[PATCH v2 0/2] usb: renesas_usbhs: fix to avoid unexpected condition

[PATCH v2 0/2] usb: renesas_usbhs: fix to avoid unexpected condition

[Yoshihiro Shimoda]

This patch set is based on the latest Felipe's usb.git / testing/next branch.
(commit id = ac5706631325ae3695bfa1527101ab2b2f64859f)

Changes from v1:
 - Add "Fixes" and "Cc: <stable@vger.kernel.org>.
 - Revise the commit log of patch 2.
  - consistent words: tx -> TX, irq -> IRQ
  - typo: heppen -> happen

Yoshihiro Shimoda (2):
  usb: renesas_usbhs: avoid NULL pointer derefernce in
    usbhsf_pkt_handler()
  usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer

 drivers/usb/renesas_usbhs/fifo.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

-- 
1.9.1

[PATCH v2 1/2] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()

[Yoshihiro Shimoda]

When unexpected situation happened (e.g. tx/rx irq happened while
DMAC is used), the usbhsf_pkt_handler() was possible to cause NULL
pointer dereference like the followings:

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 80000007 [#1] SMP ARM
Modules linked in: usb_f_acm u_serial g_serial libcomposite
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.5.0-rc6-00842-gac57066-dirty #63
Hardware name: Generic R8A7790 (Flattened Device Tree)
task: c0729c00 ti: c0724000 task.ti: c0724000
PC is at 0x0
LR is at usbhsf_pkt_handler+0xac/0x118
pc : [<00000000>]    lr : [<c03257e0>]    psr: 60000193
sp : c0725db8  ip : 00000000  fp : c0725df4
r10: 00000001  r9 : 00000193  r8 : ef3ccab4
r7 : ef3cca10  r6 : eea4586c  r5 : 00000000  r4 : ef19ceb4
r3 : 00000000  r2 : 0000009c  r1 : c0725dc4  r0 : ef19ceb4

This patch adds a condition to avoid the dereference.

Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
---
 drivers/usb/renesas_usbhs/fifo.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index b4de70e..0c25c01 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -190,7 +190,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type)
 		goto __usbhs_pkt_handler_end;
 	}
 
-	ret = func(pkt, &is_done);
+	if (likely(func))
+		ret = func(pkt, &is_done);
 
 	if (is_done)
 		__usbhsf_pkt_del(pkt);
-- 
1.9.1

[PATCH v2 2/2] usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer

[Yoshihiro Shimoda]

This patch adds a code to surely disable TX IRQ of the pipe before
starting TX DMAC transfer. Otherwise, a lot of unnecessary TX IRQs
may happen in rare cases when DMAC is used.

Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
---
 drivers/usb/renesas_usbhs/fifo.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 0c25c01..000f975 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -890,6 +890,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
 
 	pkt->trans = len;
 
+	usbhsf_tx_irq_ctrl(pipe, 0);
 	INIT_WORK(&pkt->work, xfer_work);
 	schedule_work(&pkt->work);
 
-- 
1.9.1

RE: [PATCH v2 0/2] usb: renesas_usbhs: fix to avoid unexpected condition

[Yoshihiro Shimoda]

Hi Felipe,

> From: Yoshihiro Shimoda
> Sent: Thursday, March 10, 2016 11:30 AM
> 
> This patch set is based on the latest Felipe's usb.git / testing/next branch.
> (commit id = ac5706631325ae3695bfa1527101ab2b2f64859f)

Would you review the patch set?
I confirmed that the patch set could be applied on the latest testing/next and testing/fixes branches.

Best regards,
Yoshihiro Shimoda

> Changes from v1:
>  - Add "Fixes" and "Cc: <stable@vger.kernel.org>.
>  - Revise the commit log of patch 2.
>   - consistent words: tx -> TX, irq -> IRQ
>   - typo: heppen -> happen
> 
> Yoshihiro Shimoda (2):
>   usb: renesas_usbhs: avoid NULL pointer derefernce in
>     usbhsf_pkt_handler()
>   usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
> 
>  drivers/usb/renesas_usbhs/fifo.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> --
> 1.9.1

RE: [PATCH v2 0/2] usb: renesas_usbhs: fix to avoid unexpected condition

[Felipe Balbi]

[-- Attachment #1: Type: text/plain, Size: 587 bytes --]


Yoshihiro-san,

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> writes:
>> From: Yoshihiro Shimoda
>> Sent: Thursday, March 10, 2016 11:30 AM
>> 
>> This patch set is based on the latest Felipe's usb.git / testing/next branch.
>> (commit id = ac5706631325ae3695bfa1527101ab2b2f64859f)
>
> Would you review the patch set?
>
> I confirmed that the patch set could be applied on the latest
> testing/next and testing/fixes branches.

I'm waiting for v4.6-rc1 to be tagged to carry on applying
patches. Nothing really happens during the merge window ;-)

-- 
balbi

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

RE: [PATCH v2 0/2] usb: renesas_usbhs: fix to avoid unexpected condition

[Yoshihiro Shimoda]

Hi Felipe-san,

> From: Felipe Balbi [mailto:balbi@kernel.org]
> Sent: Tuesday, March 22, 2016 4:16 PM
> 
> Yoshihiro-san,
> 
> Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> writes:
> >> From: Yoshihiro Shimoda
> >> Sent: Thursday, March 10, 2016 11:30 AM
> >>
> >> This patch set is based on the latest Felipe's usb.git / testing/next branch.
> >> (commit id = ac5706631325ae3695bfa1527101ab2b2f64859f)
> >
> > Would you review the patch set?
> >
> > I confirmed that the patch set could be applied on the latest
> > testing/next and testing/fixes branches.
> 
> I'm waiting for v4.6-rc1 to be tagged to carry on applying
> patches. Nothing really happens during the merge window ;-)

Thank you for the reply. I got it :)

Best regards,
Yoshihiro Shimoda

> --
> balbi