[PATCH 0/2] usb: gadget: f_fs: restore ffs_func_disable() functionality

[PATCH 0/2] usb: gadget: f_fs: restore ffs_func_disable() functionality

[Tudor Ambarus]

ffs_func_disable() always returned -EINVAL and made pixel6 crash on USB
disconnect. Restore ffs_func_disable() functionality.

Tudor Ambarus (2):
  usb: gadget: f_fs: restore ffs_func_disable() functionality
  usb: gadget: f_fs: pull out f->disable() from ffs_func_set_alt()

 drivers/usb/gadget/function/f_fs.c | 32 +++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 12 deletions(-)

-- 
2.46.0.rc2.264.g509ed76dc8-goog

[PATCH 1/2] usb: gadget: f_fs: restore ffs_func_disable() functionality

[Tudor Ambarus]

The blamed commit made ffs_func_disable() always return -EINVAL as the
method calls ffs_func_set_alt() with the ``alt`` argument being
``(unsigned)-1``, which is always greater than MAX_ALT_SETTINGS.
Use the MAX_ALT_SETTINGS check just in the f->set_alt() code path,
f->disable() doesn't care about the ``alt`` parameter.

Make a surgical fix, but really the f->disable() code shall be pulled
out from ffs_func_set_alt(), the code will become clearer. A patch will
follow.

Note that ffs_func_disable() always returning -EINVAL made pixel6 crash
on USB disconnect.

Fixes: 2f550553e23c ("usb: gadget: f_fs: Add the missing get_alt callback")
Reported-by: William McVicker <willmcvicker@google.com>
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
---
 drivers/usb/gadget/function/f_fs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index d8b096859337..0bfed1741b3e 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3731,10 +3731,10 @@ static int ffs_func_set_alt(struct usb_function *f,
 	struct ffs_data *ffs = func->ffs;
 	int ret = 0, intf;
 
-	if (alt > MAX_ALT_SETTINGS)
-		return -EINVAL;
-
 	if (alt != (unsigned)-1) {
+		if (alt > MAX_ALT_SETTINGS)
+			return -EINVAL;
+
 		intf = ffs_func_revmap_intf(func, interface);
 		if (intf < 0)
 			return intf;
-- 
2.46.0.rc2.264.g509ed76dc8-goog

[PATCH 2/2] usb: gadget: f_fs: pull out f->disable() from ffs_func_set_alt()

[Tudor Ambarus]

The ``alt`` parameter was used as a way to differentiate between
f->disable() and f->set_alt(). As the code paths diverge quite a bit,
pull out the f->disable() code from ffs_func_set_alt(), everything will
become clearer and less error prone. No change in functionality
intended.

Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
---
 drivers/usb/gadget/function/f_fs.c | 36 ++++++++++++++++++------------
 1 file changed, 22 insertions(+), 14 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 0bfed1741b3e..e0ceaa721949 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3731,14 +3731,12 @@ static int ffs_func_set_alt(struct usb_function *f,
 	struct ffs_data *ffs = func->ffs;
 	int ret = 0, intf;
 
-	if (alt != (unsigned)-1) {
-		if (alt > MAX_ALT_SETTINGS)
-			return -EINVAL;
+	if (alt > MAX_ALT_SETTINGS)
+		return -EINVAL;
 
-		intf = ffs_func_revmap_intf(func, interface);
-		if (intf < 0)
-			return intf;
-	}
+	intf = ffs_func_revmap_intf(func, interface);
+	if (intf < 0)
+		return intf;
 
 	if (ffs->func)
 		ffs_func_eps_disable(ffs->func);
@@ -3753,12 +3751,6 @@ static int ffs_func_set_alt(struct usb_function *f,
 	if (ffs->state != FFS_ACTIVE)
 		return -ENODEV;
 
-	if (alt == (unsigned)-1) {
-		ffs->func = NULL;
-		ffs_event_add(ffs, FUNCTIONFS_DISABLE);
-		return 0;
-	}
-
 	ffs->func = func;
 	ret = ffs_func_eps_enable(func);
 	if (ret >= 0) {
@@ -3770,7 +3762,23 @@ static int ffs_func_set_alt(struct usb_function *f,
 
 static void ffs_func_disable(struct usb_function *f)
 {
-	ffs_func_set_alt(f, 0, (unsigned)-1);
+	struct ffs_function *func = ffs_func_from_usb(f);
+	struct ffs_data *ffs = func->ffs;
+
+	if (ffs->func)
+		ffs_func_eps_disable(ffs->func);
+
+	if (ffs->state == FFS_DEACTIVATED) {
+		ffs->state = FFS_CLOSING;
+		INIT_WORK(&ffs->reset_work, ffs_reset_work);
+		schedule_work(&ffs->reset_work);
+		return;
+	}
+
+	if (ffs->state == FFS_ACTIVE) {
+		ffs->func = NULL;
+		ffs_event_add(ffs, FUNCTIONFS_DISABLE);
+	}
 }
 
 static int ffs_func_setup(struct usb_function *f,
-- 
2.46.0.rc2.264.g509ed76dc8-goog

Re: [PATCH 1/2] usb: gadget: f_fs: restore ffs_func_disable() functionality

[Greg KH]

On Fri, Aug 02, 2024 at 02:04:27PM +0000, Tudor Ambarus wrote:
> The blamed commit made ffs_func_disable() always return -EINVAL as the
> method calls ffs_func_set_alt() with the ``alt`` argument being
> ``(unsigned)-1``, which is always greater than MAX_ALT_SETTINGS.
> Use the MAX_ALT_SETTINGS check just in the f->set_alt() code path,
> f->disable() doesn't care about the ``alt`` parameter.
> 
> Make a surgical fix, but really the f->disable() code shall be pulled
> out from ffs_func_set_alt(), the code will become clearer. A patch will
> follow.
> 
> Note that ffs_func_disable() always returning -EINVAL made pixel6 crash
> on USB disconnect.
> 
> Fixes: 2f550553e23c ("usb: gadget: f_fs: Add the missing get_alt callback")
> Reported-by: William McVicker <willmcvicker@google.com>
> Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
> ---
>  drivers/usb/gadget/function/f_fs.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
> index d8b096859337..0bfed1741b3e 100644
> --- a/drivers/usb/gadget/function/f_fs.c
> +++ b/drivers/usb/gadget/function/f_fs.c
> @@ -3731,10 +3731,10 @@ static int ffs_func_set_alt(struct usb_function *f,
>  	struct ffs_data *ffs = func->ffs;
>  	int ret = 0, intf;
>  
> -	if (alt > MAX_ALT_SETTINGS)
> -		return -EINVAL;
> -
>  	if (alt != (unsigned)-1) {
> +		if (alt > MAX_ALT_SETTINGS)
> +			return -EINVAL;
> +
>  		intf = ffs_func_revmap_intf(func, interface);
>  		if (intf < 0)
>  			return intf;
> -- 
> 2.46.0.rc2.264.g509ed76dc8-goog
> 
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- You have marked a patch with a "Fixes:" tag for a commit that is in an
  older released kernel, yet you do not have a cc: stable line in the
  signed-off-by area at all, which means that the patch will not be
  applied to any older kernel releases.  To properly fix this, please
  follow the documented rules in the
  Documentation/process/stable-kernel-rules.rst file for how to resolve
  this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot