linux-kernel - Re: [PATCH V2 2/2] usb: musb: Stop bulk endpoint while queue is rotated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 23 May 2016 15:38:54 +0300
From:	Sergei Shtylyov <sergei.shtylyov@...entembedded.com>
To:	Andrew Goodbody <andrew.goodbody@...brionix.com>, b-liu@...com
Cc:	gregkh@...uxfoundation.org, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH V2 2/2] usb: musb: Stop bulk endpoint while queue is
 rotated

Hello.

On 5/23/2016 3:00 PM, Andrew Goodbody wrote:

> Ensure that the endpoint is stopped by clearing REQPKT before
> clearing DATAERR_NAKTIMEOUT before rotating the queue on the
> dedicated bulk endpoint.
> This addresses an issue where a race could result in the endpoint
> receiving data before it was reprogrammed resulting in a warning
> about such data from musb_rx_reinit before it was thrown away.
> The data thrown away was a valid packet that had been correctly
> ACKed which meant the host and device got out of sync.
>
> Signed-off-by: Andrew Goodbody <andrew.goodbody@...brionix.com>
> Cc: stable@...r.kernel.org
> ---
> V2 added comment about clearing REQPKT before DATAERR_NAKTIMEOUT
>
>  drivers/usb/musb/musb_host.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
> index 2966596..676cb98 100644
> --- a/drivers/usb/musb/musb_host.c
> +++ b/drivers/usb/musb/musb_host.c
> @@ -997,6 +997,12 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep,
>  		/* clear nak timeout bit */
>  		rx_csr = musb_readw(epio, MUSB_RXCSR);
>  		rx_csr |= MUSB_RXCSR_H_WZC_BITS;
> +		/*
> +		 * Need to stop the transaction by clearing REQPKT before

    Transcation? Maybe transfer?

> +		 * DATAERR_NAKTIMEOUT ref TRM section 16.3.8.2.2.1.2

    Which TRM? Do you understand that the MUSB core is used by multiple SoCs? 
I'd recommend referring just to the "abstract" manual or the MUSB programmer's 
guide (section 9.2.2 if you want an exact ref.).

[...]

MBR, Sergei