Commit 8405c746 authored Apr 05, 2016 by Amit Pundir

ANDROID: usb: gadget: fix MTP OS desc support



Upstream commit 1ae1602d ("configfs: switch ->default groups
to a linked list") replaced the current config groups with a
linked list. Hence we no longer need to kfree the groups.

Also the initialization for default_groups now happens in the
function config_group_init() which is called by
config_group_init_type_name(). If we call
usb_os_desc_prepare_interf_dir() prior to this initialization
the kernel crashes when we create MTP function i.e when it
reaches configfs_add_default_group(&d->group, os_desc_group)
which is accessing uninitialized data.  Fix this crash by
moving usb_os_desc_prepare_interf_dir() to after the call to
config_group_init_type_name().

Fixes: AOSP Change-ID: I9397072ca3d183efbc9571c6cde3790f10d8851e
       ("ANDROID: usb: gadget: Add support for MTP OS desc")
[MichaelS: Updated commit log for kernel crash]
Signed-off-by: Michael Scott <michael.scott@linaro.org>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

parent 5236519f

drivers/usb/gadget/function/f_mtp.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -1423,7 +1423,6 @@ static void mtp_free_inst(struct usb_function_instance *fi)
		fi_mtp = to_fi_mtp(fi);
		kfree(fi_mtp->name);
		mtp_cleanup();
		kfree(fi_mtp->mtp_os_desc.group.default_groups);
		kfree(fi_mtp);
		}

		@@ -1444,8 +1443,6 @@ struct usb_function_instance *alloc_inst_mtp_ptp(bool mtp_config)
		INIT_LIST_HEAD(&fi_mtp->mtp_os_desc.ext_prop);
		descs[0] = &fi_mtp->mtp_os_desc;
		names[0] = "MTP";
		usb_os_desc_prepare_interf_dir(&fi_mtp->func_inst.group, 1,
		descs, names, THIS_MODULE);

		if (mtp_config) {
		ret = mtp_setup_configfs(fi_mtp);
		@@ -1459,6 +1456,8 @@ struct usb_function_instance *alloc_inst_mtp_ptp(bool mtp_config)

		config_group_init_type_name(&fi_mtp->func_inst.group,
		"", &mtp_func_type);
		usb_os_desc_prepare_interf_dir(&fi_mtp->func_inst.group, 1,
		descs, names, THIS_MODULE);

		return &fi_mtp->func_inst;
		}