USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared

USB controller may access the dTD one more time after clearing the active
bit in token field.  There is a possibility of software freeing it in this
window.  When this happens, USB controller may access incorrect memory and
leads to system level issues.

dTDs are freed when requests are freed by function drivers during
disconnect or unbind.  The above race condition will come into effect only
for zero length packets.  dTDs are dynamically created for sending zero
length packets on IN endpoints.  These dTDs are immediately freed after
active bit is cleared.  Defer this to next dTD completion.  It is safe to
assume that hardware will no longer access the previous dTD when the next
dTD is completed.

Don't allocate/free setup status phase and GET_STATUS data phase requests
dynamically.  Use  one request for both cases and allocate it during bind.

CRs-Fixed: 474557
Change-Id: I5d41c310e1bb35d93b5af7d90a24ce5aab24f5f9
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc patch 2/2
USB: mdm_bridge: Fix a possible freed memory access

When tethered rmnet/dun interface probe is failed, the bridge channel
platform device is removed in error path.  The gadget driver schedule
a work to open the bridge channel in probe.  Cancel this work in remove
before closing the channel.

Cancel any pending work while closing the bridge.  Otherwise there is
a possibility of rx work running in parallel with probe error path.  If
this happens, rx work access already freed memory.

CRs-Fixed: 442119
(cherry picked from commit 50f3815166483c654ebb325c49e50af4e31547da)

Change-Id: I78c2ee04cfd083248127cfd6b9f07994087729ca
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: gadget: u_data_hsic: Cancel pending MDM write work during remove

The HSIC bridge driver removes the data bridge platform device
during subsystem restart.  If gadget driver does not cancel pending
MDM write work, we end up accessing interface structure after it
is unbounded.

CRs-Fixed: 465383
Change-Id: I05fe3e2b625e87137681477aaaf1082ba1b81bae
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: gadget: u_data_hsic: Use GFP_KERNEL where ever possible

The USB requests are allocated using dma pool API.  The dma pool has
limited memory for non-sleeping use case.  The current code does not
free USB requests during subsystem restart.  The requests are freed
only after cable is disconnected.  If subsystem restart happens
multiple  times without disconnecting cable, system may run out of the
dma pool memory.  This is leading to URB submission failures.  Use
GFP_KERNEL where ever possible.

CRs-Fixed: 463423
Change-Id: I0fca533e460e7b4234fe771e048e0e50494cb1da
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: mdm_ctrl_bridge: Do not unlink URB upon cable disconnect

MDM control bridge driver unlinks the pending URBs when control
bridge gets closed as a result of usb cable disconnect. Driver
sends set_control_line_state request to MDM upon bridge close.
Right after sending the setup request driver unlinks the pending
URBs. In case if the URB is unlinked after setup stage is completed,
status stage remains pending. This results in a control transfer
stall. Similarly, when the bridge is reopened as a result of USB
cable plug-in, the interrupt URB is not resubmitted, which can also
lead to a QMI stall since the MDM is waiting indefinitely to send
its response available notification. Fix these two potential stall
conditions by not unlinking URBs upon cable disconnect; this will
allow in-progress control transfers to finish gracefully and will
also allow notification interrupts to always be handled. Unlinking
of the URBs will happen during MDM device disconnect, instead of
upon bridge close.

(cherry picked from commit 77f79575ebe35f2ec329827290e7a67fb0e75286)
CRs-Fixed: 419128,418478

Change-Id: I5474372d832de2fd49f17faf77e7e549e80566ad
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
usb: misc: Avoid excessive logging during disconnect

When the device is in the midst of being disconnected, calls to
usb_autopm_get_interface() may fail, and a ERR-level message is
printed. Callers of such I/O functions may repeatedly try calling
again, and could end up flooding the console leading to a watchdog
timeout. Replace these printks with DBG-level messages since the
device disconnection is normal and the errors they indicate are
usually benign.

Change-Id: I03045e866c0b35bd1a698d91c12661c6df660d25
CRs-fixed: 394256
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
usb: mdm_bridge: Fix race between disconnect and I/O completion handler

There is a possibility of race between device disconnect and I/O
completion handler. In this case disconnect frees bridge device
memory in thread context and I/O completion handler uses already
freed bridge device memory in interrupt context. Hence allocate
bridge device memory at the time of driver load and free it
during unload. Also, do not anchor interrupt and read urb and
unlink them synchronously to avoid accessing transfer buffers
associated to these urbs when driver disconnect frees them.

Guard the race condition by:-
1) Adding check for usb device disconnect state in the I/O
completion handler to avoid further processing I/O completion.

2) Unlinking tx urbs synchronously since asynchronous unlinking
results in the same race condition.

CRs-Fixed: 447591
Change-Id: Iae4c2a1920c16fcf3e1728144a7cfe6ca66c7705
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Conflicts:
	drivers/usb/misc/mdm_ctrl_bridge.c
USB: mdm_bridge: Fix control bridge suspend

The current code does not abort suspend when there are pending URBs.
They are simply killed during suspend. This may lead to QMI stall.
Add proper checks to ensure that there is no pending Tx/Rx data
during suspend.  Clear the "SUSPENDED" flag in resume only after
taking out all the URBs from "tx_deferred" anchor.

CRs-Fixed: 451414
Change-Id: Icc48afc5eeedcc126d0ab1bec951bde4a53ac165
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: mdm_bridge: Fix probe error path

The platform device is not unregistered in probe error path.  The
platform device is added again during next probe and it fails.  But
the return value is not checked.  Kernel panic happens when platform
device is removed during disconnect.

CRs-Fixed: 465508
Change-Id: I4db613e72d8b405f10cde0d1335d231cf5079e64
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: gadget: u_ether: Fix memory corruption in TX path

When data aggregation is enabled, multiple skb buffers are copied
into a single USB request buffer.  When ever a USB request queue
is failed, make sure that req->length is reset to 0.  Otherwise
when the same request is used again, the stale length field is used
to access the request buffer.  This would lead to memory corruption.

The xmit function keeps the partial request at the beginning of the
queue.  Always put the idle request at the back of the queue.

CRs-Fixed: 469436
Change-Id: Idcd31e667b0bf261ab9a88f4a34464ccdf503e1b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>