Hi, David Lechner <david@xxxxxxxxxxxxxx> writes: > This reverts commit ba1582f22231821c57534e87b077d84adbc15dbd. > > I am getting a null pointer dereference when setting up an hid gadget using > configfs. Reverting this commit fixes the crash. > > dmesg: > > [ 382.406622] Unable to handle kernel NULL pointer dereference at virtual address 00000002 > [ 382.406672] pgd = c3b0c000 > [ 382.406695] [00000002] *pgd=c2d7e831, *pte=00000000, *ppte=00000000 > [ 382.406772] Internal error: Oops: 17 [#1] PREEMPT ARM > [ 382.406793] Modules linked in: usb_f_hid usb_f_ecm usb_f_rndis u_ether d_pwm d_analog d_uart d_iic rtl8150 suart_emu snd_legoev3 snd_pcm snd_timer snd soundcore lms2012_compat legoev3_bluetooth legoev3_i2c fuse uinput libcomposite configfs > [ 382.407059] CPU: 0 PID: 485 Comm: usb-hid-gadget. Not tainted 4.9.0-ev3dev-bpo-stretch-r2-ev3-lms2012 #1 > [ 382.407076] Hardware name: LEGO MINDSTORMS EV3 > [ 382.407099] task: c36f7660 task.stack: c2e6c000 > [ 382.407450] PC is at alloc_ep_req+0x28/0x8c [libcomposite] > [ 382.407522] LR is at kmem_cache_alloc+0x148/0x154 > [ 382.407557] pc : [<bf0138d8>] lr : [<c00c9c94>] psr: a0000013 > sp : c2e6dd60 ip : 00000000 fp : c2e6dd7c > [ 382.407578] r10: c3bd527c r9 : c3bd52d4 r8 : c2d132a8 > [ 382.407601] r7 : bf10769c r6 : c39a4410 r5 : 00000400 r4 : c3b3c2a0 > [ 382.407623] r3 : 00000000 r2 : 00000000 r1 : ffffffe0 r0 : c3b3c2a0 > [ 382.407648] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none > [ 382.407671] Control: 0005317f Table: c3b0c000 DAC: 00000051 > [ 382.407694] Process usb-hid-gadget. (pid: 485, stack limit = 0xc2e6c190) > [ 382.407716] Stack: (0xc2e6dd60 to 0xc2e6e000) > [ 382.407769] dd60: c2ec7654 c3bd527c 00000000 c3bd5200 c2e6ddbc c2e6dd80 bf106894 bf0138c0 > [ 382.407820] dd80: c2e6de34 c2e6dd90 c000e080 c0009010 c08f0f98 c2d1331c c3bd527c c2d132a8 > [ 382.407870] dda0: c2d132a8 c2d13200 c2d1331c c3bd527c c2e6dddc c2e6ddc0 bf00f844 bf106804 > [ 382.407920] ddc0: c2ec7400 c3bd52d4 c2ec7654 c2d132c4 c2e6de34 c2e6dde0 bf0133a0 bf00f7c8 > [ 382.407969] dde0: c2ec7400 00000000 c39a5140 c2ec768c c2e6de1c c2d1331c c3b16264 c2e6997c > [ 382.408019] de00: c3bd52d4 c2d132c8 c35ec390 c3a91400 c2ec75e0 c2ec75e0 00000000 c2ec7590 > [ 382.408067] de20: 00000000 00000000 c2e6de54 c2e6de38 c0344e7c bf013134 00000000 c3a91400 > [ 382.408117] de40: c2ec75e0 c37c0c00 c2e6de7c c2e6de58 c0345028 c0344e58 c37c0c00 c00a1994 > [ 382.408168] de60: c2ec7400 00000011 c3ba9000 c37c0c00 c2e6dea4 c2e6de80 bf01234c c0344f18 > [ 382.408216] de80: 00000011 c08f0cc0 c3ba9000 c2e6df80 00000051 c08f0cd8 c2e6dedc c2e6dea8 > [ 382.408267] dea0: bf000cd0 bf0122d4 c2e6defc c1d06a00 c00109c0 c1d06a00 c2e6df80 bf004a40 > [ 382.408316] dec0: 00000011 c2e6df80 c2e6c000 00000000 c2e6df4c c2e6dee0 c00d411c bf000bc0 > [ 382.408366] dee0: c06999f0 c2e6dfb0 000da2b8 b6e7a000 c2e6dfac c2e6df00 c000930c c00107e0 > [ 382.408415] df00: c00f45b4 c00d1aa0 c3b603c0 00000000 c3b603c0 0000000a c1d06a00 c2ff60e0 > [ 382.408463] df20: c00f4f70 00000001 c1d06a00 c1d06a00 00000000 00000011 000fc408 c2e6df80 > [ 382.408513] df40: c2e6df7c c2e6df50 c00d5370 c00d40fc c2e6df7c c2e6df60 c1d06a00 c1d06a00 > [ 382.408562] df60: 00000011 000fc408 c000a464 00000000 c2e6dfa4 c2e6df80 c00d55cc c00d52bc > [ 382.408608] df80: 00000000 00000000 00000011 000fc408 b6e7ab40 00000004 00000000 c2e6dfa8 > [ 382.408655] dfa0: c000a2c0 c00d5594 00000011 000fc408 00000001 000fc408 00000011 00000000 > [ 382.408701] dfc0: 00000011 000fc408 b6e7ab40 00000004 00000011 000fc408 00000011 00000000 > [ 382.408747] dfe0: 00000000 beb53734 b6da2cc0 b6dfbefc 60000010 00000001 00000000 00000000 > [ 382.408756] Backtrace: > [ 382.409175] [<bf0138b0>] (alloc_ep_req [libcomposite]) from [<bf106894>] (hidg_bind+0xa0/0x268 [usb_f_hid]) > [ 382.409225] r6:c3bd5200 r5:00000000 r4:c3bd527c r3:c2ec7654 > [ 382.409591] [<bf1067f4>] (hidg_bind [usb_f_hid]) from [<bf00f844>] (usb_add_function+0x8c/0x13c [libcomposite]) > [ 382.409652] r10:c3bd527c r8:c2d1331c r7:c2d13200 r6:c2d132a8 r5:c2d132a8 r4:c3bd527c > [ 382.410191] [<bf00f7b8>] (usb_add_function [libcomposite]) from [<bf0133a0>] (configfs_composite_bind+0x27c/0x34c [libcomposite]) > [ 382.410226] r5:c2d132c4 r4:c2ec7654 > [ 382.410549] [<bf013124>] (configfs_composite_bind [libcomposite]) from [<c0344e7c>] (udc_bind_to_driver+0x34/0xc0) > [ 382.410606] r10:00000000 r9:00000000 r8:c2ec7590 r7:00000000 r6:c2ec75e0 r5:c2ec75e0 > [ 382.410623] r4:c3a91400 > [ 382.410697] [<c0344e48>] (udc_bind_to_driver) from [<c0345028>] (usb_gadget_probe_driver+0x120/0x14c) > [ 382.410736] r6:c37c0c00 r5:c2ec75e0 r4:c3a91400 r3:00000000 > [ 382.411059] [<c0344f08>] (usb_gadget_probe_driver) from [<bf01234c>] (gadget_dev_desc_UDC_store+0x88/0xc0 [libcomposite]) > [ 382.411105] r7:c37c0c00 r6:c3ba9000 r5:00000011 r4:c2ec7400 > [ 382.411584] [<bf0122c4>] (gadget_dev_desc_UDC_store [libcomposite]) from [<bf000cd0>] (configfs_write_file+0x120/0x154 [configfs]) > [ 382.411644] r10:c08f0cd8 r8:00000051 r7:c2e6df80 r6:c3ba9000 r5:c08f0cc0 r4:00000011 > [ 382.411865] [<bf000bb0>] (configfs_write_file [configfs]) from [<c00d411c>] (__vfs_write+0x30/0x10c) > [ 382.411922] r10:00000000 r9:c2e6c000 r8:c2e6df80 r7:00000011 r6:bf004a40 r5:c2e6df80 > [ 382.411940] r4:c1d06a00 > [ 382.412001] [<c00d40ec>] (__vfs_write) from [<c00d5370>] (vfs_write+0xc4/0x150) > [ 382.412045] r8:c2e6df80 r7:000fc408 r6:00000011 r5:00000000 r4:c1d06a00 > [ 382.412103] [<c00d52ac>] (vfs_write) from [<c00d55cc>] (SyS_write+0x48/0x84) > [ 382.412153] r10:00000000 r8:c000a464 r7:000fc408 r6:00000011 r5:c1d06a00 r4:c1d06a00 > [ 382.412213] [<c00d5584>] (SyS_write) from [<c000a2c0>] (ret_fast_syscall+0x0/0x38) > [ 382.412250] r7:00000004 r6:b6e7ab40 r5:000fc408 r4:00000011 > [ 382.412293] Code: eb4cc3d0 e2504000 0a000016 e5963024 (e1d320d2) > [ 382.437688] ---[ end trace 3671b14cbf5571de ]--- > > --- > > drivers/usb/gadget/function/f_hid.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c > index e2966f8..aa1c199 100644 > --- a/drivers/usb/gadget/function/f_hid.c > +++ b/drivers/usb/gadget/function/f_hid.c > @@ -617,10 +617,14 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) > > /* preallocate request and buffer */ > status = -ENOMEM; > - hidg->req = alloc_ep_req(hidg->in_ep, hidg->report_length); > + hidg->req = usb_ep_alloc_request(hidg->in_ep, GFP_KERNEL); > if (!hidg->req) > goto fail; > > + hidg->req->buf = kmalloc(hidg->report_length, GFP_KERNEL); > + if (!hidg->req->buf) > + goto fail; > + > /* set descriptor dynamic values */ > hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass; > hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol; Felipe T., any comments? -- balbi
Attachment:
signature.asc
Description: PGP signature
