Patch "USB: hub: fix up early-exit pathway in hub_activate" has been added to the 4.7-stable tree

Patch "USB: hub: fix up early-exit pathway in hub_activate" has been added to the 4.7-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    USB: hub: fix up early-exit pathway in hub_activate

to the 4.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From ca5cbc8b02f9b21cc8cd1ab36668763ec34f9ee8 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Fri, 5 Aug 2016 11:49:45 -0400
Subject: USB: hub: fix up early-exit pathway in hub_activate

From: Alan Stern <stern@rowland.harvard.edu>

commit ca5cbc8b02f9b21cc8cd1ab36668763ec34f9ee8 upstream.

The early-exit pathway in hub_activate, added by commit e50293ef9775
("USB: fix invalid memory access in hub_activate()") needs
improvement.  It duplicates code that is already present at the end of
the subroutine, and it neglects to undo the effect of a
usb_autopm_get_interface_no_resume() call.

This patch fixes both problems by making the early-exit pathway jump
directly to the end of the subroutine.  It simplifies the code at the
end by merging two conditionals that actually test the same condition
although they appear different: If type < HUB_INIT3 then type must be
either HUB_INIT2 or HUB_INIT, and it can't be HUB_INIT because in that
case the subroutine would have exited earlier.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/hub.c |   15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1055,11 +1055,8 @@ static void hub_activate(struct usb_hub
 		device_lock(hub->intfdev);
 
 		/* Was the hub disconnected while we were waiting? */
-		if (hub->disconnected) {
-			device_unlock(hub->intfdev);
-			kref_put(&hub->kref, hub_release);
-			return;
-		}
+		if (hub->disconnected)
+			goto disconnected;
 		if (type == HUB_INIT2)
 			goto init2;
 		goto init3;
@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub
 	/* Scan all ports that need attention */
 	kick_hub_wq(hub);
 
-	/* Allow autosuspend if it was suppressed */
-	if (type <= HUB_INIT3)
+	if (type == HUB_INIT2 || type == HUB_INIT3) {
+		/* Allow autosuspend if it was suppressed */
+ disconnected:
 		usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
-
-	if (type == HUB_INIT2 || type == HUB_INIT3)
 		device_unlock(hub->intfdev);
+	}
 
 	kref_put(&hub->kref, hub_release);
 }


Patches currently in stable-queue which might be from stern@rowland.harvard.edu are

queue-4.7/usb-ehci-change-order-of-register-cleanup-during-shutdown.patch
queue-4.7/usb-devio-do-not-warn-when-allocation-fails.patch
queue-4.7/usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch
queue-4.7/usb-hub-change-the-locking-in-hub_activate.patch
queue-4.7/usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch
queue-4.7/usb-serial-fix-memleak-in-driver-registration-error-path.patch
queue-4.7/usb-hub-fix-unbalanced-reference-count-memory-leak-deadlocks.patch
queue-4.7/usb-misc-usbtest-add-fix-for-driver-hang.patch