Commit Graph

14 Commits

Author SHA1 Message Date
Bogdan Mirea
844cf8a9d5 usb: gadget: gserial: check if console kthread exists
Check for bad pointer that may result because of kthread_create failure.
This check is needed since the gserial setup callback function
(gs_console_setup()) is only freeing the info->con_buf in case of
kthread_create failure which will result into bad info->console_thread
pointer.
Without checking info->console_thread pointer validity in the
gserial_console_exit() function, before calling kthread_stop(), the
rmmod will generate Kernel Oops.

Signed-off-by: Bogdan Mirea <Bogdan-Stefan_mirea@mentor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-05-16 14:11:04 +03:00
Felix Hädicke
d5c024f376 usb: gadget: serial: fix possible Oops caused by calling kthread_stop(NULL)
Add check for NULL before calling kthread_stop().

There were cases in which gserial_console_exit() was called, but the
console thread was not started. This resulted in an invalid
kthread_stop(NULL) call.

Without this, the following Oops may occur:

    BUG: unable to handle kernel
    NULL pointer dereference at 0000000000000018
    IP: [<ffffffffb3ca1166>] kthread_stop+0x16/0x110
    ...
    CPU: 2 PID: 853 Comm: rmmod Not tainted 4.9.0-rc5 #3
    Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z77 Extreme3, BIOS P1.50 07/11/2013
    task: ffff880419f6a100 task.stack: ffffc90002e8c000
    RIP: 0010:[<ffffffffb3ca1166>]  [<ffffffffb3ca1166>] kthread_stop+0x16/0x110
    RSP: 0018:ffffc90002e8fdb0  EFLAGS: 00010286
    RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000
    RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000000
    RBP: ffffc90002e8fdc8 R08: 0000000000000000 R09: 0000000000000001
    R10: 000000000000019d R11: 000000000000001f R12: 0000000000000000
    R13: ffff88041b8d8400 R14: 0000000000000001 R15: 000055fd59f5a1e0
    FS:  00007f82500be700(0000) GS:ffff88042f280000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000018 CR3: 000000041bee2000 CR4: 00000000001406e0
    Stack:
     0000000000000000 ffffffffc0b8e720 ffff88041b8d8400 ffffc90002e8fdf0
     ffffffffc0b8bb52 ffff88041a106300 0000000000000001 ffff880419fc2ea8
     ffffc90002e8fe08 ffffffffc0aed749 ffffffffc0aef600 ffffc90002e8fe20
    Call Trace:
     [<ffffffffc0b8bb52>] gserial_free_line+0x72/0xb0 [u_serial]
     [<ffffffffc0aed749>] acm_free_instance+0x19/0x30 [usb_f_acm]
     [<ffffffffc0b01b40>] usb_put_function_instance+0x20/0x30 [libcomposite]
     [<ffffffffc04a603b>] gs_unbind+0x3b/0x70 [g_serial]
     [<ffffffffc0b018d1>] __composite_unbind+0x61/0xb0 [libcomposite]
     [<ffffffffc0b01933>] composite_unbind+0x13/0x20 [libcomposite]
     [<ffffffffc08ef1ad>] usb_gadget_remove_driver+0x3d/0x90 [udc_core]
     [<ffffffffc08ef26e>] usb_gadget_unregister_driver+0x6e/0xc0 [udc_core]
     [<ffffffffc0aff6d2>] usb_composite_unregister+0x12/0x20 [libcomposite]
     [<ffffffffc04a6268>] cleanup+0x10/0xda8 [g_serial]
     [<ffffffffb3d0c0c2>] SyS_delete_module+0x192/0x270
     [<ffffffffb3c032a0>] ? exit_to_usermode_loop+0x90/0xb0
     [<ffffffffb4228a3b>] entry_SYSCALL_64_fastpath+0x1e/0xad
    Code: 89 c6 e8 6e ff ff ff 48 89 df e8 06 bd fd ff 5b 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc 53 0f 1f 44 00 00 <f0> 41 ff 44 24 18 4c 89 e7 e8 bc f1 ff ff 48 85 c0 48 89 c3 74
    RIP  [<ffffffffb3ca1166>] kthread_stop+0x16/0x110
     RSP <ffffc90002e8fdb0>
    CR2: 0000000000000018
    ---[ end trace 5b3336a407e1698c ]---

Signed-off-by: Felix Hädicke <felixhaedicke@web.de>
Tested-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-11-18 13:55:19 +02:00
Joe Perches
3f5ad8640c usb: Convert pr_warning to pr_warn
Use the more common logging mechanism.

Miscellanea:

o Realign multiline statements
o Coalesce format

Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-11-03 10:38:36 +02:00
Baolin Wang
511a36d2f3 usb: gadget: Add the gserial port checking in gs_start_tx()
When usb gadget is set gadget serial function, it will be crash in below
situation.

It will clean the 'port->port_usb' pointer in gserial_disconnect() function
when usb link is inactive, but it will release lock for disabling the endpoints
in this function. Druing the lock release period, it maybe complete one request
to issue gs_write_complete()--->gs_start_tx() function, but the 'port->port_usb'
pointer had been set NULL, thus it will be crash in gs_start_tx() function.

This patch adds the 'port->port_usb' pointer checking in gs_start_tx() function
to avoid this situation.

Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-08-22 10:45:13 +03:00
Michal Nazarewicz
872ce51195 usb: gadget: fix unused-but-set-variale warnings
Those are enabled with W=1 make option.

The patch leaves of some type-limits warnings which are caused by
generic macros used in a way where they produce always-false
conditions.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2016-06-21 11:04:09 +03:00
Peter Hurley
97ef38b821 tty: Replace TTY_THROTTLED bit tests with tty_throttled()
Abstract TTY_THROTTLED bit tests with tty_throttled().

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-30 09:26:55 -07:00
Baolin Wang
a5beaaf394 usb: gadget: Add the console support for usb-to-serial port
It dose not work when we want to use the usb-to-serial port based
on one usb gadget as a console. Thus this patch adds the console
initialization to support this request.

To avoid the re-entrance when transferring data with usb endpoint,
it introduces a kthread to do the IO transmission.

Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-12-22 11:49:39 -06:00
Linus Torvalds
fd0d351de7 TTY/Serial driver patches for 4.4-rc1
Here is the big tty and serial driver update for 4.4-rc1.
 
 Lots of serial driver updates and a few small tty core changes.  Full
 details in the shortlog.
 
 All of these have been in linux-next for a while.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlY6f64ACgkQMUfUDdst+ykf8gCfYPjtHy5hD/TsharaeXROnVgi
 W8cAn16xk1Nmnde220MNNpO6zDu65G/1
 =kslf
 -----END PGP SIGNATURE-----

Merge tag 'tty-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial driver updates from Greg KH:
 "Here is the big tty and serial driver update for 4.4-rc1.

  Lots of serial driver updates and a few small tty core changes.  Full
  details in the shortlog.

  All of these have been in linux-next for a while"

* tag 'tty-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (148 commits)
  tty: Use unbound workqueue for all input workers
  tty: Abstract tty buffer work
  tty: Prevent tty teardown during tty_write_message()
  tty: core: Use correct spinlock flavor in tiocspgrp()
  tty: Combine SIGTTOU/SIGTTIN handling
  serial: amba-pl011: fix incorrect integer size in pl011_fifo_to_tty()
  ttyFDC: Fix build problems due to use of module_{init,exit}
  tty: remove unneeded return statement
  serial: 8250_mid: add support for DMA engine handling from UART MMIO
  dmaengine: hsu: remove platform data
  dmaengine: hsu: introduce stubs for the exported functions
  dmaengine: hsu: make the UART driver in control of selecting this driver
  serial: fix mctrl helper functions
  serial: 8250_pci: Intel MID UART support to its own driver
  serial: fsl_lpuart: add earlycon support
  tty: disable unbind for old 74xx based serial/mpsc console port
  serial: pl011: Spelling s/clocks-names/clock-names/
  n_tty: Remove reader wakeups for TTY_BREAK/TTY_PARITY chars
  tty: synclink, fix indentation
  serial: at91, fix rs485 properties
  ...
2015-11-04 21:35:12 -08:00
Peter Hurley
b140dfe622 usb: gadget: gserial: Privatize close_wait
close_wait is no longer needed or provided by the tty core.
Move close_wait to struct gs_port.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-17 21:11:29 -07:00
Robert Baldyga
18411c0f94 usb: gadget: u_serial: eliminate abuse of ep->driver data
Since ep->driver_data is not used for endpoint claiming, neither for
enabled/disabled state storing, we can reduce number of places where
we read or modify it's value, as now it has no particular meaning for
function or framework logic.

In case of u_serial ep->driver_data stores pointer to struct gs_port,
which is referenced in many places in code. Code using ep->driver_data
to mark endpoint as enabled/disabled has been removed.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-09-27 10:54:31 -05:00
Philip Oberstaller
3e9d3d2efc usb: gadget: serial: fix re-ordering of tx data
When a single thread is sending out data over the gadget serial port,
gs_start_tx() will be called both from the sender context and from the
write completion. Since the port lock is released before the packet is
queued, the order in which the URBs are submitted is not guaranteed.
E.g.

  sending thread                      completion (interrupt)

  gs_write()
    LOCK
                                      gs_write_complete()
                                        LOCK (wait)
    gs_start_tx()
      req1 = list_entry(pool->next)
      UNLOCK
                                        LOCK (acquired)
                                        gs_start_tx()
                                          req2 = list_entry(pool->next)
                                          UNLOCK
                                          usb_ep_queue(req2)
      usb_ep_queue(req1)

I.e., req2 is submitted before req1 but it contains the data that
comes after req1.

To reproduce, use SMP with sending thread and completion pinned to
different CPUs, or use PREEMPT_RT, and add the following delay just
before the call to usb_ep_queue():

		if (port->write_started > 0 && !list_empty(pool))
			udelay(1000);

To work around this problem, make sure that only one thread is running
through the gs_start_tx() loop with an extra flag write_busy. Since
gs_start_tx() is always called with the port lock held, no further
synchronisation is needed. The original caller will continue through
the loop when the request was successfully submitted.

Signed-off-by: Philip Oberstaller <Philip.Oberstaller@septentrio.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-04-27 14:44:29 -05:00
Scott Wood
16d9efa4b3 usb: gadget: serial: %pf is only for function pointers
Use %ps for actual addresses, otherwise you'll get bad output
on arches like ppc64 where %pf expects a function descriptor
(which is not what __builtin_return_address returns).

Reviewed-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Scott Wood <scottwood@freescale.com>
Cc: linux-usb@vger.kernel.org
CC: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-03-13 10:37:30 -05:00
Richard Leitner
c572a217d1 usb: gadget: serial: remove PREFIX macro
Remove the ttyGS PREFIX macro from u_serial.c and replace all occurences with
the hardcoded ttyGS string.

This macro was mostly used in a few debug/warning messages and a lot of
hardcoded ttyGS existed beneath. It may have been used for renaming the
tty, but if done so most debug messages would have ignored this.

Due to the fact the usage of this PREFIX in all debug calls would have
resulted in a hard to read/grep code it is removed completely.

Signed-off-by: Richard Leitner <richard.leitner@skidata.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-08-27 14:13:18 -05:00
Andrzej Pietrasiewicz
00a2430ff0 usb: gadget: Gadget directory cleanup - group usb functions
The drivers/usb/gadget directory contains many files.
Files which are related can be distributed into separate directories.
This patch moves the USB functions implementations into a separate directory.

Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-07-16 12:50:36 -05:00