[PATCH] usb: gadget: atmel_usba: Fix crashed during stopping when DEBUG is enabled

[PATCH] usb: gadget: atmel_usba: Fix crashed during stopping when DEBUG is enabled

[Gregory CLEMENT]

The debug trace in the atmel_usba_stop function made the assumption
that the driver pointer passed in parameter was not NULL. Since the
commit "usb: gadget: udc-core: fix a regression during gadget driver
unbinding", it was no more always true. This lead to a kernel crash.

This commit now use the driver pointer stored in udc which fixes this
issue.

Since the commit which have triggered this issue was backported to the
3.2 stable branch, then this one should also be backported to the same
kernel.

Cc: stable@vger.kernel.org # v3.2+
Fixes: 511f3c5326ea (usb: gadget: udc-core: fix a regression during gadget driver unbinding)
---
 drivers/usb/gadget/atmel_usba_udc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index 52771d4c44bc..167843de2d8a 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -1827,12 +1827,12 @@ static int atmel_usba_stop(struct usb_gadget *gadget,
 	toggle_bias(0);
 	usba_writel(udc, CTRL, USBA_DISABLE_MASK);
 
-	udc->driver = NULL;
-
 	clk_disable_unprepare(udc->hclk);
 	clk_disable_unprepare(udc->pclk);
 
-	DBG(DBG_GADGET, "unregistered driver `%s'\n", driver->driver.name);
+	DBG(DBG_GADGET, "unregistered driver `%s'\n", udc->driver->driver.name);
+
+	udc->driver = NULL;
 
 	return 0;
 }
-- 
1.8.1.2

Re: [PATCH] usb: gadget: atmel_usba: Fix crashed during stopping when DEBUG is enabled

[Alexandre Belloni]

[-- Attachment #1: Type: text/plain, Size: 1797 bytes --]

Hi Gregory,

On 28/02/2014 at 15:34:01 +0100, Gregory CLEMENT wrote :
> The debug trace in the atmel_usba_stop function made the assumption
> that the driver pointer passed in parameter was not NULL. Since the
> commit "usb: gadget: udc-core: fix a regression during gadget driver
> unbinding", it was no more always true. This lead to a kernel crash.
> 
> This commit now use the driver pointer stored in udc which fixes this
> issue.
> 
> Since the commit which have triggered this issue was backported to the
> 3.2 stable branch, then this one should also be backported to the same
> kernel.
> 
> Cc: stable@vger.kernel.org # v3.2+
> Fixes: 511f3c5326ea (usb: gadget: udc-core: fix a regression during gadget driver unbinding)
> ---
>  drivers/usb/gadget/atmel_usba_udc.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
> index 52771d4c44bc..167843de2d8a 100644
> --- a/drivers/usb/gadget/atmel_usba_udc.c
> +++ b/drivers/usb/gadget/atmel_usba_udc.c
> @@ -1827,12 +1827,12 @@ static int atmel_usba_stop(struct usb_gadget *gadget,
>  	toggle_bias(0);
>  	usba_writel(udc, CTRL, USBA_DISABLE_MASK);
>  
> -	udc->driver = NULL;
> -
>  	clk_disable_unprepare(udc->hclk);
>  	clk_disable_unprepare(udc->pclk);
>  
> -	DBG(DBG_GADGET, "unregistered driver `%s'\n", driver->driver.name);
> +	DBG(DBG_GADGET, "unregistered driver `%s'\n", udc->driver->driver.name);
> +
> +	udc->driver = NULL;

Shouldn't we get rid of that assignment as it is done in
usb_gadget_remove_driver() anyway ?

>  
>  	return 0;
>  }
> -- 
> 1.8.1.2
> 

-- 
Alexandre Belloni, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [PATCH] usb: gadget: atmel_usba: Fix crashed during stopping when DEBUG is enabled

[Gregory CLEMENT]

On 28/02/2014 16:50, Alexandre Belloni wrote:
> Hi Gregory,
> 
> On 28/02/2014 at 15:34:01 +0100, Gregory CLEMENT wrote :
>> The debug trace in the atmel_usba_stop function made the assumption
>> that the driver pointer passed in parameter was not NULL. Since the
>> commit "usb: gadget: udc-core: fix a regression during gadget driver
>> unbinding", it was no more always true. This lead to a kernel crash.
>>
>> This commit now use the driver pointer stored in udc which fixes this
>> issue.
>>
>> Since the commit which have triggered this issue was backported to the
>> 3.2 stable branch, then this one should also be backported to the same
>> kernel.
>>
>> Cc: stable@vger.kernel.org # v3.2+
>> Fixes: 511f3c5326ea (usb: gadget: udc-core: fix a regression during gadget driver unbinding)
>> ---
>>  drivers/usb/gadget/atmel_usba_udc.c | 6 +++---
>>  1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
>> index 52771d4c44bc..167843de2d8a 100644
>> --- a/drivers/usb/gadget/atmel_usba_udc.c
>> +++ b/drivers/usb/gadget/atmel_usba_udc.c
>> @@ -1827,12 +1827,12 @@ static int atmel_usba_stop(struct usb_gadget *gadget,
>>  	toggle_bias(0);
>>  	usba_writel(udc, CTRL, USBA_DISABLE_MASK);
>>  
>> -	udc->driver = NULL;
>> -
>>  	clk_disable_unprepare(udc->hclk);
>>  	clk_disable_unprepare(udc->pclk);
>>  
>> -	DBG(DBG_GADGET, "unregistered driver `%s'\n", driver->driver.name);
>> +	DBG(DBG_GADGET, "unregistered driver `%s'\n", udc->driver->driver.name);
>> +
>> +	udc->driver = NULL;
> 
> Shouldn't we get rid of that assignment as it is done in
> usb_gadget_remove_driver() anyway ?

usb_gadget_remove_driver() is not the only function to use it.
usb_udc_softconn_store() can call it too and doesn't have any
debug message.


Thanks,

Gregory


> 
>>  
>>  	return 0;
>>  }
>> -- 
>> 1.8.1.2
>>
> 


-- 
Gregory Clement, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com

Re: [PATCH] usb: gadget: atmel_usba: Fix crashed during stopping when DEBUG is enabled

[Felipe Balbi]

[-- Attachment #1: Type: text/plain, Size: 847 bytes --]

On Fri, Feb 28, 2014 at 03:34:01PM +0100, Gregory CLEMENT wrote:
> The debug trace in the atmel_usba_stop function made the assumption
> that the driver pointer passed in parameter was not NULL. Since the
> commit "usb: gadget: udc-core: fix a regression during gadget driver
> unbinding", it was no more always true. This lead to a kernel crash.
> 
> This commit now use the driver pointer stored in udc which fixes this
> issue.
> 
> Since the commit which have triggered this issue was backported to the
> 3.2 stable branch, then this one should also be backported to the same
> kernel.
> 
> Cc: stable@vger.kernel.org # v3.2+
> Fixes: 511f3c5326ea (usb: gadget: udc-core: fix a regression during gadget driver unbinding)

this line shouldn't be here and you're missing a SoB line, can't take
this patch, sorry.

-- 
balbi

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [PATCH] usb: gadget: atmel_usba: Fix crashed during stopping when DEBUG is enabled

[Gregory CLEMENT]

On 03/03/2014 17:33, Felipe Balbi wrote:
> On Fri, Feb 28, 2014 at 03:34:01PM +0100, Gregory CLEMENT wrote:
>> The debug trace in the atmel_usba_stop function made the assumption
>> that the driver pointer passed in parameter was not NULL. Since the
>> commit "usb: gadget: udc-core: fix a regression during gadget driver
>> unbinding", it was no more always true. This lead to a kernel crash.
>>
>> This commit now use the driver pointer stored in udc which fixes this
>> issue.
>>
>> Since the commit which have triggered this issue was backported to the
>> 3.2 stable branch, then this one should also be backported to the same
>> kernel.
>>
>> Cc: stable@vger.kernel.org # v3.2+
>> Fixes: 511f3c5326ea (usb: gadget: udc-core: fix a regression during gadget driver unbinding)
> 
> this line shouldn't be here and you're missing a SoB line, can't take
> this patch, sorry.

Right, I forgot the -s option for this commit.

and you want the "Fixes" line be before the Cc: line, right?

Thanks,

Gregory



-- 
Gregory Clement, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com

Re: [PATCH] usb: gadget: atmel_usba: Fix crashed during stopping when DEBUG is enabled

[Felipe Balbi]

[-- Attachment #1: Type: text/plain, Size: 1173 bytes --]

On Mon, Mar 03, 2014 at 05:38:49PM +0100, Gregory CLEMENT wrote:
> On 03/03/2014 17:33, Felipe Balbi wrote:
> > On Fri, Feb 28, 2014 at 03:34:01PM +0100, Gregory CLEMENT wrote:
> >> The debug trace in the atmel_usba_stop function made the assumption
> >> that the driver pointer passed in parameter was not NULL. Since the
> >> commit "usb: gadget: udc-core: fix a regression during gadget driver
> >> unbinding", it was no more always true. This lead to a kernel crash.
> >>
> >> This commit now use the driver pointer stored in udc which fixes this
> >> issue.
> >>
> >> Since the commit which have triggered this issue was backported to the
> >> 3.2 stable branch, then this one should also be backported to the same
> >> kernel.
> >>
> >> Cc: stable@vger.kernel.org # v3.2+
> >> Fixes: 511f3c5326ea (usb: gadget: udc-core: fix a regression during gadget driver unbinding)
> > 
> > this line shouldn't be here and you're missing a SoB line, can't take
> > this patch, sorry.
> 
> Right, I forgot the -s option for this commit.
> 
> and you want the "Fixes" line be before the Cc: line, right?

right, that should do it.

cheers

-- 
balbi

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]