On Tue, Sep 22, 2026 at 00:01, Marek Vasut <[email protected]> wrote:
> On 9/18/26 3:50 PM, Quentin Schulz wrote: >> Hi Shuqiao Zhang, >> >> On 9/18/26 12:11 PM, Shuqiao Zhang via B4 Relay wrote: >>> From: Shuqiao Zhang <[email protected]> >>> >>> usb_descriptor_fillbuf() expects descriptor arrays to end with NULL. >>> The high-speed RockUSB array does, but the full-speed array does not. >>> Full-speed enumeration therefore reads beyond the array and treats >>> adjacent data as another descriptor pointer. >>> >>> On a Luckfox Lyra Ultra (RK3506B), the adjacent interface descriptor >>> started with bytes 09 04 00 00. They were interpreted as pointer >>> 0x00000409, causing a data abort in usb_descriptor_fillbuf(). >>> >>> Add the missing NULL terminator, matching the high-speed descriptor >>> array. After this change, RockUSB enumerates at full speed and >>> upgrade_tool can successfully read the eMMC. >>> >> >> usb_descriptor_fillbuf() iterates over the array, but so does >> set_config() in drivers/usb/gadget/composite.c. >> >> I've quickly checked other drivers and it seems they all NULL-terminate >> also (either explicitly, or in the case of drivers/usb/gadget/ether.c by >> having an array of static size with fewer elements than the array can >> contain (and thus they are NULL)), so they should be fine hopefully. >> >> Acked-by: Quentin Schulz <[email protected]> >> >> At the organizational level, who's willing to take it through their tree >> once reviewed? I don't mind but I'll be waiting review from Lukasz, >> Mattijs and/or Marek before doing that. > Wait for Mattijs please . Unless requested otherwise, I'll pick it up through u-boot-dfu-next. I have this go through next as this bug has been here for some years already. Thanks! Mattijs
