linux-kernel - Re: [RESEND/PATCH 5/6] USB: musb-gadget: complete request only if data is transfered over

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 14 Sep 2010 14:46:22 +0400
From:	Sergei Shtylyov <sshtylyov@...sta.com>
To:	balbi@...com
CC:	Sergei Shtylyov <sshtylyov@...sta.com>,
	Ming Lei <tom.leiming@...il.com>,
	"greg@...ah.com" <greg@...ah.com>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"linux-omap@...r.kernel.org" <linux-omap@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	David Brownell <dbrownell@...rs.sourceforge.net>,
	"Gadiyar, Anand" <gadiyar@...com>,
	Mike Frysinger <vapier@...too.org>
Subject: Re: [RESEND/PATCH 5/6] USB: musb-gadget: complete request only if
 data is transfered over

Hello.

On 14-09-2010 10:56, Felipe Balbi wrote:

>> Oops, I've been too fast and haven't realized that the check done here
>> _is_ actually wrong. It causes ZLP send to trigger too fast in the DMA
>> case. So please fix this patch. Felipe, please drop it for now.

> patch is not even touching that part of the code,

    Yeah, and that's the problem.

> not even
> reading/writing TXCSR_TXPKTRDY bit care to explain please.

    If a DMA interrupt comes when the whole transfer is not yet complete (and 
other Ming Lei's patches are making this possible), it will pass due to the 
'ís_dma' condition above the patched code:

                 if (is_dma || request->actual == request->length) {

and then it will hit the code sending the final ZLP (above this patched code too):

                         /*
                          * First, maybe a terminating short packet. Some DMA
                          * engines might handle this by themselves.
                          */
                         if ((request->zero && request->length
                                 && request->length % musb_ep->packet_sz == 0)
#ifdef CONFIG_USB_INVENTRA_DMA
                                 || (is_dma && (!dma->desired_mode ||
                                         (request->actual &
                                                 (musb_ep->packet_sz - 1))))
#endif
                         ) {

before the transfer is complete while it should only be hit when and only when 
the whole transfer is complete. The current code doesn't look correct as well 
though, all due to this 'ís_dma' condition. Surely this needs fixing.

WBR, Sergei
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/