kernel/linux.git/drivers/usb/gadget/function/u_fs.h, branch linux-7.0.y

functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions

2026-02-05T18:53:12+00:00

When all files are closed, functionfs needs ffs_data_reset() to be done before any further opens are allowed. During that time we have ffs->state set to FFS_CLOSING; that makes ->open() fail with -EBUSY. Once ffs_data_reset() is done, it switches state (to FFS_READ_DESCRIPTORS) indicating that opening that thing is allowed again. There's a couple of additional twists: * mounting with -o no_disconnect delays ffs_data_reset() from doing that at the final ->release() to the first subsequent open(). That's indicated by ffs->state set to FFS_DEACTIVATED; if open() sees that, it immediately switches to FFS_CLOSING and proceeds with doing ffs_data_reset() before returning to userland. * a couple of usb callbacks need to force the delayed transition; unfortunately, they are done in locking environment that does not allow blocking and ffs_data_reset() can block. As the result, if these callbacks see FFS_DEACTIVATED, they change state to FFS_CLOSING and use schedule_work() to get ffs_data_reset() executed asynchronously. Unfortunately, the locking is rather insufficient. A fix attempted in e5bf5ee26663 ("functionfs: fix the open/removal races") had closed a bunch of UAF, but it didn't do anything to the callbacks, lacked barriers in transition from FFS_CLOSING to FFS_READ_DESCRIPTORS _and_ it had been too heavy-handed in open()/open() serialization - I've used ffs->mutex for that, and it's being held over actual IO on ep0, complete with copy_from_user(), etc. Even more unfortunately, the userland side is apparently racy enough to have the resulting timing changes (no failures, just a delayed return of open(2)) disrupt the things quite badly. Userland bugs or not, it's a clear regression that needs to be dealt with. Solution is to use a spinlock for serializing these state checks and transitions - unlike ffs->mutex it can be taken in these callbacks and it doesn't disrupt the timings in open(). We could introduce a new spinlock, but it's easier to use the one that is already there (ffs->eps_lock) instead - the locking environment is safe for it in all affected places. Since now it is held over all places that alter or check the open count (ffs->opened), there's no need to keep that atomic_t - int would serve just fine and it's simpler that way. Fixes: e5bf5ee26663 ("functionfs: fix the open/removal races") Fixes: 18d6b32fca38 ("usb: gadget: f_fs: add "no_disconnect" mode") # v4.0 Tested-by: Samuel Wu Signed-off-by: Al Viro

usb: gadget: ffs: remove ENTER() macro

2023-03-29T06:55:58+00:00

ENTER() used to show function name which called during runtime, ftrace can be used to get same information, let's remove it. Signed-off-by: Linyu Yuan Link: https://lore.kernel.org/r/1679911940-4727-1-git-send-email-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman

USB: gadget: Use the correct style for SPDX License Identifier

2020-05-05T07:58:49+00:00

This patch corrects the SPDX License Identifier style in header files related to USB peripheral controller drivers. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used). Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46. Suggested-by: Joe Perches Signed-off-by: Nishad Kamdar Signed-off-by: Felipe Balbi

usb: gadget: Change Andrzej Pietrasiewicz's e-mail address

2019-02-11T09:12:29+00:00

My @samusung.com address is going to cease existing soon, so change it to an address which can actually be used to contact me. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi

USB: gadget: function: Remove redundant license text

2017-11-07T14:45:02+00:00

Now that the SPDX tag is in all USB files, that identifies the license in a specific and legally-defined manner. So the extra GPL text wording can be removed as it is no longer needed at all. This is done on a quest to remove the 700+ different ways that files in the kernel describe the GPL license text. And there's unneeded stuff like the address (sometimes incorrect) for the FSF which is never needed. No copyright headers or other non-license-description text was removed. Cc: Oliver Neukum Cc: Johan Hovold Cc: Jerry Zhang Cc: John Keeping Cc: Krzysztof Opasiak Cc: Abdulhadi Mohamed Cc: Matthew Wilcox Cc: Janusz Dziedzic Acked-by: Felipe Balbi Acked-by: Michal Nazarewicz Acked-by: Laurent Pinchart Acked-by: Vincent Pelletier Signed-off-by: Greg Kroah-Hartman

USB: add SPDX identifiers to all remaining files in drivers/usb/

2017-11-04T10:48:02+00:00

It's good to have SPDX identifiers in all files to make it easier to audit the kernel tree for correct licenses. Update the drivers/usb/ and include/linux/usb* files with the correct SPDX license identifier based on the license text in the file itself. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This work is based on a script and data from Thomas Gleixner, Philippe Ombredanne, and Kate Stewart. Cc: Thomas Gleixner Cc: Kate Stewart Cc: Philippe Ombredanne Signed-off-by: Greg Kroah-Hartman Acked-by: Felipe Balbi Acked-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

usb: gadget: ffs: handle I/O completion in-order

2017-09-28T09:37:24+00:00

By submitting completed transfers to the system workqueue there is no guarantee that completion events will be queued up in the correct order, as in multi-processor systems there is a thread running for each processor and the work items are not bound to a particular core. This means that several completions are in the queue at the same time, they may be processed in parallel and complete out of order, resulting in data appearing corrupt when read by userspace. Create a single-threaded workqueue for FunctionFS so that data completed requests is passed to userspace in the order in which they complete. Acked-by: Michal Nazarewicz Signed-off-by: John Keeping Signed-off-by: Felipe Balbi

usb: gadget: function: f_fs: Move epfile waitqueue to ffs_data.

2017-06-02T08:22:31+00:00

There were individual waitqueues for each epfile but eps_enable would iterate through all of them, resulting in essentially the same wakeup time. The waitqueue represents the function being enabled, so a central waitqueue in ffs_data makes more sense and is less redundant. Also use wake_up_interruptible to reflect use of wait_event_interruptible. Acked-by: Michal Nazarewicz Signed-off-by: Jerry Zhang Signed-off-by: Felipe Balbi

Merge tag 'usb-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

2017-04-11T14:47:26+00:00

Felipe writes: usb: changes for v4.12 With 51 non-merge commits, this is one of the smallest USB Gadget pull requests. Apart from your expected set of non-critical fixes, and other miscellaneous items, we have most of the changes in dwc3 (52.5%) with all other UDCs following with 34.8%. As for the actual changes, the most important of them are all the recent changes to reduce memory footprint of dwc3, bare minimum dual-role support on dwc3 and reworked endpoint count and initialization routines.

usb: gadget: f_fs: simplify ffs_dev name handling

2017-04-11T07:58:22+00:00

Currently ffs_dev::name can be either allocated by the client of the ffs_dev structure or by the f_fs.c core itself. The former is used by g_ffs while the latter happens with configfs. Historically, g_ffs did not need to allocate separate buffer for the name so what is now f_fs.c core never cared about freeing that space. With configfs the name needs to be copied since the memory is not guaranteed to be availeble after ffs_set_inst_name finishes. The complication is therefore here to avoid allocations in the g_ffs case but it complicates the code inproportinally to benefits it provides. In particular, g_ffs is considered ‘legacy’ so optimising for its sake is unlikely to be worth the effort. With that observation in mind, simplify the code by unifying the code paths in g_ffs and configfs paths. Furthermore, instead of allocating a new buffer for the name, simply embed it in the ffs_dev structure. This further makes the memory management less convoluted and error-prone. The configfs interface for functionfs imposed a limit of 40 characters for the name so this results in a 41-byte buffer added to the structure. (For short names this may lead to wasted memory but the actual amount is not immediately obvious and depends on pointer size and which slab buckets the structure and name would fall into). Signed-off-by: Michal Nazarewicz Signed-off-by: Felipe Balbi