lkml.org 
[lkml]   [2015]   [Sep]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/2] usb: chipidea: udc: improve error handling on ep_queue
    Date
    From: "Felipe F. Tonello" <eu@felipetonello.com>

    _ep_queue() didn't check for errors when using add_td_to_list()
    which can fail if dma_pool_alloc fails, thus causing a kernel
    panic when lastnode->ptr is NULL.

    Signed-off-by: Felipe F. Tonello <eu@felipetonello.com>
    ---
    drivers/usb/chipidea/udc.c | 26 +++++++++++++++++++-------
    1 file changed, 19 insertions(+), 7 deletions(-)

    diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
    index 764f668..7169113e 100644
    --- a/drivers/usb/chipidea/udc.c
    +++ b/drivers/usb/chipidea/udc.c
    @@ -404,9 +404,9 @@ static inline u8 _usb_addr(struct ci_hw_ep *ep)
    }

    /**
    - * _hardware_queue: configures a request at hardware level
    - * @gadget: gadget
    + * _hardware_enqueue: configures a request at hardware level
    * @hwep: endpoint
    + * @hwreq: request
    *
    * This function returns an error code
    */
    @@ -435,19 +435,27 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq)
    if (hwreq->req.dma % PAGE_SIZE)
    pages--;

    - if (rest == 0)
    - add_td_to_list(hwep, hwreq, 0);
    + if (rest == 0) {
    + ret = add_td_to_list(hwep, hwreq, 0);
    + if (ret < 0)
    + goto done;
    + }

    while (rest > 0) {
    unsigned count = min(hwreq->req.length - hwreq->req.actual,
    (unsigned)(pages * CI_HDRC_PAGE_SIZE));
    - add_td_to_list(hwep, hwreq, count);
    + ret = add_td_to_list(hwep, hwreq, count);
    + if (ret < 0)
    + goto done;
    rest -= count;
    }

    if (hwreq->req.zero && hwreq->req.length
    - && (hwreq->req.length % hwep->ep.maxpacket == 0))
    - add_td_to_list(hwep, hwreq, 0);
    + && (hwreq->req.length % hwep->ep.maxpacket == 0)) {
    + ret = add_td_to_list(hwep, hwreq, 0);
    + if (ret < 0)
    + goto done;
    + }

    firstnode = list_first_entry(&hwreq->tds, struct td_node, td);

    @@ -750,8 +758,12 @@ static void isr_get_status_complete(struct usb_ep *ep, struct usb_request *req)

    /**
    * _ep_queue: queues (submits) an I/O request to an endpoint
    + * @ep: endpoint
    + * @req: request
    + * @gfp_flags: GFP flags (not used)
    *
    * Caller must hold lock
    + * This function returns an error code
    */
    static int _ep_queue(struct usb_ep *ep, struct usb_request *req,
    gfp_t __maybe_unused gfp_flags)
    --
    2.1.4


    \
     
     \ /
      Last update: 2015-09-18 19:41    [W:4.310 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site