From patchwork Tue Dec 6 21:59:43 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Boris BREZILLON X-Patchwork-Id: 9463307 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5BA7E60236 for ; Tue, 6 Dec 2016 22:02:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4B603284E4 for ; Tue, 6 Dec 2016 22:02:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3F2F9284EB; Tue, 6 Dec 2016 22:02:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 8C3B2284EA for ; Tue, 6 Dec 2016 22:02:16 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.85_2 #1 (Red Hat Linux)) id 1cENmh-0007T4-9m; Tue, 06 Dec 2016 22:00:23 +0000 Received: from mail.free-electrons.com ([62.4.15.54]) by bombadil.infradead.org with esmtp (Exim 4.85_2 #1 (Red Hat Linux)) id 1cENmc-0006Ur-Sa for linux-arm-kernel@lists.infradead.org; Tue, 06 Dec 2016 22:00:19 +0000 Received: by mail.free-electrons.com (Postfix, from userid 110) id E8CC520DB5; Tue, 6 Dec 2016 22:59:54 +0100 (CET) Received: from bbrezillon.home (LFbn-1-2159-240.w90-76.abo.wanadoo.fr [90.76.216.240]) by mail.free-electrons.com (Postfix) with ESMTPSA id B195720C5F; Tue, 6 Dec 2016 22:59:44 +0100 (CET) From: Boris Brezillon To: Nicolas Ferre , Alexandre Belloni , Felipe Balbi , Greg Kroah-Hartman , linux-usb@vger.kernel.org Subject: [PATCH] usb: gadget: udc: atmel: Fix check in usba_ep_enable() Date: Tue, 6 Dec 2016 22:59:43 +0100 Message-Id: <1481061583-4727-1-git-send-email-boris.brezillon@free-electrons.com> X-Mailer: git-send-email 2.7.4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20161206_140019_142189_2DD1A0C6 X-CRM114-Status: GOOD ( 14.08 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Boris Brezillon , linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK is not necessarily equal to ep->index and that's perfectly fine. The usba endpoint index is just an internal identifier used by the driver to know which registers to use for a USB endpoint. Enforcing this constraint is not only useless, but can also lead to errors since nothing guarantees that the endpoint number and index are matching when an endpoint is selected for a specific descriptor, thus leading to errors at ->enable() time when it's already too late to choose another endpoint. Signed-off-by: Boris Brezillon --- Hi, I intentionally didn't add the Cc stable and Fixes tags because this bug dates back to the drivers creation, and I fear the index <-> epnum constraint was actually required at that time. Note that I discovered this bug thanks to the WARN_ON_ONCE() in usb_ep_queue() [1] which was introduced in 4.5. It might appear that this problem was silently ignored before that (with part of the usba_ep_enable() code being skipped without any notice). Regards, Boris [1]http://lxr.free-electrons.com/source/drivers/usb/gadget/udc/core.c#L264 --- drivers/usb/gadget/udc/atmel_usba_udc.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c index bb1f6c8f0f01..981d2639d413 100644 --- a/drivers/usb/gadget/udc/atmel_usba_udc.c +++ b/drivers/usb/gadget/udc/atmel_usba_udc.c @@ -531,11 +531,8 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc) maxpacket = usb_endpoint_maxp(desc) & 0x7ff; - if (((desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK) != ep->index) - || ep->index == 0 - || desc->bDescriptorType != USB_DT_ENDPOINT - || maxpacket == 0 - || maxpacket > ep->fifo_size) { + if (ep->index == 0 || desc->bDescriptorType != USB_DT_ENDPOINT || + maxpacket == 0 || maxpacket > ep->fifo_size) { DBG(DBG_ERR, "ep_enable: Invalid argument"); return -EINVAL; }