KASAN enabled configuration reports an error

    BUG: KASAN: use-after-free in usb_composite_overwrite_options+...
                [libcomposite] at addr ...
    Read of size 1 by task ...

when some driver is un-bound and then bound again.
For example, this happens with FunctionFS driver when "ffs-test"
test application is run several times in a row.

If the driver has empty manufacturer ID string in initial static data,
it is then replaced with generated string. After driver unbinding
the generated string is freed, but the driver data still keep that
pointer. And if the driver is then bound again, that pointer
is re-used for string emptiness check.

The fix is to clean up the driver string data upon its unbinding
to drop the pointer to freed memory.

Fixes: cc2683c3 ("usb: gadget: Provide a default implementation of default manufacturer string")
Cc: stable@vger.kernel.org
Signed-off-by: NAndrew Gabbasov <andrew_gabbasov@mentor.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

If a function sets bind_deactivated flag, upon removal we will be left
with an unbalanced deactivation. Let's make sure that we conditionally
call usb_function_activate() from usb_remove_function() and make sure
usb_remove_function() is called from remove_config().
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

This commit allows a gadget that does not support SuperSpeed to indicate
that it supports LPM. It does this by setting the 'lpm_capable' flag in
the gadget structure.

If a gadget sets this, the composite gadget framework will set the
bcdUSB to 0x0201 to indicate that this supports BOS descriptors, and
also return a USB 2.0 Extension descriptor as part of the BOS descriptor
set.

See USB 2.0 LPM ECN Section 3.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NSevak Arakelyan <sevaka@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Don't send the SuperSpeed USB Device Capability descriptor if
the gadget is not capable of SuperSpeed.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NSevak Arakelyan <sevaka@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

'cdev->os_desc_req' has been allocated with 'usb_ep_alloc_request()' so
'usb_ep_free_request()' should be used to free it.
Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

By convention (according to doc) if function does not provide
get_alt() callback composite framework should assume that it has only
altsetting 0 and should respond with error if host tries to set
other one.

After commit dd4dff8b ("USB: composite: Fix bug: should test
set_alt function pointer before use it")
we started checking set_alt() callback instead of get_alt().
This check is useless as we check if set_alt() is set inside
usb_add_function() and fail if it's NULL.

Let's fix this check and move comment about why we check the get
method instead of set a little bit closer to prevent future false
fixes.

Fixes: dd4dff8b ("USB: composite: Fix bug: should test set_alt function pointer before use it")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NKrzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Let's not reimplement generic kernel helpers,
instead call kasprintf().

[ felipe.balbi@linux.intel.com: better commit log ]
Signed-off-by: NJuergen Gross <jgross@suse.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

ep->mult is supposed to be set to Isochronous and
Interrupt Endapoint's multiplier value. This value
is computed from different places depending on the
link speed.

If we're dealing with HighSpeed, then it's part of
bits [12:11] of wMaxPacketSize. This case wasn't
taken into consideration before.

While at that, also make sure the ep->mult defaults
to one so drivers can use it unconditionally and
assume they'll never multiply ep->maxpacket to zero.

Cc: <stable@vger.kernel.org>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

usb_endpoint_maxp() returns wMaxPacketSize in its
raw form. Without taking into consideration that it
also contains other bits reserved for isochronous
endpoints.

This patch fixes one occasion where this is a
problem by making sure that we initialize
ep->maxpacket only with lower 10 bits of the value
returned by usb_endpoint_maxp(). Note that seperate
patches will be necessary to audit all call sites of
usb_endpoint_maxp() and make sure that
usb_endpoint_maxp() only returns lower 10 bits of
wMaxPacketSize.

Cc: <stable@vger.kernel.org>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

It can sometimes be necessary for gadget drivers to process non-standard
control requests, which host devices can send without having sent
USB_REQ_SET_CONFIGURATION.

Therefore, the req_match() usb_function method is enhanced with the new
parameter "config0". When a USB configuration is active, this parameter
is false. When a non-core control request is processed in
composite_setup(), without an active configuration, req_match() of the
USB functions of all available configurations which implement this
function, is called with config0=true. Then the control request gets
processed by the first usb_function instance whose req_match() returns
true.
Signed-off-by: NFelix Hädicke <felixhaedicke@web.de>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

In 'composite_os_desc_req_prepare', if one of the memory allocations fail,
0 will be returned, which means success.
We should return -ENOMEM instead.
Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

cdev->config is checked for null pointer at above code, so cdev->config
might be null, fix it by adding null pointer check.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

In OS descriptors handling, if ctrl->bRequestType is
USB_RECIP_DEVICE and w_index != 0x4 or (w_value >> 8)
is true, it will not assign a valid value to req->length,
but use the default value(-EOPNOTSUPP), and queue an
OS desc request with the invalid req->length. It always
happens on the platforms which use os_desc (for example:
rk3366, rk3399), and cause kernel panic as follows
(use dwc3 driver):

Unable to handle kernel paging request at virtual address ffffffc0f7e00000
Internal error: Oops: 96000146 [#1] PREEMPT SMP
PC is at __dma_clean_range+0x18/0x30
LR is at __swiotlb_map_page+0x50/0x64
Call trace:
[<ffffffc0000930f8>] __dma_clean_range+0x18/0x30
[<ffffffc00062214c>] usb_gadget_map_request+0x134/0x1b0
[<ffffffc0005c289c>] __dwc3_ep0_do_control_data+0x110/0x14c
[<ffffffc0005c2d38>] __dwc3_gadget_ep0_queue+0x198/0x1b8
[<ffffffc0005c2e18>] dwc3_gadget_ep0_queue+0xc0/0xe8
[<ffffffc00061cfec>] composite_ep0_queue.constprop.14+0x34/0x98
[<ffffffc00061dfb0>] composite_setup+0xf60/0x100c
[<ffffffc0006204dc>] android_setup+0xd8/0x138
[<ffffffc0005c29a4>] dwc3_ep0_delegate_req+0x34/0x50
[<ffffffc0005c3534>] dwc3_ep0_interrupt+0x5dc/0xb58
[<ffffffc0005c0c3c>] dwc3_thread_interrupt+0x15c/0xa24

With this patch, the gadget driver will not queue
a request and return immediately if req->length is
invalid. And the usb controller driver can handle
the unsupport request correctly.
Signed-off-by: NWilliam Wu <william.wu@rock-chips.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

If a gadget driver loaded to a Superspeed-capable
peripheral controller, using a Superspeed cable,
doesn't provide Superspeed descriptors, we will get
a NULL pointer dereference.

In order to avoid that situation, we will try to
find any valid descriptors we can. If no set of
descriptors is passed in, then we'll let that gadget
oops anyhow.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Set the reserved fields of the SuperSpeed Plus Device Capability
descriptor to 0. Otherwise there might be stale data there which will
cause USB CV to fail.

Fixes: f228a8de ("usb: gadget: composite: Return SSP Dev Cap descriptor")
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Access multi-byte fields of the SSP Dev Cap descriptor using the correct
endianness.

Fixes: f228a8de ("usb: gadget: composite: Return SSP Dev Cap descriptor")
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

If gadget with HNP polling support receives GetStatus request of otg
status selector, it feedback to host with host request flag to indicate
if it wants to take host role.
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NLi Jun <jun.li@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Update the debug message reporting the speeds that a configuration
supports for SuperSpeedPlus.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Configure the usb_ep using the SuperSpeedPlus descriptors if connected
in SuperSpeedPlus.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Enable writing of SuperSpeedPlus descriptors for any SuperSpeedPlus
capable configuration when connected in SuperSpeedPlus.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

There are a couple places in the code that get the function descriptors
based on the speed. Move this lookup into a function call and add
support to handle the SuperSpeedPlus descriptors as well.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

If enumerated in SuperSpeedPlus, count the configurations that support
it.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

When a function is added to a configuration with usb_add_function(), the
configuration speed flags are updated. These flags indicate for which
speeds the configuration is valid for.

This patch adds a flag in the configuration for SuperSpeedPlus and
also updates this based on the existence of ssp_descriptors.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

If a gadget supports SuperSpeedPlus or higher speeds, return a
SuperSpeedPlus USB Device Capability descriptor.

Currently this implementation returns a fixed descriptor with typical
values set.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

The USB 3.1 specification replaces the USB 3.0 specification and all new
devices that are running at SuperSpeed or higher speeds must report a
bcdUSB of 0x0310.

Refer to USB 3.1 Specification, Revision 1.0, Section 9.6.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

When handling device GET_DESCRIPTOR, composite gadget driver fills
the bcdUSB field only if the gadget supports USB 3.0. Otherwise
the field is left unfilled.

For consistency, set bcdUSB to 0x0200 for gadgets that don't
support superspeed.

It's correct to use 0x0200 for any setting that doesn't use
superspeed, since USB 2.0 devices can restrict themselves to
full speed only. It is NOT correct to use 0x0210, since BOS
descriptors are handled only if gadget_is_superspeed() is
satisfied, otherwise it results in a stall.
Signed-off-by: NIgor Kotrasinski <i.kotrasinsk@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Fix comments in code to make them up to date.

composite: claiming endpoint is now done by setting ep->claimed flag,
not ep->driver_data.

epautoconf: usb_ep_autoconfig() and usb_ep_autoconfig_ss() return
claimed endpoint with ep->claimed flag already set.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Signed-off-by: NDiego Viola <diego.viola@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.com>

Copy usb_otg_descriptor from config's descriptor if host requests
USB_DT_OTG.
Signed-off-by: NMacpaul Lin <macpaul@gmail.com>
Signed-off-by: NLi Jun <jun.li@freescale.com>
Reviewed-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch introduces 'bind_deactivated' flag in struct usb_function.
Functions which don't want to be activated automatically after bind should
set this flag, and when they start to be ready to work they should call
usb_function_activate().

When USB function sets 'bind_deactivated' flag, initial deactivation
counter is incremented automatically, so there is no need to call
usb_function_deactivate() in function bind.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Using usb_gadget_disconnect to make gadget temporarily invisible to host
doesn't provide desired result, because gadget is connected immediately
after binding regardless to previous usb_gadget_disconnect() calls.

For this reason we use usb_gadget_deactivate() instead of
usb_gadget_disconnect() to make it working as expected.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

I18N should be spelled as i18n because it's not
an acronym
Signed-off-by: NDiego Viola <diego.viola@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

commit f563d230 ("usb: gadget: composite: add req_match method
to usb_function") accesses cdev->config even before set config
is invoked causing a NULL pointer dereferencing error while running
Lecroy Mass Storage Compliance test.

Fix it here by accessing cdev->config only if it is non NULL.

Fixes: commit f563d230 ("usb: gadget: composite: add req_match
method to usb_function").
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch fix some spelling typo found in gadget.xml.
It is because this file is generated from comments in sources,
I had to fix comments in the source, instead of xml file itself.
Signed-off-by: NMasanari Iida <standby24x7@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Non-standard requests can encode the actual interface number in a
non-standard way. For example composite_setup() assumes
that it is w_index && 0xFF, but the printer function encodes the interface
number in a context-dependet way (either w_index or w_index >> 8).
This can lead to such requests being directed to wrong functions.

This patch adds req_match() method to usb_function. Its purpose is to
verify that a given request can be handled by a given function.
If any function within a configuration provides the method and it returns
true, then it is assumed that the right function is found.

If a function uses req_match(), it should try as hard as possible to
determine if the request is meant for it.

If no functions in a configuration provide req_match or none of them
returns true, then fall back to the usual approach.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

If a non-standard request is processed and its parameters just happen
to match those of some standard request, the logic of composite_setup()
can be fooled, so don't even try any switch cases, just go to the
proper place where unknown requests are handled.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

USB vendor type is encoded in field bmRequestType. Make test USB_TYPE_VENDOR
with bRequestType instead of bRequest.
Signed-off-by: NMario Schuknecht <mario.schuknecht@dresearch-fe.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

USB gadgets composed with configfs lack suspend and resume
methods. This patch uses composite_suspend()/composite_resume()
the same way e.g. composite_setup() or composite_disconnect()
are used in a configfs-based gadget.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

In case we unload a gadget driver while any of
os_desc_req or req are still pending, we need
to make sure to dequeue them.

By using our setup_pending and os_desc_pending
flags we achieve that in a way that doesn't
cause any regressions because we won't dequeue
a request which was already completed.

The original idea came from Li Jun's commit
f2267089
(usb: gadget: composite: dequeue cdev->req
before free it in composite_dev_cleanup) which,
unfortunately, caused two regressions (kfree()
being called before usb_ep_dequeue() and calling
usb_ep_dequeue() when the request was already
completed). That commit also didn't take care
of os_desc_req which can fall into the same
situation so we must care for that one too.

Note that in order to make code slightly easier
to read, we introduce composite_ep_queue() which
hides details about how to fiddle with our pending
flags.
Signed-off-by: NFelipe Balbi <balbi@ti.com>