From 817c44f524419bc3e7a4a1f257f89dd68ad7a3f7 Mon Sep 17 00:00:00 2001 From: Yue Wang Date: Mon, 24 Jul 2017 16:08:25 +0800 Subject: [PATCH] usb: fix adb reboot panic. PD#146539: usb: fix adb reboot panic. Avoid kernel panic caused by race condition. For example, 1. In the ffs_epfile_io function, data buffer is allocated for non-halt requests and the address of this buffer is writed to usb controller registers. 2. After adb process be killed, data buffer is freed and this memory is allocated for the other. But the address is hold by the controller. 3. Adbd in PC is running. So, the controller receive the data and write to this memory. 4. The value of this memory is modified by the controller. This could cause the kernel panic. To avoid this, during FunctionFS mount, we allocated the data buffer for requests. And the memory resources has been released in kill_sb. Change-Id: Ie06fae8ce18ea553d71f4841458c3c3af096ff4b Signed-off-by: Yue Wang --- drivers/usb/gadget/function/f_fs.c | 156 +++++++++++++++++++++++-------------- drivers/usb/gadget/function/u_fs.h | 9 ++- 2 files changed, 106 insertions(+), 59 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 627e004..0f2ef63 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -261,6 +261,59 @@ static void ffs_release_dev(struct ffs_data *ffs_data); static int ffs_ready(struct ffs_data *ffs); static void ffs_closed(struct ffs_data *ffs); +#ifdef CONFIG_AMLOGIC_USB +static int ffs_malloc_buffer(struct ffs_data *ffs) +{ + int i; + + for (i = 0; i < FFS_BUFFER_MAX; i++) { + ffs->buffer[i].data_ep = kzalloc(MAX_PAYLOAD_EPS, GFP_KERNEL); + if (!ffs->buffer[i].data_ep) + return -ENOMEM; + ffs->buffer[i].data_state = 0; + } + + return 0; +} + +static void ffs_free_buffer(struct ffs_data *ffs) +{ + int i; + + for (i = 0; i < FFS_BUFFER_MAX; i++) { + kfree(ffs->buffer[i].data_ep); + ffs->buffer[i].data_ep = NULL; + ffs->buffer[i].data_state = 0; + } +} + +static struct ffs_data_buffer *assign_ffs_buffer(struct ffs_data *ffs) +{ + int i; + + for (i = 0; i < FFS_BUFFER_MAX; i++) { + if (ffs->buffer[i].data_state == 0) { + ffs->buffer[i].data_state = 1; + return &(ffs->buffer[i]); + } + } + + pr_info("assign_ffs_buffer failed!!!\n"); + return NULL; +} + +static void release_ffs_buffer(struct ffs_data *ffs, + struct ffs_data_buffer *buffer) +{ + struct ffs_data_buffer *buffer_temp = buffer; + + spin_lock_irq(&ffs->eps_lock); + memset(buffer_temp->data_ep, 0, MAX_PAYLOAD_EPS); + buffer_temp->data_state = 0; + spin_unlock_irq(&ffs->eps_lock); +} +#endif + /* Misc helper functions ****************************************************/ static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) @@ -316,6 +369,9 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len) return -EINTR; } +#ifdef CONFIG_AMLOGIC_USB + memcpy(data, ffs->data_ep0, len); +#endif ffs->setup_state = FFS_NO_SETUP; return req->status ? req->status : req->actual; } @@ -891,6 +947,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) struct usb_request *req; #ifdef CONFIG_AMLOGIC_USB struct ffs_ep *ep = epfile->ep; + struct ffs_data_buffer *buffer = NULL; #else struct ffs_ep *ep; #endif @@ -963,13 +1020,43 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) */ if (io_data->read) data_len = usb_ep_align_maybe(gadget, ep->ep, data_len); - spin_unlock_irq(&epfile->ffs->eps_lock); +#ifndef CONFIG_AMLOGIC_USB + spin_unlock_irq(&epfile->ffs->eps_lock); data = kmalloc(data_len, GFP_KERNEL); if (unlikely(!data)) { ret = -ENOMEM; goto error_mutex; } +#else + /* Fire the request */ + /* + * Avoid kernel panic caused by race condition. For example, + * 1. In the ffs_epfile_io function, data buffer is allocated + * for non-halt requests and the address of this buffer is + * writed to usb controller registers. + * 2. After adb process be killed, data buffer is freed and + * this memory is allocated for the other. But the address + * is hold by the controller. + * 3. Adbd in PC is running. So, the controller receive the + * data and write to this memory. + * 4. The value of this memory is modified by the controller. + * This could cause the kernel panic. + + * To avoid this, during FunctionFS mount, we allocated the + * data buffer for requests. And the memory resources has + * been released in kill_sb. + */ + buffer = assign_ffs_buffer(epfile->ffs); + if (unlikely(!buffer)) { + ret = -ENOMEM; + spin_unlock_irq(&epfile->ffs->eps_lock); + goto error_mutex; + } + data = buffer->data_ep; + spin_unlock_irq(&epfile->ffs->eps_lock); +#endif + if (!io_data->read && copy_from_iter(data, data_len, &io_data->data) != data_len) { ret = -EFAULT; @@ -1007,39 +1094,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) #endif bool interrupted = false; req = ep->req; -#ifdef CONFIG_AMLOGIC_USB - /* Fire the request */ - /*Avoid kernel panic caused by race condition. For example, - * 1. In the ffs_epfile_io function, data buffer is allocated - * for non-halt requests and the address of this buffer is - * writed to usb controller registers. - * 2. After adb process be killed, data buffer is freed and - * this memory is allocated for the other. But the address - * is hold by the controller. - * 3. Adbd in PC is running. So, the controller receive the - * data and write to this memory. - * 4. The value of this memory is modified by the controller. - *This could cause the kernel panic. - - * To avoid this, during FunctionFS mount, we allocated the - * data buffer for requests. And the memory resources has - * been released in kill_sb. - */ - if (data) { - if (ep->num == 0) - memcpy(epfile->ffs->data_ep_in, data, data_len); - else - memcpy(epfile->ffs->data_ep_out, data, - data_len); - } - - if (ep->num == 0) - req->buf = epfile->ffs->data_ep_in; - else - req->buf = epfile->ffs->data_ep_out; -#else req->buf = data; -#endif req->length = data_len; req->context = &done; @@ -1064,22 +1119,10 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) if (interrupted) ret = -EINTR; -#ifdef CONFIG_AMLOGIC_USB - else if (io_data->read && ep->status > 0) { - if (ep->num == 0) - memcpy(data, epfile->ffs->data_ep_in, - min_t(size_t, ep->status, data_len)); - else - memcpy(data, epfile->ffs->data_ep_out, - min_t(size_t, ep->status, data_len)); - ret = __ffs_epfile_read_data(epfile, data, ep->status, - &io_data->data); - } -#else + else if (io_data->read && ep->status > 0) ret = __ffs_epfile_read_data(epfile, data, ep->status, &io_data->data); -#endif else ret = ep->status; goto error_mutex; @@ -1116,7 +1159,12 @@ error_lock: error_mutex: mutex_unlock(&epfile->mutex); error: +#ifdef CONFIG_AMLOGIC_USB + if (buffer) + release_ffs_buffer(epfile->ffs, buffer); +#else kfree(data); +#endif return ret; } @@ -1566,17 +1614,14 @@ ffs_fs_mount(struct file_system_type *t, int flags, } #ifdef CONFIG_AMLOGIC_USB - ffs->data_ep0 = kmalloc(MAX_PAYLOAD_EP0, GFP_KERNEL); + ffs->data_ep0 = kzalloc(MAX_PAYLOAD_EP0, GFP_KERNEL); if (unlikely(!ffs->data_ep0)) return ERR_PTR(-ENOMEM); - ffs->data_ep_in = kmalloc(MAX_PAYLOAD_EPS, GFP_KERNEL); - if (unlikely(!ffs->data_ep_in)) - return ERR_PTR(-ENOMEM); + ret = ffs_malloc_buffer(ffs); + if (ret < 0) + return ERR_PTR(ret); - ffs->data_ep_out = kmalloc(MAX_PAYLOAD_EPS, GFP_KERNEL); - if (unlikely(!ffs->data_ep_out)) - return ERR_PTR(-ENOMEM); #endif ffs_dev = ffs_acquire_dev(dev_name); if (IS_ERR(ffs_dev)) { @@ -1608,10 +1653,7 @@ ffs_fs_kill_sb(struct super_block *sb) #ifdef CONFIG_AMLOGIC_USB kfree(ffs->data_ep0); ffs->data_ep0 = NULL; - kfree(ffs->data_ep_in); - ffs->data_ep_in = NULL; - kfree(ffs->data_ep_out); - ffs->data_ep_out = NULL; + ffs_free_buffer(ffs); #endif ffs_release_dev(sb->s_fs_info); ffs_data_closed(sb->s_fs_info); diff --git a/drivers/usb/gadget/function/u_fs.h b/drivers/usb/gadget/function/u_fs.h index 8b1e320..1ddb963 100644 --- a/drivers/usb/gadget/function/u_fs.h +++ b/drivers/usb/gadget/function/u_fs.h @@ -147,6 +147,12 @@ enum ffs_setup_state { FFS_SETUP_CANCELLED }; +#define FFS_BUFFER_MAX 10 +struct ffs_data_buffer { + char *data_ep; + bool data_state; +}; + struct ffs_data { struct usb_gadget *gadget; @@ -284,8 +290,7 @@ struct ffs_data { #ifdef CONFIG_AMLOGIC_USB char *data_ep0; - char *data_ep_in; - char *data_ep_out; + struct ffs_data_buffer buffer[FFS_BUFFER_MAX]; #endif }; -- 2.7.4