Merge tag 'usb-5.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some tiny USB fixes for a number of reported issues for
  5.2-rc3.

  Nothing huge here, just a small collection of xhci and other driver
  bugs that syzbot has been finding in some drivers. There is also a
  usbip fix and a fix for the usbip fix in here :)

  All have been in linux-next with no reported issues"

* tag 'usb-5.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usbip: usbip_host: fix stub_dev lock context imbalance regression
  media: smsusb: better handle optional alignment
  xhci: Use %zu for printing size_t type
  xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()
  xhci: Fix immediate data transfer if buffer is already DMA mapped
  usb: xhci: avoid null pointer deref when bos field is NULL
  usb: xhci: Fix a potential null pointer dereference in xhci_debugfs_create_endpoint()
  xhci: update bounce buffer with correct sg num
  media: usb: siano: Fix false-positive "uninitialized variable" warning
  USB: rio500: update Documentation
  USB: rio500: simplify locking
  USB: rio500: fix memory leak in close after disconnect
  USB: rio500: refuse more than one device at a time
  usbip: usbip_host: fix BUG: sleeping function called from invalid context
  USB: sisusbvga: fix oops in error path of sisusb_probe
  USB: Add LPM quirk for Surface Dock GigE adapter
  media: usb: siano: Fix general protection fault in smsusb
  usb: mtu3: fix up undefined reference to usb_debug_root
  USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor

diff --combined drivers/media/usb/siano/smsusb.c
index e13d77bfc2223bfe1d0c1c44f238e32d14bdb1c4,e39f3f40dfdd7776480e8379178f71e7f4fbe18f..9ba3a2ae36e54f09f2b6593e3807877a10ab93c1
--- 1/drivers/media/usb/siano/smsusb.c
--- 2/drivers/media/usb/siano/smsusb.c
+++ b/drivers/media/usb/siano/smsusb.c
@@@ -1,10 -1,21 +1,10 @@@
 +// SPDX-License-Identifier: GPL-2.0-or-later
  /****************************************************************
  
  Siano Mobile Silicon, Inc.
  MDTV receiver kernel modules.
  Copyright (C) 2005-2009, Uri Shkolnik, Anatoly Greenblat
  
 -This program is free software: you can redistribute it and/or modify
 -it under the terms of the GNU General Public License as published by
 -the Free Software Foundation, either version 2 of the License, or
 -(at your option) any later version.
 -
 - This program is distributed in the hope that it will be useful,
 -but WITHOUT ANY WARRANTY; without even the implied warranty of
 -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 -GNU General Public License for more details.
 -
 -You should have received a copy of the GNU General Public License
 -along with this program.  If not, see <http://www.gnu.org/licenses/>.
  
  ****************************************************************/
  
@@@ -389,6 -400,7 +389,7 @@@ static int smsusb_init_device(struct us
        struct smsusb_device_t *dev;
        void *mdev;
        int i, rc;
+       int align = 0;
  
        /* create device object */
        dev = kzalloc(sizeof(struct smsusb_device_t), GFP_KERNEL);
@@@ -400,6 -412,24 +401,24 @@@
        dev->udev = interface_to_usbdev(intf);
        dev->state = SMSUSB_DISCONNECTED;
  
+       for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
+               struct usb_endpoint_descriptor *desc =
+                               &intf->cur_altsetting->endpoint[i].desc;
+ 
+               if (desc->bEndpointAddress & USB_DIR_IN) {
+                       dev->in_ep = desc->bEndpointAddress;
+                       align = usb_endpoint_maxp(desc) - sizeof(struct sms_msg_hdr);
+               } else {
+                       dev->out_ep = desc->bEndpointAddress;
+               }
+       }
+ 
+       pr_debug("in_ep = %02x, out_ep = %02x\n", dev->in_ep, dev->out_ep);
+       if (!dev->in_ep || !dev->out_ep || align < 0) {  /* Missing endpoints? */
+               smsusb_term_device(intf);
+               return -ENODEV;
+       }
+ 
        params.device_type = sms_get_board(board_id)->type;
  
        switch (params.device_type) {
@@@ -414,24 -444,12 +433,12 @@@
                /* fall-thru */
        default:
                dev->buffer_size = USB2_BUFFER_SIZE;
-               dev->response_alignment =
-                   le16_to_cpu(dev->udev->ep_in[1]->desc.wMaxPacketSize) -
-                   sizeof(struct sms_msg_hdr);
+               dev->response_alignment = align;
  
                params.flags |= SMS_DEVICE_FAMILY2;
                break;
        }
  
-       for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
-               if (intf->cur_altsetting->endpoint[i].desc. bEndpointAddress & USB_DIR_IN)
-                       dev->in_ep = intf->cur_altsetting->endpoint[i].desc.bEndpointAddress;
-               else
-                       dev->out_ep = intf->cur_altsetting->endpoint[i].desc.bEndpointAddress;
-       }
- 
-       pr_debug("in_ep = %02x, out_ep = %02x\n",
-               dev->in_ep, dev->out_ep);
- 
        params.device = &dev->udev->dev;
        params.usb_device = dev->udev;
        params.buffer_size = dev->buffer_size;