usb: fixes for v4.12-rc5

Alan Stern fixed a GPF in gadgetfs found by the kernel fuzzying project
 
 composite.c learned that if it deactivates a function during bind, it
 must reactivate it during unbind.
 -----BEGIN PGP SIGNATURE-----
 
 iQJRBAABCAA7FiEElLzh7wn96CXwjh2IzL64meEamQYFAlk+gxYdHGZlbGlwZS5i
 YWxiaUBsaW51eC5pbnRlbC5jb20ACgkQzL64meEamQaxnQ/+J4+o1JUKH7BjBBtf
 +xnwklGZBnF1z8N3Ix93AkyUgBrRcKeZJrKU8fqRUesHGwtUQgBLtRoxCvqf0+d0
 wC7EwlAMUL/DCI0nCGgkszfdAfKfhv0J9gvVYxYNecctHiMQPZdklgCnYN3oTVYb
 K7eGntaDIEIyBrA/6QfuEejBNI9R1Y3VU2qYAL39M3rFfeB/M5Kqwf1tj2oDhm1W
 qwzP+XDahlcjbDQF5byDY/31T0oiln90VKQsji42vGXqwMaCfH04Sc57w1pWBK0O
 sCJakosFMHXsVseMvcS11lgLHCO7DQ+JrQd3+KbvQvjU0Cr0OXSTT+5G2AOkuJm+
 7HnfLoJRG3MSRhJuX7KZKu7QX8KH39JDGqhjd6+EFhvtgwA5ApTd9laWWx3PS1zx
 vsLJL2J5PrVRcY+2kNokhmGNbHLKd0z+Cv3jsP2VeNGla3YBZ9g/7Oeo69ROkXv5
 B2q5WtBZk2Jzd+HkfYWASaFHQukMQeC68YjMMBF2eIoso+KnqEP2y5dMSuyFccN4
 udUzThGyHo1GDeUyIhWgp68IYcmVZWUdlNDe2I4JDb7lAW70DzlltAqD0FJH23r1
 jSvWFuSVoeoYK/iRmlKiZfXAOwhnHW2JvADBUAr33/vyfoqKo2nzwUxY9FPXyEv0
 QMEP4++qYwbWEFGBvxXrlQK7Fos=
 =S9bm
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

Felipe writes:

usb: fixes for v4.12-rc5

Alan Stern fixed a GPF in gadgetfs found by the kernel fuzzying project

composite.c learned that if it deactivates a function during bind, it
must reactivate it during unbind.
This commit is contained in:
Greg Kroah-Hartman 2017-06-12 16:02:19 +02:00
commit 8ada5f3ae9
2 changed files with 8 additions and 7 deletions

View file

@ -315,6 +315,9 @@ void usb_remove_function(struct usb_configuration *c, struct usb_function *f)
list_del(&f->list);
if (f->unbind)
f->unbind(c, f);
if (f->bind_deactivated)
usb_function_activate(f);
}
EXPORT_SYMBOL_GPL(usb_remove_function);
@ -956,12 +959,8 @@ static void remove_config(struct usb_composite_dev *cdev,
f = list_first_entry(&config->functions,
struct usb_function, list);
list_del(&f->list);
if (f->unbind) {
DBG(cdev, "unbind function '%s'/%p\n", f->name, f);
f->unbind(config, f);
/* may free memory for "f" */
}
usb_remove_function(config, f);
}
list_del(&config->list);
if (config->unbind) {

View file

@ -1183,8 +1183,10 @@ dev_release (struct inode *inode, struct file *fd)
/* closing ep0 === shutdown all */
if (dev->gadget_registered)
if (dev->gadget_registered) {
usb_gadget_unregister_driver (&gadgetfs_driver);
dev->gadget_registered = false;
}
/* at this point "good" hardware has disconnected the
* device from USB; the host won't see it any more.