net: make skb_gso_segment error handling more robust

skb_gso_segment has three possible return values:
1. a pointer to the first segmented skb
2. an errno value (IS_ERR())
3. NULL.  This can happen when GSO is used for header verification.

However, several callers currently test IS_ERR instead of IS_ERR_OR_NULL
and would oops when NULL is returned.

Note that these call sites should never actually see such a NULL return
value; all callers mask out the GSO bits in the feature argument.

However, there have been issues with some protocol handlers erronously not
respecting the specified feature mask in some cases.

It is preferable to get 'have to turn off hw offloading, else slow' reports
rather than 'kernel crashes'.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
net: core: handle encapsulation offloads when computing segment lengths

if ->encapsulation is set we have to use inner_tcp_hdrlen and add the
size of the inner network headers too.

This is 'mostly harmless'; tbf might send skb that is slightly over
quota or drop skb even if it would have fit.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge branch 'gso_encap_fixes'

Florian Westphal says:

====================
net: minor gso encapsulation fixes

The following series fixes a minor bug in the gso segmentation handlers
when encapsulation offload is used.

Theoretically this could cause kernel panic when the stack tries
to software-segment such a GRE offload packet, but it looks like there
is only one affected call site (tbf scheduler) and it handles NULL
return value.

I've included a followup patch to add IS_ERR_OR_NULL checks where needed.

While looking into this, I also found that size computation of the individual
segments is incorrect if skb->encapsulation is set.

Please see individual patches for delta vs. v1.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
HID: add keyboard input assist hid usages

Add keyboard input assist controls usages from approved
hid usage table request HUTTR42:
http://www.usb.org/developers/hidpage/HUTRR42c.pdf

Signed-off-by: Olivier Gay <ogay@logitech.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
ARM: pxa: fix hang on startup with DEBUG_LL

The commit 2111667b4677 ("ARM: pxa: call debug_ll_io_init for
earlyprintk") triggers in the current kernel the attached backtrace on
PXA/tosa early in the boot time when DEBUG_LL is enabled.

It is due to overlap between uart virtual memory defined in
DEBUG_UART_VIRT and mapped by debug_ll_io_init() and peripheral bus
mapped by pxa_map_io at the same address, 0xf2100000.

As hinted by Arnd, map early virtual memory for low level debug on
address 0xf6200000, even if that means 2 virtual mappings will give
access to the pxa internal UARTs (FFUART, BTUART, STUART, ...).

------------[ cut here ]------------
kernel BUG at /home/lumag/linux/mm/vmalloc.c:1143!
Internal error: Oops - BUG: 0 [#1] PREEMPT ARM
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 3.17.0-00032-g8e0d202-dirty #23
task: c062a5a8 ti: c0620000 task.ti: c0620000
PC is at vm_area_add_early+0x54/0x84
LR is at add_static_vm_early+0xc/0x60
pc : [<c03e1100>]    lr : [<c03d9ef4>]    psr: 800001d3
sp : c0621f04  ip : c03efa74  fp : c03edf84
r10: c0637e98  r9 : 40000001  r8 : c03da57c
r7 : c3ffcfb0  r6 : 00000000  r5 : c3ffcfb0  r4 : 02000000
r3 : c3ffcfd8  r2 : f2100000  r1 : f4000000  r0 : c3ffcfb0
Flags: Nzcv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment kernel
Control: 00007977  Table: a0004000  DAC: 00000017
Process swapper (pid: 0, stack limit = 0xc06201c8)
Stack: (0xc0621f04 to 0xc0622000)
1f00:          c3ffcfd8 40000001 c3ffcfd8 c03ee08c c03da570 c03db90c c0637d24
1f20: 00000000 c03ec7cc c066e654 a0700000 000a0700 c03db914 c03db90c c03daf84
1f40: 00000000 000a0000 c0000000 c03ec7cc 000a0700 c0700000 ffff1000 000a3fff
1f60: 00001000 00000007 00000000 c03ec7cc c0008000 c03ed748 c0621fd4 c03d5d18
1f80: 69052d00 a03ec48c 00000000 c03d8ad0 0000006c 00007977 c036c6e8 00000001
1fa0: c0621fd4 c03ed744 c0628000 a0004000 69052d00 a03ec48c 00000000 c03d68d4
1fc0: 00000000 00000000 00000000 00000000 00000000 c03ed748 c0649894 c062801c
1fe0: c03ed744 c062b2f0 a0004000 69052d00 a03ec48c a0008040 00000000 00000000
[<c03e1100>] (vm_area_add_early) from [<c03d9ef4>] (add_static_vm_early+0xc/0x60)
[<c03d9ef4>] (add_static_vm_early) from [<c03da570>] (iotable_init.part.6+0xa8/0xb4)
[<c03da570>] (iotable_init.part.6) from [<c03db914>] (pxa25x_map_io+0x8/0x24)
[<c03db914>] (pxa25x_map_io) from [<c03daf84>] (paging_init+0x744/0x8d8)
[<c03daf84>] (paging_init) from [<c03d8ad0>] (setup_arch+0x354/0x608)
[<c03d8ad0>] (setup_arch) from [<c03d68d4>] (start_kernel+0xa8/0x3dc)
[<c03d68d4>] (start_kernel) from [<a0008040>] (0xa0008040)
Code: e5904008 e0811004 e1520001 2a000005 (e7f001f2)
---[ end trace f24b6c88ae00fa9a ]---
Kernel panic - not syncing: Attempted to kill the idle task!
---[ end Kernel panic - not syncing: Attempted to kill the idle task!

Cc: <stable@vger.kernel.org>
Reported-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Acked-by: Arnd Bergmann <arnd@arndb.de>
usb: dwc3: trace: don't dereference pointers

The way trace works is that it won't decode strings
until we read the actual trace. Because of that, we
can't make assumptions of pointers still being valid
at the time we read the trace. In order to avoid that,
just copy all fields from every struct pointer we need
for our traces.

Ths patch fixes the following bug:

[ 2940.039229] Unable to handle kernel paging request at virtual address 814efa9e
[ 2940.046904] pgd = ec3dc000
[ 2940.049737] [814efa9e] *pgd=00000000
[ 2940.053552] Internal error: Oops: 5 [#1] SMP ARM
[ 2940.058379] Modules linked in: usb_f_acm u_serial g_serial usb_f_uac2 libcomposite configfs xhci_hcd dwc3 udc_core matrix_keypad dwc3_omap lis3lv02d_i2c lis3lv02d input_polldev [last unloaded: g_audio]
[ 2940.077238] CPU: 0 PID: 3020 Comm: tail Tainted: G        W
3.17.0-rc5-dirty #1097
[ 2940.085596] task: ed1b1040 ti: ed07c000 task.ti: ed07c000
[ 2940.091258] PC is at strnlen+0x18/0x68
[ 2940.095177] LR is at 0xfffffffe
[ 2940.098454] pc : [<c0356df8>]    lr : [<fffffffe>]    psr: a0000013
[ 2940.098454] sp : ed07ddb0  ip : ed07ddc0  fp : ed07ddbc
[ 2940.110445] r10: c070ff70  r9 : ed07de70  r8 : 00000000
[ 2940.115906] r7 : 814efa9e  r6 : ffffffff  r5 : ed4b6087  r4 : ed4b50c7
[ 2940.122726] r3 : 00000000  r2 : 814efa9e  r1 : ffffffff  r0 : 814efa9e
[ 2940.129546] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM Segment user
[ 2940.137000] Control: 10c5387d  Table: ac3dc059  DAC: 00000015
[ 2940.143006] Process tail (pid: 3020, stack limit = 0xed07c248)
[ 2940.149098] Stack: (0xed07ddb0 to 0xed07e000)
[ 2940.153660] dda0:                                     ed07dde4 ed07ddc0 c0359628 c0356dec
[ 2940.162203] ddc0: 00000000 ed4b50c7 bf03ae9c ed4b6087 bf03ae9e 00000002 ed07de3c ed07dde8
[ 2940.170740] dde0: c035ab50 c0359600 ffffffff ffffffff ff0a0000 ffffffff ed07de30 ed4b5088
[ 2940.179275] de00: ed4b50c7 00000fc0 ff0a0004 ffffffff ed4b5088 ed4b5088 00000000 00001000
[ 2940.187810] de20: 00001008 00000fc0 ed4b5088 00000000 ed07de68 ed07de40 c00f1e64 c035a9c4
[ 2940.196341] de40: bf03dae0 ed07de70 ed4b4000 ec25b280 ed4b4000 ec25b280 bf03dae0 ed07de9c
[ 2940.204886] de60: ed07de78 bf033324 c00f1e0c bf03ae9c 814efa9e ed428bc0 814eca3e 00000000
[ 2940.213428] de80: 814eba3e ed4b4000 03bd1201 c0c34790 ed07ded4 ed07dea0 c00edc0c bf0332d0
[ 2940.221994] dea0: 000002c7 ed07df10 ed07decc ed07deb8 ed4b4000 0000209c ec278ac0 00000000
[ 2940.230536] dec0: 00002000 ec0db340 ed07def4 ed07ded8 c00ee7ec c00eda90 c00ee7b0 ec278ac0
[ 2940.239075] dee0: ed4b4000 000002d5 ed07df44 ed07def8 c018b8d0 c00ee7bc c0166d3c ec278af0
[ 2940.247621] df00: 0001f090 ed07df78 000002c7 00000000 000002c8 00000000 00000000 ec0db340
[ 2940.256173] df20: 0001f090 ed07df78 ec0db340 00002000 0001f090 00000000 ed07df74 ed07df48
[ 2940.264729] df40: c0166e98 c018b5f4 00000001 c018535c 000168c1 00000000 ec0db340 ec0db340
[ 2940.273284] df60: 00002000 0001f090 ed07dfa4 ed07df78 c01675c4 c0166e0c 000168c1 00000000
[ 2940.281829] df80: 00002000 0000000a 0001f090 00000003 c000f064 ed07c000 00000000 ed07dfa8
[ 2940.290365] dfa0: c000ede0 c0167584 00002000 0000000a 00000003 0001f090 00002000 00000000
[ 2940.298909] dfc0: 00002000 0000000a 0001f090 00000003 7fffe000 0001e1e0 00002004 0000002f
[ 2940.307445] dfe0: 00000000 beed38ec 000104c8 b6e6397c 40000010 00000003 00000000 00000000
[ 2940.315992] [<c0356df8>] (strnlen) from [<c0359628>] (string.isra.8+0x34/0xe8)
[ 2940.323534] [<c0359628>] (string.isra.8) from [<c035ab50>] (vsnprintf+0x198/0x3fc)
[ 2940.331461] [<c035ab50>] (vsnprintf) from [<c00f1e64>] (trace_seq_printf+0x68/0x94)
[ 2940.339494] [<c00f1e64>] (trace_seq_printf) from [<bf033324>] (ftrace_raw_output_dwc3_log_request+0x60/0x78 [dwc3])
[ 2940.350424] [<bf033324>] (ftrace_raw_output_dwc3_log_request [dwc3]) from [<c00edc0c>] (print_trace_line+0x188/0x418)
[ 2940.361507] [<c00edc0c>] (print_trace_line) from [<c00ee7ec>] (s_show+0x3c/0x12c)
[ 2940.369330] [<c00ee7ec>] (s_show) from [<c018b8d0>] (seq_read+0x2e8/0x4a0)
[ 2940.376519] [<c018b8d0>] (seq_read) from [<c0166e98>] (vfs_read+0x98/0x158)
[ 2940.383796] [<c0166e98>] (vfs_read) from [<c01675c4>] (SyS_read+0x4c/0xa0)
[ 2940.390981] [<c01675c4>] (SyS_read) from [<c000ede0>] (ret_fast_syscall+0x0/0x48)
[ 2940.398792] Code: e24cb004 e3510000 e241e001 0a000011 (e5d01000)
[ 2940.406980] ---[ end trace d8b38370fbb531f3 ]---

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc3: ep0: hold our lock in dwc3_gadget_ep0_set_halt

dwc3_gadget_ep0_set_halt() will be called without
locks held in some cases, so we must hold the lock
on our own. While at that, also add a version without
locks to be called in certain conditions.

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc3: gadget: move isoc endpoint check to unlocked set_halt

__dwc3_gadget_ep_set_halt() is the function which
handles the actual halt feature. In order to cope
with some extra cleanup comming as a follow-up patch
let's move the isochronous endpoint check there too.

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc3: gadget: hold the lock through set_wedge()'s life

Instead of releasing the lock and calling locked
versions of our set_halt() methods, let's hold
the lock all the way through and call unlocked
versions of those functions.

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc3: gadget: fix set_halt() bug with pending transfers

According to our Gadget Framework API documentation,
->set_halt() *must* return -EAGAIN if we have pending
transfers (on either direction) or FIFO isn't empty (on
TX endpoints).

Fix this bug so that the mass storage gadget can be used
without stall=0 parameter.

This patch should be backported to all kernels since v3.2.

Cc: <stable@vger.kernel.org> # v3.2+
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: uvc: conditionally dequeue

We shouldn't try to dequeue a NULL pointer.

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: uvc: make sure to balance ep enable/disable

If a set_alt() to the same alternate setting that's
already selected is received, functions are required
to reset the interface state, this means we must disable
all endpoints and reenable them again.

This is also documented on our kdoc for struct usb_function

* @set_alt: (REQUIRED) Reconfigures altsettings; function drivers may
*	initialize usb_ep.driver data at this time (when it is used).
*	Note that setting an interface to its current altsetting resets
*	interface state, and that all interfaces have a disabled state.

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: uvc: return correct alt-setting

If our alternate setting has been selected, we must
return that on a subsequent Get Interface request
even if we're not streaming.

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: acm: make f_acm pass USB20CV Chapter9

During Halt Endpoint Test, our interrupt endpoint
will be disabled, which will clear out ep->desc
to NULL. Unless we call config_ep_by_speed() again,
we will not be able to enable this endpoint which
will make us fail that test.

Fixes: f9c56cd (usb: gadget: Clear usb_endpoint_descriptor
	inside the struct usb_ep on disable)
Cc: <stable@vger.kernel.org> # v3.4+
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: uvc: manage our video control endpoint

just like any other endpoint, we must enable/disable
our video control endpoint based on calls to our
->set_alt() method.

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: uvc: disable endpoints on ->disable()

when our ->disable() method is called, we must
make sure to teardown all our resources, including
endpoints.

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: uac2: add wMaxPacketSize to ep desc

Endpoint descriptors should pass wMaxPacketSize. Note
that this also fixes USB20CV Other Speed Endpoint
Descriptor Tests.

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: uac2: prevent double ep disable

without this check, f_uac2 would try to disable
the same endpoint twice. Fix that.

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: uac2: add a release method

devices are required to provide a release method. This
patch fixes the following WARN():

[   42.611159] ------------[ cut here ]------------
[   42.616025] WARNING: CPU: 0 PID: 1453 at drivers/base/core.c:250 device_release+0x94/0xa0()
[   42.624820] Device 'snd_uac2.0' does not have a release() function, it is broken and must be fixed.
[   42.634328] Modules linked in: usb_f_uac2 g_audio(-) libcomposite configfs xhci_hcd snd_soc_davinci_mcasp snd_soc_edma snd_soc_tlv320aic3x snd_soc_omap snd_soc_evm snd_soc_core dwc3 snd_compress omapdrm snd_pcm_dmaengine snd_pcm snd_timer snd fb_sys_fops lis3lv02d_i2c matrix_keypad dwc3_omap lis3lv02d panel_dpi input_polldev soundcore
[   42.665687] CPU: 0 PID: 1453 Comm: modprobe Tainted: G      D        3.17.0-rc6-00448-g9f3d0ec-dirty #188
[   42.675756] [<c0017338>] (unwind_backtrace) from [<c0012fdc>] (show_stack+0x20/0x24)
[   42.683911] [<c0012fdc>] (show_stack) from [<c0647fbc>] (dump_stack+0x8c/0xa4)
[   42.691526] [<c0647fbc>] (dump_stack) from [<c0049950>] (warn_slowpath_common+0x7c/0xa0)
[   42.700004] [<c0049950>] (warn_slowpath_common) from [<c00499b4>] (warn_slowpath_fmt+0x40/0x48)
[   42.709194] [<c00499b4>] (warn_slowpath_fmt) from [<c0405f7c>] (device_release+0x94/0xa0)
[   42.717794] [<c0405f7c>] (device_release) from [<c032e8e8>] (kobject_cleanup+0x4c/0x7c)
[   42.726189] [<c032e8e8>] (kobject_cleanup) from [<c032e7c8>] (kobject_put+0x60/0x90)
[   42.734316] [<c032e7c8>] (kobject_put) from [<c0406320>] (put_device+0x24/0x28)
[   42.741995] [<c0406320>] (put_device) from [<c040c008>] (platform_device_unregister+0x2c/0x30)
[   42.751061] [<c040c008>] (platform_device_unregister) from [<bf2b6b70>] (afunc_unbind+0x2c/0x68 [usb_f_uac2])
[   42.761523] [<bf2b6b70>] (afunc_unbind [usb_f_uac2]) from [<bf29dbec>] (remove_config.isra.8+0xe8/0x100 [libcomposite])
[   42.772868] [<bf29dbec>] (remove_config.isra.8 [libcomposite]) from [<bf29f9a4>] (__composite_unbind+0x48/0xb0 [libcomposite])
[   42.784855] [<bf29f9a4>] (__composite_unbind [libcomposite]) from [<bf29fa28>] (composite_unbind+0x1c/0x20 [libcomposite])
[   42.796446] [<bf29fa28>] (composite_unbind [libcomposite]) from [<c04d229c>] (usb_gadget_remove_driver+0x78/0xb0)
[   42.807224] [<c04d229c>] (usb_gadget_remove_driver) from [<c04d2348>] (usb_gadget_unregister_driver+0x74/0xb8)
[   42.817742] [<c04d2348>] (usb_gadget_unregister_driver) from [<bf29db00>] (usb_composite_unregister+0x1c/0x20 [libcomposite])
[   42.829632] [<bf29db00>] (usb_composite_unregister [libcomposite]) from [<bf2b1084>] (audio_driver_exit+0x14/0x1c [g_audio])
[   42.841430] [<bf2b1084>] (audio_driver_exit [g_audio]) from [<c00c0fe0>] (SyS_delete_module+0x120/0x1b0)
[   42.851415] [<c00c0fe0>] (SyS_delete_module) from [<c000ed40>] (ret_fast_syscall+0x0/0x48)
[   42.860075] ---[ end trace bb22e678d8d6db7b ]---
root@saruman:~#

Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: function: f_obex: fix Interface Descriptor Test

On USB20CV's Interface Descriptor Test, a series
of SetInterface/GetInterface requests are issued
and gadget driver is required to always return
correct alternate setting.

In one step of the test, g_serial with f_obex
was returning the wrong value (1 instead of 0).

In order to fix this, we will now hold currently
selected alternate setting inside our struct f_obex
and just return that from our ->get_alt()
implementation.

Note that his also simplifies the code a bit.

Signed-off-by: Felipe Balbi <balbi@ti.com>