From 1bd1d033377796418008e9a2351f18dbdf88940c Mon Sep 17 00:00:00 2001 From: Francois Berder Date: Sun, 24 May 2026 21:25:47 +0200 Subject: [PATCH 1/3] fastboot: Fix blk_dwrite error checking blk_dwrite() returns the number of blocks written. The code was only checking if the return value was different than 0. Hence, partial writes were considered successful. Fix blk_dwrite error handling by checking that all blocks are written. Signed-off-by: Francois Berder Reviewed-by: Mattijs Korpershoek Link: https://patch.msgid.link/BESP194MB2805BBD03E7C92727F116585DA0D2@BESP194MB2805.EURP194.PROD.OUTLOOK.COM Signed-off-by: Mattijs Korpershoek --- drivers/fastboot/fb_mmc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/fastboot/fb_mmc.c b/drivers/fastboot/fb_mmc.c index 11d9c8e8460..9bc782ccd02 100644 --- a/drivers/fastboot/fb_mmc.c +++ b/drivers/fastboot/fb_mmc.c @@ -263,7 +263,7 @@ static int fb_mmc_update_zimage(struct blk_desc *dev_desc, /* Write new kernel size to boot image header */ hdr->kernel_size = download_bytes; res = blk_dwrite(dev_desc, info.start, hdr_sectors, (void *)hdr); - if (res == 0) { + if (res != hdr_sectors) { pr_err("cannot writeback boot image header\n"); fastboot_fail("cannot write back boot image header", response); return -1; @@ -275,7 +275,7 @@ static int fb_mmc_update_zimage(struct blk_desc *dev_desc, sectors_per_page; res = blk_dwrite(dev_desc, kernel_sector_start, kernel_sectors, download_buffer); - if (res == 0) { + if (res != kernel_sectors) { pr_err("cannot write new kernel\n"); fastboot_fail("cannot write new kernel", response); return -1; @@ -287,7 +287,7 @@ static int fb_mmc_update_zimage(struct blk_desc *dev_desc, sectors_per_page; res = blk_dwrite(dev_desc, ramdisk_sector_start, ramdisk_sectors, ramdisk_buffer); - if (res == 0) { + if (res != ramdisk_sectors) { pr_err("cannot write back original ramdisk\n"); fastboot_fail("cannot write back original ramdisk", response); return -1; From e41e97e6e6061fec5a2fb069eaad662cf6359a93 Mon Sep 17 00:00:00 2001 From: Colin Pinnell McAllister Date: Mon, 25 May 2026 00:31:58 +0000 Subject: [PATCH 2/3] android_ab: fix slot selection The boot selection rules state that a slot is bootable if it is not corrupted and either has tries remaining or has already booted successfully. However, slots that have tries_remaining == 0 and successful_boot == 1 will be disregarded when picking the slot to attempt. Updates the selection logic so slots marked successful remain eligible even when their tries counter is zero. Debug message now also includes the successful_boot value. Signed-off-by: Colin Pinnell McAllister Reviewed-by: Mattijs Korpershoek Link: https://patch.msgid.link/20260525003158.11319-1-colinmca242@gmail.com Signed-off-by: Mattijs Korpershoek --- boot/android_ab.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/boot/android_ab.c b/boot/android_ab.c index 13e82dbcb7f..f2b1110aa24 100644 --- a/boot/android_ab.c +++ b/boot/android_ab.c @@ -289,11 +289,14 @@ int ab_select_slot(struct blk_desc *dev_desc, struct disk_partition *part_info, slot = -1; for (i = 0; i < abc->nb_slot; ++i) { if (abc->slot_info[i].verity_corrupted || - !abc->slot_info[i].tries_remaining) { + (!abc->slot_info[i].tries_remaining && + !abc->slot_info[i].successful_boot)) { log_debug("ANDROID: unbootable slot %d tries: %d, ", i, abc->slot_info[i].tries_remaining); - log_debug("corrupt: %d\n", + log_debug("corrupt: %d, ", abc->slot_info[i].verity_corrupted); + log_debug("successful: %d\n", + abc->slot_info[i].successful_boot); continue; } log_debug("ANDROID: bootable slot %d pri: %d, tries: %d, ", From 033eb908d0a8ed938bc652f34a2d702a29a8726f Mon Sep 17 00:00:00 2001 From: Zixun LI Date: Sat, 6 Jun 2026 10:27:09 +0200 Subject: [PATCH 3/3] usb: gadget: atmel: use calloc() to allocate endpoint list malloc() doesn't zero out memory, leaving ep->ep.enabled uninitiated, which could make this flag falsely true. In next usb_ep_enable() call since this flag is true, ep->ops->enable() will be skipped. Then usb_ep_queue() will fail on uninitialized endpoint. Fixes: 59310d1ecb9f ("usb: gadget: introduce 'enabled' flag in struct usb_ep") Signed-off-by: Zixun LI Reviewed-by: Marek Vasut Reviewed-by: Mattijs Korpershoek Link: https://patch.msgid.link/20260606-udc_malloc-v2-1-1155326b182b@hifiphile.com Signed-off-by: Mattijs Korpershoek --- drivers/usb/gadget/atmel_usba_udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c index a2eee2bca2c..0caf8b8b7b4 100644 --- a/drivers/usb/gadget/atmel_usba_udc.c +++ b/drivers/usb/gadget/atmel_usba_udc.c @@ -1201,7 +1201,7 @@ static struct usba_ep *usba_udc_pdata(struct usba_platform_data *pdata, struct usba_ep *eps; int i; - eps = malloc(sizeof(struct usba_ep) * pdata->num_ep); + eps = calloc(pdata->num_ep, sizeof(struct usba_ep)); if (!eps) { log_err("failed to alloc eps\n"); return NULL;