tree: https://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb.git testing/next head: 862b43460309779e5814616a68aa36d29a70d6e0 commit: 2b4e4d3c929db0fc7cf99212bfac0570b6902c14 [48/49] usb: gadget: serial: fix oops when data rx'd after close config: xtensa-allmodconfig (attached as .config) compiler: xtensa-linux-gcc (GCC) 4.9.0 reproduce: wget https://raw.githubusercontent.com/01org/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross git checkout 2b4e4d3c929db0fc7cf99212bfac0570b6902c14 # save the attached .config to linux build tree make.cross ARCH=xtensa
All errors (new ones prefixed by >>):
drivers/usb//gadget/function/u_serial.c: In function 'gs_rx_push':
>> drivers/usb//gadget/function/u_serial.c:540:19: error: invalid operands to
>> binary & (have 'unsigned int' and 'struct tty_struct *')
if (req->actual & tty) {
^
vim +540 drivers/usb//gadget/function/u_serial.c
492
493 /*
494 * RX tasklet takes data out of the RX queue and hands it up to the TTY
495 * layer until it refuses to take any more data (or is throttled back).
496 * Then it issues reads for any further data.
497 *
498 * If the RX queue becomes full enough that no usb_request is queued,
499 * the OUT endpoint may begin NAKing as soon as its FIFO fills up.
500 * So QUEUE_SIZE packets plus however many the FIFO holds (usually two)
501 * can be buffered before the TTY layer's buffers (currently 64 KB).
502 */
503 static void gs_rx_push(unsigned long _port)
504 {
505 struct gs_port *port = (void *)_port;
506 struct tty_struct *tty;
507 struct list_head *queue = &port->read_queue;
508 bool disconnect = false;
509 bool do_push = false;
510
511 /* hand any queued data to the tty */
512 spin_lock_irq(&port->port_lock);
513 tty = port->port.tty;
514 while (!list_empty(queue)) {
515 struct usb_request *req;
516
517 req = list_first_entry(queue, struct usb_request, list);
518
519 /* leave data queued if tty was rx throttled */
520 if (tty && tty_throttled(tty))
521 break;
522
523 switch (req->status) {
524 case -ESHUTDOWN:
525 disconnect = true;
526 pr_vdebug("ttyGS%d: shutdown\n",
port->port_num);
527 break;
528
529 default:
530 /* presumably a transient fault */
531 pr_warn("ttyGS%d: unexpected RX status %d\n",
532 port->port_num, req->status);
533 /* FALLTHROUGH */
534 case 0:
535 /* normal completion */
536 break;
537 }
538
539 /* push data to (open) tty */
> 540 if (req->actual & tty) {
541 char *packet = req->buf;
542 unsigned size = req->actual;
543 unsigned n;
544 int count;
545
546 /* we may have pushed part of this packet
already... */
547 n = port->n_read;
548 if (n) {
549 packet += n;
550 size -= n;
551 }
552
553 count = tty_insert_flip_string(&port->port,
packet,
554 size);
555 if (count)
556 do_push = true;
557 if (count != size) {
558 /* stop pushing; TTY layer can't handle
more */
559 port->n_read += count;
560 pr_vdebug("ttyGS%d: rx block %d/%d\n",
561 port->port_num, count,
req->actual);
562 break;
563 }
564 port->n_read = 0;
565 }
566
567 list_move(&req->list, &port->read_pool);
568 port->read_started--;
569 }
570
571 /* Push from tty to ldisc; this is handled by a workqueue,
572 * so we won't get callbacks and can hold port_lock
573 */
574 if (do_push)
575 tty_flip_buffer_push(&port->port);
576
577
578 /* We want our data queue to become empty ASAP, keeping data
579 * in the tty and ldisc (not here). If we couldn't push any
580 * this time around, there may be trouble unless there's an
581 * implicit tty_unthrottle() call on its way...
582 *
583 * REVISIT we should probably add a timer to keep the tasklet
584 * from starving ... but it's not clear that case ever happens.
585 */
586 if (!list_empty(queue) && tty) {
587 if (!tty_throttled(tty)) {
588 if (do_push)
589 tasklet_schedule(&port->push);
590 else
591 pr_warn("ttyGS%d: RX not scheduled?\n",
592 port->port_num);
593 }
594 }
595
596 /* If we're still connected, refill the USB RX queue. */
597 if (!disconnect && port->port_usb)
598 gs_start_rx(port);
599
600 spin_unlock_irq(&port->port_lock);
601 }
602
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
.config.gz
Description: application/gzip
