kernel.git/drivers/usb/gadget/function/u_ether.c, branch linux-4.9.y

usb: gadget: u_ether: fix a potential null pointer dereference

2021-09-22T09:43:05Z

[ Upstream commit 8ae01239609b29ec2eff55967c8e0fe3650cfa09 ] f_ncm tx timeout can call us with null skb to flush a pending frame. In this case skb is NULL to begin with but ceases to be null after dev->wrap() completes. In such a case in->maxpacket will be read, even though we've failed to check that 'in' is not NULL. Though I've never observed this fail in practice, however the 'flush operation' simply does not make sense with a null usb IN endpoint - there's nowhere to flush to... (note that we're the gadget/device, and IN is from the point of view of the host, so here IN actually means outbound...) Cc: Brooke Basile Cc: "Bryan O'Donoghue" Cc: Felipe Balbi Cc: Greg Kroah-Hartman Cc: Lorenzo Colitti Signed-off-by: Maciej Żenczykowski Link: https://lore.kernel.org/r/20210701114834.884597-6-zenczykowski@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well

2020-10-29T08:05:36Z

[ Upstream commit 4eea21dc67b0c6ba15ae41b1defa113a680a858e ] The u_ether driver has a qmult setting that multiplies the transmit queue length (which by default is 2). The intent is that it should be enabled at high/super speed, but because the code does not explicitly check for USB_SUPER_PLUS, it is disabled at that speed. Fix this by ensuring that the queue multiplier is enabled for any wired link at high speed or above. Using >= for USB_SPEED_* constants seems correct because it is what the gadget_is_xxxspeed functions do. The queue multiplier substantially helps performance at higher speeds. On a direct SuperSpeed Plus link to a Linux laptop, iperf3 single TCP stream: Before (qmult=1): 1.3 Gbps After (qmult=5): 3.2 Gbps Fixes: 04617db7aa68 ("usb: gadget: add SS descriptors to Ethernet gadget") Reviewed-by: Maciej Żenczykowski Signed-off-by: Lorenzo Colitti Signed-off-by: Felipe Balbi Signed-off-by: Sasha Levin

usb: gadget: ether: Fix race between gether_disconnect and rx_submit

2019-07-21T07:06:01Z

commit d29fcf7078bc8be2b6366cbd4418265b53c94fac upstream. On spin lock release in rx_submit, gether_disconnect get a chance to run, it makes port_usb NULL, rx_submit access NULL port USB, hence null pointer crash. Fixed by releasing the lock in rx_submit after port_usb is used. Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core") Cc: Signed-off-by: Kiruthika Varadarajan Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_ether: remove interrupt throttling

2016-11-01T13:48:25Z

According to Dave Miller "the networking stack has a hard requirement that all SKBs which are transmitted must have their completion signalled in a fininte amount of time. This is because, until the SKB is freed by the driver, it holds onto socket, netfilter, and other subsystem resources." In summary, this means that using TX IRQ throttling for the networking gadgets is, at least, complex and we should avoid it for the time being. Cc: Reported-by: Ville Syrjälä Tested-by: Ville Syrjälä Suggested-by: David Miller Signed-off-by: Felipe Balbi

usb: gadget: function: u_ether: don't starve tx request queue

2016-10-17T08:14:00Z

If we don't guarantee that we will always get an interrupt at least when we're queueing our very last request, we could fall into situation where we queue every request with 'no_interrupt' set. This will cause the link to get stuck. The behavior above has been triggered with g_ether and dwc3. Cc: Reported-by: Ville Syrjälä Signed-off-by: Felipe Balbi

Revert "usb: gadget: NCM: Protect dev->port_usb using dev->lock"

2016-09-19T09:05:43Z

This reverts commit c9ffc78745f89e300fe704348dd8e6800acf4d18 as it was reported to be broken. Cc: Felipe Balbi Cc: Jim Baxter Cc: Harish Jenny K N Signed-off-by: Greg Kroah-Hartman

usb: gadget: NCM: Protect dev->port_usb using dev->lock

2016-09-09T11:49:20Z

This commit incorporates findings from https://lkml.org/lkml/2016/4/25/594 The function has been modified to make sure we hold the dev lock when accessing the net device pointer. Acked-by: Jim Baxter Signed-off-by: Harish Jenny K N Signed-off-by: Felipe Balbi

usb: gadget: u_ether: fix another dereference after null check

2016-09-09T11:49:02Z

dev->port_usb is checked for null pointer previously, so dev->port_usb might be null during no zlp check, fix it by adding null pointer check. Acked-by: Jim Baxter Signed-off-by: Harish Jenny K N Signed-off-by: Felipe Balbi

usb: gadget: u_ether: add a flag to avoid skb_reserve() calling

2016-08-31T07:06:03Z

This patch adds a flag "no_skb_reserve" in struct eth_dev. So, if a peripheral driver sets the quirk_avoids_skb_reserve flag, upper network gadget drivers (e.g. f_ncm.c) can avoid skb_reserve() calling using the flag as well. Signed-off-by: Yoshihiro Shimoda Signed-off-by: Felipe Balbi

usb: gadget: u_ether: fix dereference after null check coverify warning

2016-08-11T12:09:44Z

dev->port_usb is checked for null pointer at above code, so dev->port_usb might be null, fix it by adding null pointer check. Signed-off-by: Peter Chen Signed-off-by: Felipe Balbi