kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/gadget
History
Krzysztof Opasiak db67ff3a09 usb: gadget: configfs: Fix interfaces array NULL-termination 
commit 903124fe1a upstream.

memset() to 0 interfaces array before reusing
usb_configuration structure.

This commit fix bug:

ln -s functions/acm.1 configs/c.1
ln -s functions/acm.2 configs/c.1
ln -s functions/acm.3 configs/c.1
echo "UDC name" > UDC
echo "" > UDC
rm configs/c.1/acm.*
rmdir functions/*
mkdir functions/ecm.usb0
ln -s functions/ecm.usb0 configs/c.1
echo "UDC name" > UDC

[   82.220969] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[   82.229009] pgd = c0004000
[   82.231698] [00000000] *pgd=00000000
[   82.235260] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[   82.240638] Modules linked in:
[   82.243681] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.0.0-rc2 #39
[   82.249926] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[   82.256003] task: c07cd2f0 ti: c07c8000 task.ti: c07c8000
[   82.261393] PC is at composite_setup+0xe3c/0x1674
[   82.266073] LR is at composite_setup+0xf20/0x1674
[   82.270760] pc : [<c03510d4>]    lr : [<c03511b8>]    psr: 600001d3
[   82.270760] sp : c07c9df0  ip : c0806448  fp : ed8c9c9c
[   82.282216] r10: 00000001  r9 : 00000000  r8 : edaae918
[   82.287425] r7 : ed551cc0  r6 : 00007fff  r5 : 00000000  r4 : ed799634
[   82.293934] r3 : 00000003  r2 : 00010002  r1 : edaae918  r0 : 0000002e
[   82.300446] Flags: nZCv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment kernel
[   82.307910] Control: 10c5387d  Table: 6bc1804a  DAC: 00000015
[   82.313638] Process swapper/0 (pid: 0, stack limit = 0xc07c8210)
[   82.319627] Stack: (0xc07c9df0 to 0xc07ca000)
[   82.323969] 9de0:                                     00000000 c06e65f4 00000000 c07c9f68
[   82.332130] 9e00: 00000067 c07c59ac 000003f7 edaae918 ed8c9c98 ed799690 eca2f140 200001d3
[   82.340289] 9e20: ee79a2d8 c07c9e88 c07c5304 ffff55db 00010002 edaae810 edaae860 eda96d50
[   82.348448] 9e40: 00000009 ee264510 00000007 c07ca444 edaae860 c0340890 c0827a40 ffff55e0
[   82.356607] 9e60: c0827a40 eda96e40 ee264510 edaae810 00000000 edaae860 00000007 c07ca444
[   82.364766] 9e80: edaae860 c0354170 c03407dc c033db4c edaae810 00000000 00000000 00000010
[   82.372925] 9ea0: 00000032 c0341670 00000000 00000000 00000001 eda96e00 00000000 00000000
[   82.381084] 9ec0: 00000000 00000032 c0803a23 ee1aa840 00000001 c005d54c 249e2450 00000000
[   82.389244] 9ee0: 200001d3 ee1aa840 ee1aa8a0 ed84f4c0 00000000 c07c9f68 00000067 c07c59ac
[   82.397403] 9f00: 00000000 c005d688 ee1aa840 ee1aa8a0 c07db4b4 c006009c 00000032 00000000
[   82.405562] 9f20: 00000001 c005ce20 c07c59ac c005cf34 f002000c c07ca780 c07c9f68 00000057
[   82.413722] 9f40: f0020000 413fc090 00000001 c00086b4 c000f804 60000053 ffffffff c07c9f9c
[   82.421880] 9f60: c0803a20 c0011fc0 00000000 00000000 c07c9fb8 c001bee0 c07ca4f0 c057004c
[   82.430040] 9f80: c07ca4fc c0803a20 c0803a20 413fc090 00000001 00000000 01000000 c07c9fb0
[   82.438199] 9fa0: c000f800 c000f804 60000053 ffffffff 00000000 c0050e70 c0803bc0 c0783bd8
[   82.446358] 9fc0: ffffffff ffffffff c0783664 00000000 00000000 c07b13e8 00000000 c0803e54
[   82.454517] 9fe0: c07ca480 c07b13e4 c07ce40c 4000406a 00000000 40008074 00000000 00000000
[   82.462689] [<c03510d4>] (composite_setup) from [<c0340890>] (s3c_hsotg_complete_setup+0xb4/0x418)
[   82.471626] [<c0340890>] (s3c_hsotg_complete_setup) from [<c0354170>] (usb_gadget_giveback_request+0xc/0x10)
[   82.481429] [<c0354170>] (usb_gadget_giveback_request) from [<c033db4c>] (s3c_hsotg_complete_request+0xcc/0x12c)
[   82.491583] [<c033db4c>] (s3c_hsotg_complete_request) from [<c0341670>] (s3c_hsotg_irq+0x4fc/0x558)
[   82.500614] [<c0341670>] (s3c_hsotg_irq) from [<c005d54c>] (handle_irq_event_percpu+0x50/0x150)
[   82.509291] [<c005d54c>] (handle_irq_event_percpu) from [<c005d688>] (handle_irq_event+0x3c/0x5c)
[   82.518145] [<c005d688>] (handle_irq_event) from [<c006009c>] (handle_fasteoi_irq+0xd4/0x18c)
[   82.526650] [<c006009c>] (handle_fasteoi_irq) from [<c005ce20>] (generic_handle_irq+0x20/0x30)
[   82.535242] [<c005ce20>] (generic_handle_irq) from [<c005cf34>] (__handle_domain_irq+0x6c/0xdc)
[   82.543923] [<c005cf34>] (__handle_domain_irq) from [<c00086b4>] (gic_handle_irq+0x2c/0x6c)
[   82.552256] [<c00086b4>] (gic_handle_irq) from [<c0011fc0>] (__irq_svc+0x40/0x74)
[   82.559716] Exception stack(0xc07c9f68 to 0xc07c9fb0)
[   82.564753] 9f60:                   00000000 00000000 c07c9fb8 c001bee0 c07ca4f0 c057004c
[   82.572913] 9f80: c07ca4fc c0803a20 c0803a20 413fc090 00000001 00000000 01000000 c07c9fb0
[   82.581069] 9fa0: c000f800 c000f804 60000053 ffffffff
[   82.586113] [<c0011fc0>] (__irq_svc) from [<c000f804>] (arch_cpu_idle+0x30/0x3c)
[   82.593491] [<c000f804>] (arch_cpu_idle) from [<c0050e70>] (cpu_startup_entry+0x128/0x1a4)
[   82.601740] [<c0050e70>] (cpu_startup_entry) from [<c0783bd8>] (start_kernel+0x350/0x3bc)
[   82.609890] Code: 0a000002 e3530005 05975010 15975008 (e5953000)
[   82.615965] ---[ end trace f57d5f599a5f1bfa ]---

Most of kernel code assume that interface array in
struct usb_configuration is NULL terminated.

When gadget is composed with configfs configuration
structure may be reused for different functions set.

This bug happens because purge_configs_funcs() sets
only next_interface_id to 0. Interface array still
contains pointers to already freed interfaces. If in
second try we add less interfaces than earlier we
may access unallocated memory when trying to get
interface descriptors.

Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
History 2015-05-28 09:59:58 +01:00
..
acm_ms.c usb: gadget: fix up some comments about CONFIG_USB_DEBUG 2013-12-20 09:51:24 -06:00
amd5536udc.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
amd5536udc.h usb: gadget: amd5536udc: remove unused structure member 2013-03-18 11:16:56 +02:00
at91_udc.c usb: gadget: at91_udc: move prepare clk into process context 2015-01-05 13:48:50 +00:00
at91_udc.h usb: gadget: at91_udc: add usb_clk for transition to common clk framework 2013-08-02 15:17:03 +03:00
atmel_usba_udc.c usb: gadget: udc: atmel: fix possible oops when unloading module 2015-01-22 16:33:25 +00:00
atmel_usba_udc.h usb: gadget: at91: using USBA_NR_DMAS for DMA channels 2014-02-19 13:47:12 -06:00
audio.c usb: gadget: remove usb_gadget_controller_number() 2012-09-10 16:43:24 +03:00
bcm63xx_udc.c usb: gadget: bcm63xx_udc: fix build failure on DMA channel code 2014-02-18 10:34:54 -06:00
cdc2.c usb: gadget: cdc2: fix conversion to new interface of f_ecm 2013-09-17 10:38:52 -05:00
composite.c usb: gadget: composite: enable BESL support 2015-05-04 10:15:05 +01:00
config.c usb: gadget: always update HS/SS descriptors and create a copy of them 2012-10-31 15:09:44 +02:00
configfs.c usb: gadget: configfs: Fix interfaces array NULL-termination 2015-05-28 09:59:58 +01:00
configfs.h usb: gadget: OS descriptors: provide interface directory names 2014-06-19 10:06:48 -05:00
dbgp.c usb: gadget: allocate & giveback serial ports instead hard code them 2013-01-21 20:52:43 +02:00
dummy_hcd.c usb: gadget: make return of 0 explicit 2014-05-27 15:58:57 -07:00
epautoconf.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
ether.c usb: gadget: ether: put_usb_function on unbind 2013-07-25 20:35:23 +03:00
f_acm.c usb: gadget: function: acm: make f_acm pass USB20CV Chapter9 2014-11-13 11:48:31 +00:00
f_ecm.c usb: gadget: f_ecm: remove compatibility layer 2013-12-12 13:43:36 -06:00
f_eem.c usb: gadget: f_eem: Staticize eem_alloc 2013-09-17 11:06:50 -05:00
f_fs.c usb: ffs: fix regression when quirk_ep_out_aligned_size flag is set 2014-11-13 11:48:41 +00:00
f_hid.c usb: gadget: factor out alloc_ep_req 2013-11-26 13:41:32 -06:00
f_loopback.c usb: gadget: f_loopback: Fix sparse warning 2013-12-17 13:17:42 -06:00
f_mass_storage.c usb: gadget: f_mass_storage: Fix sparse warning 2013-12-17 13:17:43 -06:00
f_mass_storage.h usb: gadget: f_mass_storage: remove compatibility layer 2013-10-10 10:24:53 -05:00
f_midi.c usb: gadget: Convert to snd_card_new() with a device pointer 2014-02-14 08:14:11 +01:00
f_ncm.c usb: gadget: f_ncm: Fix sparse warning 2013-12-17 13:17:43 -06:00
f_obex.c usb: gadget: f_obex: Fix sparse warning 2013-12-17 13:17:43 -06:00
f_phonet.c usb: gadget: function: phonet: balance usb_ep_disable calls 2015-03-23 15:17:57 +00:00
f_rndis.c usb: gadget: f_rndis: fix interface id for OS descriptors 2014-10-05 13:40:57 -07:00
f_serial.c usb: gadget: f_serial: Fix sparse warning 2013-12-17 13:17:44 -06:00
f_sourcesink.c usb: gadget: f_sourcesink: Fix sparse warning 2013-12-17 13:17:44 -06:00
f_subset.c usb: gadget: f_subset: replace PTR_RET with PTR_ERR_OR_ZERO 2014-04-21 14:07:29 -05:00
f_uac1.c usb: gadget: f_uac1: Staticize local functions 2013-08-09 16:34:19 +03:00
f_uac2.c usb: gadget: f_uac2: don't queue new requests when shutting down 2014-05-15 10:30:31 -05:00
f_uvc.c Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 2013-07-13 12:09:57 -07:00
f_uvc.h usb: gadget: uvc: Fix coding style issues introduced by SS support 2013-03-18 11:18:18 +02:00
fotg210-udc.c usb: gadget: fotg210-udc: remove unnecessary OOM messages 2014-05-14 09:23:27 -05:00
fotg210.h usb: gadget: add Faraday fotg210_udc driver 2013-06-10 17:58:11 +03:00
fsl_mxc_udc.c usb: gadget: use dev_get_platdata() 2013-07-30 11:18:46 +03:00
fsl_qe_udc.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
fsl_qe_udc.h usb: gadget: Complete fsl qe/udc driver conversion 2012-06-12 13:32:29 +03:00
fsl_udc_core.c usb: patches for v3.16 merge window 2014-05-23 11:28:21 +09:00
fsl_usb2_udc.h usb: gadget: fsl_mxc_udc: replace MX35_IO_ADDRESS to ioremap 2013-01-18 14:08:21 +02:00
functions.c usb: gadget: add a forward pointer from usb_function to its "instance" 2013-01-21 20:52:46 +02:00
fusb300_udc.c usb: gadget: fusb300_udc: remove unnecessary OOM messages 2014-05-14 09:23:28 -05:00
fusb300_udc.h usb: gadget: fusb300_udc: add FUSB300_EPSET0_STL_CLR for clearing EP0 stall 2013-04-02 16:57:24 +03:00
g_ffs.c usb: gadget: g_ffs: convert to new interface of f_fs 2013-12-12 13:43:39 -06:00
g_zero.h usb: gadget: f_sourcesink: add configfs support 2013-11-26 13:47:41 -06:00
gadget_chips.h usb: gadget: remove usb_gadget_controller_number() 2012-09-10 16:43:24 +03:00
gmidi.c usb: gadget: consider link speed for bMaxPower 2013-01-10 12:38:52 +02:00
goku_udc.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
goku_udc.h usb: gadget: goku_udc: let udc-core manage gadget->dev 2013-03-18 11:16:45 +02:00
gr_udc.c usb: gadget: gr_udc: Fix check for invalid number of microframes 2014-06-27 10:53:07 -05:00
gr_udc.h usb: gadget: Add UDC driver for Aeroflex Gaisler GRUSBDC 2013-12-23 19:26:13 -06:00
hid.c usb: gadget: use dev_get_platdata() 2013-07-30 11:18:46 +03:00
inode.c usb: gadget: gadgetfs: Free memory allocated by memdup_user() 2015-01-22 15:42:53 +00:00
Kconfig usb: pch_udc: usb gadget device support for Intel Quark X1000 2014-10-30 09:40:10 -07:00
lpc32xx_udc.c Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm 2014-04-05 13:20:43 -07:00
m66592-udc.c usb: gadget: m66592-udc: remove unnecessary OOM messages 2014-05-14 09:23:29 -05:00
m66592-udc.h usb: gadget: m66592-udc: convert to udc_start/udc_stop 2013-01-24 21:11:29 +02:00
Makefile usb: dwc2/s3c-hsotg: move s3c-hsotg into dwc2 directory 2014-04-24 13:12:43 -07:00
mass_storage.c usb: gadget: mass_storage: convert to new interface of f_mass_storage 2013-10-10 10:24:10 -05:00
multi.c usb: gadget: fix up some comments about CONFIG_USB_DEBUG 2013-12-20 09:51:24 -06:00
mv_u3d.h usb: gadget: mv: Add USB 3.0 device driver for Marvell PXA2128 chip. 2012-06-22 13:08:21 +03:00
mv_u3d_core.c usb: gadget: mv_u3d_core: remove unnecessary OOM messages 2014-05-14 09:23:29 -05:00
mv_udc.h usb: gadget: mv_udc_core: remove unused clock 2013-04-02 11:42:45 +03:00
mv_udc_core.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
ncm.c usb: gadget: ncm: convert to new function interface 2013-06-10 17:12:52 +03:00
ndis.h usb/net: rndis: break out <linux/rndis.h> defines 2012-05-12 15:02:22 -04:00
net2272.c usb: gadget: add "maxpacket_limit" field to struct usb_ep 2013-12-17 13:17:41 -06:00
net2272.h USB: net2272: driver for PLX NET2272 USB device controller 2011-06-06 16:47:27 -07:00
net2280.c Revert "usb: gadget: net2280: Add support for PLX USB338X" 2014-05-28 11:35:41 -07:00
net2280.h Revert "usb: gadget: net2280: Add support for PLX USB338X" 2014-05-28 11:35:41 -07:00
nokia.c usb: gadget: nokia: fix error recovery path for optional functions 2013-12-17 13:17:41 -06:00
omap_udc.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
omap_udc.h usb: gadget: Update omap_udc to use usb_endpoint_descriptor inside the struct usb_ep 2012-05-04 15:52:57 +03:00
pch_udc.c usb: pch_udc: usb gadget device support for Intel Quark X1000 2014-10-30 09:40:10 -07:00
printer.c usb: gadget: printer: enqueue printer's response for setup request 2015-05-04 16:06:38 +01:00
pxa25x_udc.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
pxa25x_udc.h usb: gadget: pxa25x_udc: convert to udc_start/udc_stop 2013-01-24 21:11:31 +02:00
pxa27x_udc.c usb: gadget: add "maxpacket_limit" field to struct usb_ep 2013-12-17 13:17:41 -06:00
pxa27x_udc.h usb: gadget: pxa27x_udc: convert to udc_start/udc_stop 2013-01-24 21:11:31 +02:00
r8a66597-udc.c usb: gadget: r8a66597-udc: remove unnecessary OOM messages 2014-05-14 09:23:29 -05:00
r8a66597-udc.h gadget/r8a66597: remove conditional compilation of clk code 2012-07-30 17:25:12 -07:00
rndis.c usb: patches for v3.16 merge window 2014-05-23 11:28:21 +09:00
rndis.h usb: gadget: rndis: init & exit rndis at module load/unload 2013-06-10 17:58:09 +03:00
s3c-hsudc.c usb: gadget: s3c-hsudc: remove unused label 2014-02-18 10:52:53 -06:00
s3c2410_udc.c usb: gadget: s3c2410_udc: don't use pr_debug return value 2014-05-14 09:23:31 -05:00
s3c2410_udc.h usb: gadget: s3c2410: convert to udc_start/udc_stop 2013-01-24 21:11:32 +02:00
serial.c usb: gadget: serial: convert to new interface of f_obex 2013-04-03 14:43:36 +03:00
storage_common.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2014-06-12 10:30:18 -07:00
storage_common.h usb: gadget: mass storage: fix return of delayed status 2013-11-25 10:56:33 -06:00
tcm_usb_gadget.c Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next 2014-06-03 12:57:53 -07:00
tcm_usb_gadget.h usb: gadget: make sure each gadget is using same index for Product, Serial,… 2012-09-10 16:13:00 +03:00
u_ecm.h usb: gadget: f_ecm: add configfs support 2013-06-10 17:27:54 +03:00
u_eem.h usb: gadget: f_eem: add configfs support 2013-06-10 17:58:00 +03:00
u_ether.c usb: gadget: u_ether: synchronize with transmit when stopping queue 2014-06-19 10:06:46 -05:00
u_ether.h usb: gadget: f_rndis: remove compatibility layer 2013-12-12 13:43:37 -06:00
u_ether_configfs.h usb: gadget: add helpers for configfs support for USB Ethernet 2013-06-10 17:15:43 +03:00
u_f.c usb: gadget: only GPL drivers in the gadget and phy framework 2014-04-21 14:07:12 -05:00
u_f.h usb: gadget: FunctionFS: share VLA macros with all usb gadget files 2014-05-14 09:37:27 -05:00
u_fs.h usb: gadget: f_fs: Add flags to descriptors block 2014-03-05 14:40:11 -06:00
u_gether.h usb: gadget: f_subset: add configfs support 2013-06-10 17:58:08 +03:00
u_ncm.h usb: gadget: f_ncm: add configfs support 2013-06-10 17:15:02 +03:00
u_os_desc.h usb: gadget: OS Feature Descriptors support 2014-05-14 09:38:16 -05:00
u_phonet.h usb: gadget: f_phonet: remove compatibility layer 2013-06-10 17:31:55 +03:00
u_rndis.h usb: gadget: f_rndis: OS descriptors support 2014-05-14 09:38:58 -05:00
u_serial.c tty: Fix low_latency BUG 2014-02-28 16:31:00 -08:00
u_serial.h usb: gadget: nokia: use function framework for ACM 2013-04-03 14:43:20 +03:00
u_uac1.c usb: gadget: u_uac1: add __user annotation 2013-08-09 16:34:13 +03:00
u_uac1.h usb: gadget: Rename audio function to uac1 2012-02-15 10:09:48 +02:00
udc-core.c usb: gadget: udc: core: fix kernel oops with soft-connect 2014-11-13 11:48:42 +00:00
usbstring.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
uvc.h [media] f_uvc: add v4l2_device and replace parent with v4l2_dev 2013-06-21 11:04:47 -03:00
uvc_queue.c usb: gadget: uvc: Set the vb2 queue timestamp flags 2014-05-15 11:07:56 -05:00
uvc_queue.h usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework 2013-04-02 11:42:48 +03:00
uvc_v4l2.c usb: gadget/uvc: Add support for 'get_unmapped_area' for MMUless architectures 2013-04-02 11:42:49 +03:00
uvc_video.c usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework 2013-04-02 11:42:48 +03:00
webcam.c usb: gadget: consider link speed for bMaxPower 2013-01-10 12:38:52 +02:00
zero.c usb: gadget: zero: Fix SuperSpeed enumeration for alternate setting 1 2014-04-16 10:11:45 -05:00