Merge tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB driver fixes for reported problems and
  regressions. Include in here are:

   - xhci driver fixes

   - cdns3 driver fixes

   - usb gadget driver fixes for syzbot found problems

   - typec driver fixes for broken hardware and other bugs found

   - kernel data leaks in mdc800 driver

   - usb storage driver fixes

   - other small USB driver fixes

  All of these have been in linux-next this week with no reported
  issues"

* tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
  usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
  usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
  usb: gadget: fix null pointer dereference in usb_put_function_instance()
  usb: typec: qcom-pmic: cancel reset_work on stop
  usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
  usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
  usb: storage: realtek_cr: fix use-after-free on disconnect
  usb: cdnsp: fix wakeup from S3 after controller context loss
  usb-storage: ene_ub6250: fix race between scan work and probe
  USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
  usb: gadget: f_midi: initialize work in f_midi_alloc()
  usb: gadget: f_midi2: fix use-after-free in string attribute show path
  usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
  usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
  usb: typec: hd3ss3220: track VBUS enable state per consumer
  usb: dwc3: clear forceRM when issuing EndTransfer
  usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES
  usb: typec: mux: avoid duplicated mux switches
  usb: typec: mux: Fix typec_switch_match()
  usb: image: mdc800: change kmalloc() to kzalloc()
  ...

2 files changed, 6 insertions, 5 deletions

diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index ed49a3bc8..895f90c7a 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -2357,7 +2357,9 @@ static int ene_ub6250_probe(struct usb_interface *intf,
 		return result;
 
 	/* probe card type */
+	mutex_lock(&us->dev_mutex);
 	result = ene_get_card_type(us, REG_CARD_STATUS, info->bbuf);
+	mutex_unlock(&us->dev_mutex);
 	if (result != USB_STOR_XFER_GOOD) {
 		usb_stor_disconnect(intf);
 		return USB_STOR_TRANSPORT_ERROR;
diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index af038b897..c4b287446 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -916,7 +916,6 @@ static int realtek_cr_autosuspend_setup(struct us_data *us)
 	us->proto_handler = rts51x_invoke_transport;
 
 	chip->timer_expires = 0;
-	timer_setup(&chip->rts51x_suspend_timer, rts51x_suspend_timer_fn, 0);
 	fw5895_init(us);
 
 	/* enable autosuspend function of the usb device */
@@ -934,10 +933,7 @@ static void realtek_cr_destructor(void *extra)
 		return;
 
 #ifdef CONFIG_REALTEK_AUTOPM
-	if (ss_en) {
-		timer_delete(&chip->rts51x_suspend_timer);
-		chip->timer_expires = 0;
-	}
+	timer_shutdown_sync(&chip->rts51x_suspend_timer);
 #endif
 	kfree(chip->status);
 }
@@ -982,6 +978,9 @@ static int init_realtek_cr(struct us_data *us)
 
 	us->extra = chip;
 	us->extra_destructor = realtek_cr_destructor;
+#ifdef CONFIG_REALTEK_AUTOPM
+	timer_setup(&chip->rts51x_suspend_timer, rts51x_suspend_timer_fn, 0);
+#endif
 	us->max_lun = chip->max_lun = rts51x_get_max_lun(us);
 	chip->us = us;