Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f8cd6323 authored by Dov Levenglick's avatar Dov Levenglick
Browse files

usb: gadget: unconfigure ep during disable 



The dwc3-msm function msm_ep_configure is called each
time the USB is connected. In order to allow this to
happen more than once, the corresponding msm_ep_unconfigure
function has to be called during the function disable.
Without the fix, the call to msm_ep_configure returns an error
which leads to the composition switch to fail. In turn, this
causes a call to reset_config which calls gbam_disconnect
during the ongoing process of gbam2bam_connect_work. The
disconnect function nullifies a pointer that the connect function
uses - thereby causing a null pointer dereferencing

Change-Id: I0cf567f7d91cadd490ee7bf88e67bd8ad3e6dfa7
Signed-off-by: default avatarDov Levenglick <dovl@codeaurora.org>
parent 57387ee5

drivers/usb/gadget/f_qc_ecm.c

+6 −0
Original line number Diff line number Diff line
@@ -662,6 +662,12 @@ static void ecm_qc_disable(struct usb_function *f) 
			gether_qc_disconnect_name(&ecm->port, "ecm0");

	}



	if (ecm->xport == USB_GADGET_XPORT_BAM2BAM_IPA &&

			gadget_is_dwc3(cdev->gadget)) {

		msm_ep_unconfig(ecm->port.out_ep);

		msm_ep_unconfig(ecm->port.in_ep);

	}



	if (ecm->notify->driver_data) {

		usb_ep_disable(ecm->notify);

		ecm->notify->driver_data = NULL;

drivers/usb/gadget/f_qc_rndis.c

+6 −0
Original line number Diff line number Diff line
@@ -781,6 +781,7 @@ fail: 
static void rndis_qc_disable(struct usb_function *f)

{

	struct f_rndis_qc		*rndis = func_to_rndis_qc(f);

	struct usb_composite_dev *cdev = f->config->cdev;



	if (!rndis->notify->driver_data)

		return;
@@ -794,6 +795,11 @@ static void rndis_qc_disable(struct usb_function *f) 
	else

		rndis_ipa_supported = false;



	if (rndis->xport == USB_GADGET_XPORT_BAM2BAM_IPA &&

			gadget_is_dwc3(cdev->gadget)) {

		msm_ep_unconfig(rndis->port.out_ep);

		msm_ep_unconfig(rndis->port.in_ep);

	}

	usb_ep_disable(rndis->notify);

	rndis->notify->driver_data = NULL;

}

drivers/usb/gadget/f_rmnet.c

+7 −0
Original line number Diff line number Diff line
@@ -696,6 +696,8 @@ static void frmnet_resume(struct usb_function *f) 
static void frmnet_disable(struct usb_function *f)

{

	struct f_rmnet *dev = func_to_rmnet(f);

	enum transport_type	dxport = rmnet_ports[dev->port_num].data_xport;

	struct usb_composite_dev	*cdev = dev->cdev;



	pr_debug("%s: port#%d\n", __func__, dev->port_num);
@@ -706,6 +708,11 @@ static void frmnet_disable(struct usb_function *f) 


	frmnet_purge_responses(dev);



	if (dxport == USB_GADGET_XPORT_BAM2BAM_IPA &&

	    gadget_is_dwc3(cdev->gadget)) {

		msm_ep_unconfig(dev->port.out);

		msm_ep_unconfig(dev->port.in);

	}

	gport_rmnet_disconnect(dev);

}