[PATCH master 1/3] usb: gadget: multi: do not double free on error

[PATCH master 1/3] usb: gadget: multi: do not double free on error

[Ahmad Fatoum]

Recent sync with kernel changed usb_composite_probe to free resources on
error as expected, so calling usb_composite_unregister on failed probe
is now a double free. Fix that.

Fixes: 14211ab8b0e1 ("usb: gadget: Update core to Linux-6.3-rc2")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/usb/gadget/legacy/multi.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/legacy/multi.c b/drivers/usb/gadget/legacy/multi.c
index 7046a529b1db..ddb3d4158cd7 100644
--- a/drivers/usb/gadget/legacy/multi.c
+++ b/drivers/usb/gadget/legacy/multi.c
@@ -294,10 +294,8 @@ int usb_multi_register(struct f_multi_opts *opts)
 	gadget_multi_opts = opts;
 
 	ret = usb_composite_probe(&multi_driver);
-	if (ret) {
-		usb_composite_unregister(&multi_driver);
+	if (ret)
 		gadget_multi_opts = NULL;
-	}
 
 	return ret;
 }
-- 
2.39.2

[PATCH master 2/3] commands: usbserial: prevent double free

[Ahmad Fatoum]

usbserial -d may be called more than once, which now results in removal
of a driver that may already be removed leading to double frees.

usbgadget -d doesn't suffer from this as both usb_multi_register and
usb_multi_unregister keep around a global variable to check if the
gadget is currently registered. Let's do likewise for usb_serial_unregister.

Fixes: 14211ab8b0e1 ("usb: gadget: Update core to Linux-6.3-rc2")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/usb/gadget/legacy/serial.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/serial.c b/drivers/usb/gadget/legacy/serial.c
index 46c41f6dea30..913d174a9177 100644
--- a/drivers/usb/gadget/legacy/serial.c
+++ b/drivers/usb/gadget/legacy/serial.c
@@ -247,8 +247,17 @@ static struct usb_composite_driver gserial_driver = {
 	.unbind		= gs_unbind,
 };
 
+static bool usb_serial_registered;
+
 int usb_serial_register(struct usb_serial_pdata *pdata)
 {
+	int ret;
+
+	if (usb_serial_registered) {
+		pr_err("USB serial gadget already registered\n");
+		return -EBUSY;
+	}
+
 	/* We *could* export two configs; that'd be much cleaner...
 	 * but neither of these product IDs was defined that way.
 	 */
@@ -273,10 +282,18 @@ int usb_serial_register(struct usb_serial_pdata *pdata)
 		device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
 	}
 
-	return usb_composite_probe(&gserial_driver);
+	ret = usb_composite_probe(&gserial_driver);
+	if (!ret)
+		usb_serial_registered = true;
+
+	return ret;
 }
 
 void usb_serial_unregister(void)
 {
+	if (!usb_serial_registered)
+		return;
+
 	usb_composite_unregister(&gserial_driver);
+	usb_serial_registered = false;
 }
-- 
2.39.2

[PATCH master 3/3] usb: gadget: return error on missing UDC

[Ahmad Fatoum]

Recent sync with kernel added the match_existing_only member, but set it
no where, leading to usb_gadget_register_driver succeeding on missing
UDC. This used to be an error and we depend on it, e.g.
global.usbgadget.autostart=1 is a no-op once usb_composite_probe has
succeeded, but if we signal success in error cases, it can't be used
to retry registration.

Fixes: 14211ab8b0e1 ("usb: gadget: Update core to Linux-6.3-rc2")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/usb/gadget/composite.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 58c10f1191f8..f55ae5698e08 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2496,6 +2496,7 @@ int usb_composite_probe(struct usb_composite_driver *driver)
 	gadget_driver->function =  (char *) driver->name;
 	gadget_driver->driver.name = driver->name;
 	gadget_driver->max_speed = driver->max_speed;
+	gadget_driver->match_existing_only = true;
 
 	return usb_gadget_register_driver(gadget_driver);
 }
-- 
2.39.2

Re: [PATCH master 1/3] usb: gadget: multi: do not double free on error

[Sascha Hauer]

On Fri, Jul 07, 2023 at 02:13:52PM +0200, Ahmad Fatoum wrote:
> Recent sync with kernel changed usb_composite_probe to free resources on
> error as expected, so calling usb_composite_unregister on failed probe
> is now a double free. Fix that.
> 
> Fixes: 14211ab8b0e1 ("usb: gadget: Update core to Linux-6.3-rc2")
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
>  drivers/usb/gadget/legacy/multi.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)

Applied, thanks

Sascha

> 
> diff --git a/drivers/usb/gadget/legacy/multi.c b/drivers/usb/gadget/legacy/multi.c
> index 7046a529b1db..ddb3d4158cd7 100644
> --- a/drivers/usb/gadget/legacy/multi.c
> +++ b/drivers/usb/gadget/legacy/multi.c
> @@ -294,10 +294,8 @@ int usb_multi_register(struct f_multi_opts *opts)
>  	gadget_multi_opts = opts;
>  
>  	ret = usb_composite_probe(&multi_driver);
> -	if (ret) {
> -		usb_composite_unregister(&multi_driver);
> +	if (ret)
>  		gadget_multi_opts = NULL;
> -	}
>  
>  	return ret;
>  }
> -- 
> 2.39.2
> 
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |