kernel.git/drivers/usb/gadget/function/rndis.h, branch linux-4.9.y

usb: gadget: rndis: add spinlock for rndis response list

2022-03-02T10:32:04Z

commit aaaba1c86d04dac8e49bf508b492f81506257da3 upstream. There's no lock for rndis response list. It could cause list corruption if there're two different list_add at the same time like below. It's better to add in rndis_add_response / rndis_free_response / rndis_get_next_response to prevent any race condition on response list. [ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. next->prev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=ffffff80651764d0). [ 361.904380] [1: irq/191-dwc3:16979] Call trace: [ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90 [ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0 [ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84 [ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/0xe4 [ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60 [ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0 [ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc [ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6cc [ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec [ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c Fixes: f6281af9d62e ("usb: gadget: rndis: use list_for_each_entry_safe") Cc: stable Signed-off-by: Daehwan Jung Link: https://lore.kernel.org/r/1645507768-77687-1-git-send-email-dh10.jung@samsung.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: rndis: use signed type for a signed value

2015-05-21T21:29:14Z

rndis_get_nr() returns either a non-negative value on success or a negative value on failure. In case of failure an error code is returned to the caller of rndis_register(). If the "i" is unsigned, the information about error from rndis_get_nr() is lost. If there is no error but rndis_get_nr() returns a value greater than 256 the least significant bits of i are zero effectively limiting the number of configs to 256. This patch fixes that. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi

usb: gadget: rndis: style correction

2015-05-07T18:47:08Z

Don't use a space between function name and parameter list opening bracket. All other functions in this file comply wich checkpatch rules. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi

usb: gadget: rndis: use rndis_params instead of configNr

2015-05-07T18:46:54Z

RNDIS function has a limitation on the number of allowed instances. So far it has been RNDIS_MAX_CONFIGS, which happens to be one. In order to eliminate this kind of arbitrary limitation we should not preallocate a predefined (RNDIS_MAX_CONFIGS) array of struct rndis_params instances but instead allow allocating them on demand. This patch prepares the elimination of the said limit by converting all the functions which accept rndis config number to accept a pointer to the actual struct rndis_params. Consequently, rndis_register() returns a pointer to a corresponding struct rndis_params instance. The pointer is then always used by f_rndis.c instead of config number when it talks to rndis.c API. A nice side-effect of the changes is that many lines of code in rndis.c become shorter and fit in 80 columns. If a function prototype changes in rndis.h a style cleanup is made at the same time, otherwise checkpatch complains that the patch has style problems. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi

usb: gadget: Gadget directory cleanup - group usb functions

2014-07-16T17:50:36Z

The drivers/usb/gadget directory contains many files. Files which are related can be distributed into separate directories. This patch moves the USB functions implementations into a separate directory. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi