c4fdbe985 100644
--- a/drivers/usb/gadget/udc/pxa27x_udc.c
+++ b/drivers/usb/gadget/udc/pxa27x_udc.c
@@ -2534,9 +2534,10 @@ static int pxa_udc_remove(struct platform_device *_dev)
        usb_del_gadget_udc(&udc->gadget);
        pxa_cleanup_debugfs(udc);
-        if (!IS_ERR_OR_NULL(udc->transceiver))
+        if (!IS_ERR_OR_NULL(udc->transceiver)) {
                usb_unregister_notifier(udc->transceiver, &pxa27x_udc_phy);
-        usb_put_phy(udc->transceiver);
+                usb_put_phy(udc->transceiver);
+        }
        udc->transceiver = NULL;
        the_controller = NULL;
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 414e3c376dbb..5302f988e7e6 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -350,7 +350,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                case USB_PORT_FEAT_SUSPEND:
                        dev_dbg(hcd->self.controller, "SetPortFeat: SUSPEND\n");
-                        if (valid_port(wIndex)) {
+                        if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
                                ohci_at91_port_suspend(ohci_at91->sfr_regmap,
                                                       1);
                                return 0;
@@ -393,7 +393,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                case USB_PORT_FEAT_SUSPEND:
                        dev_dbg(hcd->self.controller, "ClearPortFeature: SUSPEND\n");
-                        if (valid_port(wIndex)) {
+                        if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
                                ohci_at91_port_suspend(ohci_at91->sfr_regmap,
                                                       0);
                                return 0;
diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
index 363d125300ea..2b4a00fa735d 100644
--- a/drivers/usb/host/xhci-dbg.c
+++ b/drivers/usb/host/xhci-dbg.c
@@ -109,7 +109,7 @@ static void xhci_print_cap_regs(struct xhci_hcd *xhci)
        xhci_dbg(xhci, "RTSOFF 0x%x:\n", temp & RTSOFF_MASK);
        /* xhci 1.1 controllers have the HCCPARAMS2 register */
-        if (hci_version > 100) {
+        if (hci_version > 0x100) {
                temp = readl(&xhci->cap_regs->hcc_params2);
                xhci_dbg(xhci, "HCC PARAMS2 0x%x:\n", (unsigned int) temp);
                xhci_dbg(xhci, "  HC %s Force save context capability",
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 9066ec9e0c2e..67d5dc79b6b5 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -382,7 +382,6 @@ static int usb_wakeup_of_property_parse(struct xhci_hcd_mtk *mtk,
 static int xhci_mtk_setup(struct usb_hcd *hcd);
 static const struct xhci_driver_overrides xhci_mtk_overrides __initconst = {
-        .extra_priv_size = sizeof(struct xhci_hcd),
        .reset = xhci_mtk_setup,
 };
@@ -678,13 +677,13 @@ static int xhci_mtk_probe(struct platform_device *pdev)
                goto power_off_phys;
        }
-        if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
-                xhci->shared_hcd->can_do_streams = 1;
        ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
        if (ret)
                goto put_usb3_hcd;
+        if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
+                xhci->shared_hcd->can_do_streams = 1;
        ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED);
        if (ret)
                goto dealloc_usb2_hcd;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 6d33b42ffcf5..bd02a6cd8e2c 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -286,6 +286,8 @@ static int xhci_plat_remove(struct platform_device *dev)
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
        struct clk *clk = xhci->clk;
+        xhci->xhc_state |= XHCI_STATE_REMOVING;
        usb_remove_hcd(xhci->shared_hcd);
        usb_phy_shutdown(hcd->usb_phy);
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index a59fafb4b329..74436f8ca538 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1308,7 +1308,6 @@ static int tegra_xhci_setup(struct usb_hcd *hcd)
 }
 static const struct xhci_driver_overrides tegra_xhci_overrides __initconst = {
-        .extra_priv_size = sizeof(struct xhci_hcd),
        .reset = tegra_xhci_setup,
 };
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6d6c46000e56..50aee8b7718b 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -868,7 +868,7 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
        spin_lock_irqsave(&xhci->lock, flags);
-        /* disble usb3 ports Wake bits*/
+        /* disable usb3 ports Wake bits */
        port_index = xhci->num_usb3_ports;
        port_array = xhci->usb3_ports;
        while (port_index--) {
@@ -879,7 +879,7 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
                        writel(t2, port_array[port_index]);
        }
-        /* disble usb2 ports Wake bits*/
+        /* disable usb2 ports Wake bits */
        port_index = xhci->num_usb2_ports;
        port_array = xhci->usb2_ports;
        while (port_index--) {
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 095778ff984d..37c63cb39714 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -781,12 +781,6 @@ static int iowarrior_probe(struct usb_interface *interface,
        iface_desc = interface->cur_altsetting;
        dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
-        if (iface_desc->desc.bNumEndpoints < 1) {
-                dev_err(&interface->dev, "Invalid number of endpoints\n");
-                retval = -EINVAL;
-                goto error;
-        }
        /* set up the endpoint information */
        for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
                endpoint = &iface_desc->endpoint[i].desc;
@@ -797,6 +791,21 @@ static int iowarrior_probe(struct usb_interface *interface,
                        /* this one will match for the IOWarrior56 only */
                        dev->int_out_endpoint = endpoint;
        }
+        if (!dev->int_in_endpoint) {
+                dev_err(&interface->dev, "no interrupt-in endpoint found\n");
+                retval = -ENODEV;
+                goto error;
+        }
+        if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) {
+                if (!dev->int_out_endpoint) {
+                        dev_err(&interface->dev, "no interrupt-out endpoint found\n");
+                        retval = -ENODEV;
+                        goto error;
+                }
+        }
        /* we have to check the report_size often, so remember it in the endianness suitable for our machine */
        dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
        if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
index 4e18600dc9b4..91f66d68bcb7 100644
--- a/drivers/usb/misc/usb251xb.c
+++ b/drivers/usb/misc/usb251xb.c
@@ -375,18 +375,24 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
        if (of_get_property(np, "dynamic-power-switching", NULL))
                hub->conf_data2 |= BIT(7);
-        if (of_get_property(np, "oc-delay-100us", NULL)) {
+        if (!of_property_read_u32(np, "oc-delay-us", property_u32)) {
-                hub->conf_data2 &= ~BIT(5);
+                if (*property_u32 == 100) {
-                hub->conf_data2 &= ~BIT(4);
+                        /* 100 us*/
-        } else if (of_get_property(np, "oc-delay-4ms", NULL)) {
+                        hub->conf_data2 &= ~BIT(5);
-                hub->conf_data2 &= ~BIT(5);
+                        hub->conf_data2 &= ~BIT(4);
-                hub->conf_data2 |= BIT(4);
+                } else if (*property_u32 == 4000) {
-        } else if (of_get_property(np, "oc-delay-8ms", NULL)) {
+                        /* 4 ms */
-                hub->conf_data2 |= BIT(5);
+                        hub->conf_data2 &= ~BIT(5);
-                hub->conf_data2 &= ~BIT(4);
+                        hub->conf_data2 |= BIT(4);
-        } else if (of_get_property(np, "oc-delay-16ms", NULL)) {
+                } else if (*property_u32 == 16000) {
-                hub->conf_data2 |= BIT(5);
+                        /* 16 ms */
-                hub->conf_data2 |= BIT(4);
+                        hub->conf_data2 |= BIT(5);
+                        hub->conf_data2 |= BIT(4);
+                } else {
+                        /* 8 ms (DEFAULT) */
+                        hub->conf_data2 |= BIT(5);
+                        hub->conf_data2 &= ~BIT(4);
+                }
        }
        if (of_get_property(np, "compound-device", NULL))
@@ -432,30 +438,9 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
                }
        }
-        hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
-        if (!of_property_read_u32(np, "max-sp-power", property_u32))
-                hub->max_power_sp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                          250);
-        hub->max_power_bp = USB251XB_DEF_MAX_POWER_BUS;
-        if (!of_property_read_u32(np, "max-bp-power", property_u32))
-                hub->max_power_bp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                          250);
-        hub->max_current_sp = USB251XB_DEF_MAX_CURRENT_SELF;
-        if (!of_property_read_u32(np, "max-sp-current", property_u32))
-                hub->max_current_sp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                            250);
-        hub->max_current_bp = USB251XB_DEF_MAX_CURRENT_BUS;
-        if (!of_property_read_u32(np, "max-bp-current", property_u32))
-                hub->max_current_bp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                            250);
        hub->power_on_time = USB251XB_DEF_POWER_ON_TIME;
-        if (!of_property_read_u32(np, "power-on-time", property_u32))
+        if (!of_property_read_u32(np, "power-on-time-ms", property_u32))
-                hub->power_on_time = min_t(u8, be32_to_cpu(*property_u32) / 2,
+                hub->power_on_time = min_t(u8, *property_u32 / 2, 255);
-                                           255);
        if (of_property_read_u16_array(np, "language-id", &hub->lang_id, 1))
                hub->lang_id = USB251XB_DEF_LANGUAGE_ID;
@@ -492,6 +477,10 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
        /* The following parameters are currently not exposed to devicetree, but
         * may be as soon as needed.
         */
+        hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
+        hub->max_power_bp = USB251XB_DEF_MAX_POWER_BUS;
+        hub->max_current_sp = USB251XB_DEF_MAX_CURRENT_SELF;
+        hub->max_current_bp = USB251XB_DEF_MAX_CURRENT_BUS;
        hub->bat_charge_en = USB251XB_DEF_BATTERY_CHARGING_ENABLE;
        hub->boost_up = USB251XB_DEF_BOOST_UP;
        hub->boost_x = USB251XB_DEF_BOOST_X;
diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c
index db68156568e6..b3b33cf7ddf6 100644
--- a/drivers/usb/phy/phy-isp1301.c
+++ b/drivers/usb/phy/phy-isp1301.c
@@ -33,6 +33,12 @@ static const struct i2c_device_id isp1301_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, isp1301_id);
+static const struct of_device_id isp1301_of_match[] = {
+        {.compatible = "nxp,isp1301" },
+        { },
+};
+MODULE_DEVICE_TABLE(of, isp1301_of_match);
 static struct i2c_client *isp1301_i2c_client;
 static int __isp1301_write(struct isp1301 *isp, u8 reg, u8 value, u8 clear)
@@ -130,6 +136,7 @@ static int isp1301_remove(struct i2c_client *client)
 static struct i2c_driver isp1301_driver = {
        .driver = {
                .name = DRV_NAME,
+                .of_match_table = of_match_ptr(isp1301_of_match),
        },
        .probe = isp1301_probe,
        .remove = isp1301_remove,
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index ab78111e0968..6537d3ca2797 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1500,7 +1500,7 @@ static int digi_read_oob_callback(struct urb *urb)
                return -1;
        /* handle each oob command */
-        for (i = 0; i < urb->actual_length - 4; i += 4) {
+        for (i = 0; i < urb->actual_length - 3; i += 4) {
                opcode = buf[i];
                line = buf[i + 1];
                status = buf[i + 2];
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index ceaeebaa6f90..a76b95d32157 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1674,6 +1674,12 @@ static void edge_interrupt_callback(struct urb *urb)
        function    = TIUMP_GET_FUNC_FROM_CODE(data[0]);
        dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__,
                port_number, function, data[1]);
+        if (port_number >= edge_serial->serial->num_ports) {
+                dev_err(dev, "bad port number %d\n", port_number);
+                goto exit;
+        }
        port = edge_serial->serial->port[port_number];
        edge_port = usb_get_serial_port_data(port);
        if (!edge_port) {
@@ -1755,7 +1761,7 @@ static void edge_bulk_in_callback(struct urb *urb)
        port_number = edge_port->port->port_number;
-        if (edge_port->lsr_event) {
+        if (urb->actual_length > 0 && edge_port->lsr_event) {
                edge_port->lsr_event = 0;
                dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n",
                        __func__, port_number, edge_port->lsr_mask, *data);
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index a180b17d2432..dd706953b466 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -31,7 +31,6 @@
 #define BT_IGNITIONPRO_ID       0x2000
 /* function prototypes */
-static int  omninet_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void omninet_process_read_urb(struct urb *urb);
 static void omninet_write_bulk_callback(struct urb *urb);
 static int  omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -60,7 +59,6 @@ static struct usb_serial_driver zyxel_omninet_device = {
        .attach =               omninet_attach,
        .port_probe =           omninet_port_probe,
        .port_remove =          omninet_port_remove,
-        .open =                 omninet_open,
        .write =                omninet_write,
        .write_room =           omninet_write_room,
        .write_bulk_callback =  omninet_write_bulk_callback,
@@ -140,17 +138,6 @@ static int omninet_port_remove(struct usb_serial_port *port)
        return 0;
 }
-static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port)
-{
-        struct usb_serial       *serial = port->serial;
-        struct usb_serial_port  *wport;
-        wport = serial->port[1];
-        tty_port_tty_set(&wport->port, tty);
-        return usb_serial_generic_open(tty, port);
-}
 #define OMNINET_HEADERLEN       4
 #define OMNINET_BULKOUTSIZE     64
 #define OMNINET_PAYLOADSIZE     (OMNINET_BULKOUTSIZE - OMNINET_HEADERLEN)
diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c
index 93c6c9b08daa..8a069aa154ed 100644
--- a/drivers/usb/serial/safe_serial.c
+++ b/drivers/usb/serial/safe_serial.c
@@ -200,6 +200,11 @@ static void safe_process_read_urb(struct urb *urb)
        if (!safe)
                goto out;
+        if (length < 2) {
+                dev_err(&port->dev, "malformed packet\n");
+                return;
+        }
        fcs = fcs_compute10(data, length, CRC10_INITFCS);
        if (fcs) {
                dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 16cc18369111..9129f6cb8230 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2071,6 +2071,20 @@ UNUSUAL_DEV(  0x1370, 0x6828, 0x0110, 0x0110,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_IGNORE_RESIDUE ),
+/*
+ * Reported by Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+ * The INIC-3619 bridge is used in the StarTech SLSODDU33B
+ * SATA-USB enclosure for slimline optical drives.
+ *
+ * The quirk enables MakeMKV to properly exchange keys with
+ * an installed BD drive.
+ */
+UNUSUAL_DEV(  0x13fd, 0x3609, 0x0209, 0x0209,
+                "Initio Corporation",
+                "INIC-3619",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE ),
 /* Reported by Qinglin Ye <yestyle@gmail.com> */
 UNUSUAL_DEV(  0x13fe, 0x3600, 0x0100, 0x0100,
                "Kingston",