On 9/18/26 12:11 PM, Shuqiao Zhang via B4 Relay wrote:
From: Shuqiao Zhang <[email protected]>

usb_descriptor_fillbuf() expects descriptor arrays to end with NULL.
The high-speed RockUSB array does, but the full-speed array does not.
Full-speed enumeration therefore reads beyond the array and treats
adjacent data as another descriptor pointer.

On a Luckfox Lyra Ultra (RK3506B), the adjacent interface descriptor
started with bytes 09 04 00 00. They were interpreted as pointer
0x00000409, causing a data abort in usb_descriptor_fillbuf().

Add the missing NULL terminator, matching the high-speed descriptor
array. After this change, RockUSB enumerates at full speed and
upgrade_tool can successfully read the eMMC.

Fixes: bf2b72bef14b ("usb: rockchip: add the rockusb gadget")
Signed-off-by: Shuqiao Zhang <[email protected]>
Reviewed-by: Marek Vasut <[email protected]>

Reply via email to