Revision tags: v6.6.25, v6.6.24, v6.6.23, v6.6.16, v6.6.15, v6.6.14, v6.6.13, v6.6.12, v6.6.11, v6.6.10, v6.6.9, v6.6.8, v6.6.7, v6.6.6, v6.6.5, v6.6.4, v6.6.3, v6.6.2, v6.5.11, v6.6.1, v6.5.10, v6.6, v6.5.9, v6.5.8, v6.5.7, v6.5.6, v6.5.5, v6.5.4, v6.5.3, v6.5.2, v6.1.51, v6.5.1, v6.1.50, v6.5, v6.1.49, v6.1.48, v6.1.46, v6.1.45, v6.1.44, v6.1.43, v6.1.42, v6.1.41, v6.1.40, v6.1.39, v6.1.38, v6.1.37, v6.1.36, v6.4, v6.1.35, v6.1.34, v6.1.33, v6.1.32, v6.1.31, v6.1.30, v6.1.29, v6.1.28, v6.1.27, v6.1.26, v6.3, v6.1.25, v6.1.24, v6.1.23, v6.1.22, v6.1.21, v6.1.20, v6.1.19, v6.1.18, v6.1.17, v6.1.16, v6.1.15, v6.1.14, v6.1.13, v6.2, v6.1.12, v6.1.11, v6.1.10 |
|
#
30d09b31 |
| 01-Feb-2023 |
Aaro Koskinen <aaro.koskinen@iki.fi> |
usb: gadget: udc: do not clear gadget driver.bus
Before the commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget driver.bus was unused. For whatever reason, many UDC drivers set thi
usb: gadget: udc: do not clear gadget driver.bus
Before the commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget driver.bus was unused. For whatever reason, many UDC drivers set this field explicitly to NULL in udc_start(). With the newly added gadget bus, doing this will crash the driver during the attach.
The problem was first reported, fixed and tested with OMAP UDC and g_ether. Other drivers are changed based on code analysis only.
Fixes: fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") Cc: stable <stable@kernel.org> Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi> Acked-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/20230201220125.GD2415@darkstar.musicnaut.iki.fi Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
Revision tags: v6.1.9, v6.1.8, v6.1.7, v6.1.6, v6.1.5, v6.0.19, v6.0.18, v6.1.4, v6.1.3, v6.0.17, v6.1.2, v6.0.16, v6.1.1, v6.0.15, v6.0.14, v6.0.13, v6.1, v6.0.12, v6.0.11, v6.0.10, v5.15.80, v6.0.9, v5.15.79, v6.0.8, v5.15.78, v6.0.7, v5.15.77, v5.15.76, v6.0.6, v6.0.5, v5.15.75, v6.0.4, v6.0.3, v6.0.2, v5.15.74, v5.15.73, v6.0.1, v5.15.72, v6.0, v5.15.71, v5.15.70, v5.15.69, v5.15.68, v5.15.67, v5.15.66, v5.15.65, v5.15.64, v5.15.63, v5.15.62, v5.15.61, v5.15.60, v5.15.59, v5.19, v5.15.58, v5.15.57, v5.15.56, v5.15.55, v5.15.54, v5.15.53, v5.15.52, v5.15.51, v5.15.50, v5.15.49, v5.15.48, v5.15.47, v5.15.46, v5.15.45, v5.15.44, v5.15.43, v5.15.42, v5.18, v5.15.41, v5.15.40, v5.15.39, v5.15.38, v5.15.37, v5.15.36, v5.15.35, v5.15.34, v5.15.33 |
|
#
67ec2c75 |
| 07-Apr-2022 |
Guo Zhengkui <guozhengkui@vivo.com> |
usb: gadget: net2280: use swap() instead of open coding it
Address the following coccicheck warning: drivers/usb/gadget/udc/net2280.c:940:20-21: WARNING opportunity for swap(). drivers/usb/gadget/ud
usb: gadget: net2280: use swap() instead of open coding it
Address the following coccicheck warning: drivers/usb/gadget/udc/net2280.c:940:20-21: WARNING opportunity for swap(). drivers/usb/gadget/udc/net2280.c:944:25-26: WARNING opportunity for swap().
by using swap() for the swapping of variable values and drop the tmp variables (`tmp` and `end`) that are not needed any more.
Signed-off-by: Guo Zhengkui <guozhengkui@vivo.com> Link: https://lore.kernel.org/r/20220407100459.3605-1-guozhengkui@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
Revision tags: v5.15.32, v5.15.31, v5.17, v5.15.30, v5.15.29, v5.15.28, v5.15.27 |
|
#
b6f8cc55 |
| 08-Mar-2022 |
Jakob Koschel <jakobkoschel@gmail.com> |
usb: gadget: udc: net2280: remove usage of list iterator past the loop body
If the list representing the request queue does not contain the expected request, the value of the list_for_each_entry() i
usb: gadget: udc: net2280: remove usage of list iterator past the loop body
If the list representing the request queue does not contain the expected request, the value of the list_for_each_entry() iterator will not point to a valid structure. To avoid type confusion in such case, the list iterator scope will be limited to the list_for_each_entry() loop.
In preparation to limiting scope of the list iterator to the list traversal loop, use a dedicated pointer to point to the found request object [1].
Link: https://lore.kernel.org/all/YhdfEIwI4EdtHdym@kroah.com/ Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com> Link: https://lore.kernel.org/r/20220308171818.384491-13-jakobkoschel@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
Revision tags: v5.15.26, v5.15.25, v5.15.24, v5.15.23, v5.15.22, v5.15.21, v5.15.20, v5.15.19, v5.15.18, v5.15.17, v5.4.173, v5.15.16, v5.15.15, v5.16, v5.15.10, v5.15.9, v5.15.8, v5.15.7, v5.15.6, v5.15.5, v5.15.4, v5.15.3, v5.15.2, v5.15.1, v5.15, v5.14.14, v5.14.13, v5.14.12, v5.14.11, v5.14.10, v5.14.9, v5.14.8, v5.14.7, v5.14.6, v5.10.67, v5.10.66, v5.14.5, v5.14.4, v5.10.65, v5.14.3, v5.10.64, v5.14.2, v5.10.63, v5.14.1, v5.10.62, v5.14, v5.10.61, v5.10.60, v5.10.53, v5.10.52, v5.10.51, v5.10.50, v5.10.49, v5.13, v5.10.46 |
|
#
73f3d945 |
| 17-Jun-2021 |
Colin Ian King <colin.king@canonical.com> |
USB: UDC: net2280: remove redundant continue statement
The continue statement at the end of a for-loop has no effect, remove it.
Signed-off-by: Colin Ian King <colin.king@canonical.com> Addresses-C
USB: UDC: net2280: remove redundant continue statement
The continue statement at the end of a for-loop has no effect, remove it.
Signed-off-by: Colin Ian King <colin.king@canonical.com> Addresses-Coverity: ("Continue has no effect") Link: https://lore.kernel.org/r/20210617112638.9072-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
Revision tags: v5.10.43, v5.10.42, v5.10.41, v5.10.40, v5.10.39 |
|
#
b42e8090 |
| 20-May-2021 |
Alan Stern <stern@rowland.harvard.edu> |
USB: UDC: Implement udc_async_callbacks in net2280
This patch adds a udc_async_callbacks handler to the net2280 UDC driver, which will prevent a theoretical race during gadget unbinding.
The net228
USB: UDC: Implement udc_async_callbacks in net2280
This patch adds a udc_async_callbacks handler to the net2280 UDC driver, which will prevent a theoretical race during gadget unbinding.
The net2280 driver is sufficiently complicated that I didn't want to mess around with IRQ settings. Instead, the patch simply adds a new flag to control async callbacks, and checks the flag before issuing any of them.
Acked-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/20210520202200.GE1216852@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
Revision tags: v5.4.119, v5.10.36, v5.10.35, v5.10.34, v5.4.116, v5.10.33, v5.12, v5.10.32, v5.10.31, v5.10.30, v5.10.27, v5.10.26, v5.10.25, v5.10.24, v5.10.23, v5.10.22, v5.10.21, v5.10.20, v5.10.19, v5.4.101, v5.10.18, v5.10.17, v5.11, v5.10.16, v5.10.15, v5.10.14, v5.10, v5.8.17, v5.8.16, v5.8.15, v5.9, v5.8.14, v5.8.13, v5.8.12, v5.8.11, v5.8.10, v5.8.9, v5.8.8, v5.8.7, v5.8.6, v5.4.62, v5.8.5, v5.8.4, v5.4.61, v5.8.3, v5.4.60 |
|
#
f770fbec |
| 20-Aug-2020 |
Alan Stern <stern@rowland.harvard.edu> |
USB: UDC: net2280: Fix memory leaks
As Anton and Evgeny have noted, the net2280 UDC driver has a problem with leaking memory along some of its failure pathways. It also has another problem, not pre
USB: UDC: net2280: Fix memory leaks
As Anton and Evgeny have noted, the net2280 UDC driver has a problem with leaking memory along some of its failure pathways. It also has another problem, not previously noted, in that some of the failure pathways will call usb_del_gadget_udc() without first calling usb_add_gadget_udc_release(). And it leaks memory by calling kfree() when it should call put_device().
Previous attempts to fix the problems have failed because of lack of support in the UDC core for separately initializing and adding gadgets, or for separately deleting and freeing gadgets. The previous patch in this series adds the necessary support, making it possible to fix the outstanding problems properly.
This patch adds an "added" flag to the net2280 structure to indicate whether or not the gadget has been registered (and thus whether or not to call usb_del_gadget()), and it fixes the deallocation issues by calling usb_put_gadget() at the appropriate point.
A similar memory leak issue, apparently never before recognized, stems from the fact that the driver never initializes the drvdata field in the gadget's embedded struct device! Evidently this wasn't noticed because the pointer is only ever used as an argument to kfree(), which doesn't mind getting called with a NULL pointer. In fact, the drvdata for gadget device will be written by usb_composite_dev structure if any gadget class is loaded, so it needs to use usb_gadget structure to get net2280 private data.
CC: Benjamin Herrenschmidt <benh@kernel.crashing.org> Reported-by: Anton Vasilyev <vasilyev@ispras.ru> Reported-by: Evgeny Novikov <novikov@ispras.ru> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
show more ...
|
#
805ca9c2 |
| 21-Sep-2020 |
Chunfeng Yun <chunfeng.yun@mediatek.com> |
usb: udc: net2280: convert to readl_poll_timeout_atomic()
Use readl_poll_timeout_atomic() to simplify code
Cc: Alan Stern <stern@rowland.harvard.edu> Cc: Felipe Balbi <balbi@kernel.org> Acked-by: A
usb: udc: net2280: convert to readl_poll_timeout_atomic()
Use readl_poll_timeout_atomic() to simplify code
Cc: Alan Stern <stern@rowland.harvard.edu> Cc: Felipe Balbi <balbi@kernel.org> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Link: https://lore.kernel.org/r/1600668815-12135-10-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
Revision tags: v5.8.2, v5.4.59, v5.8.1, v5.4.58, v5.4.57, v5.4.56, v5.8, v5.7.12, v5.4.55, v5.7.11, v5.4.54, v5.7.10, v5.4.53 |
|
#
2468c877 |
| 21-Jul-2020 |
Evgeny Novikov <novikov@ispras.ru> |
usb: gadget: net2280: fix memory leak on probe error handling paths
Driver does not release memory for device on error handling paths in net2280_probe() when gadget_release() is not registered yet.
usb: gadget: net2280: fix memory leak on probe error handling paths
Driver does not release memory for device on error handling paths in net2280_probe() when gadget_release() is not registered yet.
The patch fixes the bug like in other similar drivers.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru> Signed-off-by: Felipe Balbi <balbi@kernel.org>
show more ...
|
Revision tags: v5.4.52, v5.7.9, v5.7.8, v5.4.51, v5.4.50, v5.7.7, v5.4.49, v5.7.6, v5.7.5, v5.4.48, v5.7.4, v5.7.3, v5.4.47, v5.4.46, v5.7.2, v5.4.45, v5.7.1, v5.4.44, v5.7, v5.4.43, v5.4.42, v5.4.41, v5.4.40, v5.4.39, v5.4.38, v5.4.37, v5.4.36, v5.4.35, v5.4.34, v5.4.33, v5.4.32, v5.4.31, v5.4.30, v5.4.29, v5.6, v5.4.28, v5.4.27, v5.4.26, v5.4.25, v5.4.24, v5.4.23, v5.4.22 |
|
#
c06a1c37 |
| 20-Feb-2020 |
Kees Cook <keescook@chromium.org> |
usb: gadget: net2280: Distribute switch variables for initialization
Variables declared in a switch statement before any case statements cannot be automatically initialized with compiler instrumenta
usb: gadget: net2280: Distribute switch variables for initialization
Variables declared in a switch statement before any case statements cannot be automatically initialized with compiler instrumentation (as they are not part of any execution flow). With GCC's proposed automatic stack variable initialization feature, this triggers a warning (and they don't get initialized). Clang's automatic stack variable initialization (via CONFIG_INIT_STACK_ALL=y) doesn't throw a warning, but it also doesn't initialize such variables[1]. Note that these warnings (or silent skipping) happen before the dead-store elimination optimization phase, so even when the automatic initializations are later elided in favor of direct initializations, the warnings remain.
To avoid these problems, move such variables into the "case" where they're used or lift them up into the main function body.
drivers/usb/gadget/udc/net2280.c: In function ‘handle_stat0_irqs_superspeed’: drivers/usb/gadget/udc/net2280.c:2871:22: warning: statement will never be executed [-Wswitch-unreachable] 2871 | struct net2280_ep *e; | ^
[1] https://bugs.llvm.org/show_bug.cgi?id=44916
Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/202002201515.DFC51CF@keescook Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
Revision tags: v5.4.21 |
|
#
8d57a84a |
| 18-Feb-2020 |
Corentin Labbe <clabbe@baylibre.com> |
usb: gadget: net2280: remove useless cast for driver.name
device_driver name is const char pointer, so it not useful to cast driver_name (which is already const char).
Signed-off-by: Corentin Labbe
usb: gadget: net2280: remove useless cast for driver.name
device_driver name is const char pointer, so it not useful to cast driver_name (which is already const char).
Signed-off-by: Corentin Labbe <clabbe@baylibre.com> Link: https://lore.kernel.org/r/1582054383-35760-12-git-send-email-clabbe@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
Revision tags: v5.4.20, v5.4.19, v5.4.18, v5.4.17, v5.4.16, v5.5, v5.4.15, v5.4.14, v5.4.13, v5.4.12, v5.4.11, v5.4.10, v5.4.9 |
|
#
4bdc0d67 |
| 06-Jan-2020 |
Christoph Hellwig <hch@lst.de> |
remove ioremap_nocache and devm_ioremap_nocache
ioremap has provided non-cached semantics by default since the Linux 2.6 days, so remove the additional ioremap_nocache interface.
Signed-off-by: Chr
remove ioremap_nocache and devm_ioremap_nocache
ioremap has provided non-cached semantics by default since the Linux 2.6 days, so remove the additional ioremap_nocache interface.
Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Arnd Bergmann <arnd@arndb.de>
show more ...
|
Revision tags: v5.4.8, v5.4.7, v5.4.6, v5.4.5, v5.4.4, v5.4.3, v5.3.15, v5.4.2, v5.4.1, v5.3.14, v5.4, v5.3.13, v5.3.12, v5.3.11, v5.3.10, v5.3.9, v5.3.8, v5.3.7, v5.3.6, v5.3.5, v5.3.4, v5.3.3, v5.3.2, v5.3.1, v5.3, v5.2.14, v5.3-rc8, v5.2.13, v5.2.12 |
|
#
18a93cd3 |
| 29-Aug-2019 |
Benjamin Herrenschmidt <benh@kernel.crashing.org> |
usb: gadget: net2280: Add workaround for AB chip Errata 11
The errata description is:
Workaround for Default Duration of LFPS Handshake Signaling for Device-Initiated U1 Exit is too short.
The def
usb: gadget: net2280: Add workaround for AB chip Errata 11
The errata description is:
Workaround for Default Duration of LFPS Handshake Signaling for Device-Initiated U1 Exit is too short.
The default duration of the LFPS handshake generated by USB3380 for a device-initiated U1-exit may not be long enough for certain SuperSpeed downstream ports (SuperSpeed hubs/hosts) to recognize. This could lead to USB3380 entering the recovery state pre-maturely and ending up in the SS.Inactive state.
I have observed various enumeration failures, seemingly related to lost transactions or SETUP status phases on modern hosts (typically thunderbolt capable systems) without this workaround.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|
#
ec8ca8a3 |
| 29-Aug-2019 |
Benjamin Herrenschmidt <benh@kernel.crashing.org> |
usb: gadget: net2280: Move all "ll" registers in one structure
The split into multiple structures of the "ll" register bank is impractical. It makes it hard to add ll_lfps_timers_2 which is at offse
usb: gadget: net2280: Move all "ll" registers in one structure
The split into multiple structures of the "ll" register bank is impractical. It makes it hard to add ll_lfps_timers_2 which is at offset 0x794, which is outside of the existing "lfps" structure and would require us to add yet another one.
Instead, move all the "ll" registers into a single usb338x_ll_regs structure, and add ll_lfps_timers_2 while at it. It will be used in a subsequent patch.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|
Revision tags: v5.2.11, v5.2.10, v5.2.9, v5.2.8, v5.2.7, v5.2.6, v5.2.5, v5.2.4, v5.2.3, v5.2.2, v5.2.1, v5.2, v5.1.16, v5.1.15, v5.1.14, v5.1.13, v5.1.12, v5.1.11, v5.1.10, v5.1.9, v5.1.8, v5.1.7, v5.1.6, v5.1.5, v5.1.4, v5.1.3, v5.1.2, v5.1.1, v5.0.14, v5.1, v5.0.13, v5.0.12, v5.0.11, v5.0.10, v5.0.9, v5.0.8 |
|
#
de497f63 |
| 15-Apr-2019 |
Alan Stern <stern@rowland.harvard.edu> |
USB: UDC: net22{80,72}: remove mistaken test of req->zero
The net2280 UDC driver (and also net2272, probably via copy-and-paste) incorrectly checks the req->zero flag during OUT transfers, after cop
USB: UDC: net22{80,72}: remove mistaken test of req->zero
The net2280 UDC driver (and also net2272, probably via copy-and-paste) incorrectly checks the req->zero flag during OUT transfers, after copying data from the UDC's FIFO into memory. This makes no sense at all; the "zero" flag indicates that an extra zero-length packet should be appended to an IN transfer if the length is an even multiple of the maxpacket size. It has nothing to do with OUT transfers.
In practice this doesn't cause any problems because gadget drivers never set req->zero for OUT transfers anyway. Still, it is an error and unnecessary code, so this patch removes the check.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|
#
6574abe6 |
| 15-Apr-2019 |
Alan Stern <stern@rowland.harvard.edu> |
USB: UDC: net2280: Remove redundant "if" condition
The net2280 driver includes an unnecessary test for an endpoint's queue being empty. The test is redundant; it sits inside a conditional block of
USB: UDC: net2280: Remove redundant "if" condition
The net2280 driver includes an unnecessary test for an endpoint's queue being empty. The test is redundant; it sits inside a conditional block of an "if" statement which already tests the endpoint's queue.
This patch removes the redundant test.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|
Revision tags: v5.0.7, v5.0.6, v5.0.5, v5.0.4, v5.0.3 |
|
#
f1d3fba1 |
| 18-Mar-2019 |
Guido Kiener <guido@kiener-muenchen.de> |
usb: gadget: net2280: Fix net2280_dequeue()
When a request must be dequeued with net2280_dequeue() e.g. due to a device clear action and the same request is finished by the function scan_dma_complet
usb: gadget: net2280: Fix net2280_dequeue()
When a request must be dequeued with net2280_dequeue() e.g. due to a device clear action and the same request is finished by the function scan_dma_completions() then the function net2280_dequeue() does not find the request in the following search loop and returns the error -EINVAL without restoring the status ep->stopped. Thus the endpoint keeps blocked and does not receive any data anymore. This fix restores the status and does not issue an error message.
Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|
#
9d6a54c1 |
| 19-Mar-2019 |
Guido Kiener <guido@kiener-muenchen.de> |
usb: gadget: net2280: Fix overrun of OUT messages
The OUT endpoint normally blocks (NAK) subsequent packets when a short packet was received and returns an incomplete queue entry to the gadget drive
usb: gadget: net2280: Fix overrun of OUT messages
The OUT endpoint normally blocks (NAK) subsequent packets when a short packet was received and returns an incomplete queue entry to the gadget driver. Thereby the gadget driver can detect a short packet when reading queue entries with a length that is not equal to a multiple of packet size.
The start_queue() function enables receiving OUT packets regardless of the content of the OUT FIFO. This results in a race: With the current code, it's possible that the "!ep->is_in && (readl(&ep->regs->ep_stat) & BIT(NAK_OUT_PACKETS))" test in start_dma() will fail, then a short packet will be received, and then start_queue() will call stop_out_naking(). That's what we don't want (OUT naking gets turned off while there is data in the FIFO) because then the next driver request might receive a mixture of old and new packets.
With the patch, this race can't occur because the FIFO's state is tested after we know that OUT naking is already turned on, and OUT naking is stopped only when both of the conditions are met. This ensures that all received data is delivered to the gadget driver, which can detect a short packet now before new packets are appended to the last short packet.
Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|
Revision tags: v4.19.29, v5.0.2, v4.19.28, v5.0.1, v4.19.27, v5.0, v4.19.26, v4.19.25, v4.19.24, v4.19.23, v4.19.22, v4.19.21, v4.19.20, v4.19.19, v4.19.18, v4.19.17 |
|
#
1ff767bf |
| 22-Jan-2019 |
Colin Ian King <colin.king@canonical.com> |
usb: gadget: fix various indentation issues
There are a bunch of various indentation issues, clean these up.
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Felipe Balbi <fe
usb: gadget: fix various indentation issues
There are a bunch of various indentation issues, clean these up.
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|
#
836bcab5 |
| 04-Feb-2019 |
Guido Kiener <guido.kiener@rohde-schwarz.com> |
udc: net2280: Fix net2280_disable
A reset e.g. calling ep_reset_338x() can happen while endpoints are enabled. The ep_reset_338x() sets ep->desc = NULL to mark endpoint being invalid. A subsequent c
udc: net2280: Fix net2280_disable
A reset e.g. calling ep_reset_338x() can happen while endpoints are enabled. The ep_reset_338x() sets ep->desc = NULL to mark endpoint being invalid. A subsequent call of net2280_disable will fail and return -EINVAL to parent function usb_ep_disable(), which will fail, too, and do not set the member ep->enabled = false.
See: https://elixir.bootlin.com/linux/v5.0-rc5/source/drivers/usb/gadget/udc/core.c#L139
This fix ignores dp->desc and allows net2280_disable() to succeed. Subsequent calls to usb_ep_enable()/usb_ep_disable() succeeds.
Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|
Revision tags: v4.19.16, v4.19.15, v4.19.14, v4.19.13, v4.19.12, v4.19.11, v4.19.10, v4.19.9, v4.19.8, v4.19.7, v4.19.6, v4.19.5, v4.19.4, v4.18.20, v4.19.3, v4.18.19, v4.19.2, v4.18.18, v4.18.17, v4.19.1, v4.19, v4.18.16, v4.18.15, v4.18.14, v4.18.13, v4.18.12 |
|
#
3b766f45 |
| 02-Oct-2018 |
Alan Stern <stern@rowland.harvard.edu> |
USB: net2280: Remove ->disconnect() callback from net2280_pullup()
The net2280 UDC driver invokes the gadget driver's ->disconnect() callback routine when the net2280_pullup() routine turns off the
USB: net2280: Remove ->disconnect() callback from net2280_pullup()
The net2280 UDC driver invokes the gadget driver's ->disconnect() callback routine when the net2280_pullup() routine turns off the D+ pullup. This is now unnecessary, because the gadget core performs the callback on our behalf. This patch removes the unneeded callback.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|
Revision tags: v4.18.11, v4.18.10, v4.18.9, v4.18.7, v4.18.6, v4.18.5, v4.17.18, v4.18.4, v4.18.3, v4.17.17, v4.18.2, v4.17.16, v4.17.15, v4.18.1, v4.18, v4.17.14 |
|
#
dec3c23c |
| 08-Aug-2018 |
Alan Stern <stern@rowland.harvard.edu> |
USB: net2280: Fix erroneous synchronization change
Commit f16443a034c7 ("USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks") was based on a serious misunderstanding. It introduced regres
USB: net2280: Fix erroneous synchronization change
Commit f16443a034c7 ("USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks") was based on a serious misunderstanding. It introduced regressions into both the dummy-hcd and net2280 drivers.
The problem in dummy-hcd was fixed by commit 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"), but the problem in net2280 remains. Namely: the ->disconnect(), ->suspend(), ->resume(), and ->reset() callbacks must be invoked without the private lock held; otherwise a deadlock will occur when the callback routine tries to interact with the UDC driver.
This patch largely is a reversion of the relevant parts of f16443a034c7. It also drops the private lock around the calls to ->suspend() and ->resume() (something the earlier patch forgot to do). This is safe from races with device interrupts because it occurs within the interrupt handler.
Finally, the patch changes where the ->disconnect() callback is invoked when net2280_pullup() turns the pullup off. Rather than making the callback from within stop_activity() at a time when dropping the private lock could be unsafe, the callback is moved to a point after the lock has already been dropped.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Fixes: f16443a034c7 ("USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks") Reported-by: D. Ziesche <dziesche@zes.com> Tested-by: D. Ziesche <dziesche@zes.com> CC: <stable@vger.kernel.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|
Revision tags: v4.17.13, v4.17.12, v4.17.11, v4.17.10, v4.17.9, v4.17.8, v4.17.7, v4.17.6, v4.17.5, v4.17.4, v4.17.3, v4.17.2, v4.17.1, v4.17, v4.16, v4.15, v4.13.16, v4.14 |
|
#
229e3682 |
| 06-Nov-2017 |
Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
USB: gadget: udc: Remove redundant license text
Now that the SPDX tag is in all USB files, that identifies the license in a specific and legally-defined manner. So the extra GPL text wording can be
USB: gadget: udc: Remove redundant license text
Now that the SPDX tag is in all USB files, that identifies the license in a specific and legally-defined manner. So the extra GPL text wording can be removed as it is no longer needed at all.
This is done on a quest to remove the 700+ different ways that files in the kernel describe the GPL license text. And there's unneeded stuff like the address (sometimes incorrect) for the FSF which is never needed.
No copyright headers or other non-license-description text was removed.
Cc: Kevin Cernekee <cernekee@gmail.com> Cc: Florian Fainelli <f.fainelli@gmail.com> Cc: Vladimir Zapolskiy <vz@mleia.com> Cc: Sylvain Lemieux <slemieux.tyco@gmail.com> Cc: Daniel Mack <daniel@zonque.org> Cc: Haojian Zhuang <haojian.zhuang@gmail.com> Cc: Michal Simek <michal.simek@xilinx.com> Cc: "Sören Brinkmann" <soren.brinkmann@xilinx.com> Cc: Raviteja Garimella <raviteja.garimella@broadcom.com> Cc: Romain Perier <romain.perier@collabora.com> Cc: Johan Hovold <johan@kernel.org> Cc: Al Cooper <alcooperx@gmail.com> Cc: Srinath Mannam <srinath.mannam@broadcom.com> Cc: Roger Quadros <rogerq@ti.com> Cc: Krzysztof Opasiak <k.opasiak@samsung.com> Cc: Stefan Agner <stefan@agner.ch> Cc: Alan Stern <stern@rowland.harvard.edu> Cc: "Felix Hädicke" <felixhaedicke@web.de> Cc: Peter Chen <peter.chen@nxp.com> Cc: Allen Pais <allen.lkml@gmail.com> Cc: Yuyang Du <yuyang.du@intel.com> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com> Acked-by: Robert Jarzmik <robert.jarzmik@free.fr> Acked-by: Li Yang <leoyang.li@nxp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
#
5fd54ace |
| 03-Nov-2017 |
Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
USB: add SPDX identifiers to all remaining files in drivers/usb/
It's good to have SPDX identifiers in all files to make it easier to audit the kernel tree for correct licenses.
Update the drivers/
USB: add SPDX identifiers to all remaining files in drivers/usb/
It's good to have SPDX identifiers in all files to make it easier to audit the kernel tree for correct licenses.
Update the drivers/usb/ and include/linux/usb* files with the correct SPDX license identifier based on the license text in the file itself. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text.
This work is based on a script and data from Thomas Gleixner, Philippe Ombredanne, and Kate Stewart.
Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Kate Stewart <kstewart@linuxfoundation.org> Cc: Philippe Ombredanne <pombredanne@nexb.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Acked-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
Revision tags: v4.13.5, v4.13, v4.12 |
|
#
f16443a0 |
| 13-Jun-2017 |
Alan Stern <stern@rowland.harvard.edu> |
USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks
Using the syzkaller kernel fuzzer, Andrey Konovalov generated the following error in gadgetfs:
> BUG: KASAN: use-after-free in __lock_ac
USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks
Using the syzkaller kernel fuzzer, Andrey Konovalov generated the following error in gadgetfs:
> BUG: KASAN: use-after-free in __lock_acquire+0x3069/0x3690 > kernel/locking/lockdep.c:3246 > Read of size 8 at addr ffff88003a2bdaf8 by task kworker/3:1/903 > > CPU: 3 PID: 903 Comm: kworker/3:1 Not tainted 4.12.0-rc4+ #35 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > Workqueue: usb_hub_wq hub_event > Call Trace: > __dump_stack lib/dump_stack.c:16 [inline] > dump_stack+0x292/0x395 lib/dump_stack.c:52 > print_address_description+0x78/0x280 mm/kasan/report.c:252 > kasan_report_error mm/kasan/report.c:351 [inline] > kasan_report+0x230/0x340 mm/kasan/report.c:408 > __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:429 > __lock_acquire+0x3069/0x3690 kernel/locking/lockdep.c:3246 > lock_acquire+0x22d/0x560 kernel/locking/lockdep.c:3855 > __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] > _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151 > spin_lock include/linux/spinlock.h:299 [inline] > gadgetfs_suspend+0x89/0x130 drivers/usb/gadget/legacy/inode.c:1682 > set_link_state+0x88e/0xae0 drivers/usb/gadget/udc/dummy_hcd.c:455 > dummy_hub_control+0xd7e/0x1fb0 drivers/usb/gadget/udc/dummy_hcd.c:2074 > rh_call_control drivers/usb/core/hcd.c:689 [inline] > rh_urb_enqueue drivers/usb/core/hcd.c:846 [inline] > usb_hcd_submit_urb+0x92f/0x20b0 drivers/usb/core/hcd.c:1650 > usb_submit_urb+0x8b2/0x12c0 drivers/usb/core/urb.c:542 > usb_start_wait_urb+0x148/0x5b0 drivers/usb/core/message.c:56 > usb_internal_control_msg drivers/usb/core/message.c:100 [inline] > usb_control_msg+0x341/0x4d0 drivers/usb/core/message.c:151 > usb_clear_port_feature+0x74/0xa0 drivers/usb/core/hub.c:412 > hub_port_disable+0x123/0x510 drivers/usb/core/hub.c:4177 > hub_port_init+0x1ed/0x2940 drivers/usb/core/hub.c:4648 > hub_port_connect drivers/usb/core/hub.c:4826 [inline] > hub_port_connect_change drivers/usb/core/hub.c:4999 [inline] > port_event drivers/usb/core/hub.c:5105 [inline] > hub_event+0x1ae1/0x3d40 drivers/usb/core/hub.c:5185 > process_one_work+0xc08/0x1bd0 kernel/workqueue.c:2097 > process_scheduled_works kernel/workqueue.c:2157 [inline] > worker_thread+0xb2b/0x1860 kernel/workqueue.c:2233 > kthread+0x363/0x440 kernel/kthread.c:231 > ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:424 > > Allocated by task 9958: > save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 > save_stack+0x43/0xd0 mm/kasan/kasan.c:513 > set_track mm/kasan/kasan.c:525 [inline] > kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:617 > kmem_cache_alloc_trace+0x87/0x280 mm/slub.c:2745 > kmalloc include/linux/slab.h:492 [inline] > kzalloc include/linux/slab.h:665 [inline] > dev_new drivers/usb/gadget/legacy/inode.c:170 [inline] > gadgetfs_fill_super+0x24f/0x540 drivers/usb/gadget/legacy/inode.c:1993 > mount_single+0xf6/0x160 fs/super.c:1192 > gadgetfs_mount+0x31/0x40 drivers/usb/gadget/legacy/inode.c:2019 > mount_fs+0x9c/0x2d0 fs/super.c:1223 > vfs_kern_mount.part.25+0xcb/0x490 fs/namespace.c:976 > vfs_kern_mount fs/namespace.c:2509 [inline] > do_new_mount fs/namespace.c:2512 [inline] > do_mount+0x41b/0x2d90 fs/namespace.c:2834 > SYSC_mount fs/namespace.c:3050 [inline] > SyS_mount+0xb0/0x120 fs/namespace.c:3027 > entry_SYSCALL_64_fastpath+0x1f/0xbe > > Freed by task 9960: > save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 > save_stack+0x43/0xd0 mm/kasan/kasan.c:513 > set_track mm/kasan/kasan.c:525 [inline] > kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:590 > slab_free_hook mm/slub.c:1357 [inline] > slab_free_freelist_hook mm/slub.c:1379 [inline] > slab_free mm/slub.c:2961 [inline] > kfree+0xed/0x2b0 mm/slub.c:3882 > put_dev+0x124/0x160 drivers/usb/gadget/legacy/inode.c:163 > gadgetfs_kill_sb+0x33/0x60 drivers/usb/gadget/legacy/inode.c:2027 > deactivate_locked_super+0x8d/0xd0 fs/super.c:309 > deactivate_super+0x21e/0x310 fs/super.c:340 > cleanup_mnt+0xb7/0x150 fs/namespace.c:1112 > __cleanup_mnt+0x1b/0x20 fs/namespace.c:1119 > task_work_run+0x1a0/0x280 kernel/task_work.c:116 > exit_task_work include/linux/task_work.h:21 [inline] > do_exit+0x18a8/0x2820 kernel/exit.c:878 > do_group_exit+0x14e/0x420 kernel/exit.c:982 > get_signal+0x784/0x1780 kernel/signal.c:2318 > do_signal+0xd7/0x2130 arch/x86/kernel/signal.c:808 > exit_to_usermode_loop+0x1ac/0x240 arch/x86/entry/common.c:157 > prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] > syscall_return_slowpath+0x3ba/0x410 arch/x86/entry/common.c:263 > entry_SYSCALL_64_fastpath+0xbc/0xbe > > The buggy address belongs to the object at ffff88003a2bdae0 > which belongs to the cache kmalloc-1024 of size 1024 > The buggy address is located 24 bytes inside of > 1024-byte region [ffff88003a2bdae0, ffff88003a2bdee0) > The buggy address belongs to the page: > page:ffffea0000e8ae00 count:1 mapcount:0 mapping: (null) > index:0x0 compound_mapcount: 0 > flags: 0x100000000008100(slab|head) > raw: 0100000000008100 0000000000000000 0000000000000000 0000000100170017 > raw: ffffea0000ed3020 ffffea0000f5f820 ffff88003e80efc0 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffff88003a2bd980: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff88003a2bda00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > >ffff88003a2bda80: fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb fb > ^ > ffff88003a2bdb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff88003a2bdb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ==================================================================
What this means is that the gadgetfs_suspend() routine was trying to access dev->lock after it had been deallocated. The root cause is a race in the dummy_hcd driver; the dummy_udc_stop() routine can race with the rest of the driver because it contains no locking. And even when proper locking is added, it can still race with the set_link_state() function because that function incorrectly drops the private spinlock before invoking any gadget driver callbacks.
The result of this race, as seen above, is that set_link_state() can invoke a callback in gadgetfs even after gadgetfs has been unbound from dummy_hcd's UDC and its private data structures have been deallocated.
include/linux/usb/gadget.h documents that the ->reset, ->disconnect, ->suspend, and ->resume callbacks may be invoked in interrupt context. In general this is necessary, to prevent races with gadget driver removal. This patch fixes dummy_hcd to retain the spinlock across these calls, and it adds a spinlock acquisition to dummy_udc_stop() to prevent the race.
The net2280 driver makes the same mistake of dropping the private spinlock for its ->disconnect and ->reset callback invocations. The patch fixes it too.
Lastly, since gadgetfs_suspend() may be invoked in interrupt context, it cannot assume that interrupts are enabled when it runs. It must use spin_lock_irqsave() instead of spin_lock_irq(). The patch fixes that bug as well.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-and-tested-by: Andrey Konovalov <andreyknvl@google.com> CC: <stable@vger.kernel.org> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
Revision tags: v4.10.17, v4.10.16, v4.10.15, v4.10.14 |
|
#
53e720f3 |
| 02-May-2017 |
Gustavo A. R. Silva <garsilva@embeddedor.com> |
usb: gadget: udc: add null check before pointer dereference
Add null check before dereferencing dev->regs pointer inside net2280_led_shutdown() function.
Addresses-Coverity-ID: 101783 Acked-by: Ala
usb: gadget: udc: add null check before pointer dereference
Add null check before dereferencing dev->regs pointer inside net2280_led_shutdown() function.
Addresses-Coverity-ID: 101783 Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
show more ...
|