sched: Fix reference to stale task_struct in try_to_wake_up()

try_to_wake_up() currently drops p->pi_lock and later checks for need
to notify cpufreq governor on task migrations or wakeups. However the
woken task could exit between the time p->pi_lock is released and the
time the test for notification is run. As a result, the test for
notification could refer to an exited task. task_notify_on_migrate(p)
could thus lead to invalid memory reference.

Fix this by running the test for notification with task's pi_lock
held.

Change-Id: I1c7a337473d2d8e79342a015a179174ce00702e1
Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>
fs: Fix -Wmaybe-uninitialized

Change-Id: I46e65c678d03d72531729f5423f8fe51da716029
USB: composite: Fix issue of get interface returning wrong altsetting

Currently composite driver will block and doesn't forward the set
interface with zero index vlaue after set configuration request.
This leads to returning wrong altsetting value for get interface
request from Host for interfaces that does support multiple
alternatesettings when host sends set interface with one followed
by set interface with zero index value after device is configured.
This could cause USB3.0 complaince test fail. Hence fix this value
by forwarding set interface request for interfaces that does
support mutliple altsettings.

CRs-Fixed: 747760
Change-Id: Ib82d4acc90f577308e18f0e0af1e616dbc8ce6a8
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB: gadget: f_rndis: Add check before queuing notification available

There is a chance that rndis_response_available() and unbind() race each
other due to which request's buffer might have freed and could cause
accessing freed buffer pointer. Hence add check before accessing buffer
pointer of USB request for interrupt endpoint.

CRs-fixed: 731323
Change-Id: I2082e54cbdc28817651e75e8e8ed13d0ee61a6d5
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
usb: gadget: Fix response available notify count usage

The outstanding responses are purged and notify count is reset
during bus suspend. But the notify interrupt endpoint is not flushed.
If a request is pending with the controller, It gets finished during
resume and the notify count is decremented in the completion handler.
As the notify count is reset during the suspend its become negative now.
As the counter is not zero, interrupt notifications are queued even
though there are no responses. This is leading to watchdog bark due to
an error print messages.

Flush the notify endpoint before resetting the notify counter during
suspend. As we are modifying notify counter under spin lock, atomic
variable is not required. Ensure that notify counter never
becomes negative.

CRs-Fixed: 607029
Change-Id: I78cb7a585c1c2b527ca6b46bc99e7db8067ee21a
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
usb: Avoid incorrect memory leaks reported by kmemleak tool.

Certain memory allocations are not properly tracked by the kmemleak
tool, which causes it to incorrectly detect memory leaks. Notify the
tool by using kmemleak_not_leak() to ignore the memory allocation
so that incorrect leak reports are avoided.

CRs-Fixed: 612944
Change-Id: Ia15d94bb140f415a25d5b7e6996d3b985f33b28b
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
usb: gadget: Fix synchronization issue between f_audio_source

Race is happening when both audio_pcm_close() and audio_send()
executes in parallel.
When the PCM session is closed, the substream attribute of the
audio_dev structure is set to NULL in audio_pcm_close().
As there is no synchronization protection for the audio_dev subtream
attributes in audio_send(), it is causing NULL pointer dereference.
Hence fixing the issue by adding proper synchronization protection
for the audio_dev subtream attributes in audio_send().

CRs-Fixed: 613498
Change-Id: Id9ab0d4e347b8bb2f551f9033829e541bdcaf0e8
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
usb: Fix race between diag_function_disable() and usb_diag_write()

There is a race when diag_function_disable() and usb_diag_write()
executes in parallel.
The diag context attribute is set to NULL in diag_function_disable()
which is later accessed in usb_diag_write() leading to NULL pointer
dereference.
Fix the issue by adding proper synchronization protection
for the diag context attribute in usb_diag_write().

CRs-Fixed: 620348
Change-Id: Ia2439c135bcab6ec9ed8191bd2e55cc1ac3abfdb
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
usb: gadget: mbim: protect packets queue corruption

The f_mbim usb function driver maintain a packets queue sent from the
host as encapsulated commands which need to be read by the QBI using the
mbim_read fops.

In case of excessive messages arriving from the host we end up with simple
race condition between the queue writer and queue reader which end up in
corruption of the queue and packet loss.

Simply add a missing lock protection upon reading (deleting) a packet from
queue.

CRs-Fixed: 576720
Change-Id: I8aff04745f02cbefd3d6b83d944cad9aa1726ebf
Signed-off-by: Ido Shayevitz <idos@codeaurora.org>
usb: f_qc_rndis: Correct SSUSB descriptor with IAD information

Currently SSUB descriptor is using rndis.c related descriptor
which is not being updated at binding time. Hence windows host
is not able to load RNDIS driver identifying both Control and
Data Interfaces. Update the same which is being updated and used
by qc_rndis.c file to resolve this issue.

Change-Id: I6788059bf247dc5f767970ef76a10351ed83dbb1
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
USB: gadget: ether: Fix memory corruption issues with multi_pkt_xfers

If gadget xmits packets before host sends RNDIS_MSG_INIT to update
maximum packets supported per transfer, then there is a possibility
of using freed skb memory later from xmit function. Fix such
races which may arise between tx_complete and start_xmit routines
depending on when multi_pkt_transfers are enabled.
Other option is to defer starting TX transfers until RNDIS_MSG_INIT
is received, but then it makes it difficult to handle scenarios
where host doesn't support this message or just doesn't send it.

CRs-fixed: 595367
Change-Id: I181da831120b38840ae4b8b74c1dacce129d1ba6
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
USB: android: release spinlock before queuing work in android_setup

In android_setup we release spinlock after scheduling the work but there
is no need for holding the spinlock during the schedule_work call
is executed this can lead to spinlock timeouts in case where schedule
work takes more time.

So before scheduling work in android_setup we release spinlock to avoid
potential spinlock lockup or timeout.

CRs-Fixed: 661220
Change-Id: Ibf8ff7f07caf20edf9e646fdcef540fbc6441aec
Signed-off-by: Tarun Gupta <tarung@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
usb: gadget: Ignore the second set_config from the host

Some USB hosts may send SET_CONFIGURATION with same value twice.
The current code implementation of android_work() issues disconnect
event to userspace if SetConfiguration with non-zero value is sent
twice. The Userspace application may disconnect USB and it causes
fail to connect to the USB host.

Fix this by ignoring the second time SET_CONFIGURATION request
from the host only for the same configuration value twice.

CRs-Fixed: 661220
Change-Id: Iec8dd7824fa9f371ea147784cf9137aa88a7128e
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
usb: android: Skip the work when set_config arrives with same value twice

Some USB hosts may send SET_CONFIGURATION with same value twice.
The current code implementation processing the 2nd set_config and
schedules the work. The android_work() issues disconnect event to
userspace if SetConfiguration with non-zero value is sent twice.
The userspace applications may disconnect the USB and the device
doesn't connect to the host.

Fix this by avoiding the android_work for the second time SET_CONFIGURATION
request when it receives SetConfiguration request with same configuration
value twice from the host.

CRs-Fixed: 661220
Change-Id: Ic450315a9067b9b679b4936480d125e4e4b7cdf7
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
fix false disconnect due to a signal sent to the reading process

- In the current implementation, when a signal is sent to the reading process,
  read is cancelled by calling usb_ep_dequeue, which lead into calling
  acc_complete_out with ECONNRESET, but the current logic treats it as
  disconnection, which makes the device inaccessible until cable is actually
  disconnected.
- The fix calls disconnect only when ESHUTDOWN error is passed.
- If data has already arrived while trying cancelling, the data is marked
  as available, and it will be read out on the next read. This is necessary
  as USB bulk is assumed to guarantee no data loss.

Signed-off-by: keunyoung <keunyoung@google.com>