linux-kernel - [RFC][PATCH v2] usb: gadget: u_ether: Fix data stall issue in RNDIS tethering mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1454965791-22746-1-git-send-email-amit.pundir@linaro.org>
Date:	Tue,  9 Feb 2016 02:39:51 +0530
From:	Amit Pundir <amit.pundir@...aro.org>
To:	linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org
Cc:	Badhri Jagan Sridharan <Badhri@...gle.com>,
	Felipe Balbi <balbi@...nel.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Mike Looijmans <mike.looijmans@...ic.nl>,
	Robert Baldyga <r.baldyga@...sung.com>,
	Android Kernel Team <kernel-team@...roid.com>,
	John Stultz <john.stultz@...aro.org>,
	Sumit Semwal <sumit.semwal@...aro.org>,
	Praneeth Bajjuri <praneeth@...com>,
	Vijayavardhan Vennapusa <vvreddy@...eaurora.org>
Subject: [RFC][PATCH v2] usb: gadget: u_ether: Fix data stall issue in RNDIS tethering mode

From: Badhri Jagan Sridharan <Badhri@...gle.com>

For dual speed gadget, with current no. of request(10), there is
possibility of corner case occurrence where all 10 requests are queued
to HW without setting IOC bit, which could lead to data stall in
RNDIS tethering and RNDIS local networking.

With this patch, counter will be incremented before queueing request to
HW and sets IOC bit for every nth request due to which the corner case
of all requests queued to HW without IOC bit set will be avoided.

Cc: Felipe Balbi <balbi@...nel.org>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Mike Looijmans <mike.looijmans@...ic.nl> 
Cc: Robert Baldyga <r.baldyga@...sung.com>
Cc: Android Kernel Team <kernel-team@...roid.com>
Cc: John Stultz <john.stultz@...aro.org>
Cc: Sumit Semwal <sumit.semwal@...aro.org>
Cc: Praneeth Bajjuri <praneeth@...com>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@...eaurora.org>
[pundir:
 * cherry-picked this patch from AOSP experimental/android-4.4 tree.
 * folded in an AOSP build fix from Praneeth Bajjuri <praneeth@...com>]
Signed-off-by: Amit Pundir <amit.pundir@...aro.org>
---
v2: folded in the build fix for v1 from AOSP. Updated the commit log.

v1: Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
    I could not find upstream submission history for this patch, so my
    apologies in advance if this has already been NACKed before.

 drivers/usb/gadget/function/u_ether.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 9a69332..7f98a2d 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -64,7 +64,7 @@ struct eth_dev {
 
 	spinlock_t		req_lock;	/* guard {rx,tx}_reqs */
 	struct list_head	tx_reqs, rx_reqs;
-	atomic_t		tx_qlen;
+	unsigned		tx_qlen;
 
 	struct sk_buff_head	rx_frames;
 
@@ -464,7 +464,6 @@ static void tx_complete(struct usb_ep *ep, struct usb_request *req)
 	spin_unlock(&dev->req_lock);
 	dev_kfree_skb_any(skb);
 
-	atomic_dec(&dev->tx_qlen);
 	if (netif_carrier_ok(dev->net))
 		netif_wake_queue(dev->net);
 }
@@ -584,12 +583,19 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
 
 	req->length = length;
 
-	/* throttle high/super speed IRQ rate back slightly */
-	if (gadget_is_dualspeed(dev->gadget))
-		req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH ||
-				     dev->gadget->speed == USB_SPEED_SUPER)
-			? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0)
-			: 0;
+	/* throttle highspeed IRQ rate back slightly */
+	if (gadget_is_dualspeed(dev->gadget) &&
+			 (dev->gadget->speed == USB_SPEED_HIGH)) {
+		dev->tx_qlen++;
+		if (dev->tx_qlen == dev->qmult) {
+			req->no_interrupt = 0;
+			dev->tx_qlen = 0;
+		} else {
+			req->no_interrupt = 1;
+		}
+	} else {
+		req->no_interrupt = 0;
+	}
 
 	retval = usb_ep_queue(in, req, GFP_ATOMIC);
 	switch (retval) {
@@ -598,7 +604,6 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
 		break;
 	case 0:
 		net->trans_start = jiffies;
-		atomic_inc(&dev->tx_qlen);
 	}
 
 	if (retval) {
@@ -625,7 +630,7 @@ static void eth_start(struct eth_dev *dev, gfp_t gfp_flags)
 	rx_fill(dev, gfp_flags);
 
 	/* and open the tx floodgates */
-	atomic_set(&dev->tx_qlen, 0);
+	dev->tx_qlen = 0;
 	netif_wake_queue(dev->net);
 }
 
-- 
1.9.1