Merge tag 'usb-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB/Thunderbolt fixes from Greg KH:
 "Here is a big set of USB and Thunderbolt driver fixes for 7.3-rc6.
  They were delayed on my side due to conference travel, not the fault
  of the submitters at all. Included in here are:

   - lots of small thunderbolt fixes for reported issues due to more
     testing and devices and a few reverts as well based on that work

   - more usb-serial device ids added

   - usb-serial and cdc-acm driver hangup and other fixes

   - dwc3 driver fixes for reported problems

   - lots of usb gadget driver fixes as people again fuzz these drivers
     and send in fixes, which is nice to finally see

   - typec driver fixes for reported problems

   - octeon-hcd driver fixes for reported problems

   - more usb-storage quirks added

   - other small USB driver bugs resolved for reported problems

  All of these have been in linux-next without any reported issues"

* tag 'usb-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (63 commits)
  usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
  Revert "usb: dwc3: gadget: fix IRQ storm on invalid event buffer count"
  USB: gadget: dummy-hcd: Fix wait for outstanding request completions
  usb: typec: port-mapper: Only match USB4 port if host interface is available
  usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
  usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
  usb: typec: ucsi: Get the connector fwnode based on reg value
  usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
  usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
  USB: cdc-acm: skip URB restart in port_shutdown if disconnected
  usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
  usb: gadget: aspeed-vhub: cancel wake work on device removal
  thunderbolt: Disable CL states for the Anker Prime TB5 dock
  thunderbolt: stream: Announce support for FMODE_NOWAIT
  usb: typec: ucsi: displayport: Current CAM OOB index fixup
  usb: ohci-st: disable controller wakeup on removal
  usb: ohci-spear: disable controller wakeup on removal
  usb: ohci-s3c2410: disable controller wakeup on removal
  usb: ohci-da8xx: disable controller wakeup on cleanup
  usb: cdns3: fix use-after-free in cdns3_gadget_exit()
  ...

2 files changed, 22 insertions, 18 deletions

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 7bc5329fa..8ba4e4fa2 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -331,7 +331,6 @@ static void acm_process_notification(struct acm *acm, unsigned char *buf)
 
 		spin_lock_irqsave(&acm->read_lock, flags);
 		acm->ctrlin = newctrl;
-		acm->oldcount = acm->iocount;
 
 		if (difference & USB_CDC_SERIAL_STATE_DSR)
 			acm->iocount.dsr++;
@@ -788,6 +787,9 @@ static void acm_port_shutdown(struct tty_port *port)
 		usb_autopm_put_interface_async(acm->control);
 	}
 
+	if (acm->disconnected)
+		return;
+
 	acm_unpoison_urbs(acm);
 
 	if (acm->quirks & ALWAYS_POLL_CTRL) {
@@ -1027,11 +1029,16 @@ static int wait_serial_change(struct acm *acm, unsigned long arg)
 	DECLARE_WAITQUEUE(wait, current);
 	struct async_icount old, new;
 
-	do {
+	spin_lock_irq(&acm->read_lock);
+	old = acm->iocount;
+	spin_unlock_irq(&acm->read_lock);
+
+	add_wait_queue(&acm->wioctl, &wait);
+	for (;;) {
+		set_current_state(TASK_INTERRUPTIBLE);
+
 		spin_lock_irq(&acm->read_lock);
-		old = acm->oldcount;
 		new = acm->iocount;
-		acm->oldcount = new;
 		spin_unlock_irq(&acm->read_lock);
 
 		if ((arg & TIOCM_DSR) &&
@@ -1044,22 +1051,20 @@ static int wait_serial_change(struct acm *acm, unsigned long arg)
 			old.rng != new.rng)
 			break;
 
-		add_wait_queue(&acm->wioctl, &wait);
-		set_current_state(TASK_INTERRUPTIBLE);
-		schedule();
-		remove_wait_queue(&acm->wioctl, &wait);
 		if (acm->disconnected) {
-			if (arg & TIOCM_CD)
-				break;
-			else
-				rv = -ENODEV;
-		} else {
-			if (signal_pending(current))
-				rv = -ERESTARTSYS;
+			rv = -ENODEV;
+			break;
 		}
-	} while (!rv);
 
-	
+		schedule();
+
+		if (signal_pending(current)) {
+			rv = -ERESTARTSYS;
+			break;
+		}
+	}
+	__set_current_state(TASK_RUNNING);
+	remove_wait_queue(&acm->wioctl, &wait);
 
 	return rv;
 }
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index 01f448a78..d245e60eb 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -90,7 +90,6 @@ struct acm {
 	unsigned int ctrlin;				/* input control lines (DCD, DSR, RI, break, overruns) */
 	unsigned int ctrlout;				/* output control lines (DTR, RTS) */
 	struct async_icount iocount;			/* counters for control line changes */
-	struct async_icount oldcount;			/* for comparison of counter */
 	wait_queue_head_t wioctl;			/* for ioctl */
 	unsigned int writesize;				/* max packet size for the output bulk endpoint */
 	unsigned int readsize,ctrlsize;			/* buffer sizes for freeing */