linux-toradex.git/drivers/usb/gadget, branch v3.10.17

USB: Fix breakage in ffs_fs_mount()

2013-10-05T14:13:11+00:00

commit 2606b28aabd7dea1766c23a105e1124c95409c96 upstream.

	There's a bunch of failure exits in ffs_fs_mount() with
seriously broken recovery logics.  Most of that appears to stem
from misunderstanding of the ->kill_sb() semantics; unlike
->put_super() it is called for *all* superblocks of given type,
no matter how (in)complete the setup had been.  ->put_super()
is called only if ->s_root is not NULL; any failure prior to
setting ->s_root will have the call of ->put_super() skipped.
->kill_sb(), OTOH, awaits every superblock that has come from
sget().

Current behaviour of ffs_fs_mount():

We have struct ffs_sb_fill_data data on stack there.  We do
	ffs_dev = functionfs_acquire_dev_callback(dev_name);
and store that in data.private_data.  Then we call mount_nodev(),
passing it ffs_sb_fill() as a callback.  That will either fail
outright, or manage to call ffs_sb_fill().  There we allocate an
instance of struct ffs_data, slap the value of ffs_dev (picked
from data.private_data) into ffs->private_data and overwrite
data.private_data by storing ffs into an overlapping member
(data.ffs_data).  Then we store ffs into sb->s_fs_info and attempt
to set the rest of the things up (root inode, root dentry, then
create /ep0 there).  Any of those might fail.  Should that
happen, we get ffs_fs_kill_sb() called before mount_nodev()
returns.  If mount_nodev() fails for any reason whatsoever,
we proceed to
	functionfs_release_dev_callback(data.ffs_data);

That's broken in a lot of ways.  Suppose the thing has failed in
allocation of e.g. root inode or dentry.  We have
	functionfs_release_dev_callback(ffs);
	ffs_data_put(ffs);
done by ffs_fs_kill_sb() (ffs accessed via sb->s_fs_info), followed by
	functionfs_release_dev_callback(ffs);
from ffs_fs_mount() (via data.ffs_data).  Note that the second
functionfs_release_dev_callback() has every chance to be done to freed memory.

Suppose we fail *before* root inode allocation.  What happens then?
ffs_fs_kill_sb() doesn't do anything to ffs (it's either not called at all,
or it doesn't have a pointer to ffs stored in sb->s_fs_info).  And
	functionfs_release_dev_callback(data.ffs_data);
is called by ffs_fs_mount(), but here we are in nasal daemon country - we
are reading from a member of union we'd never stored into.  In practice,
we'll get what we used to store into the overlapping field, i.e. ffs_dev.
And then we get screwed, since we treat it (struct gfs_ffs_obj * in
disguise, returned by functionfs_acquire_dev_callback()) as struct
ffs_data *, pick what would've been ffs_data ->private_data from it
(*well* past the actual end of the struct gfs_ffs_obj - struct ffs_data
is much bigger) and poke in whatever it points to.

FWIW, there's a minor leak on top of all that in case if ffs_sb_fill()
fails on kstrdup() - ffs is obviously forgotten.

The thing is, there is no point in playing all those games with union.
Just allocate and initialize ffs_data *before* calling mount_nodev() and
pass a pointer to it via data.ffs_data.  And once it's stored in
sb->s_fs_info, clear data.ffs_data, so that ffs_fs_mount() knows that
it doesn't need to kill the sucker manually - from that point on
we'll have it done by ->kill_sb().

Signed-off-by: Al Viro 
Acked-by: Michal Nazarewicz 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: fix a bug and a WARN_ON in dummy-hcd

2013-10-01T16:17:46+00:00

commit 5f5610f69be3a925b1f79af27150bb7377bc9ad6 upstream.

This patch fixes a NULL pointer dereference and a WARN_ON in
dummy-hcd.  These things were the result of moving to the UDC core
framework, and possibly of changes to that framework.

Now unloading a gadget driver causes the UDC to be stopped after the
gadget driver is unbound, not before.  Therefore the "driver" argument
to dummy_udc_stop() can be NULL, so we must not try to print the
driver's name without checking first.

Also, the UDC framework automatically unregisters the gadget when the
UDC is deleted.  Therefore a sysfs attribute file attached to the
gadget must be removed before the UDC is deleted, not after.

Signed-off-by: Alan Stern 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: uvc: Fix error handling in uvc_queue_buffer()

2013-09-27T00:18:12+00:00

commit ebe864a6cb8e087ede047fa1fa6b6d06fcb9a9e4 upstream.

The conversion to videobuf2 failed to check the return value of
vb2_qbuf(). Fix it.

Reported-by: Michael Grzeschik 
Signed-off-by: Laurent Pinchart 
Tested-By: Michael Grzeschik 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: acm gadget: Null termintate strings table

2013-09-08T05:09:59+00:00

commit d257221854f0b34cca3247e6c45344d0470f7398 upstream.

The gadget strings table should be null terminated.
usb_gadget_get_string() loops through the table
expecting a null at the end of the list.

Signed-off-by: Graham Williams 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: udc-core: fix the typo of udc state attribute

2013-08-04T08:51:14+00:00

commit 1894870eb4240399fabc6f0cb8c6fff4e6edbe83 upstream.

The name of udc state attribute file under sysfs is registered as
"state", while usb_gadget_set_state take it as "status" when it's
going to update. This patch fixes the typo.

Signed-off-by: Rong Wang 
Signed-off-by: Barry Song 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_mass_storage: add missing memory barrier for thread_wakeup_needed

2013-07-22T01:21:24+00:00

commit d68c277b501889b3a50c179d1c3d704db7947b83 upstream.

Without this memory barrier, the file-storage thread may fail to
escape from the following while loop, because it may observe new
common->thread_wakeup_needed and old bh->state which are updated by
the callback functions.

	/* Wait for the CBW to arrive */
	while (bh->state != BUF_STATE_FULL) {
		rc = sleep_thread(common);
		if (rc)
			return rc;
	}

Signed-off-by: UCHINO Satoshi 
Acked-by: Michal Nazarewicz 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: phy: remove CONFIG_USB_OTG_UTILS once more

2013-05-15T14:33:42+00:00

The Kconfig symbol USB_OTG_UTILS was removed in the v3.10 merge window,
in commit fd89149875 ("usb: phy: remove CONFIG_USB_OTG_UTILS"). But that
symbol popped up again in a few places. Remove it there too.

Acked-by: Paul Zimmerman 
Signed-off-by: Paul Bolle 
Signed-off-by: Felipe Balbi

usb: gadget: s3c-hsotg: pass 'struct usb_request *' to usb_gadget_unmap_request()

2013-05-15T14:33:09+00:00

'struct usb_request *' should be passed to usb_gadget_unmap_request(),
as the second argument; however, 'struct s3c_hsotg_req *' is used.

Fixed build warnings as below:

drivers/usb/gadget/s3c-hsotg.c: In function 's3c_hsotg_unmap_dma':
drivers/usb/gadget/s3c-hsotg.c:440:2: warning: passing argument 2 of 'usb_gadget_unmap_request' from incompatible pointer type
[enabled by default]
include/linux/usb/gadget.h:961:13: note: expected 'struct usb_request *' but argument is of type 'struct s3c_hsotg_req *'
drivers/usb/gadget/s3c-hsotg.c:434:22: warning: unused variable 'req' [-Wunused-variable]

Signed-off-by: Jingoo Han 
Signed-off-by: Felipe Balbi

usb: gadget: don't check resource with devm_ioremap_resource

2013-05-15T14:31:58+00:00

devm_ioremap_resource does sanity checks on the given resource. No need to
duplicate this in the driver.

Acked-by: Greg Kroah-Hartman 
Signed-off-by: Wolfram Sang 
Signed-off-by: Felipe Balbi

usb: gadget: fix error return code in configfs_composite_bind()

2013-05-15T14:25:49+00:00

Fix to return a negative error code in the go through all configs error
handling case instead of 0(usb_add_function() will overwrite ret to 0).
Also use error code from usb_gstrings_attach() in all strings init error
case instead of -EINVAL.

Signed-off-by: Wei Yongjun 
Signed-off-by: Felipe Balbi