MLK-22366-7 usb: cdns3: gadget: quit if endpoint has already disabled

It fixed below oops:
audit: audit_lost=500851 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
libprocessgroup: Successfully killed process cgroup uid 0 pid 25371 in 49ms
init: Service 'adbd' (pid 25371) received signal 9
init: processing action (init.svc.adbd=stopped) from (/init.usb.configfs.rc:14)
init: Received control message 'start' for 'adbd' from pid: 3308 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
init: starting service 'adbd'...
init: Created socket '/dev/socket/adbd', mode 660, user 1000, group 1000
read descriptors
read strings
init: Received control message 'start' for 'adbd' from pid: 3447 (system_server)
android_work: did not send uevent (0 0           (null))
audit: audit_lost=500888 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
read descriptors
read strings
android_work: did not send uevent (0 0           (null))
audit: audit_lost=500925 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
using random self ethernet address
using random host ethernet address
read descriptors
read strings
usb0: HOST MAC 32:e7:67:29:5f:d8
usb0: MAC 02:5c:48:b3:2b:d7
android_work: sent uevent USB_STATE=CONNECTED
configfs-gadget gadget: high-speed config #1: b
android_work: sent uevent USB_STATE=CONFIGURED
Unable to handle kernel NULL pointer dereference at virtual address 00000002
Mem abort info:
  Exception class = DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgd = ffff8008f7bed000
[0000000000000002] *pgd=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 2 PID: 3326 Comm: Binder:3276_2 Not tainted 4.14.98-07848-gfb2a5a8 #1
Hardware name: Freescale i.MX8QM MEK (DT)
task: ffff8008f77f3800 task.stack: ffff00000b378000
PC is at __cdns3_gadget_ep_queue.isra.18+0x238/0x524
LR is at cdns3_gadget_ep_queue+0x44/0xd8
pc : [<ffff0000089bbf90>] lr : [<ffff0000089bc2c0>] pstate: 400001c5
sp : ffff00000b37ba40
x29: ffff00000b37ba40 x28: ffff8008f235fa00
x27: ffff8008f2f11600 x26: ffff8008f2dee118
x25: ffff8008f2df0000 x24: 0000000000000000
x23: ffff000009c8e000 x22: ffff8008f2df0000
x21: 0000000000000000 x20: ffff8008f2dee118
x19: ffff8008f1f1ac00 x18: 0000fcc72810fc1a
x17: 0000fcc729e2d0e0 x16: ffff0000082b4430
x15: 0000000000000000 x14: ffffffffffffffff
x13: 0000000000000000 x12: 0000000000000020
x11: 0000000000000020 x10: 0101010101010101
x9 : 0000000000000000 x8 : 0000000000000024
x7 : 0000000040000000 x6 : 0000000000000020
x5 : 0000000000000000 x4 : 0000000000000000
x3 : 0000000000000140 x2 : 0000000000000000
x1 : ffff8008f1f1ac00 x0 : ffff8008f7738010

X0: 0xffff8008f7737f90:
7f90  f75baef8 ffff8008 00000000 00000000 3305708c 00000000 f7332aa0 ffff8008
7fb0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7fd0  00005408 00000001 a1ff0014 00000000 00000000 00000000 00000000 00000000
7ff0  00000000 00000000 00000000 00000000 f7548780 ffff8008 ffffffff 00000000
8010  09dc50d8 ffff0000 f76fc800 ffff8008 f7548780 ffff8008 f7738428 ffff8008
8030  f76e7c28 ffff8008 09dc50e8 ffff0000 f6e6ae80 ffff8008 09dc4ac8 ffff0000
8050  f753e660 ffff8008 00000007 00000007 00000000 00000000 00000000 00000000
8070  00000000 00000000 00000000 00000000 f7738080 ffff8008 f7738080 ffff8008

X1: 0xffff8008f1f1ab80:
ab80  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
aba0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
abc0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
abe0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ac00  ec128080 ffff8008 0000062a 00000000 f5383800 00000000 00000000 00000000
ac20  00000000 00000000 00000000 00000000 08a179d8 ffff0000 e85aeb00 ffff8008
ac40  f1f1ac40 ffff8008 f1f1ac40 ffff8008 ffffff8d 00000000 f2dee118 ffff8008
ac60  0afdb024 ffff0000 00000003 00000003 00000000 00000000 00000000 00000000

X19: 0xffff8008f1f1ab80:
ab80  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
aba0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
abc0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
abe0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ac00  ec128080 ffff8008 0000062a 00000000 f5383800 00000000 00000000 00000000
ac20  00000000 00000000 00000000 00000000 08a179d8 ffff0000 e85aeb00 ffff8008
ac40  f1f1ac40 ffff8008 f1f1ac40 ffff8008 ffffff8d 00000000 f2dee118 ffff8008
ac60  0afdb024 ffff0000 00000003 00000003 00000000 00000000 00000000 00000000

X20: 0xffff8008f2dee098:
e098  ae000000 00000000 f2df0000 ffff8008 00307065 00000000 00000000 00000000
e0b8  00000000 00000010 00000000 00000000 00000080 00000000 00000002 00000000
e0d8  00000000 00000000 00000002 00000000 00000000 00000000 00000000 00000000
e0f8  00000000 00000000 f2dee200 ffff8008 f2dee000 ffff8008 087793a4 ffff0000
e118  f0475900 ffff8008 f2dee1a8 ffff8008 091c36b0 ffff0000 f2dee230 ffff8008
e138  f2df0048 ffff8008 0000002e 02000000 000f0400 00000101 00000000 00000000
e158  00000000 00000000 f2dee160 ffff8008 f2dee160 ffff8008 f2dee170 ffff8008
e178  f2dee170 ffff8008 f2dee180 ffff8008 f2dee180 ffff8008 0afdb000 ffff0000

X22: 0xffff8008f2deff80:
ff80  f33b40a0 ffff8008 f3dd6810 ffff8008 f03f8de8 ffff8008 00000000 00000000
ffa0  27ac430e 00000000 00000000 00000000 f2aec128 ffff8008 f32e0680 ffff8008
ffc0  00000000 00000000 f3623400 ffff8008 000000ac 00000001 41e80011 00000000
ffe0  f3b18000 ffff8008 00000000 00000000 00000000 00000000 00000000 00000000
0000  f7738010 ffff8008 f7738010 ffff8008 000000c0 00000000 f2df0018 ffff8008
0020  f2df0018 ffff8008 08a077e4 ffff0000 f2d42c00 ffff8008 091c3650 ffff0000
0040  f2dee018 ffff8008 f2dee130 ffff8008 f2deee30 ffff8008 00000003 00000005
0060  00000007 00000000 095d1550 ffff0000 f7738010 ffff8008 f2deef00 ffff8008

X25: 0xffff8008f2deff80:
ff80  f33b40a0 ffff8008 f3dd6810 ffff8008 f03f8de8 ffff8008 00000000 00000000
ffa0  27ac430e 00000000 00000000 00000000 f2aec128 ffff8008 f32e0680 ffff8008
ffc0  00000000 00000000 f3623400 ffff8008 000000ac 00000001 41e80011 00000000
ffe0  f3b18000 ffff8008 00000000 00000000 00000000 00000000 00000000 00000000
0000  f7738010 ffff8008 f7738010 ffff8008 000000c0 00000000 f2df0018 ffff8008
0020  f2df0018 ffff8008 08a077e4 ffff0000 f2d42c00 ffff8008 091c3650 ffff0000
0040  f2dee018 ffff8008 f2dee130 ffff8008 f2deee30 ffff8008 00000003 00000005
0060  00000007 00000000 095d1550 ffff0000 f7738010 ffff8008 f2deef00 ffff8008

X26: 0xffff8008f2dee098:
e098  ae000000 00000000 f2df0000 ffff8008 00307065 00000000 00000000 00000000
e0b8  00000000 00000010 00000000 00000000 00000080 00000000 00000002 00000000
e0d8  00000000 00000000 00000002 00000000 00000000 00000000 00000000 00000000
e0f8  00000000 00000000 f2dee200 ffff8008 f2dee000 ffff8008 087793a4 ffff0000
e118  f0475900 ffff8008 f2dee1a8 ffff8008 091c36b0 ffff0000 f2dee230 ffff8008
e138  f2df0048 ffff8008 0000002e 02000000 000f0400 00000101 00000000 00000000
e158  00000000 00000000 f2dee160 ffff8008 f2dee160 ffff8008 f2dee170 ffff8008
e178  f2dee170 ffff8008 f2dee180 ffff8008 f2dee180 ffff8008 0afdb000 ffff0000

X27: 0xffff8008f2f11580:
1580  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
15a0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
15c0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
15e0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
1600  f0475000 ffff8008 00000003 00000000 f235fa00 ffff8008 00000000 00000000
1620  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
1640  00000000 00000000 00000000 00000000 00000002 00000000 00000000 00000000
1660  00000000 00000000 00000000 00000000 08e3b158 ffff0000 f2f11600 ffff8008

X28: 0xffff8008f235f980:
f980  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
f9a0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
f9c0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
f9e0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
fa00  00000000 00000000 09f6e3d8 ffff0000 00000000 00000000 f2f11600 ffff8008
fa20  00000000 00000000 00000000 00000000 812aa8c0 812aa8c0 00ffffff ff2aa8c0
fa40  00001800 00000080 30627375 00000000 00000000 00000000 00000000 00000000
fa60  0046ac7c 00000001 0046ac7c 00000001 00000000 00000000 00000000 00000000

Process Binder:3276_2 (pid: 3326, stack limit = 0xffff00000b378000)
Call trace:
Exception stack(0xffff00000b37b900 to 0xffff00000b37ba40)
b900: ffff8008f7738010 ffff8008f1f1ac00 0000000000000000 0000000000000140
b920: 0000000000000000 0000000000000000 0000000000000020 0000000040000000
b940: 0000000000000024 0000000000000000 0101010101010101 0000000000000020
b960: 0000000000000020 0000000000000000 ffffffffffffffff 0000000000000000
b980: ffff0000082b4430 0000fcc729e2d0e0 0000fcc72810fc1a ffff8008f1f1ac00
b9a0: ffff8008f2dee118 0000000000000000 ffff8008f2df0000 ffff000009c8e000
b9c0: 0000000000000000 ffff8008f2df0000 ffff8008f2dee118 ffff8008f2f11600
b9e0: ffff8008f235fa00 ffff00000b37ba40 ffff0000089bc2c0 ffff00000b37ba40
ba00: ffff0000089bbf90 00000000400001c5 ffff00000b37ba20 ffff00000827c354
ba20: 0000ffffffffffff ffff000008d578c4 ffff00000b37ba40 ffff0000089bbf90
[<ffff0000089bbf90>] __cdns3_gadget_ep_queue.isra.18+0x238/0x524
[<ffff0000089bc2c0>] cdns3_gadget_ep_queue+0x44/0xd8
[<ffff000008a06f70>] usb_ep_queue+0x5c/0xfc
[<ffff000008a1762c>] rx_submit+0xec/0x1bc
[<ffff000008a1775c>] rx_fill+0x60/0xb4
[<ffff000008a17c7c>] eth_open+0x64/0x78
[<ffff000008d72cf4>] __dev_open+0xe0/0x164
[<ffff000008d73128>] __dev_change_flags+0x160/0x18c
[<ffff000008d73174>] dev_change_flags+0x20/0x5c
[<ffff000008e359f0>] devinet_ioctl+0x68c/0x724
[<ffff000008e37cc4>] inet_ioctl+0x8c/0xa8
[<ffff000008d48a48>] sock_do_ioctl+0x34/0x70
[<ffff000008d49da0>] sock_ioctl+0x21c/0x320
[<ffff0000082b3b98>] do_vfs_ioctl+0xbc/0x954
[<ffff0000082b44b4>] SyS_ioctl+0x84/0x98
Exception stack(0xffff00000b37bec0 to 0xffff00000b37c000)
bec0: 000000000000003d 0000000000008914 0000fcc728110840 0000000000000003
bee0: 0000fcc728110850 6f43ffffffffffff 0000000000000000 0000000000800000
bf00: 000000000000001d 0000fcc7281107f8 0000fcc7281107f8 0000fcc728110840
bf20: 0000fcc728110458 0000000000000028 ffffffffffffffff 00002d18ec000000
bf40: 0000fcc72962af68 0000fcc729e2d0e0 0000fcc72810fc1a 0000fcc728111588
bf60: 0000fcc72962b000 0000ab36f6e99ac5 0000ab36f6e99a8e 0000000000000008
bf80: 0000ab36f6e99ac8 0000fcc728111588 0000ab36f6e99c0e 0000000000000006
bfa0: 0000fcc72902b108 0000fcc728110830 0000fcc729e2d16c 0000fcc728110740
bfc0: 0000fcc729e73758 00000000a0000000 000000000000003d 000000000000001d
bfe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[<ffff000008083ac0>] el0_svc_naked+0x34/0x38
Code: d503201f f9401e82 aa1303e1 f94006c0 (39c00842)
---[ end trace f7b45310362d53ac ]---
Kernel panic - not syncing: Fatal exception
SMP: stopping secondary CPUs
SMP: failed to stop secondary CPUs 0,2,4
Kernel Offset: disabled
CPU features: 0x180200c
Memory Limit: none
Rebooting in 5 seconds..
SMP: stopping secondary CPUs
SMP: failed to stop secondary CPUs 0,2,4

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>

diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
index 1007fee..0d944e0 100644 (file)
--- a/drivers/usb/cdns3/gadget.c
+++ b/drivers/usb/cdns3/gadget.c
@@ -1715,6 +1715,9 @@ static int cdns3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
        priv_ep = ep_to_cdns3_ep(ep);
        priv_dev = priv_ep->cdns3_dev;
 
+       if (!priv_ep->endpoint.desc)
+               return -EINVAL;
+
        spin_lock_irqsave(&priv_dev->lock, flags);
 
        ret = __cdns3_gadget_ep_queue(ep, request, gfp_flags);