linux.git/drivers/usb/gadget/function/u_serial.c, branch v4.14

usb: gadget: serial: fix oops when data rx'd after close

2017-08-18T09:28:50+00:00

When the gadget serial device has no associated TTY, do not pass any
received data into the TTY layer for processing; simply drop it instead.
This prevents the TTY layer from calling back into the gadget serial
driver, which will then crash in e.g. gs_write_room() due to lack of
gadget serial device to TTY association (i.e. a NULL pointer dereference).

Signed-off-by: Stephen Warren 
Signed-off-by: Felipe Balbi

usb: gadget: gserial: check if console kthread exists

2017-05-16T11:11:04+00:00

Check for bad pointer that may result because of kthread_create failure.
This check is needed since the gserial setup callback function
(gs_console_setup()) is only freeing the info->con_buf in case of
kthread_create failure which will result into bad info->console_thread
pointer.
Without checking info->console_thread pointer validity in the
gserial_console_exit() function, before calling kthread_stop(), the
rmmod will generate Kernel Oops.

Signed-off-by: Bogdan Mirea 
Signed-off-by: Felipe Balbi

usb: gadget: serial: fix possible Oops caused by calling kthread_stop(NULL)

2016-11-18T11:55:19+00:00

Add check for NULL before calling kthread_stop().

There were cases in which gserial_console_exit() was called, but the
console thread was not started. This resulted in an invalid
kthread_stop(NULL) call.

Without this, the following Oops may occur:

    BUG: unable to handle kernel
    NULL pointer dereference at 0000000000000018
    IP: [] kthread_stop+0x16/0x110
    ...
    CPU: 2 PID: 853 Comm: rmmod Not tainted 4.9.0-rc5 #3
    Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z77 Extreme3, BIOS P1.50 07/11/2013
    task: ffff880419f6a100 task.stack: ffffc90002e8c000
    RIP: 0010:[]  [] kthread_stop+0x16/0x110
    RSP: 0018:ffffc90002e8fdb0  EFLAGS: 00010286
    RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000
    RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000000
    RBP: ffffc90002e8fdc8 R08: 0000000000000000 R09: 0000000000000001
    R10: 000000000000019d R11: 000000000000001f R12: 0000000000000000
    R13: ffff88041b8d8400 R14: 0000000000000001 R15: 000055fd59f5a1e0
    FS:  00007f82500be700(0000) GS:ffff88042f280000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000018 CR3: 000000041bee2000 CR4: 00000000001406e0
    Stack:
     0000000000000000 ffffffffc0b8e720 ffff88041b8d8400 ffffc90002e8fdf0
     ffffffffc0b8bb52 ffff88041a106300 0000000000000001 ffff880419fc2ea8
     ffffc90002e8fe08 ffffffffc0aed749 ffffffffc0aef600 ffffc90002e8fe20
    Call Trace:
     [] gserial_free_line+0x72/0xb0 [u_serial]
     [] acm_free_instance+0x19/0x30 [usb_f_acm]
     [] usb_put_function_instance+0x20/0x30 [libcomposite]
     [] gs_unbind+0x3b/0x70 [g_serial]
     [] __composite_unbind+0x61/0xb0 [libcomposite]
     [] composite_unbind+0x13/0x20 [libcomposite]
     [] usb_gadget_remove_driver+0x3d/0x90 [udc_core]
     [] usb_gadget_unregister_driver+0x6e/0xc0 [udc_core]
     [] usb_composite_unregister+0x12/0x20 [libcomposite]
     [] cleanup+0x10/0xda8 [g_serial]
     [] SyS_delete_module+0x192/0x270
     [] ? exit_to_usermode_loop+0x90/0xb0
     [] entry_SYSCALL_64_fastpath+0x1e/0xad
    Code: 89 c6 e8 6e ff ff ff 48 89 df e8 06 bd fd ff 5b 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc 53 0f 1f 44 00 00  41 ff 44 24 18 4c 89 e7 e8 bc f1 ff ff 48 85 c0 48 89 c3 74
    RIP  [] kthread_stop+0x16/0x110
     RSP 
    CR2: 0000000000000018
    ---[ end trace 5b3336a407e1698c ]---

Signed-off-by: Felix Hädicke 
Tested-by: Peter Chen 
Signed-off-by: Felipe Balbi

usb: Convert pr_warning to pr_warn

2016-11-03T08:38:36+00:00

Use the more common logging mechanism.

Miscellanea:

o Realign multiline statements
o Coalesce format

Acked-by: Robert Jarzmik 
Acked-by: Nicolas Ferre 
Signed-off-by: Joe Perches 
Signed-off-by: Felipe Balbi

usb: gadget: Add the gserial port checking in gs_start_tx()

2016-08-22T07:45:13+00:00

When usb gadget is set gadget serial function, it will be crash in below
situation.

It will clean the 'port->port_usb' pointer in gserial_disconnect() function
when usb link is inactive, but it will release lock for disabling the endpoints
in this function. Druing the lock release period, it maybe complete one request
to issue gs_write_complete()--->gs_start_tx() function, but the 'port->port_usb'
pointer had been set NULL, thus it will be crash in gs_start_tx() function.

This patch adds the 'port->port_usb' pointer checking in gs_start_tx() function
to avoid this situation.

Signed-off-by: Baolin Wang 
Signed-off-by: Felipe Balbi

usb: gadget: fix unused-but-set-variale warnings

2016-06-21T08:04:09+00:00

Those are enabled with W=1 make option.

The patch leaves of some type-limits warnings which are caused by
generic macros used in a way where they produce always-false
conditions.

Signed-off-by: Michal Nazarewicz 
Signed-off-by: Felipe Balbi

tty: Replace TTY_THROTTLED bit tests with tty_throttled()

2016-04-30T16:26:55+00:00

Abstract TTY_THROTTLED bit tests with tty_throttled().

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: Add the console support for usb-to-serial port

2015-12-22T17:49:39+00:00

It dose not work when we want to use the usb-to-serial port based
on one usb gadget as a console. Thus this patch adds the console
initialization to support this request.

To avoid the re-entrance when transferring data with usb endpoint,
it introduces a kthread to do the IO transmission.

Signed-off-by: Baolin Wang 
Signed-off-by: Felipe Balbi

Merge tag 'tty-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2015-11-05T05:35:12+00:00

Pull tty/serial driver updates from Greg KH:
 "Here is the big tty and serial driver update for 4.4-rc1.

  Lots of serial driver updates and a few small tty core changes.  Full
  details in the shortlog.

  All of these have been in linux-next for a while"

* tag 'tty-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (148 commits)
  tty: Use unbound workqueue for all input workers
  tty: Abstract tty buffer work
  tty: Prevent tty teardown during tty_write_message()
  tty: core: Use correct spinlock flavor in tiocspgrp()
  tty: Combine SIGTTOU/SIGTTIN handling
  serial: amba-pl011: fix incorrect integer size in pl011_fifo_to_tty()
  ttyFDC: Fix build problems due to use of module_{init,exit}
  tty: remove unneeded return statement
  serial: 8250_mid: add support for DMA engine handling from UART MMIO
  dmaengine: hsu: remove platform data
  dmaengine: hsu: introduce stubs for the exported functions
  dmaengine: hsu: make the UART driver in control of selecting this driver
  serial: fix mctrl helper functions
  serial: 8250_pci: Intel MID UART support to its own driver
  serial: fsl_lpuart: add earlycon support
  tty: disable unbind for old 74xx based serial/mpsc console port
  serial: pl011: Spelling s/clocks-names/clock-names/
  n_tty: Remove reader wakeups for TTY_BREAK/TTY_PARITY chars
  tty: synclink, fix indentation
  serial: at91, fix rs485 properties
  ...

usb: gadget: gserial: Privatize close_wait

2015-10-18T04:11:29+00:00

close_wait is no longer needed or provided by the tty core.
Move close_wait to struct gs_port.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman