linux-toradex.git/drivers/usb/chipidea/udc.c, branch v4.9.126

usb: chipidea: udc: fix NULL pointer dereference if udc_start failed

2017-06-14T13:05:58+00:00

commit aa1f058d7d9244423b8c5a75b9484b1115df7f02 upstream.

Fix below NULL pointer dereference. we set ci->roles[CI_ROLE_GADGET]
too early in ci_hdrc_gadget_init(), if udc_start() fails due to some
reason, the ci->roles[CI_ROLE_GADGET] check in  ci_hdrc_gadget_destroy
can't protect us.

We fix this issue by only setting ci->roles[CI_ROLE_GADGET] if
udc_start() succeed.

[    1.398550] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
...
[    1.448600] PC is at dma_pool_free+0xb8/0xf0
[    1.453012] LR is at dma_pool_free+0x28/0xf0
[    2.113369] [] dma_pool_free+0xb8/0xf0
[    2.118857] [] destroy_eps+0x4c/0x68
[    2.124165] [] ci_hdrc_gadget_destroy+0x28/0x50
[    2.130461] [] ci_hdrc_probe+0x588/0x7e8
[    2.136129] [] platform_drv_probe+0x50/0xb8
[    2.142066] [] driver_probe_device+0x1fc/0x2a8
[    2.148270] [] __device_attach_driver+0x9c/0xf8
[    2.154563] [] bus_for_each_drv+0x58/0x98
[    2.160317] [] __device_attach+0xc4/0x138
[    2.166072] [] device_initial_probe+0x10/0x18
[    2.172185] [] bus_probe_device+0x94/0xa0
[    2.177940] [] device_add+0x3f0/0x560
[    2.183337] [] platform_device_add+0x180/0x240
[    2.189541] [] ci_hdrc_add_device+0x440/0x4f8
[    2.195654] [] ci_hdrc_usb2_probe+0x13c/0x2d8
[    2.201769] [] platform_drv_probe+0x50/0xb8
[    2.207705] [] driver_probe_device+0x1fc/0x2a8
[    2.213910] [] __driver_attach+0xac/0xb0
[    2.219575] [] bus_for_each_dev+0x60/0xa0
[    2.225329] [] driver_attach+0x20/0x28
[    2.230816] [] bus_add_driver+0x1d0/0x238
[    2.236571] [] driver_register+0x60/0xf8
[    2.242237] [] __platform_driver_register+0x44/0x50
[    2.248891] [] ci_hdrc_usb2_driver_init+0x18/0x20
[    2.255365] [] do_one_initcall+0x38/0x128
[    2.261121] [] kernel_init_freeable+0x1ac/0x250
[    2.267414] [] kernel_init+0x10/0x100
[    2.272810] [] ret_from_fork+0x10/0x50

Fixes: 3f124d233e97 ("usb: chipidea: add role init and destroy APIs")
Signed-off-by: Jisheng Zhang 
Signed-off-by: Peter Chen 
Signed-off-by: Greg Kroah-Hartman

usb: chipidea: move the lock initialization to core file

2016-11-15T18:25:25+00:00

This can fix below dump when the lock is accessed at host
mode due to it is not initialized.

[   46.119638] INFO: trying to register non-static key.
[   46.124643] the code is fine but needs lockdep annotation.
[   46.130144] turning off the locking correctness validator.
[   46.135659] CPU: 0 PID: 690 Comm: cat Not tainted 4.9.0-rc3-00079-g4b75f1d #1210
[   46.143075] Hardware name: Freescale i.MX6 SoloX (Device Tree)
[   46.148923] Backtrace:
[   46.151448] [] (dump_backtrace) from [] (show_stack+0x18/0x1c)
[   46.159038]  r7:edf52000
[   46.161412]  r6:60000193
[   46.163967]  r5:00000000
[   46.165035]  r4:c0e25c2c

[   46.169109] [] (show_stack) from [] (dump_stack+0xb4/0xe8)
[   46.176362] [] (dump_stack) from [] (register_lock_class+0x4fc/0x56c)
[   46.184554]  r10:c0e25d24
[   46.187014]  r9:edf53e70
[   46.189569]  r8:c1642444
[   46.190637]  r7:ee9da024
[   46.193191]  r6:00000000
[   46.194258]  r5:00000000
[   46.196812]  r4:00000000
[   46.199185]  r3:00000001

[   46.203259] [] (register_lock_class) from [] (__lock_acquire+0x80/0x10f0)
[   46.211797]  r10:c0e25d24
[   46.214257]  r9:edf53e70
[   46.216813]  r8:ee9da024
[   46.217880]  r7:c1642444
[   46.220435]  r6:edcd1800
[   46.221502]  r5:60000193
[   46.224057]  r4:00000000

[   46.227953] [] (__lock_acquire) from [] (lock_acquire+0x74/0x94)
[   46.235710]  r10:00000001
[   46.238169]  r9:edf53e70
[   46.240723]  r8:edf53f80
[   46.241790]  r7:00000001
[   46.244344]  r6:00000001
[   46.245412]  r5:60000193
[   46.247966]  r4:00000000

[   46.251866] [] (lock_acquire) from [] (_raw_spin_lock_irqsave+0x40/0x54)
[   46.260319]  r7:ee1c6a00
[   46.262691]  r6:c062a570
[   46.265247]  r5:20000113
[   46.266314]  r4:ee9da014

[   46.270393] [] (_raw_spin_lock_irqsave) from [] (ci_port_test_show+0x2c/0x70)
[   46.279280]  r6:eebd2000
[   46.281652]  r5:ee9da010
[   46.284207]  r4:ee9da014

[   46.286810] [] (ci_port_test_show) from [] (seq_read+0x1ac/0x4f8)
[   46.294655]  r9:edf53e70
[   46.297028]  r8:edf53f80
[   46.299583]  r7:ee1c6a00
[   46.300650]  r6:00000001
[   46.303205]  r5:00000000
[   46.304273]  r4:eebd2000
[   46.306850] [] (seq_read) from [] (full_proxy_read+0x54/0x6c)
[   46.314348]  r10:00000000
[   46.316808]  r9:c0a6ad30
[   46.319363]  r8:edf53f80
[   46.320430]  r7:00020000
[   46.322986]  r6:b6de3000
[   46.324053]  r5:ee1c6a00
[   46.326607]  r4:c0248b58

[   46.330505] [] (full_proxy_read) from [] (__vfs_read+0x34/0x118)
[   46.338262]  r9:edf52000
[   46.340635]  r8:c0107fc4
[   46.343190]  r7:00020000
[   46.344257]  r6:edf53f80
[   46.346812]  r5:c039e810
[   46.347879]  r4:ee1c6a00
[   46.350447] [] (__vfs_read) from [] (vfs_read+0x8c/0x11c)
[   46.357597]  r9:edf52000
[   46.359969]  r8:c0107fc4
[   46.362524]  r7:edf53f80
[   46.363592]  r6:b6de3000
[   46.366147]  r5:ee1c6a00
[   46.367214]  r4:00020000
[   46.369782] [] (vfs_read) from [] (SyS_read+0x4c/0xa8)
[   46.376672]  r8:c0107fc4
[   46.379045]  r7:00020000
[   46.381600]  r6:b6de3000
[   46.382667]  r5:ee1c6a00
[   46.385222]  r4:ee1c6a00

[   46.387817] [] (SyS_read) from [] (ret_fast_syscall+0x0/0x1c)
[   46.395314]  r7:00000003
[   46.397687]  r6:b6de3000
[   46.400243]  r5:00020000
[   46.401310]  r4:00020000

Cc: 
Fixes: 26c696c678c4 ("USB: Chipidea: rename struct
	       	ci13xxx variables from udc to ci")
Signed-off-by: Peter Chen 
Signed-off-by: Greg Kroah-Hartman

usb: chipidea: udc: Use the preferred form for passing a size of a struct

2016-09-14T02:58:13+00:00

According to Documentation/CodingStyle:

"The preferred form for passing a size of a struct is the following:

	p = kmalloc(sizeof(*p), ...);
"
, so do as suggested to improve readability.

Signed-off-by: Fabio Estevam 
Signed-off-by: Peter Chen

usb: chipidea: udc: Fit into a single line

2016-09-14T02:58:13+00:00

No need to split the dma_pool_zalloc() line into two as it can
perfectly fit into a single line.

Signed-off-by: Fabio Estevam 
Signed-off-by: Peter Chen

usb: chipidea: udc: Use dma_pool_zalloc()

2016-09-14T02:58:13+00:00

We can make the code simpler by using dma_pool_zalloc() instead
of calling dma_pool_alloc() and then a memset().

Signed-off-by: Fabio Estevam 
Signed-off-by: Peter Chen

usb: chipidea: udc: Use direction flags consequently

2016-09-14T02:58:13+00:00

This driver make assumptions about the value of the direction flags.
So better use them in comparisons to improve the readability.

Signed-off-by: Stefan Wahren 
Signed-off-by: Peter Chen

usb: chipidea: udc: Don't flush endpoint fifo twice

2016-09-14T02:58:13+00:00

The endpoint fifo is already flushed in _ep_nuke so there
is no need to flush it twice.

Signed-off-by: Stefan Wahren 
Signed-off-by: Peter Chen

usb: chipidea: udc: move write barrier into hw_ep_prime

2016-09-14T02:58:13+00:00

Since there should be a write barrier before every call of
hw_ep_prime we could move it into hw_ep_prime.

Signed-off-by: Stefan Wahren 
Signed-off-by: Peter Chen

usb: chipidea: udc: fix NULL ptr dereference in isr_setup_status_phase

2016-09-09T09:19:57+00:00

Problems with the signal integrity of the high speed USB data lines or
noise on reference ground lines can cause the i.MX6 USB controller to
violate USB specs and exhibit unexpected behavior.

It was observed that USBi_UI interrupts were triggered first and when
isr_setup_status_phase was called, ci->status was NULL, which lead to a
NULL pointer dereference kernel panic.

This patch fixes the kernel panic, emits a warning once and returns
-EPIPE to halt the device and let the host get stalled.
It also adds a comment to point people, who are experiencing this issue,
to their USB hardware design.

Cc:  #4.1+
Signed-off-by: Clemens Gruber 
Signed-off-by: Peter Chen

usb: chipidea: udc: don't touch DP when controller is in host mode

2016-08-19T01:27:07+00:00

When the controller is configured to be dual role and it's in host mode,
if bind udc and gadgt driver, those gadget operations will do gadget
disconnect and finally pull down DP line, which will break host function.

Cc:  # 4.1+
Signed-off-by: Li Jun 
Signed-off-by: Peter Chen