1. 20 Jul, 2018 1 commit
    • Jerry Zhang's avatar
      usb: gadget: f_fs: Only return delayed status when len is 0 · 4d644abf
      Jerry Zhang authored
      Commit 1b9ba000 ("Allow function drivers to pause control
      transfers") states that USB_GADGET_DELAYED_STATUS is only
      supported if data phase is 0 bytes.
      
      It seems that when the length is not 0 bytes, there is no
      need to explicitly delay the data stage since the transfer
      is not completed until the user responds. However, when the
      length is 0, there is no data stage and the transfer is
      finished once setup() returns, hence there is a need to
      explicitly delay completion.
      
      This manifests as the following bugs:
      
      Prior to 946ef68a ('Let setup() return
      USB_GADGET_DELAYED_STATUS'), when setup is 0 bytes, ffs
      would require user to queue a 0 byte request in order to
      clear setup state. However, that 0 byte request was actually
      not needed and would hang and cause errors in other setup
      requests.
      
      After the above commit, 0 byte setups work since the gadget
      now accepts empty queues to ep0 to clear the delay, but all
      other setups hang.
      
      Fixes: 946ef68a ("Let setup() return USB_GADGET_DELAYED_STATUS")
      Signed-off-by: default avatarJerry Zhang <zhangjerry@google.com>
      Cc: stable <stable@vger.kernel.org>
      Acked-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4d644abf
  2. 17 Jul, 2018 21 commits
    • Greg Kroah-Hartman's avatar
      Merge tag 'fixes-for-v4.18-rc5' of... · 2c3806c4
      Greg Kroah-Hartman authored
      Merge tag 'fixes-for-v4.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
      
      Felipe writes:
      
      usb: fixes for v4.18-rc5
      
      With a total of 20 non-merge commits, we have accumulated quite a few
      fixes. These include lot's of fixes the our audio gadget interface, a
      build error fix for PPC64 builds for the frescale PHY driver,
      sleep-while-atomic fixes on the r8a66597 UDC driver, 3-stage SETUP fix
      for the aspeed-vhub UDC and some other misc fixes.
      2c3806c4
    • Eugeniu Rosca's avatar
      usb: gadget: f_uac2: fix endianness of 'struct cntrl_*_lay3' · eec24f2a
      Eugeniu Rosca authored
      The list [1] of commits doing endianness fixes in USB subsystem is long
      due to below quote from USB spec Revision 2.0 from April 27, 2000:
      
      ------------
      8.1 Byte/Bit Ordering
      
      Multiple byte fields in standard descriptors, requests, and responses
      are interpreted as and moved over the bus in little-endian order, i.e.
      LSB to MSB.
      ------------
      
      This commit belongs to the same family.
      
      [1] Example of endianness fixes in USB subsystem:
      commit 14e1d56c ("usb: gadget: f_uac2: endianness fixes.")
      commit 42370b82 ("usb: gadget: f_uac1: endianness fixes.")
      commit 63afd5cc ("USB: chaoskey: fix Alea quirk on big-endian hosts")
      commit 74098c4a ("usb: gadget: acm: fix endianness in notifications")
      commit cdd7928d ("ACM gadget: fix endianness in notifications")
      commit 323ece54 ("cdc-wdm: fix endianness bug in debug statements")
      commit e102609f ("usb: gadget: uvc: Fix endianness mismatches")
             list goes on
      
      Fixes: 132fcb46 ("usb: gadget: Add Audio Class 2.0 Driver")
      Signed-off-by: default avatarEugeniu Rosca <erosca@de.adit-jv.com>
      Reviewed-by: default avatarRuslan Bilovol <ruslan.bilovol@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      eec24f2a
    • Antti Seppälä's avatar
      usb: dwc2: Fix inefficient copy of unaligned buffers · 1e111e88
      Antti Seppälä authored
      Make sure only to copy any actual data rather than the whole buffer,
      when releasing the temporary buffer used for unaligned non-isochronous
      transfers.
      
      Taken directly from commit 0efd937e ("USB: ehci-tegra: fix inefficient
      copy of unaligned buffers")
      
      Tested with Lantiq xRX200 (MIPS) and RPi Model B Rev 2 (ARM)
      Reviewed-by: default avatarDouglas Anderson <dianders@chromium.org>
      Signed-off-by: default avatarAntti Seppälä <a.seppala@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      1e111e88
    • Antti Seppälä's avatar
      usb: dwc2: Fix DMA alignment to start at allocated boundary · 56406e01
      Antti Seppälä authored
      The commit 3bc04e28 ("usb: dwc2: host: Get aligned DMA in a more
      supported way") introduced a common way to align DMA allocations.
      The code in the commit aligns the struct dma_aligned_buffer but the
      actual DMA address pointed by data[0] gets aligned to an offset from
      the allocated boundary by the kmalloc_ptr and the old_xfer_buffer
      pointers.
      
      This is against the recommendation in Documentation/DMA-API.txt which
      states:
      
        Therefore, it is recommended that driver writers who don't take
        special care to determine the cache line size at run time only map
        virtual regions that begin and end on page boundaries (which are
        guaranteed also to be cache line boundaries).
      
      The effect of this is that architectures with non-coherent DMA caches
      may run into memory corruption or kernel crashes with Unhandled
      kernel unaligned accesses exceptions.
      
      Fix the alignment by positioning the DMA area in front of the allocation
      and use memory at the end of the area for storing the orginal
      transfer_buffer pointer. This may have the added benefit of increased
      performance as the DMA area is now fully aligned on all architectures.
      
      Tested with Lantiq xRX200 (MIPS) and RPi Model B Rev 2 (ARM).
      
      Fixes: 3bc04e28 ("usb: dwc2: host: Get aligned DMA in a more supported way")
      Cc: <stable@vger.kernel.org>
      Reviewed-by: default avatarDouglas Anderson <dianders@chromium.org>
      Signed-off-by: default avatarAntti Seppälä <a.seppala@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      56406e01
    • Enric Balletbo i Serra's avatar
      usb: dwc3: rockchip: Fix PHY documentation links. · 33d8a2f6
      Enric Balletbo i Serra authored
      Commit 34962fb8 ("docs: Fix more broken references") replaced the
      broken reference to rockchip,dwc3-usb-phy.txt binding for the Qualcomm
      DWC3 binding (qcom-dwc3-usb-phy.txt). That's wrong, so replace that
      reference for the correct ones.
      
      Fixes: 34962fb8 ("docs: Fix more broken references")
      Reviewed-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Signed-off-by: default avatarEnric Balletbo i Serra <enric.balletbo@collabora.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      33d8a2f6
    • Peter Senna Tschudin's avatar
      tools: usb: ffs-test: Fix build on big endian systems · a2b22ddd
      Peter Senna Tschudin authored
      The tools/usb/ffs-test.c file defines cpu_to_le16/32 by using the C
      library htole16/32 function calls. However, cpu_to_le16/32 are used when
      initializing structures, i.e in a context where a function call is not
      allowed.
      
      It works fine on little endian systems because htole16/32 are defined by
      the C library as no-ops. But on big-endian systems, they are actually
      doing something, which might involve calling a function, causing build
      failures, such as:
      
         ffs-test.c:48:25: error: initializer element is not constant
          #define cpu_to_le32(x)  htole32(x)
                                  ^~~~~~~
         ffs-test.c:128:12: note: in expansion of macro ‘cpu_to_le32’
            .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC_V2),
                     ^~~~~~~~~~~
      
      To solve this, we code cpu_to_le16/32 in a way that allows them to be
      used when initializing structures. This fix was imported from
      meta-openembedded/android-tools/fix-big-endian-build.patch written by
      Thomas Petazzoni <thomas.petazzoni@free-electrons.com>.
      
      CC: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Signed-off-by: default avatarPeter Senna Tschudin <peter.senna@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      a2b22ddd
    • Benjamin Herrenschmidt's avatar
      usb: gadget: aspeed: Workaround memory ordering issue · bb286336
      Benjamin Herrenschmidt authored
      The Aspeed SoC has a memory ordering issue that (thankfully)
      only affects the USB gadget device. A read back is necessary
      after writing to memory and before letting the device DMA
      from it.
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      bb286336
    • Colin Ian King's avatar
      usb: dwc3: gadget: remove redundant variable maxpacket · 9566a7c7
      Colin Ian King authored
      Variable maxpacket is being assigned but is never used hence it is
      redundant and can be removed.
      
      Cleans up clang warning:
      warning: variable 'maxpacket' set but not used [-Wunused-but-set-variable]
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      9566a7c7
    • John Keeping's avatar
      usb: dwc2: avoid NULL dereferences · 89066b36
      John Keeping authored
      For unidirectional endpoints, the endpoint pointer will be NULL for the
      unused direction.  Check that the endpoint is active before
      dereferencing this pointer.
      
      Fixes: 1b4977c7 ("usb: dwc2: Update dwc2_handle_incomplete_isoc_in() function")
      Fixes: 689efb26 ("usb: dwc2: Update dwc2_handle_incomplete_isoc_out() function")
      Fixes: d8484552 ("usb: dwc2: Update GINTSTS_GOUTNAKEFF interrupt handling")
      Signed-off-by: default avatarJohn Keeping <john@metanate.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      89066b36
    • Randy Dunlap's avatar
      usb/phy: fix PPC64 build errors in phy-fsl-usb.c · a39ba90a
      Randy Dunlap authored
      Fix build errors when built for PPC64:
      These variables are only used on PPC32 so they don't need to be
      initialized for PPC64.
      
      ../drivers/usb/phy/phy-fsl-usb.c: In function 'usb_otg_start':
      ../drivers/usb/phy/phy-fsl-usb.c:865:3: error: '_fsl_readl' undeclared (first use in this function); did you mean 'fsl_readl'?
         _fsl_readl = _fsl_readl_be;
      ../drivers/usb/phy/phy-fsl-usb.c:865:16: error: '_fsl_readl_be' undeclared (first use in this function); did you mean 'fsl_readl'?
         _fsl_readl = _fsl_readl_be;
      ../drivers/usb/phy/phy-fsl-usb.c:866:3: error: '_fsl_writel' undeclared (first use in this function); did you mean 'fsl_writel'?
         _fsl_writel = _fsl_writel_be;
      ../drivers/usb/phy/phy-fsl-usb.c:866:17: error: '_fsl_writel_be' undeclared (first use in this function); did you mean 'fsl_writel'?
         _fsl_writel = _fsl_writel_be;
      ../drivers/usb/phy/phy-fsl-usb.c:868:16: error: '_fsl_readl_le' undeclared (first use in this function); did you mean 'fsl_readl'?
         _fsl_readl = _fsl_readl_le;
      ../drivers/usb/phy/phy-fsl-usb.c:869:17: error: '_fsl_writel_le' undeclared (first use in this function); did you mean 'fsl_writel'?
         _fsl_writel = _fsl_writel_le;
      
      and the sysfs "show" function return type should be ssize_t, not int:
      
      ../drivers/usb/phy/phy-fsl-usb.c:1042:49: error: initialization of 'ssize_t (*)(struct device *, struct device_attribute *, char *)' {aka 'long int (*)(struct device *, struct device_attribute *, char *)'} from incompatible pointer type 'int (*)(struct device *, struct device_attribute *, char *)' [-Werror=incompatible-pointer-types]
       static DEVICE_ATTR(fsl_usb2_otg_state, S_IRUGO, show_fsl_usb2_otg_state, NULL);
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Felipe Balbi <balbi@kernel.org>
      Cc: linux-usb@vger.kernel.org
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: linuxppc-dev@lists.ozlabs.org
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      a39ba90a
    • Dmitry Torokhov's avatar
      usb: dwc2: host: do not delay retries for CONTROL IN transfers · b3eb981b
      Dmitry Torokhov authored
      When handling split transactions we will try to delay retry after
      getting a NAK from the device. This works well for BULK transfers that
      can be polled for essentially forever. Unfortunately, on slower systems
      at boot time, when the kernel is busy enumerating all the devices (USB
      or not), we issue a bunch of control requests (reading device
      descriptors, etc). If we get a NAK for the IN part of the control
      request and delay retry for too long (because the system is busy), we
      may confuse the device when we finally get to reissue SSPLIT/CSPLIT IN
      and the device will respond with STALL. As a result we end up with
      failure to get device descriptor and will fail to enumerate the device:
      
      [    3.428801] usb 2-1.2.1: new full-speed USB device number 9 using dwc2
      [    3.508576] usb 2-1.2.1: device descriptor read/8, error -32
      [    3.699150] usb 2-1.2.1: device descriptor read/8, error -32
      [    3.891653] usb 2-1.2.1: new full-speed USB device number 10 using dwc2
      [    3.968859] usb 2-1.2.1: device descriptor read/8, error -32
      ...
      
      Let's not delay retries of split CONTROL IN transfers, as this allows us
      to reliably enumerate devices at boot time.
      
      Fixes: 38d2b5fb ("usb: dwc2: host: Don't retry NAKed transactions right away")
      Reviewed-by: default avatarDouglas Anderson <dianders@chromium.org>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      b3eb981b
    • Vladimir Zapolskiy's avatar
      usb: gadget: u_audio: protect stream runtime fields with stream spinlock · 56bc6158
      Vladimir Zapolskiy authored
      The change protects almost the whole body of u_audio_iso_complete()
      function by PCM stream lock, this is mainly sufficient to avoid a race
      between USB request completion and stream termination, the change
      prevents a possibility of invalid memory access in interrupt context
      by memcpy():
      
          Unable to handle kernel paging request at virtual address 00004e80
          pgd = c0004000
          [00004e80] *pgd=00000000
          Internal error: Oops: 817 [#1] PREEMPT SMP ARM
          CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: G         C   3.14.54+ #117
          task: da180b80 ti: da192000 task.ti: da192000
          PC is at memcpy+0x50/0x330
          LR is at 0xcdd92b0e
          pc : [<c029ef30>]    lr : [<cdd92b0e>]    psr: 20000193
          sp : da193ce4  ip : dd86ae26  fp : 0000b180
          r10: daf81680  r9 : 00000000  r8 : d58a01ea
          r7 : 2c0b43e4  r6 : acdfb08b  r5 : 01a271cf  r4 : 87389377
          r3 : 69469782  r2 : 00000020  r1 : daf82fe0  r0 : 00004e80
          Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
          Control: 10c5387d  Table: 2b70804a  DAC: 00000015
          Process ksoftirqd/0 (pid: 3, stack limit = 0xda192238)
      
      Also added a check for potential !runtime condition, commonly it is
      done by PCM_RUNTIME_CHECK(substream) in the beginning, however this
      does not completely prevent from oopses in u_audio_iso_complete(),
      because the proper protection scheme must be implemented in PCM
      library functions.
      
      An example of *not fixed* oops due to substream->runtime->*
      dereference by snd_pcm_running(substream) from
      snd_pcm_period_elapsed(), where substream->runtime is gone while
      waiting the substream lock:
      
          Unable to handle kernel paging request at virtual address 6b6b6b6b
          pgd = db7e4000
          [6b6b6b6b] *pgd=00000000
          CPU: 0 PID: 193 Comm: klogd Tainted: G         C   3.14.54+ #118
          task: db5ac500 ti: db60c000 task.ti: db60c000
          PC is at snd_pcm_period_elapsed+0x48/0xd8 [snd_pcm]
          LR is at snd_pcm_period_elapsed+0x40/0xd8 [snd_pcm]
          pc : [<>]    lr : [<>]    psr: 60000193
          Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
          Control: 10c5387d  Table: 2b7e404a  DAC: 00000015
          Process klogd (pid: 193, stack limit = 0xdb60c238)
          [<>] (snd_pcm_period_elapsed [snd_pcm]) from [<>] (udc_irq+0x500/0xbbc)
          [<>] (udc_irq) from [<>] (ci_irq+0x280/0x304)
          [<>] (ci_irq) from [<>] (handle_irq_event_percpu+0xa4/0x40c)
          [<>] (handle_irq_event_percpu) from [<>] (handle_irq_event+0x3c/0x5c)
          [<>] (handle_irq_event) from [<>] (handle_fasteoi_irq+0xc4/0x110)
          [<>] (handle_fasteoi_irq) from [<>] (generic_handle_irq+0x20/0x30)
          [<>] (generic_handle_irq) from [<>] (handle_IRQ+0x80/0xc0)
          [<>] (handle_IRQ) from [<>] (gic_handle_irq+0x3c/0x60)
          [<>] (gic_handle_irq) from [<>] (__irq_svc+0x44/0x78)
      Signed-off-by: default avatarVladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
      [erosca: W/o this patch, with minimal instrumentation [1], I can
               consistently reproduce BUG: KASAN: use-after-free [2]]
      
      [1] Instrumentation to reproduce issue [2]:
       diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
       index a72295c953bb..bd0b308024fe 100644
       --- a/drivers/usb/gadget/function/u_audio.c
       +++ b/drivers/usb/gadget/function/u_audio.c
       @@ -16,6 +16,7 @@
        #include <sound/core.h>
        #include <sound/pcm.h>
        #include <sound/pcm_params.h>
       +#include <linux/delay.h>
      
        #include "u_audio.h"
      
       @@ -147,6 +148,8 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
      
       	spin_unlock_irqrestore(&prm->lock, flags);
      
       +	udelay(500); //delay here to increase probability of parallel activities
       +
       	/* Pack USB load in ALSA ring buffer */
       	pending = prm->dma_bytes - hw_ptr;
      
      [2] After applying [1], below BUG occurs on Rcar-H3-Salvator-X board:
      ==================================================================
      BUG: KASAN: use-after-free in u_audio_iso_complete+0x24c/0x520 [u_audio]
      Read of size 8 at addr ffff8006cafcc248 by task swapper/0/0
      
      CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        WC      4.14.47+ #160
      Hardware name: Renesas Salvator-X board based on r8a7795 ES2.0+ (DT)
      Call trace:
      [<ffff2000080925ac>] dump_backtrace+0x0/0x364
      [<ffff200008092924>] show_stack+0x14/0x1c
      [<ffff200008f8dbcc>] dump_stack+0x108/0x174
      [<ffff2000083c71b8>] print_address_description+0x7c/0x32c
      [<ffff2000083c78e8>] kasan_report+0x324/0x354
      [<ffff2000083c6114>] __asan_load8+0x24/0x94
      [<ffff2000021d1b34>] u_audio_iso_complete+0x24c/0x520 [u_audio]
      [<ffff20000152fe50>] usb_gadget_giveback_request+0x480/0x4d0 [udc_core]
      [<ffff200001860ab8>] usbhsg_queue_done+0x100/0x130 [renesas_usbhs]
      [<ffff20000185f814>] usbhsf_pkt_handler+0x1a4/0x298 [renesas_usbhs]
      [<ffff20000185fb38>] usbhsf_irq_ready+0x128/0x178 [renesas_usbhs]
      [<ffff200001859cc8>] usbhs_interrupt+0x440/0x490 [renesas_usbhs]
      [<ffff2000081a0288>] __handle_irq_event_percpu+0x594/0xa58
      [<ffff2000081a07d0>] handle_irq_event_percpu+0x84/0x12c
      [<ffff2000081a0928>] handle_irq_event+0xb0/0x10c
      [<ffff2000081a8384>] handle_fasteoi_irq+0x1e0/0x2ec
      [<ffff20000819e5f8>] generic_handle_irq+0x2c/0x44
      [<ffff20000819f0d0>] __handle_domain_irq+0x190/0x194
      [<ffff20000808177c>] gic_handle_irq+0x80/0xac
      Exception stack(0xffff200009e97c80 to 0xffff200009e97dc0)
      7c80: 0000000000000000 0000000000000000 0000000000000003 ffff200008179298
      7ca0: ffff20000ae1c180 dfff200000000000 0000000000000000 ffff2000081f9a88
      7cc0: ffff200009eb5960 ffff200009e97cf0 0000000000001600 ffff0400041b064b
      7ce0: 0000000000000000 0000000000000002 0000000200000001 0000000000000001
      7d00: ffff20000842197c 0000ffff958c4970 0000000000000000 ffff8006da0d5b80
      7d20: ffff8006d4678498 0000000000000000 000000126bde0a8b ffff8006d4678480
      7d40: 0000000000000000 000000126bdbea64 ffff200008fd0000 ffff8006fffff980
      7d60: 00000000495f0018 ffff200009e97dc0 ffff200008b6c4ec ffff200009e97dc0
      7d80: ffff200008b6c4f0 0000000020000145 ffff8006da0d5b80 ffff8006d4678498
      7da0: ffffffffffffffff ffff8006d4678498 ffff200009e97dc0 ffff200008b6c4f0
      [<ffff200008084034>] el1_irq+0xb4/0x12c
      [<ffff200008b6c4f0>] cpuidle_enter_state+0x818/0x844
      [<ffff200008b6c59c>] cpuidle_enter+0x18/0x20
      [<ffff20000815f2e4>] call_cpuidle+0x98/0x9c
      [<ffff20000815f674>] do_idle+0x214/0x264
      [<ffff20000815facc>] cpu_startup_entry+0x20/0x24
      [<ffff200008fb09d8>] rest_init+0x30c/0x320
      [<ffff2000095f1338>] start_kernel+0x570/0x5b0
      ---<-snip->---
      
      Fixes: 132fcb46 ("usb: gadget: Add Audio Class 2.0 Driver")
      Signed-off-by: default avatarEugeniu Rosca <erosca@de.adit-jv.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      56bc6158
    • Vladimir Zapolskiy's avatar
      usb: gadget: u_audio: remove cached period bytes value · 773e53d5
      Vladimir Zapolskiy authored
      Substream period size potentially can be changed in runtime, however
      this is not accounted in the data copying routine, the change replaces
      the cached value with an actual value from substream runtime.
      
      As a side effect the change also removes a potential division by zero
      in u_audio_iso_complete() function, if there is a race with
      uac_pcm_hw_free(), which sets prm->period_size to 0.
      
      Fixes: 132fcb46 ("usb: gadget: Add Audio Class 2.0 Driver")
      Signed-off-by: default avatarVladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
      Signed-off-by: default avatarEugeniu Rosca <erosca@de.adit-jv.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      773e53d5
    • Vladimir Zapolskiy's avatar
      usb: gadget: u_audio: remove caching of stream buffer parameters · 96afb54e
      Vladimir Zapolskiy authored
      There is no necessity to copy PCM stream ring buffer area and size
      properties to UAC private data structure, these values can be got
      from substream itself.
      
      The change gives more control on substream and avoid stale caching.
      
      Fixes: 132fcb46 ("usb: gadget: Add Audio Class 2.0 Driver")
      Signed-off-by: default avatarVladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
      Signed-off-by: default avatarEugeniu Rosca <erosca@de.adit-jv.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      96afb54e
    • Joshua Frkuska's avatar
      usb: gadget: u_audio: update hw_ptr in iso_complete after data copied · 6b37bd78
      Joshua Frkuska authored
      In u_audio_iso_complete, the runtime hw_ptr is updated before the
      data is actually copied over to/from the buffer/dma area. When
      ALSA uses this hw_ptr, the data may not actually be available to
      be used. This causes trash/stale audio to play/record. This
      patch updates the hw_ptr after the data has been copied to avoid
      this.
      
      Fixes: 132fcb46 ("usb: gadget: Add Audio Class 2.0 Driver")
      Signed-off-by: default avatarJoshua Frkuska <joshua_frkuska@mentor.com>
      Signed-off-by: default avatarEugeniu Rosca <erosca@de.adit-jv.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      6b37bd78
    • Eugeniu Rosca's avatar
      usb: gadget: u_audio: fix pcm/card naming in g_audio_setup() · dfa042fa
      Eugeniu Rosca authored
      Fix below smatch (v0.5.0-4443-g69e9094e11c1) warnings:
      drivers/usb/gadget/function/u_audio.c:607 g_audio_setup() warn: strcpy() 'pcm_name' of unknown size might be too large for 'pcm->name'
      drivers/usb/gadget/function/u_audio.c:614 g_audio_setup() warn: strcpy() 'card_name' of unknown size might be too large for 'card->driver'
      drivers/usb/gadget/function/u_audio.c:615 g_audio_setup() warn: strcpy() 'card_name' of unknown size might be too large for 'card->shortname'
      
      Below commits performed a similar 's/strcpy/strlcpy/' rework:
      * v2.6.31 commit 8372d498 ("ALSA: ctxfi - Fix PCM device naming")
      * v4.14 commit 003d3e70 ("ALSA: ad1848: fix format string overflow warning")
      * v4.14 commit 6d8b04de ("ALSA: cs423x: fix format string overflow warning")
      
      Fixes: eb9fecb9 ("usb: gadget: f_uac2: split out audio core")
      Signed-off-by: default avatarEugeniu Rosca <erosca@de.adit-jv.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      dfa042fa
    • Eugeniu Rosca's avatar
      usb: gadget: f_uac2: fix error handling in afunc_bind (again) · e87581fe
      Eugeniu Rosca authored
      If usb_ep_autoconfig() fails (i.e. returns a null endpoint descriptor),
      we expect afunc_bind() to fail (i.e. return a negative error code).
      
      However, due to v4.10-rc1 commit f1d3861d ("usb: gadget: f_uac2: fix
      error handling at afunc_bind"), afunc_bind() returns zero, telling the
      caller that it succeeded. This then generates NULL pointer dereference
      in below scenario on Rcar H3-ES20-Salvator-X target:
      
      rcar-gen3:/home/root# modprobe g_audio
      [  626.521155] g_audio gadget: afunc_bind:565 Error!
      [  626.526319] g_audio gadget: Linux USB Audio Gadget, version: Feb 2, 2012
      [  626.533405] g_audio gadget: g_audio ready
      rcar-gen3:/home/root#
      rcar-gen3:/home/root# modprobe -r g_audio
      [  728.256707] ==================================================================
      [  728.264293] BUG: KASAN: null-ptr-deref in u_audio_stop_capture+0x70/0x268 [u_audio]
      [  728.272244] Read of size 8 at addr 00000000000000a0 by task modprobe/2545
      [  728.279309]
      [  728.280849] CPU: 0 PID: 2545 Comm: modprobe Tainted: G        WC      4.14.47+ #152
      [  728.288778] Hardware name: Renesas Salvator-X board based on r8a7795 ES2.0+ (DT)
      [  728.296454] Call trace:
      [  728.299151] [<ffff2000080925ac>] dump_backtrace+0x0/0x364
      [  728.304808] [<ffff200008092924>] show_stack+0x14/0x1c
      [  728.310081] [<ffff200008f8d5cc>] dump_stack+0x108/0x174
      [  728.315522] [<ffff2000083c77c8>] kasan_report+0x1fc/0x354
      [  728.321134] [<ffff2000083c611c>] __asan_load8+0x24/0x94
      [  728.326600] [<ffff2000021e1618>] u_audio_stop_capture+0x70/0x268 [u_audio]
      [  728.333735] [<ffff2000021f8b7c>] afunc_disable+0x44/0x60 [usb_f_uac2]
      [  728.340503] [<ffff20000218177c>] usb_remove_function+0x9c/0x210 [libcomposite]
      [  728.348060] [<ffff200002183320>] remove_config.isra.2+0x1d8/0x218 [libcomposite]
      [  728.355788] [<ffff200002186c54>] __composite_unbind+0x104/0x1f8 [libcomposite]
      [  728.363339] [<ffff200002186d58>] composite_unbind+0x10/0x18 [libcomposite]
      [  728.370536] [<ffff20000152f158>] usb_gadget_remove_driver+0xc0/0x170 [udc_core]
      [  728.378172] [<ffff20000153154c>] usb_gadget_unregister_driver+0x1cc/0x258 [udc_core]
      [  728.386274] [<ffff200002180de8>] usb_composite_unregister+0x10/0x18 [libcomposite]
      [  728.394116] [<ffff2000021d035c>] audio_driver_exit+0x14/0x28 [g_audio]
      [  728.400878] [<ffff200008213ed4>] SyS_delete_module+0x288/0x32c
      [  728.406935] Exception stack(0xffff8006cf6c7ec0 to 0xffff8006cf6c8000)
      [  728.413624] 7ec0: 0000000006136428 0000000000000800 0000000000000000 0000ffffd706efe8
      [  728.421718] 7ee0: 0000ffffd706efe9 000000000000000a 1999999999999999 0000000000000000
      [  728.429792] 7f00: 000000000000006a 000000000042c078 0000000000000000 0000000000000005
      [  728.437870] 7f20: 0000000000000000 0000000000000000 0000000000000004 0000000000000000
      [  728.445952] 7f40: 000000000042bfc8 0000ffffbc7c8f40 0000000000000000 00000000061363c0
      [  728.454035] 7f60: 0000000006136428 0000000000000000 0000000000000000 0000000006136428
      [  728.462114] 7f80: 000000000042c000 0000ffffd7071448 000000000042c000 0000000000000000
      [  728.470190] 7fa0: 00000000061350c0 0000ffffd7070010 000000000041129c 0000ffffd7070010
      [  728.478281] 7fc0: 0000ffffbc7c8f48 0000000060000000 0000000006136428 000000000000006a
      [  728.486351] 7fe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
      [  728.494434] [<ffff200008084780>] el0_svc_naked+0x34/0x38
      [  728.499957] ==================================================================
      [  728.507801] Unable to handle kernel NULL pointer dereference at virtual address 000000a0
      [  728.517742] Mem abort info:
      [  728.520993]   Exception class = DABT (current EL), IL = 32 bits
      [  728.527375]   SET = 0, FnV = 0
      [  728.530731]   EA = 0, S1PTW = 0
      [  728.534361] Data abort info:
      [  728.537650]   ISV = 0, ISS = 0x00000006
      [  728.541863]   CM = 0, WnR = 0
      [  728.545167] user pgtable: 4k pages, 48-bit VAs, pgd = ffff8006c6100000
      [  728.552156] [00000000000000a0] *pgd=0000000716a8d003
      [  728.557519] , *pud=00000007116fc003
      [  728.561259] , *pmd=0000000000000000
      [  728.564985] Internal error: Oops: 96000006 [#1] PREEMPT SMP
      [  728.570815] Modules linked in:
      [  728.574023]  usb_f_uac2
      [  728.576560]  u_audio
      [  728.578827]  g_audio(-)
      [  728.581361]  libcomposite
      [  728.584071]  configfs
      [  728.586428]  aes_ce_blk
      [  728.588960]  sata_rcar
      [  728.591421]  crypto_simd
      [  728.594039]  cryptd
      [  728.596217]  libata
      [  728.598396]  aes_ce_cipher
      [  728.601188]  crc32_ce
      [  728.603542]  ghash_ce
      [  728.605896]  gf128mul
      [  728.608250]  aes_arm64
      [  728.610692]  scsi_mod
      [  728.613046]  sha2_ce
      [  728.615313]  xhci_plat_hcd
      [  728.618106]  sha256_arm64
      [  728.620811]  sha1_ce
      [  728.623077]  renesas_usbhs
      [  728.625869]  xhci_hcd
      [  728.628243]  renesas_usb3
      [  728.630948]  sha1_generic
      [  728.633670]  ravb_streaming(C)
      [  728.636814]  udc_core
      [  728.639168]  cpufreq_dt
      [  728.641697]  rcar_gen3_thermal
      [  728.644840]  usb_dmac
      [  728.647194]  pwm_rcar
      [  728.649548]  thermal_sys
      [  728.652165]  virt_dma
      [  728.654519]  mch_core(C)
      [  728.657137]  pwm_bl
      [  728.659315]  snd_soc_rcar
      [  728.662020]  snd_aloop
      [  728.664462]  snd_soc_generic_card
      [  728.667869]  snd_soc_ak4613
      [  728.670749]  ipv6
      [  728.672768]  autofs4
      [  728.675052] CPU: 0 PID: 2545 Comm: modprobe Tainted: G    B   WC      4.14.47+ #152
      [  728.682973] Hardware name: Renesas Salvator-X board based on r8a7795 ES2.0+ (DT)
      [  728.690637] task: ffff8006ced38000 task.stack: ffff8006cf6c0000
      [  728.696814] PC is at u_audio_stop_capture+0x70/0x268 [u_audio]
      [  728.702896] LR is at u_audio_stop_capture+0x70/0x268 [u_audio]
      [  728.708964] pc : [<ffff2000021e1618>] lr : [<ffff2000021e1618>] pstate: 60000145
      [  728.716620] sp : ffff8006cf6c7a50
      [  728.720154] x29: ffff8006cf6c7a50
      [  728.723760] x28: ffff8006ced38000
      [  728.727272] x27: ffff200008fd7000
      [  728.730857] x26: ffff2000021d2340
      [  728.734361] x25: 0000000000000000
      [  728.737948] x24: ffff200009e94b08
      [  728.741452] x23: 00000000000000a0
      [  728.745052] x22: 00000000000000a8
      [  728.748558] x21: 1ffff000d9ed8f7c
      [  728.752142] x20: ffff8006d671a800
      [  728.755646] x19: 0000000000000000
      [  728.759231] x18: 0000000000000000
      [  728.762736] x17: 0000ffffbc7c8f40
      [  728.766320] x16: ffff200008213c4c
      [  728.769823] x15: 0000000000000000
      [  728.773408] x14: 0720072007200720
      [  728.776912] x13: 0720072007200720
      [  728.780497] x12: ffffffffffffffff
      [  728.784001] x11: 0000000000000040
      [  728.787598] x10: 0000000000001600
      [  728.791103] x9 : ffff8006cf6c77a0
      [  728.794689] x8 : ffff8006ced39660
      [  728.798193] x7 : ffff20000811c738
      [  728.801794] x6 : 0000000000000000
      [  728.805299] x5 : dfff200000000000
      [  728.808885] x4 : ffff8006ced38000
      [  728.812390] x3 : ffff200008fb46e8
      [  728.815976] x2 : 0000000000000007
      [  728.819480] x1 : 3ba68643e7431500
      [  728.823066] x0 : 0000000000000000
      [  728.826574] Process modprobe (pid: 2545, stack limit = 0xffff8006cf6c0000)
      [  728.833704] Call trace:
      [  728.836292] Exception stack(0xffff8006cf6c7910 to 0xffff8006cf6c7a50)
      [  728.842987] 7900:                                   0000000000000000 3ba68643e7431500
      [  728.851084] 7920: 0000000000000007 ffff200008fb46e8 ffff8006ced38000 dfff200000000000
      [  728.859173] 7940: 0000000000000000 ffff20000811c738 ffff8006ced39660 ffff8006cf6c77a0
      [  728.867248] 7960: 0000000000001600 0000000000000040 ffffffffffffffff 0720072007200720
      [  728.875323] 7980: 0720072007200720 0000000000000000 ffff200008213c4c 0000ffffbc7c8f40
      [  728.883412] 79a0: 0000000000000000 0000000000000000 ffff8006d671a800 1ffff000d9ed8f7c
      [  728.891485] 79c0: 00000000000000a8 00000000000000a0 ffff200009e94b08 0000000000000000
      [  728.899561] 79e0: ffff2000021d2340 ffff200008fd7000 ffff8006ced38000 ffff8006cf6c7a50
      [  728.907636] 7a00: ffff2000021e1618 ffff8006cf6c7a50 ffff2000021e1618 0000000060000145
      [  728.915710] 7a20: 0000000000000008 0000000000000000 0000ffffffffffff 3ba68643e7431500
      [  728.923780] 7a40: ffff8006cf6c7a50 ffff2000021e1618
      [  728.928880] [<ffff2000021e1618>] u_audio_stop_capture+0x70/0x268 [u_audio]
      [  728.936032] [<ffff2000021f8b7c>] afunc_disable+0x44/0x60 [usb_f_uac2]
      [  728.942822] [<ffff20000218177c>] usb_remove_function+0x9c/0x210 [libcomposite]
      [  728.950385] [<ffff200002183320>] remove_config.isra.2+0x1d8/0x218 [libcomposite]
      [  728.958134] [<ffff200002186c54>] __composite_unbind+0x104/0x1f8 [libcomposite]
      [  728.965689] [<ffff200002186d58>] composite_unbind+0x10/0x18 [libcomposite]
      [  728.972882] [<ffff20000152f158>] usb_gadget_remove_driver+0xc0/0x170 [udc_core]
      [  728.980522] [<ffff20000153154c>] usb_gadget_unregister_driver+0x1cc/0x258 [udc_core]
      [  728.988638] [<ffff200002180de8>] usb_composite_unregister+0x10/0x18 [libcomposite]
      [  728.996472] [<ffff2000021d035c>] audio_driver_exit+0x14/0x28 [g_audio]
      [  729.003231] [<ffff200008213ed4>] SyS_delete_module+0x288/0x32c
      [  729.009278] Exception stack(0xffff8006cf6c7ec0 to 0xffff8006cf6c8000)
      [  729.015946] 7ec0: 0000000006136428 0000000000000800 0000000000000000 0000ffffd706efe8
      [  729.024022] 7ee0: 0000ffffd706efe9 000000000000000a 1999999999999999 0000000000000000
      [  729.032099] 7f00: 000000000000006a 000000000042c078 0000000000000000 0000000000000005
      [  729.040172] 7f20: 0000000000000000 0000000000000000 0000000000000004 0000000000000000
      [  729.048263] 7f40: 000000000042bfc8 0000ffffbc7c8f40 0000000000000000 00000000061363c0
      [  729.056337] 7f60: 0000000006136428 0000000000000000 0000000000000000 0000000006136428
      [  729.064411] 7f80: 000000000042c000 0000ffffd7071448 000000000042c000 0000000000000000
      [  729.072484] 7fa0: 00000000061350c0 0000ffffd7070010 000000000041129c 0000ffffd7070010
      [  729.080563] 7fc0: 0000ffffbc7c8f48 0000000060000000 0000000006136428 000000000000006a
      [  729.088636] 7fe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
      [  729.096733] [<ffff200008084780>] el0_svc_naked+0x34/0x38
      [  729.102259] Code: 9597d1b3 aa1703e0 9102a276 958792b9 (f9405275)
      [  729.108617] ---[ end trace 7560c5fa3d100243 ]---
      
      After this patch is applied, the issue is fixed:
      rcar-gen3:/home/root# modprobe g_audio
      [   59.217127] g_audio gadget: afunc_bind:565 Error!
      [   59.222329] g_audio ee020000.usb: failed to start g_audio: -19
      modprobe: ERROR: could not insert 'g_audio': No such device
      rcar-gen3:/home/root# modprobe -r g_audio
      rcar-gen3:/home/root#
      
      Fixes: f1d3861d ("usb: gadget: f_uac2: fix error handling at afunc_bind")
      Signed-off-by: default avatarEugeniu Rosca <erosca@de.adit-jv.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      e87581fe
    • Jia-Ju Bai's avatar
      usb: gadget: r8a66597: Fix a possible sleep-in-atomic-context bugs in r8a66597_queue() · f36b507c
      Jia-Ju Bai authored
      The driver may sleep in an interrupt handler.
      The function call path (from bottom to top) in Linux-4.16.7 is:
      
      [FUNC] r8a66597_queue(GFP_KERNEL)
      drivers/usb/gadget/udc/r8a66597-udc.c, 1193:
      		r8a66597_queue in get_status
      drivers/usb/gadget/udc/r8a66597-udc.c, 1301:
      		get_status in setup_packet
      drivers/usb/gadget/udc/r8a66597-udc.c, 1381:
      		setup_packet in irq_control_stage
      drivers/usb/gadget/udc/r8a66597-udc.c, 1508:
      		irq_control_stage in r8a66597_irq (interrupt handler)
      
      To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.
      
      This bug is found by my static analysis tool (DSAC-2) and checked by
      my code review.
      Signed-off-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      f36b507c
    • Jia-Ju Bai's avatar
      usb: gadget: r8a66597: Fix two possible sleep-in-atomic-context bugs in init_controller() · 0602088b
      Jia-Ju Bai authored
      The driver may sleep with holding a spinlock.
      The function call paths (from bottom to top) in Linux-4.16.7 are:
      
      [FUNC] msleep
      drivers/usb/gadget/udc/r8a66597-udc.c, 839:
      		msleep in init_controller
      drivers/usb/gadget/udc/r8a66597-udc.c, 96:
      		init_controller in r8a66597_usb_disconnect
      drivers/usb/gadget/udc/r8a66597-udc.c, 93:
      		spin_lock in r8a66597_usb_disconnect
      
      [FUNC] msleep
      drivers/usb/gadget/udc/r8a66597-udc.c, 835:
      		msleep in init_controller
      drivers/usb/gadget/udc/r8a66597-udc.c, 96:
      		init_controller in r8a66597_usb_disconnect
      drivers/usb/gadget/udc/r8a66597-udc.c, 93:
      		spin_lock in r8a66597_usb_disconnect
      
      To fix these bugs, msleep() is replaced with mdelay().
      
      This bug is found by my static analysis tool (DSAC-2) and checked by
      my code review.
      Signed-off-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      0602088b
    • Benjamin Herrenschmidt's avatar
      usb: gadget: Fix OS descriptors support · 50b9773c
      Benjamin Herrenschmidt authored
      The current code is broken as it re-defines "req" inside the
      if block, then goto out of it. Thus the request that ends
      up being sent is not the one that was populated by the
      code in question.
      
      This fixes RNDIS driver autodetect by Windows 10 for me.
      
      The bug was introduced by Chris rework to remove the local
      queuing inside the if { } block of the redefined request.
      
      Fixes: 636ba13a ("usb: gadget: composite: remove duplicated code in OS desc handling")
      Cc: <stable@vger.kernel.org> # v4.17
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      50b9773c
    • Benjamin Herrenschmidt's avatar
      usb: gadget: aspeed-vhub: Fix SETUP packets with OUT data phase · 9196b55e
      Benjamin Herrenschmidt authored
      A couple of bugs in the driver are preventing SETUP packets
      with an OUT data phase from working properly.
      
      Interestingly those are incredibly rare (RNDIS typically
      uses them and thus is broken without this fix).
      
      The main problem was an incorrect register offset being
      applied for arming RX on EP0. The other problem relates
      to stalling such a packet before the data phase, in which
      case we don't get an ACK cycle, and get the next SETUP
      packet directly, so we shouldn't reject it.
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      9196b55e
  3. 16 Jul, 2018 3 commits
  4. 15 Jul, 2018 2 commits
  5. 14 Jul, 2018 13 commits