From: Shuqiao Zhang <[email protected]>
usb_descriptor_fillbuf() expects descriptor arrays to end with NULL.
The high-speed RockUSB array does, but the full-speed array does not.
Full-speed enumeration therefore reads beyond the array and treats
adjacent data as another descriptor pointer.
On a Luckfox Lyra Ultra (RK3506B), the adjacent interface descriptor
started with bytes 09 04 00 00. They were interpreted as pointer
0x00000409, causing a data abort in usb_descriptor_fillbuf().
Add the missing NULL terminator, matching the high-speed descriptor
array. After this change, RockUSB enumerates at full speed and
upgrade_tool can successfully read the eMMC.
Fixes: bf2b72bef14b ("usb: rockchip: add the rockusb gadget")
Signed-off-by: Shuqiao Zhang <[email protected]>
---
drivers/usb/gadget/f_rockusb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/gadget/f_rockusb.c b/drivers/usb/gadget/f_rockusb.c
index d679cdae97c..77a89b47d99 100644
--- a/drivers/usb/gadget/f_rockusb.c
+++ b/drivers/usb/gadget/f_rockusb.c
@@ -71,6 +71,7 @@ static struct usb_descriptor_header *rkusb_fs_function[] = {
(struct usb_descriptor_header *)&interface_desc,
(struct usb_descriptor_header *)&fs_ep_in,
(struct usb_descriptor_header *)&fs_ep_out,
+ NULL,
};
static struct usb_descriptor_header *rkusb_hs_function[] = {
---
base-commit: 211de43d0f954a00a490220c1aac9db298287c40
change-id: 20260918-rockusb-fs-descriptor-terminator-0de356c7b6a8
Best regards,
--
Shuqiao Zhang <[email protected]>
