From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Subject: [PATCH 4.19 34/81] usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior
Date: Wed, 16 Oct 2019 14:50:45 -0700 [thread overview]
Message-ID: <20191016214834.753707258@linuxfoundation.org> (raw)
In-Reply-To: <20191016214805.727399379@linuxfoundation.org>
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
commit 4d599cd3a097a85a5c68a2c82b9a48cddf9953ec upstream.
According to usb_ep_set_halt()'s description,
__usbhsg_ep_set_halt_wedge() should return -EAGAIN if the IN endpoint
has any queue or data. Otherwise, this driver is possible to cause
just STALL without sending a short packet data on g_mass_storage driver,
and then a few resetting a device happens on a host side during
a usb enumaration.
Fixes: 2f98382dcdfe ("usb: renesas_usbhs: Add Renesas USBHS Gadget")
Cc: <stable@vger.kernel.org> # v3.0+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1569924633-322-3-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/renesas_usbhs/common.h | 1 +
drivers/usb/renesas_usbhs/fifo.c | 2 +-
drivers/usb/renesas_usbhs/fifo.h | 1 +
drivers/usb/renesas_usbhs/mod_gadget.c | 16 +++++++++++++++-
drivers/usb/renesas_usbhs/pipe.c | 15 +++++++++++++++
drivers/usb/renesas_usbhs/pipe.h | 1 +
6 files changed, 34 insertions(+), 2 deletions(-)
--- a/drivers/usb/renesas_usbhs/common.h
+++ b/drivers/usb/renesas_usbhs/common.h
@@ -207,6 +207,7 @@ struct usbhs_priv;
/* DCPCTR */
#define BSTS (1 << 15) /* Buffer Status */
#define SUREQ (1 << 14) /* Sending SETUP Token */
+#define INBUFM (1 << 14) /* (PIPEnCTR) Transfer Buffer Monitor */
#define CSSTS (1 << 12) /* CSSTS Status */
#define ACLRM (1 << 9) /* Buffer Auto-Clear Mode */
#define SQCLR (1 << 8) /* Toggle Bit Clear */
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -89,7 +89,7 @@ static void __usbhsf_pkt_del(struct usbh
list_del_init(&pkt->node);
}
-static struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe)
+struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe)
{
return list_first_entry_or_null(&pipe->list, struct usbhs_pkt, node);
}
--- a/drivers/usb/renesas_usbhs/fifo.h
+++ b/drivers/usb/renesas_usbhs/fifo.h
@@ -97,5 +97,6 @@ void usbhs_pkt_push(struct usbhs_pipe *p
void *buf, int len, int zero, int sequence);
struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt);
void usbhs_pkt_start(struct usbhs_pipe *pipe);
+struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe);
#endif /* RENESAS_USB_FIFO_H */
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -721,6 +721,7 @@ static int __usbhsg_ep_set_halt_wedge(st
struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
struct device *dev = usbhsg_gpriv_to_dev(gpriv);
unsigned long flags;
+ int ret = 0;
dev_dbg(dev, "set halt %d (pipe %d)\n",
halt, usbhs_pipe_number(pipe));
@@ -728,6 +729,18 @@ static int __usbhsg_ep_set_halt_wedge(st
/******************** spin lock ********************/
usbhs_lock(priv, flags);
+ /*
+ * According to usb_ep_set_halt()'s description, this function should
+ * return -EAGAIN if the IN endpoint has any queue or data. Note
+ * that the usbhs_pipe_is_dir_in() returns false if the pipe is an
+ * IN endpoint in the gadget mode.
+ */
+ if (!usbhs_pipe_is_dir_in(pipe) && (__usbhsf_pkt_get(pipe) ||
+ usbhs_pipe_contains_transmittable_data(pipe))) {
+ ret = -EAGAIN;
+ goto out;
+ }
+
if (halt)
usbhs_pipe_stall(pipe);
else
@@ -738,10 +751,11 @@ static int __usbhsg_ep_set_halt_wedge(st
else
usbhsg_status_clr(gpriv, USBHSG_STATUS_WEDGE);
+out:
usbhs_unlock(priv, flags);
/******************** spin unlock ******************/
- return 0;
+ return ret;
}
static int usbhsg_ep_set_halt(struct usb_ep *ep, int value)
--- a/drivers/usb/renesas_usbhs/pipe.c
+++ b/drivers/usb/renesas_usbhs/pipe.c
@@ -277,6 +277,21 @@ int usbhs_pipe_is_accessible(struct usbh
return -EBUSY;
}
+bool usbhs_pipe_contains_transmittable_data(struct usbhs_pipe *pipe)
+{
+ u16 val;
+
+ /* Do not support for DCP pipe */
+ if (usbhs_pipe_is_dcp(pipe))
+ return false;
+
+ val = usbhsp_pipectrl_get(pipe);
+ if (val & INBUFM)
+ return true;
+
+ return false;
+}
+
/*
* PID ctrl
*/
--- a/drivers/usb/renesas_usbhs/pipe.h
+++ b/drivers/usb/renesas_usbhs/pipe.h
@@ -83,6 +83,7 @@ void usbhs_pipe_clear(struct usbhs_pipe
void usbhs_pipe_clear_without_sequence(struct usbhs_pipe *pipe,
int needs_bfre, int bfre_enable);
int usbhs_pipe_is_accessible(struct usbhs_pipe *pipe);
+bool usbhs_pipe_contains_transmittable_data(struct usbhs_pipe *pipe);
void usbhs_pipe_enable(struct usbhs_pipe *pipe);
void usbhs_pipe_disable(struct usbhs_pipe *pipe);
void usbhs_pipe_stall(struct usbhs_pipe *pipe);
next prev parent reply other threads:[~2019-10-16 22:10 UTC|newest]
Thread overview: 104+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-16 21:50 [PATCH 4.19 00/81] 4.19.80-stable review Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 01/81] panic: ensure preemption is disabled during panic() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 02/81] f2fs: use EINVAL for superblock with invalid magic Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 03/81] USB: rio500: Remove Rio 500 kernel driver Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 04/81] USB: yurex: Dont retry on unexpected errors Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 05/81] USB: yurex: fix NULL-derefs on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 06/81] USB: usb-skeleton: fix runtime PM after driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 07/81] USB: usb-skeleton: fix NULL-deref on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 08/81] xhci: Fix false warning message about wrong bounce buffer write length Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 09/81] xhci: Prevent device initiated U1/U2 link pm if exit latency is too long Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 10/81] xhci: Check all endpoints for LPM timeout Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 11/81] xhci: Fix USB 3.1 capability detection on early xHCI 1.1 spec based hosts Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 12/81] usb: xhci: wait for CNR controller not ready bit in xhci resume Greg Kroah-Hartman
2019-10-18 17:28 ` Pavel Machek
2019-10-16 21:50 ` [PATCH 4.19 13/81] xhci: Prevent deadlock when xhci adapter breaks during init Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 14/81] xhci: Increase STS_SAVE timeout in xhci_suspend() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 15/81] USB: adutux: fix use-after-free on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 16/81] USB: adutux: fix NULL-derefs " Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 17/81] USB: adutux: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 18/81] USB: iowarrior: fix use-after-free on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 19/81] USB: iowarrior: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 20/81] USB: iowarrior: fix use-after-free after driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 21/81] USB: usblp: fix runtime PM " Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 22/81] USB: chaoskey: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 23/81] USB: ldusb: fix NULL-derefs on driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 24/81] serial: uartlite: fix exit path null pointer Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 25/81] USB: serial: keyspan: fix NULL-derefs on open() and write() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 26/81] USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 27/81] USB: serial: option: add Telit FN980 compositions Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 28/81] USB: serial: option: add support for Cinterion CLS8 devices Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 29/81] USB: serial: fix runtime PM after driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 30/81] USB: usblcd: fix I/O after disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 31/81] USB: microtek: fix info-leak at probe Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 32/81] USB: dummy-hcd: fix power budget for SuperSpeed mode Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 33/81] usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}() Greg Kroah-Hartman
2019-10-16 21:50 ` Greg Kroah-Hartman [this message]
2019-10-16 21:50 ` [PATCH 4.19 35/81] USB: legousbtower: fix slab info leak at probe Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 36/81] USB: legousbtower: fix deadlock on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 37/81] USB: legousbtower: fix potential NULL-deref " Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 38/81] USB: legousbtower: fix open after failed reset request Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 39/81] USB: legousbtower: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 40/81] mei: me: add comet point (lake) LP device ids Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 41/81] mei: avoid FW version request on Ibex Peak and earlier Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 42/81] gpio: eic: sprd: Fix the incorrect EIC offset when toggling Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 43/81] Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 44/81] staging: vt6655: Fix memory leak in vt6655_probe Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 45/81] iio: adc: hx711: fix bug in sampling of data Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 46/81] iio: adc: ad799x: fix probe error handling Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 47/81] iio: adc: axp288: Override TS pin bias current for some models Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 48/81] iio: light: opt3001: fix mutex unlock race Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 49/81] efivar/ssdt: Dont iterate over EFI vars if no SSDT override was specified Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 50/81] perf llvm: Dont access out-of-scope array Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 51/81] perf inject jit: Fix JIT_CODE_MOVE filename Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 52/81] blk-wbt: fix performance regression in wbt scale_up/scale_down Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 53/81] CIFS: Gracefully handle QueryInfo errors during open Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 54/81] CIFS: Force revalidate inode when dentry is stale Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 55/81] CIFS: Force reval dentry if LOOKUP_REVAL flag is set Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 56/81] kernel/sysctl.c: do not override max_threads provided by userspace Greg Kroah-Hartman
2019-10-17 10:59 ` Pavel Machek
2019-10-17 11:05 ` Michal Hocko
2019-10-17 11:25 ` David Laight
2019-10-17 11:39 ` Michal Hocko
2019-11-18 15:25 ` Pavel Machek
2019-11-18 15:52 ` Michal Hocko
2019-10-16 21:51 ` [PATCH 4.19 57/81] mm/vmpressure.c: fix a signedness bug in vmpressure_register_event() Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 58/81] firmware: google: increment VPD key_len properly Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 59/81] gpiolib: dont clear FLAG_IS_OUT when emulating open-drain/open-source Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 60/81] iio: adc: stm32-adc: move registers definitions Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 61/81] iio: adc: stm32-adc: fix a race when using several adcs with dma and irq Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 62/81] cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic Greg Kroah-Hartman
2019-10-17 8:55 ` Pavel Machek
2019-10-17 16:01 ` Greg Kroah-Hartman
2019-10-17 17:19 ` Sasha Levin
2019-10-16 21:51 ` [PATCH 4.19 63/81] btrfs: fix incorrect updating of log root tree Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 64/81] btrfs: fix uninitialized ret in ref-verify Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 65/81] NFS: Fix O_DIRECT accounting of number of bytes read/written Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 66/81] MIPS: Disable Loongson MMI instructions for kernel build Greg Kroah-Hartman
2020-08-26 21:06 ` Guenter Roeck
2020-09-03 9:26 ` Greg Kroah-Hartman
2020-09-07 3:35 ` Philippe Mathieu-Daudé
2020-09-24 13:54 ` Thomas Bogendoerfer
2019-10-16 21:51 ` [PATCH 4.19 67/81] MIPS: elf_hwcap: Export userspace ASEs Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 68/81] ACPICA: ACPI 6.3: PPTT add additional fields in Processor Structure Flags Greg Kroah-Hartman
2019-10-17 8:59 ` Pavel Machek
2019-10-17 15:59 ` Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 69/81] ACPI/PPTT: Add support for ACPI 6.3 thread flag Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 70/81] arm64: topology: Use PPTT to determine if PE is a thread Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 71/81] Fix the locking in dcache_readdir() and friends Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 72/81] media: stkwebcam: fix runtime PM after driver unbind Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 73/81] arm64/sve: Fix wrong free for task->thread.sve_state Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 74/81] tracing/hwlat: Report total time spent in all NMIs during the sample Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 75/81] tracing/hwlat: Dont ignore outer-loop duration when calculating max_latency Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 76/81] ftrace: Get a reference counter for the trace_array on filter files Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 77/81] tracing: Get trace_array reference for available_tracers files Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 78/81] hwmon: Fix HWMON_P_MIN_ALARM mask Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 79/81] x86/asm: Fix MWAITX C-state hint value Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 80/81] PCI: vmd: Fix config addressing when using bus offsets Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 81/81] perf/hw_breakpoint: Fix arch_hw_breakpoint use-before-initialization Greg Kroah-Hartman
2019-10-17 4:42 ` [PATCH 4.19 00/81] 4.19.80-stable review kernelci.org bot
2019-10-17 13:50 ` Naresh Kamboju
2019-10-17 15:02 ` shuah
2019-10-17 18:04 ` Guenter Roeck
2019-10-17 18:35 ` Didik Setiawan
2019-10-18 8:00 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191016214834.753707258@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yoshihiro.shimoda.uh@renesas.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).