linux-toradex.git/drivers/usb/gadget/function/f_fs.c, branch v4.4.78

usb: gadget: f_fs: Fix possibe deadlock

2017-07-05T12:37:16+00:00

commit b3ce3ce02d146841af012d08506b4071db8ffde3 upstream.

When system try to close /dev/usb-ffs/adb/ep0 on one core, at the same
time another core try to attach new UDC, which will cause deadlock as
below scenario. Thus we should release ffs lock before issuing
unregister_gadget_item().

[   52.642225] c1 ======================================================
[   52.642228] c1 [ INFO: possible circular locking dependency detected ]
[   52.642236] c1 4.4.6+ #1 Tainted: G        W  O
[   52.642241] c1 -------------------------------------------------------
[   52.642245] c1 usb ffs open/2808 is trying to acquire lock:
[   52.642270] c0  (udc_lock){+.+.+.}, at: []
		usb_gadget_unregister_driver+0x3c/0xc8
[   52.642272] c1  but task is already holding lock:
[   52.642283] c0  (ffs_lock){+.+.+.}, at: []
		ffs_data_clear+0x30/0x140
[   52.642285] c1 which lock already depends on the new lock.
[   52.642287] c1
               the existing dependency chain (in reverse order) is:
[   52.642295] c0
	       -> #1 (ffs_lock){+.+.+.}:
[   52.642307] c0        [] __lock_acquire+0x20f0/0x2238
[   52.642314] c0        [] lock_acquire+0xe4/0x298
[   52.642322] c0        [] mutex_lock_nested+0x7c/0x3cc
[   52.642328] c0        [] ffs_func_bind+0x504/0x6e8
[   52.642334] c0        [] usb_add_function+0x84/0x184
[   52.642340] c0        [] configfs_composite_bind+0x264/0x39c
[   52.642346] c0        [] udc_bind_to_driver+0x58/0x11c
[   52.642352] c0        [] usb_udc_attach_driver+0x90/0xc8
[   52.642358] c0        [] gadget_dev_desc_UDC_store+0xd4/0x128
[   52.642369] c0        [] configfs_write_file+0xd0/0x13c
[   52.642376] c0        [] vfs_write+0xb8/0x214
[   52.642381] c0        [] SyS_write+0x54/0xb0
[   52.642388] c0        [] el0_svc_naked+0x24/0x28
[   52.642395] c0
              -> #0 (udc_lock){+.+.+.}:
[   52.642401] c0        [] print_circular_bug+0x84/0x2e4
[   52.642407] c0        [] __lock_acquire+0x2138/0x2238
[   52.642412] c0        [] lock_acquire+0xe4/0x298
[   52.642420] c0        [] mutex_lock_nested+0x7c/0x3cc
[   52.642427] c0        [] usb_gadget_unregister_driver+0x3c/0xc8
[   52.642432] c0        [] unregister_gadget_item+0x28/0x44
[   52.642439] c0        [] ffs_data_clear+0x138/0x140
[   52.642444] c0        [] ffs_data_reset+0x20/0x6c
[   52.642450] c0        [] ffs_data_closed+0xac/0x12c
[   52.642454] c0        [] ffs_ep0_release+0x20/0x2c
[   52.642460] c0        [] __fput+0xb0/0x1f4
[   52.642466] c0        [] ____fput+0x20/0x2c
[   52.642473] c0        [] task_work_run+0xb4/0xe8
[   52.642482] c0        [] do_exit+0x360/0xb9c
[   52.642487] c0        [] do_group_exit+0x4c/0xb0
[   52.642494] c0        [] get_signal+0x380/0x89c
[   52.642501] c0        [] do_signal+0x154/0x518
[   52.642507] c0        [] do_notify_resume+0x70/0x78
[   52.642512] c0        [] work_pending+0x1c/0x20
[   52.642514] c1
              other info that might help us debug this:
[   52.642517] c1  Possible unsafe locking scenario:
[   52.642518] c1        CPU0                    CPU1
[   52.642520] c1        ----                    ----
[   52.642525] c0   lock(ffs_lock);
[   52.642529] c0                                lock(udc_lock);
[   52.642533] c0                                lock(ffs_lock);
[   52.642537] c0   lock(udc_lock);
[   52.642539] c1
                      *** DEADLOCK ***
[   52.642543] c1 1 lock held by usb ffs open/2808:
[   52.642555] c0  #0:  (ffs_lock){+.+.+.}, at: []
		ffs_data_clear+0x30/0x140
[   52.642557] c1 stack backtrace:
[   52.642563] c1 CPU: 1 PID: 2808 Comm: usb ffs open Tainted: G
[   52.642565] c1 Hardware name: Spreadtrum SP9860g Board (DT)
[   52.642568] c1 Call trace:
[   52.642573] c1 [] dump_backtrace+0x0/0x170
[   52.642577] c1 [] show_stack+0x20/0x28
[   52.642583] c1 [] dump_stack+0xa8/0xe0
[   52.642587] c1 [] print_circular_bug+0x1fc/0x2e4
[   52.642591] c1 [] __lock_acquire+0x2138/0x2238
[   52.642595] c1 [] lock_acquire+0xe4/0x298
[   52.642599] c1 [] mutex_lock_nested+0x7c/0x3cc
[   52.642604] c1 [] usb_gadget_unregister_driver+0x3c/0xc8
[   52.642608] c1 [] unregister_gadget_item+0x28/0x44
[   52.642613] c1 [] ffs_data_clear+0x138/0x140
[   52.642618] c1 [] ffs_data_reset+0x20/0x6c
[   52.642621] c1 [] ffs_data_closed+0xac/0x12c
[   52.642625] c1 [] ffs_ep0_release+0x20/0x2c
[   52.642629] c1 [] __fput+0xb0/0x1f4
[   52.642633] c1 [] ____fput+0x20/0x2c
[   52.642636] c1 [] task_work_run+0xb4/0xe8
[   52.642640] c1 [] do_exit+0x360/0xb9c
[   52.642644] c1 [] do_group_exit+0x4c/0xb0
[   52.642647] c1 [] get_signal+0x380/0x89c
[   52.642651] c1 [] do_signal+0x154/0x518
[   52.642656] c1 [] do_notify_resume+0x70/0x78
[   52.642659] c1 [] work_pending+0x1c/0x20

Acked-by: Michal Nazarewicz 
Signed-off-by: Baolin Wang 
Signed-off-by: Felipe Balbi 
Cc: Jerry Zhang 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_fs: avoid out of bounds access on comp_desc

2017-06-29T10:48:53+00:00

commit b7f73850bb4fac1e2209a4dd5e636d39be92f42c upstream.

Companion descriptor is only used for SuperSpeed endpoints,
if the endpoints are HighSpeed or FullSpeed, the Companion
descriptor will not allocated, so we can only access it if
gadget is SuperSpeed.

I can reproduce this issue on Rockchip platform rk3368 SoC
which supports USB 2.0, and use functionfs for ADB. Kernel
build with CONFIG_KASAN=y and CONFIG_SLUB_DEBUG=y report
the following BUG:

==================================================================
BUG: KASAN: slab-out-of-bounds in ffs_func_set_alt+0x224/0x3a0 at addr ffffffc0601f6509
Read of size 1 by task swapper/0/0
============================================================================
BUG kmalloc-256 (Not tainted): kasan: bad access detected
----------------------------------------------------------------------------

Disabling lock debugging due to kernel taint
INFO: Allocated in ffs_func_bind+0x52c/0x99c age=1275 cpu=0 pid=1
alloc_debug_processing+0x128/0x17c
___slab_alloc.constprop.58+0x50c/0x610
__slab_alloc.isra.55.constprop.57+0x24/0x34
__kmalloc+0xe0/0x250
ffs_func_bind+0x52c/0x99c
usb_add_function+0xd8/0x1d4
configfs_composite_bind+0x48c/0x570
udc_bind_to_driver+0x6c/0x170
usb_udc_attach_driver+0xa4/0xd0
gadget_dev_desc_UDC_store+0xcc/0x118
configfs_write_file+0x1a0/0x1f8
__vfs_write+0x64/0x174
vfs_write+0xe4/0x200
SyS_write+0x68/0xc8
el0_svc_naked+0x24/0x28
INFO: Freed in inode_doinit_with_dentry+0x3f0/0x7c4 age=1275 cpu=7 pid=247
...
Call trace:
[] dump_backtrace+0x0/0x230
[] show_stack+0x14/0x1c
[] dump_stack+0xa0/0xc8
[] print_trailer+0x188/0x198
[] object_err+0x3c/0x4c
[] kasan_report+0x324/0x4dc
[] __asan_load1+0x24/0x50
[] ffs_func_set_alt+0x224/0x3a0
[] composite_setup+0xdcc/0x1ac8
[] android_setup+0x124/0x1a0
[] _setup+0x54/0x74
[] handle_ep0+0x3288/0x4390
[] dwc_otg_pcd_handle_out_ep_intr+0x14dc/0x2ae4
[] dwc_otg_pcd_handle_intr+0x1ec/0x298
[] dwc_otg_pcd_irq+0x10/0x20
[] handle_irq_event_percpu+0x124/0x3ac
[] handle_irq_event+0x60/0xa0
[] handle_fasteoi_irq+0x10c/0x1d4
[] generic_handle_irq+0x30/0x40
[] __handle_domain_irq+0xac/0xdc
[] gic_handle_irq+0x64/0xa4
...
Memory state around the buggy address:
  ffffffc0601f6400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ffffffc0601f6480: 00 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc
 >ffffffc0601f6500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                       ^
  ffffffc0601f6580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffffffc0601f6600: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================

Signed-off-by: William Wu 
Signed-off-by: Felipe Balbi 
Cc: Jerry Zhang 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: function: f_fs: pass companion descriptor along

2017-03-18T11:09:57+00:00

commit 2bfa0719ac2a9b2f3c91345873d3cdebd0296ba9 upstream.

If we're dealing with SuperSpeed endpoints, we need
to make sure to pass along the companion descriptor
and initialize fields needed by the Gadget
API. Eventually, f_fs.c should be converted to use
config_ep_by_speed() like all other functions,
though.

Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_fs: Assorted buffer overflow checks.

2017-02-09T07:02:46+00:00

commit 83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947 upstream.

OS descriptor head, when flagged as provided, is accessed without
checking if it fits in provided buffer. Verify length before access.
Also, there are other places where buffer length it checked
after accessing offsets which are potentially past the end. Check
buffer length before as well to fail cleanly.

Signed-off-by: Vincent Pelletier 
Acked-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: f_fs: off by one bug in _ffs_func_bind()

2016-08-20T16:09:16+00:00

commit 0015f9156092d07b3ec06d37d014328419d5832e upstream.

This loop is supposed to set all the .num[] values to -1 but it's off by
one so it skips the first element and sets one element past the end of
the array.

I've cleaned up the loop a little as well.

Fixes: ddf8abd25994 ('USB: f_fs: the FunctionFS driver')
Acked-by: Michal Nazarewicz 
Signed-off-by: Dan Carpenter 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_fs: Fix EFAULT generation for async read operations

2016-06-01T19:15:51+00:00

commit 332a5b446b7916d272c2a659a3b20909ce34d2c1 upstream.

In the current implementation functionfs generates a EFAULT for async read
operations if the read buffer size is larger than the URB data size. Since
a application does not necessarily know how much data the host side is
going to send it typically supplies a buffer larger than the actual data,
which will then result in a EFAULT error.

This behaviour was introduced while refactoring the code to use iov_iter
interface in commit c993c39b8639 ("gadget/function/f_fs.c: use put iov_iter
into io_data"). The original code took the minimum over the URB size and
the user buffer size and then attempted to copy that many bytes using
copy_to_user(). If copy_to_user() could not copy all data a EFAULT error
was generated. Restore the original behaviour by only generating a EFAULT
error when the number of bytes copied is not the size of the URB and the
target buffer has not been fully filled.

Commit 342f39a6c8d3 ("usb: gadget: f_fs: fix check in read operation")
already fixed the same problem for the synchronous read path.

Fixes: c993c39b8639 ("gadget/function/f_fs.c: use put iov_iter into io_data")
Acked-by: Michal Nazarewicz 
Signed-off-by: Lars-Peter Clausen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_fs: Fix use-after-free

2016-05-04T21:48:41+00:00

commit 38740a5b87d53ceb89eb2c970150f6e94e00373a upstream.

When using asynchronous read or write operations on the USB endpoints the
issuer of the IO request is notified by calling the ki_complete() callback
of the submitted kiocb when the URB has been completed.

Calling this ki_complete() callback will free kiocb. Make sure that the
structure is no longer accessed beyond that point, otherwise undefined
behaviour might occur.

Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
Signed-off-by: Lars-Peter Clausen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: functionfs: fix missing access_ok checks

2015-11-18T21:09:26+00:00

use safe copy_*_user instead of unsafe __copy_*_user
functions when accessing userland memory.

Signed-off-by: Daniel Walter 
Signed-off-by: Felipe Balbi

usb: gadget: ffs: call functionfs_unbind() if _ffs_func_bind() fails

2015-07-31T13:57:57+00:00

Function ffs_do_functionfs_bind() calls functionfs_bind() which allocates
usb request and increments refcounts. These things needs to be cleaned
up by if further steps of initialization fail by calling functionfs_unbind().

Signed-off-by: Robert Baldyga 
Acked-by: Michal Nazarewicz 
Signed-off-by: Felipe Balbi

usb: gadget: f_fs: do not set cancel function on synchronous {read,write}

2015-07-06T17:34:08+00:00

do not try to set cancel function in synchronous operations in
ffs_epfile_{read,write}_iter.

Cc:  # v4.0+
Acked-by: Al Viro 
Signed-off-by: Rui Miguel Silva 
Signed-off-by: Felipe Balbi