1. 11 4月, 2017 17 次提交
  2. 27 3月, 2017 2 次提交
  3. 22 3月, 2017 5 次提交
  4. 17 3月, 2017 1 次提交
  5. 10 3月, 2017 1 次提交
  6. 06 3月, 2017 9 次提交
    • R
      usb: gadget: udc: net2280: Fix tmp reusage in net2280 driver · ef5e2fa9
      Raz Manor 提交于
      In the function scan_dma_completions() there is a reusage of tmp
      variable. That coused a wrong value being used in some case when
      reading a short packet terminated transaction from an endpoint,
      in 2 concecutive reads.
      
      This was my logic for the patch:
      
      The req->td->dmadesc equals to 0 iff:
      -- There was a transaction ending with a short packet, and
      -- The read() to read it was shorter than the transaction length, and
      -- The read() to complete it is longer than the residue.
      I believe this is true from the printouts of various cases,
      but I can't be positive it is correct.
      
      Entering this if, there should be no more data in the endpoint
      (a short packet terminated the transaction).
      If there is, the transaction wasn't really done and we should exit and
      wait for it to finish entirely. That is the inner if.
      That inner if should never happen, but it is there to be on the safe
      side. That is why it is marked with the comment /* paranoia */.
      The size of the data available in the endpoint is ep->dma->dmacount
      and it is read to tmp.
      This entire clause is based on my own educated guesses.
      
      If we passed that inner if without breaking in the original code,
      than tmp & DMA_BYTE_MASK_COUNT== 0.
      That means we will always pass dma bytes count of 0 to dma_done(),
      meaning all the requested bytes were read.
      
      dma_done() reports back to the upper layer that the request (read())
      was done and how many bytes were read.
      In the original code that would always be the request size,
      regardless of the actual size of the data.
      That did not make sense to me at all.
      
      However, the original value of tmp is req->td->dmacount,
      which is the dmacount value when the request's dma transaction was
      finished. And that is a much more reasonable value to report back to
      the caller.
      
      To recreate the problem:
      Read from a bulk out endpoint in a loop, 1024 * n bytes in each
      iteration.
      Connect the PLX to a host you can control.
      Send to that endpoint 1024 * n + x bytes,
      such that 0 < x < 1024 * n and (x % 1024) != 0
      You would expect the first read() to return 1024 * n
      and the second read() to return x.
      But you will get the first read to return 1024 * n
      and the second one to return 1024 * n.
      That is true for every positive integer n.
      
      Cc: Felipe Balbi <balbi@kernel.org>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: linux-usb@vger.kernel.org
      Signed-off-by: NRaz Manor <Raz.Manor@valens.com>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      ef5e2fa9
    • P
      usb: gadget: pxa27x: Test for a valid argument pointer · df754571
      Petr Cvek 提交于
      A call usb_put_phy(udc->transceiver) must be tested for a valid pointer.
      Use an already existing test for usb_unregister_notifier call.
      Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
      Reported-by: NRobert Jarzmik <robert.jarzmik@free.fr>
      Signed-off-by: NPetr Cvek <petr.cvek@tul.cz>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      df754571
    • J
      Revert "usb: gadget: f_fs: Fix ExtCompat descriptor validation" · 3ba534df
      Janusz Dziedzic 提交于
      This reverts commit ac670a3a650b899fc020b81f63e810d06015b865.
      
      This introduce bug we already fixed in
      commit 53642399 ("usb: gadget: f_fs: Fix wrong check on reserved1 wof OS_DESC_EXT_COMPAT")
      
      Next FFS (adb) SS enumeration fail with Windows OS.
      Signed-off-by: NJanusz Dziedzic <januszx.dziedzic@linux.intel.com>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      3ba534df
    • C
      USB: gadgetfs: Fix a potential memory leak in 'dev_config()' · b6e7aeea
      Christophe JAILLET 提交于
      'kbuf' is allocated just a few lines above using 'memdup_user()'.
      If the 'if (dev->buf)' test fails, this memory is never released.
      Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      b6e7aeea
    • A
      usb: gadget: udc: atmel: fix debug output · 42428202
      Arnd Bergmann 提交于
      The debug output now contains the wrong variable, as seen from the compiler
      warning:
      
      drivers/usb/gadget/udc/atmel_usba_udc.c: In function 'usba_ep_enable':
      drivers/usb/gadget/udc/atmel_usba_udc.c:632:550: error: 'ept_cfg' may be used uninitialized in this function [-Werror=maybe-uninitialized]
        DBG(DBG_ERR, "%s: EPT_CFG = 0x%lx (maxpacket = %lu)\n",
      
      This changes the debug output the same way as the other code.
      
      Fixes: 741d2558 ("usb: gadget: udc: atmel: Update endpoint allocation scheme")
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Acked-by: NAlexandre Belloni <alexandre.belloni@free-electrons.com>
      Acked-by: NNicolas Ferre <nicolas.ferre@microchip.com>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      42428202
    • J
      usb: gadget: configs: plug memory leak · 38355b2a
      John Keeping 提交于
      When binding a gadget to a device, "name" is stored in gi->udc_name, but
      this does not happen when unregistering and the string is leaked.
      Signed-off-by: NJohn Keeping <john@metanate.com>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      38355b2a
    • P
      usb: gadget: dummy_hcd: clear usb_gadget region before registration · 5bbc8526
      Peter Chen 提交于
      When the user does device unbind and rebind test, the kernel will
      show below dump due to usb_gadget memory region is dirty after unbind.
      Clear usb_gadget region for every new probe.
      
      root@imx6qdlsolo:/sys/bus/platform/drivers/dummy_udc# echo dummy_udc.0 > bind
      [  102.523312] kobject (eddd78b0): tried to init an initialized object, something is seriously wrong.
      [  102.532447] CPU: 0 PID: 734 Comm: sh Not tainted 4.10.0-rc7-00872-g1b2b8e9 #1298
      [  102.539866] Hardware name: Freescale i.MX6 SoloX (Device Tree)
      [  102.545717] Backtrace:
      [  102.548225] [<c010d090>] (dump_backtrace) from [<c010d338>] (show_stack+0x18/0x1c)
      [  102.555822]  r7:ede34000 r6:60010013 r5:00000000 r4:c0f29418
      [  102.561512] [<c010d320>] (show_stack) from [<c040c2a4>] (dump_stack+0xb4/0xe8)
      [  102.568764] [<c040c1f0>] (dump_stack) from [<c040e6d4>] (kobject_init+0x80/0x9c)
      [  102.576187]  r10:0000001f r9:eddd7000 r8:eeaf8c10 r7:eddd78a8 r6:c177891c r5:c0f3b060
      [  102.584036]  r4:eddd78b0 r3:00000000
      [  102.587641] [<c040e654>] (kobject_init) from [<c05359a4>] (device_initialize+0x28/0xf8)
      [  102.595665]  r5:eebc4800 r4:eddd78a8
      [  102.599268] [<c053597c>] (device_initialize) from [<c05382ac>] (device_register+0x14/0x20)
      [  102.607556]  r7:eddd78a8 r6:00000000 r5:eebc4800 r4:eddd78a8
      [  102.613256] [<c0538298>] (device_register) from [<c0668ef4>] (usb_add_gadget_udc_release+0x8c/0x1ec)
      [  102.622410]  r5:eebc4800 r4:eddd7860
      [  102.626015] [<c0668e68>] (usb_add_gadget_udc_release) from [<c0669068>] (usb_add_gadget_udc+0x14/0x18)
      [  102.635351]  r10:0000001f r9:eddd7000 r8:eddd788c r7:bf003770 r6:eddd77f8 r5:eddd7818
      [  102.643198]  r4:eddd785c r3:eddd7b24
      [  102.646834] [<c0669054>] (usb_add_gadget_udc) from [<bf003428>] (dummy_udc_probe+0x170/0x1c4 [dummy_hcd])
      [  102.656458] [<bf0032b8>] (dummy_udc_probe [dummy_hcd]) from [<c053d114>] (platform_drv_probe+0x54/0xb8)
      [  102.665881]  r10:00000008 r9:c1778960 r8:bf004128 r7:fffffdfb r6:bf004128 r5:eeaf8c10
      [  102.673727]  r4:eeaf8c10
      [  102.676293] [<c053d0c0>] (platform_drv_probe) from [<c053b160>] (driver_probe_device+0x264/0x474)
      [  102.685186]  r7:00000000 r6:00000000 r5:c1778960 r4:eeaf8c10
      [  102.690876] [<c053aefc>] (driver_probe_device) from [<c05397c4>] (bind_store+0xb8/0x14c)
      [  102.698994]  r10:eeb3bb4c r9:ede34000 r8:0000000c r7:eeaf8c44 r6:bf004128 r5:c0f3b668
      [  102.706840]  r4:eeaf8c10
      [  102.709402] [<c053970c>] (bind_store) from [<c0538ca8>] (drv_attr_store+0x28/0x34)
      [  102.716998]  r9:ede34000 r8:00000000 r7:ee3863c0 r6:ee3863c0 r5:c0538c80 r4:c053970c
      [  102.724776] [<c0538c80>] (drv_attr_store) from [<c029c930>] (sysfs_kf_write+0x50/0x54)
      [  102.732711]  r5:c0538c80 r4:0000000c
      [  102.736313] [<c029c8e0>] (sysfs_kf_write) from [<c029be84>] (kernfs_fop_write+0x100/0x214)
      [  102.744599]  r7:ee3863c0 r6:eeb3bb40 r5:00000000 r4:00000000
      [  102.750287] [<c029bd84>] (kernfs_fop_write) from [<c0222dd8>] (__vfs_write+0x34/0x120)
      [  102.758231]  r10:00000000 r9:ede34000 r8:c0108bc4 r7:0000000c r6:ede35f80 r5:c029bd84
      [  102.766077]  r4:ee223780
      [  102.768638] [<c0222da4>] (__vfs_write) from [<c0224678>] (vfs_write+0xa8/0x170)
      [  102.775974]  r9:ede34000 r8:c0108bc4 r7:ede35f80 r6:01861cb0 r5:ee223780 r4:0000000c
      [  102.783743] [<c02245d0>] (vfs_write) from [<c0225498>] (SyS_write+0x4c/0xa8)
      [  102.790818]  r9:ede34000 r8:c0108bc4 r7:0000000c r6:01861cb0 r5:ee223780 r4:ee223780
      [  102.798595] [<c022544c>] (SyS_write) from [<c0108a20>] (ret_fast_syscall+0x0/0x1c)
      [  102.806188]  r7:00000004 r6:b6e83d58 r5:01861cb0 r4:0000000c
      
      Fixes: 90fccb52 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
      Cc: stable <stable@vger.kernel.org>
      Acked-by: NAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: NPeter Chen <peter.chen@nxp.com>
      Tested-by: NXiaolong Ye <xiaolong.ye@intel.com>
      Reported-by: NFengguang Wu <fengguang.wu@intel.com>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      5bbc8526
    • R
      Revert "usb: gadget: uvc: Add missing call for additional setup data" · eb38d913
      Roger Quadros 提交于
      This reverts commit 4fbac520.
      
      This commit breaks g_webcam when used with uvc-gadget [1].
      
      The user space application (e.g. uvc-gadget) is responsible for
      sending response to UVC class specific requests on control endpoint
      in uvc_send_response() in uvc_v4l2.c.
      
      The bad commit was causing a duplicate response to be sent with
      incorrect response data thus causing UVC probe to fail at the host
      and broken control transfer endpoint at the gadget.
      
      [1] - git://git.ideasonboard.org/uvc-gadget.git
      
      Cc: <stable@vger.kernel.org> # v4.9+
      Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: NRoger Quadros <rogerq@ti.com>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      eb38d913
    • F
      usb: gadget: function: f_fs: pass companion descriptor along · 2bfa0719
      Felipe Balbi 提交于
      If we're dealing with SuperSpeed endpoints, we need
      to make sure to pass along the companion descriptor
      and initialize fields needed by the Gadget
      API. Eventually, f_fs.c should be converted to use
      config_ep_by_speed() like all other functions,
      though.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      2bfa0719
  7. 02 3月, 2017 2 次提交
  8. 28 2月, 2017 3 次提交