From: Linyu Yuan <[email protected]>
there is following warning,
[<ffffff8008905a94>] dwc3_gadget_ep_queue+0x1b4/0x1c8
[<ffffff800895ec9c>] usb_ep_queue+0x3c/0x120
[<ffffff80089677a0>] eem_unwrap+0x180/0x330
[<ffffff80089634f8>] rx_complete+0x70/0x230
[<ffffff800895edbc>] usb_gadget_giveback_request+0x3c/0xe8
[<ffffff8008901e7c>] dwc3_gadget_giveback+0xb4/0x190
[<ffffff8008905254>] dwc3_endpoint_transfer_complete+0x32c/0x410
[<ffffff80089060fc>] dwc3_bh_work+0x654/0x12e8
[<ffffff80080c63fc>] process_one_work+0x1d4/0x4a8
[<ffffff80080c6720>] worker_thread+0x50/0x4a8
[<ffffff80080cc8e8>] kthread+0xe8/0x100
[<ffffff8008083980>] ret_from_fork+0x10/0x50
request ffffffc0716bf200 belongs to 'ep0out'
when gadget receive a eem command packet from host, it need to response,
but queue usb request to wrong endpoint.
fix it by queue usb request to eem IN endpoint and allow host read it.
Cc: stable <[email protected]>
Signed-off-by: Linyu Yuan <[email protected]>
---
drivers/usb/gadget/function/f_eem.c | 44
++++++++++++++++++++++++++++++++-----
1 file changed, 39 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/gadget/function/f_eem.c
b/drivers/usb/gadget/function/f_eem.c
index 2cd9942..2c2ca1e 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -30,6 +30,11 @@ struct f_eem {
u8 ctrl_id;
};
+struct in_context {
+ struct sk_buff *skb;
+ struct usb_ep *ep;
+};
+
static inline struct f_eem *func_to_eem(struct usb_function *f)
{
return container_of(f, struct f_eem, port.func);
@@ -320,9 +325,12 @@ static int eem_bind(struct usb_configuration *c, struct
usb_function *f)
static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
{
- struct sk_buff *skb = (struct sk_buff *)req->context;
+ struct in_context *ctx = req->context;
- dev_kfree_skb_any(skb);
+ kfree(req->buf);
+ dev_kfree_skb_any(ctx->skb);
+ usb_ep_free_request(ctx->ep, req);
+ kfree(ctx);
}
/*
@@ -410,7 +418,9 @@ static int eem_unwrap(struct gether *port,
* b15: bmType (0 == data, 1 == command)
*/
if (header & BIT(15)) {
- struct usb_request *req = cdev->req;
+ struct usb_request *req;
+ struct in_context *ctx;
+ struct usb_ep *ep;
u16 bmEEMCmd;
/* EEM command packet format:
@@ -439,13 +449,37 @@ static int eem_unwrap(struct gether *port,
skb_trim(skb2, len);
put_unaligned_le16(BIT(15) | BIT(11) | len,
skb_push(skb2, 2));
+
+ ep = port->in_ep;
+ req = usb_ep_alloc_request(ep, GFP_ATOMIC);
+ if (!req) {
+ dev_kfree_skb_any(skb2);
+ break;
+ }
+
+ ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+ if (!ctx)
+ goto nomem;
+ ctx->skb = skb2;
+ ctx->ep = ep;
+
+ req->buf = kmalloc(skb2->len, GFP_KERNEL);
+ if (!req->buf)
+ goto nomem;
+
skb_copy_bits(skb2, 0, req->buf, skb2->len);
req->length = skb2->len;
req->complete = eem_cmd_complete;
req->zero = 1;
- req->context = skb2;
- if (usb_ep_queue(port->in_ep, req,
GFP_ATOMIC))
+ req->context = ctx;
+ if (usb_ep_queue(ep, req, GFP_ATOMIC)) {
DBG(cdev, "echo response queue
fail\n");
+nomem:
+ kfree(req->buf);
+ usb_ep_free_request(ep, req);
+ dev_kfree_skb_any(skb2);
+ kfree(ctx);
+ }
break;
case 1: /* echo response */
--
2.7.4
On Thu, Jun 10, 2021 at 02:10:40PM +0800, [email protected] wrote:
> From: Linyu Yuan <[email protected]>
>
> there is following warning,
> [<ffffff8008905a94>] dwc3_gadget_ep_queue+0x1b4/0x1c8
> [<ffffff800895ec9c>] usb_ep_queue+0x3c/0x120
> [<ffffff80089677a0>] eem_unwrap+0x180/0x330
> [<ffffff80089634f8>] rx_complete+0x70/0x230
> [<ffffff800895edbc>] usb_gadget_giveback_request+0x3c/0xe8
> [<ffffff8008901e7c>] dwc3_gadget_giveback+0xb4/0x190
> [<ffffff8008905254>] dwc3_endpoint_transfer_complete+0x32c/0x410
> [<ffffff80089060fc>] dwc3_bh_work+0x654/0x12e8
> [<ffffff80080c63fc>] process_one_work+0x1d4/0x4a8
> [<ffffff80080c6720>] worker_thread+0x50/0x4a8
> [<ffffff80080cc8e8>] kthread+0xe8/0x100
> [<ffffff8008083980>] ret_from_fork+0x10/0x50
> request ffffffc0716bf200 belongs to 'ep0out'
>
> when gadget receive a eem command packet from host, it need to response,
> but queue usb request to wrong endpoint.
> fix it by queue usb request to eem IN endpoint and allow host read it.
>
> Cc: stable <[email protected]>
> Signed-off-by: Linyu Yuan <[email protected]>
> ---
> drivers/usb/gadget/function/f_eem.c | 44
> ++++++++++++++++++++++++++++++++-----
Your patch is line-wrapped and can not be applied :(
Please fix your email client to properly send patches correctly.
thanks,
greg k-h
On Thu, Jun 10, 2021 at 02:10:40PM +0800, [email protected] wrote:
> From: Linyu Yuan <[email protected]>
>
> there is following warning,
> [<ffffff8008905a94>] dwc3_gadget_ep_queue+0x1b4/0x1c8
> [<ffffff800895ec9c>] usb_ep_queue+0x3c/0x120
> [<ffffff80089677a0>] eem_unwrap+0x180/0x330
> [<ffffff80089634f8>] rx_complete+0x70/0x230
> [<ffffff800895edbc>] usb_gadget_giveback_request+0x3c/0xe8
> [<ffffff8008901e7c>] dwc3_gadget_giveback+0xb4/0x190
> [<ffffff8008905254>] dwc3_endpoint_transfer_complete+0x32c/0x410
> [<ffffff80089060fc>] dwc3_bh_work+0x654/0x12e8
> [<ffffff80080c63fc>] process_one_work+0x1d4/0x4a8
> [<ffffff80080c6720>] worker_thread+0x50/0x4a8
> [<ffffff80080cc8e8>] kthread+0xe8/0x100
> [<ffffff8008083980>] ret_from_fork+0x10/0x50
> request ffffffc0716bf200 belongs to 'ep0out'
>
> when gadget receive a eem command packet from host, it need to response,
> but queue usb request to wrong endpoint.
What is the full warning here? THe above traceback is a bit odd and
does not show what is happening.
> fix it by queue usb request to eem IN endpoint and allow host read it.
I do not understand how this matches up with your kernel patch, when you
resend this, can you please expand on this and make it more obvious what
you are doing here?
thanks,
greg k-h