linux.git/drivers/usb/gadget/function/f_fs.c, branch v4.8

usb: gadget: f_fs: check for allocation failure

2016-06-29T08:13:33+00:00

Return -ENOMEM if kmalloc() fails.

Fixes: 9353afbbfa7b ('usb: gadget: f_fs: buffer data from ‘oversized’ OUT requests')
Signed-off-by: Dan Carpenter 
Acked-by: Michal Nazarewicz 
Signed-off-by: Felipe Balbi

usb: gadget: f_fs: buffer data from ‘oversized’ OUT requests

2016-06-21T08:11:31+00:00

f_fs rounds up read(2) requests to a multiple of a max packet size
which means that host may provide more data than user has space for.
So far, the excess data has been silently ignored.

This introduces a buffer for a tail of such requests so that they are
returned on next read instead of being ignored.

Signed-off-by: Michal Nazarewicz 
Signed-off-by: Felipe Balbi

usb: gadget: f_fs: printk error when excess data is dropped on read

2016-06-21T08:11:23+00:00

Add a pr_err when host sent more data then the size of the buffer user
space gave us.  This may happen on UDCs which require OUT requests to
be aligned to max packet size.  The patch includes a description of the
situation.

Signed-off-by: Michal Nazarewicz 
Signed-off-by: Felipe Balbi

usb: gadget: fix unused-but-set-variale warnings

2016-06-21T08:04:09+00:00

Those are enabled with W=1 make option.

The patch leaves of some type-limits warnings which are caused by
generic macros used in a way where they produce always-false
conditions.

Signed-off-by: Michal Nazarewicz 
Signed-off-by: Felipe Balbi

usb: gadget: f_fs: Fix kernel panic if use_os_string not set

2016-05-31T08:24:30+00:00

If c->cdev->use_os_string flag is not set,
don't need to invoke ffs_do_os_descs() in _ffs_func_bind.
So uninitialized ext_compat_id pointer won't be accessed by
__ffs_func_bind_do_os_desc to cause kernel panic.

Signed-off-by: Jim Lin 
Signed-off-by: Felipe Balbi

usb: gadget: f_fs: Fix wrong check on reserved1 of OS_DESC_EXT_COMPAT

2016-05-31T08:13:02+00:00

Current __ffs_data_do_os_desc() of f_fs.c will check reserved1 field
of OS_DESC_EXT_COMPAT and return -EINVAL if it's 1.
But MS OS 1.0 Descriptors
http://msdn.microsoft.com/en-us/library/windows/hardware/gg463179.aspx
defines that field to be 1.

Signed-off-by: Jim Lin 
Signed-off-by: Felipe Balbi

usb: f_fs: off by one bug in _ffs_func_bind()

2016-05-31T08:12:53+00:00

This loop is supposed to set all the .num[] values to -1 but it's off by
one so it skips the first element and sets one element past the end of
the array.

I've cleaned up the loop a little as well.

Fixes: ddf8abd25994 ('USB: f_fs: the FunctionFS driver')
Acked-by: Michal Nazarewicz 
Signed-off-by: Dan Carpenter 
Signed-off-by: Felipe Balbi

Merge tag 'usb-for-v4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

2016-04-28T16:32:39+00:00

Felipe writes:

usb: changes for v4.7 merge window

Here's the big USB Gadget pull request. This time
not as large as usual with only 57 non-merge
commits.

The most important part here is, again, all the work
on dwc3. This time around we're treating all
endpoints (except for control endpoint) exactly the
same. They all have the same amount of TRBs on the
ring, they all treat the ring as an actual ring with
a link TRB pointing to the head, etc.

We're also helping the host side burst (on
SuperSpeed GEN1 or GEN2 at least) for as long as
possible until the endpoint returns NRDY.

Other than this big TRB ring rework on dwc3, we also
have a dwc3-omap DMA initialization fix, some extra
debugfs files to aid in some odd debug sessions and
a complete removal of our FIFO resizing logic.

We have a new quirk for some dwc3 P3 quirk in some
implementations.

The rest is basically non-critical fixes and the
usual cleanups.

usb: gadget: f_fs: Fix use-after-free

2016-04-20T07:38:06+00:00

When using asynchronous read or write operations on the USB endpoints the
issuer of the IO request is notified by calling the ki_complete() callback
of the submitted kiocb when the URB has been completed.

Calling this ki_complete() callback will free kiocb. Make sure that the
structure is no longer accessed beyond that point, otherwise undefined
behaviour might occur.

Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
Cc:  # v3.15+
Signed-off-by: Lars-Peter Clausen 
Signed-off-by: Felipe Balbi

usb: gadget: f_fs: Fix EFAULT generation for async read operations

2016-04-19T08:11:56+00:00

In the current implementation functionfs generates a EFAULT for async read
operations if the read buffer size is larger than the URB data size. Since
a application does not necessarily know how much data the host side is
going to send it typically supplies a buffer larger than the actual data,
which will then result in a EFAULT error.

This behaviour was introduced while refactoring the code to use iov_iter
interface in commit c993c39b8639 ("gadget/function/f_fs.c: use put iov_iter
into io_data"). The original code took the minimum over the URB size and
the user buffer size and then attempted to copy that many bytes using
copy_to_user(). If copy_to_user() could not copy all data a EFAULT error
was generated. Restore the original behaviour by only generating a EFAULT
error when the number of bytes copied is not the size of the URB and the
target buffer has not been fully filled.

Commit 342f39a6c8d3 ("usb: gadget: f_fs: fix check in read operation")
already fixed the same problem for the synchronous read path.

Fixes: c993c39b8639 ("gadget/function/f_fs.c: use put iov_iter into io_data")
Acked-by: Michal Nazarewicz 
Signed-off-by: Lars-Peter Clausen 
Signed-off-by: Felipe Balbi