linux.git/drivers/usb/gadget/function/u_serial.c, branch v4.11

usb: gadget: serial: fix possible Oops caused by calling kthread_stop(NULL)

2016-11-18T11:55:19+00:00

Add check for NULL before calling kthread_stop().

There were cases in which gserial_console_exit() was called, but the
console thread was not started. This resulted in an invalid
kthread_stop(NULL) call.

Without this, the following Oops may occur:

    BUG: unable to handle kernel
    NULL pointer dereference at 0000000000000018
    IP: [] kthread_stop+0x16/0x110
    ...
    CPU: 2 PID: 853 Comm: rmmod Not tainted 4.9.0-rc5 #3
    Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z77 Extreme3, BIOS P1.50 07/11/2013
    task: ffff880419f6a100 task.stack: ffffc90002e8c000
    RIP: 0010:[]  [] kthread_stop+0x16/0x110
    RSP: 0018:ffffc90002e8fdb0  EFLAGS: 00010286
    RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000
    RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000000
    RBP: ffffc90002e8fdc8 R08: 0000000000000000 R09: 0000000000000001
    R10: 000000000000019d R11: 000000000000001f R12: 0000000000000000
    R13: ffff88041b8d8400 R14: 0000000000000001 R15: 000055fd59f5a1e0
    FS:  00007f82500be700(0000) GS:ffff88042f280000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000018 CR3: 000000041bee2000 CR4: 00000000001406e0
    Stack:
     0000000000000000 ffffffffc0b8e720 ffff88041b8d8400 ffffc90002e8fdf0
     ffffffffc0b8bb52 ffff88041a106300 0000000000000001 ffff880419fc2ea8
     ffffc90002e8fe08 ffffffffc0aed749 ffffffffc0aef600 ffffc90002e8fe20
    Call Trace:
     [] gserial_free_line+0x72/0xb0 [u_serial]
     [] acm_free_instance+0x19/0x30 [usb_f_acm]
     [] usb_put_function_instance+0x20/0x30 [libcomposite]
     [] gs_unbind+0x3b/0x70 [g_serial]
     [] __composite_unbind+0x61/0xb0 [libcomposite]
     [] composite_unbind+0x13/0x20 [libcomposite]
     [] usb_gadget_remove_driver+0x3d/0x90 [udc_core]
     [] usb_gadget_unregister_driver+0x6e/0xc0 [udc_core]
     [] usb_composite_unregister+0x12/0x20 [libcomposite]
     [] cleanup+0x10/0xda8 [g_serial]
     [] SyS_delete_module+0x192/0x270
     [] ? exit_to_usermode_loop+0x90/0xb0
     [] entry_SYSCALL_64_fastpath+0x1e/0xad
    Code: 89 c6 e8 6e ff ff ff 48 89 df e8 06 bd fd ff 5b 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc 53 0f 1f 44 00 00  41 ff 44 24 18 4c 89 e7 e8 bc f1 ff ff 48 85 c0 48 89 c3 74
    RIP  [] kthread_stop+0x16/0x110
     RSP 
    CR2: 0000000000000018
    ---[ end trace 5b3336a407e1698c ]---

Signed-off-by: Felix Hädicke 
Tested-by: Peter Chen 
Signed-off-by: Felipe Balbi

usb: Convert pr_warning to pr_warn

2016-11-03T08:38:36+00:00

Use the more common logging mechanism.

Miscellanea:

o Realign multiline statements
o Coalesce format

Acked-by: Robert Jarzmik 
Acked-by: Nicolas Ferre 
Signed-off-by: Joe Perches 
Signed-off-by: Felipe Balbi

usb: gadget: Add the gserial port checking in gs_start_tx()

2016-08-22T07:45:13+00:00

When usb gadget is set gadget serial function, it will be crash in below
situation.

It will clean the 'port->port_usb' pointer in gserial_disconnect() function
when usb link is inactive, but it will release lock for disabling the endpoints
in this function. Druing the lock release period, it maybe complete one request
to issue gs_write_complete()--->gs_start_tx() function, but the 'port->port_usb'
pointer had been set NULL, thus it will be crash in gs_start_tx() function.

This patch adds the 'port->port_usb' pointer checking in gs_start_tx() function
to avoid this situation.

Signed-off-by: Baolin Wang 
Signed-off-by: Felipe Balbi

usb: gadget: fix unused-but-set-variale warnings

2016-06-21T08:04:09+00:00

Those are enabled with W=1 make option.

The patch leaves of some type-limits warnings which are caused by
generic macros used in a way where they produce always-false
conditions.

Signed-off-by: Michal Nazarewicz 
Signed-off-by: Felipe Balbi

tty: Replace TTY_THROTTLED bit tests with tty_throttled()

2016-04-30T16:26:55+00:00

Abstract TTY_THROTTLED bit tests with tty_throttled().

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: Add the console support for usb-to-serial port

2015-12-22T17:49:39+00:00

It dose not work when we want to use the usb-to-serial port based
on one usb gadget as a console. Thus this patch adds the console
initialization to support this request.

To avoid the re-entrance when transferring data with usb endpoint,
it introduces a kthread to do the IO transmission.

Signed-off-by: Baolin Wang 
Signed-off-by: Felipe Balbi

Merge tag 'tty-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2015-11-05T05:35:12+00:00

Pull tty/serial driver updates from Greg KH:
 "Here is the big tty and serial driver update for 4.4-rc1.

  Lots of serial driver updates and a few small tty core changes.  Full
  details in the shortlog.

  All of these have been in linux-next for a while"

* tag 'tty-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (148 commits)
  tty: Use unbound workqueue for all input workers
  tty: Abstract tty buffer work
  tty: Prevent tty teardown during tty_write_message()
  tty: core: Use correct spinlock flavor in tiocspgrp()
  tty: Combine SIGTTOU/SIGTTIN handling
  serial: amba-pl011: fix incorrect integer size in pl011_fifo_to_tty()
  ttyFDC: Fix build problems due to use of module_{init,exit}
  tty: remove unneeded return statement
  serial: 8250_mid: add support for DMA engine handling from UART MMIO
  dmaengine: hsu: remove platform data
  dmaengine: hsu: introduce stubs for the exported functions
  dmaengine: hsu: make the UART driver in control of selecting this driver
  serial: fix mctrl helper functions
  serial: 8250_pci: Intel MID UART support to its own driver
  serial: fsl_lpuart: add earlycon support
  tty: disable unbind for old 74xx based serial/mpsc console port
  serial: pl011: Spelling s/clocks-names/clock-names/
  n_tty: Remove reader wakeups for TTY_BREAK/TTY_PARITY chars
  tty: synclink, fix indentation
  serial: at91, fix rs485 properties
  ...

usb: gadget: gserial: Privatize close_wait

2015-10-18T04:11:29+00:00

close_wait is no longer needed or provided by the tty core.
Move close_wait to struct gs_port.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_serial: eliminate abuse of ep->driver data

2015-09-27T15:54:31+00:00

Since ep->driver_data is not used for endpoint claiming, neither for
enabled/disabled state storing, we can reduce number of places where
we read or modify it's value, as now it has no particular meaning for
function or framework logic.

In case of u_serial ep->driver_data stores pointer to struct gs_port,
which is referenced in many places in code. Code using ep->driver_data
to mark endpoint as enabled/disabled has been removed.

Signed-off-by: Robert Baldyga 
Signed-off-by: Felipe Balbi

usb: gadget: serial: fix re-ordering of tx data

2015-04-27T19:44:29+00:00

When a single thread is sending out data over the gadget serial port,
gs_start_tx() will be called both from the sender context and from the
write completion. Since the port lock is released before the packet is
queued, the order in which the URBs are submitted is not guaranteed.
E.g.

  sending thread                      completion (interrupt)

  gs_write()
    LOCK
                                      gs_write_complete()
                                        LOCK (wait)
    gs_start_tx()
      req1 = list_entry(pool->next)
      UNLOCK
                                        LOCK (acquired)
                                        gs_start_tx()
                                          req2 = list_entry(pool->next)
                                          UNLOCK
                                          usb_ep_queue(req2)
      usb_ep_queue(req1)

I.e., req2 is submitted before req1 but it contains the data that
comes after req1.

To reproduce, use SMP with sending thread and completion pinned to
different CPUs, or use PREEMPT_RT, and add the following delay just
before the call to usb_ep_queue():

		if (port->write_started > 0 && !list_empty(pool))
			udelay(1000);

To work around this problem, make sure that only one thread is running
through the gs_start_tx() loop with an extra flag write_busy. Since
gs_start_tx() is always called with the port lock held, no further
synchronisation is needed. The original caller will continue through
the loop when the request was successfully submitted.

Signed-off-by: Philip Oberstaller 
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) 
Signed-off-by: Felipe Balbi