From: Jim Lin <jilin@nvidia.com>
To: <balbi@kernel.org>
Cc: <linux-usb@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
Jim Lin <jilin@nvidia.com>
Subject: [PATCH] usb: gadget: f_fs: Fix kernel panic for SuperSpeed
Date: Fri, 22 Apr 2016 18:43:00 +0800 [thread overview]
Message-ID: <1461321780-3226-1-git-send-email-jilin@nvidia.com> (raw)
Android N adds os_desc_compat in v2_descriptor by init_functionfs()
(system/core/adb/usb_linux_client.cpp) to support automatic install
of MTP driver on Windows for USB device mode.
Current __ffs_data_do_os_desc() of f_fs.c will check reserved1 field
and return -EINVAL.
This results in a second adb_write of usb_linux_client.cpp
(system/core/adb/) which doesn't have ss_descriptors filled.
Then later kernel_panic (composite.c) occurs when ss_descriptors
as a pointer with NULL is being accessed.
Fix is to ignore the checking on reserved1 field so that first
adb_write goes successfully with v2_descriptor which has
ss_descriptors filled.
Signed-off-by: Jim Lin <jilin@nvidia.com>
---
drivers/usb/gadget/function/f_fs.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 73515d5..f5ea3df 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2050,8 +2050,7 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
int i;
if (len < sizeof(*d) ||
- d->bFirstInterfaceNumber >= ffs->interfaces_count ||
- d->Reserved1)
+ d->bFirstInterfaceNumber >= ffs->interfaces_count)
return -EINVAL;
for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
if (d->Reserved2[i])
--
1.9.1
next reply other threads:[~2016-04-22 10:43 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-04-22 10:43 Jim Lin [this message]
2016-04-22 11:21 ` [PATCH] usb: gadget: f_fs: Fix kernel panic for SuperSpeed Lars-Peter Clausen
2016-04-22 11:52 ` Felipe Balbi
2016-04-25 11:32 ` Jim Lin
2016-04-25 12:01 ` Felipe Balbi
2016-04-26 8:49 ` Jim Lin
2016-04-28 11:16 ` Jim Lin
2016-04-28 12:21 ` Felipe Balbi
2016-04-29 11:27 ` Jim Lin
2016-04-29 11:57 ` Felipe Balbi
2016-05-04 8:07 ` Jim Lin
2016-05-04 10:37 ` Felipe Balbi
2016-05-05 10:35 ` Jim Lin
2016-05-06 6:44 ` Felipe Balbi
2016-05-06 2:37 ` Jim Lin
2016-04-29 15:28 ` Mathias Nyman
2016-05-02 6:23 ` Felipe Balbi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1461321780-3226-1-git-send-email-jilin@nvidia.com \
--to=jilin@nvidia.com \
--cc=balbi@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).