Hi Shuqiao Zhang,
On 9/18/26 12:11 PM, Shuqiao Zhang via B4 Relay wrote:
From: Shuqiao Zhang <[email protected]>
usb_descriptor_fillbuf() expects descriptor arrays to end with NULL.
The high-speed RockUSB array does, but the full-speed array does not.
Full-speed enumeration therefore reads beyond the array and treats
adjacent data as another descriptor pointer.
On a Luckfox Lyra Ultra (RK3506B), the adjacent interface descriptor
started with bytes 09 04 00 00. They were interpreted as pointer
0x00000409, causing a data abort in usb_descriptor_fillbuf().
Add the missing NULL terminator, matching the high-speed descriptor
array. After this change, RockUSB enumerates at full speed and
upgrade_tool can successfully read the eMMC.
usb_descriptor_fillbuf() iterates over the array, but so does
set_config() in drivers/usb/gadget/composite.c.
I've quickly checked other drivers and it seems they all NULL-terminate
also (either explicitly, or in the case of drivers/usb/gadget/ether.c by
having an array of static size with fewer elements than the array can
contain (and thus they are NULL)), so they should be fine hopefully.
Acked-by: Quentin Schulz <[email protected]>
At the organizational level, who's willing to take it through their tree
once reviewed? I don't mind but I'll be waiting review from Lukasz,
Mattijs and/or Marek before doing that.
Thanks!
Quentin
