diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-06-12 16:02:19 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-06-12 16:02:19 +0200 |
| commit | 8ada5f3ae96b0336145e453740b9168a56a0fc1d (patch) | |
| tree | c099e28c6c8c7b167db3f380d85814142202b3df | |
| parent | Linux 4.12-rc5 (diff) | |
| parent | USB: gadget: fix GPF in gadgetfs (diff) | |
| download | linux-8ada5f3ae96b0336145e453740b9168a56a0fc1d.tar.xz linux-8ada5f3ae96b0336145e453740b9168a56a0fc1d.zip | |
Merge tag 'fixes-for-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
Felipe writes:
usb: fixes for v4.12-rc5
Alan Stern fixed a GPF in gadgetfs found by the kernel fuzzying project
composite.c learned that if it deactivates a function during bind, it
must reactivate it during unbind.
| -rw-r--r-- | drivers/usb/gadget/composite.c | 11 | ||||
| -rw-r--r-- | drivers/usb/gadget/legacy/inode.c | 4 |
2 files changed, 8 insertions, 7 deletions
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index 49d685ad0da9..45b554032332 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -315,6 +315,9 @@ void usb_remove_function(struct usb_configuration *c, struct usb_function *f) list_del(&f->list); if (f->unbind) f->unbind(c, f); + + if (f->bind_deactivated) + usb_function_activate(f); } EXPORT_SYMBOL_GPL(usb_remove_function); @@ -956,12 +959,8 @@ static void remove_config(struct usb_composite_dev *cdev, f = list_first_entry(&config->functions, struct usb_function, list); - list_del(&f->list); - if (f->unbind) { - DBG(cdev, "unbind function '%s'/%p\n", f->name, f); - f->unbind(config, f); - /* may free memory for "f" */ - } + + usb_remove_function(config, f); } list_del(&config->list); if (config->unbind) { diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index b9ca0a26cbd9..5ffd879f7886 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1183,8 +1183,10 @@ dev_release (struct inode *inode, struct file *fd) /* closing ep0 === shutdown all */ - if (dev->gadget_registered) + if (dev->gadget_registered) { usb_gadget_unregister_driver (&gadgetfs_driver); + dev->gadget_registered = false; + } /* at this point "good" hardware has disconnected the * device from USB; the host won't see it any more. |