linux-kernel - Re: [PATCH] dwc3: gadget: Introduce dwc3_endpoint_xfer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 26 May 2016 15:11:12 +0800
From:	Baolin Wang <baolin.wang@...aro.org>
To:	Felipe Balbi <balbi@...nel.org>
Cc:	Greg KH <gregkh@...uxfoundation.org>,
	Mark Brown <broonie@...nel.org>,
	USB <linux-usb@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] dwc3: gadget: Introduce dwc3_endpoint_xfer_xxx() to check
 endpoint type

Hi Felipe,

On 26 May 2016 at 14:22, Felipe Balbi <balbi@...nel.org> wrote:
>
> Hi,
>
> Baolin Wang <baolin.wang@...aro.org> writes:
>> When handling the endpoint interrupt handler, it maybe disable the endpoint
>> from another core user to set the USB endpoint descriptor pointor to be NULL
>> while issuing usb_gadget_giveback_request() function to release lock. So it
>> will be one bug to check the endpoint type by usb_endpoint_xfer_xxx() APIs with
>> one NULL USB endpoint descriptor.
>
> too complex, Baolin :-) Can you see if this helps:
>
> https://git.kernel.org/cgit/linux/kernel/git/balbi/usb.git/commit/?id=88bf752cfb55e57a78e27c931c9fef63240c739a
>
> The only situation when that can happen is while we drop our lock on
> dwc3_gadget_giveback().

OK, But line 1974 and line 2025 as below may be at risk? So I think
can we have a common place to solve the problem in case
usb_endpoint_xfer_xxx() APIs are issued at this risk? What do you
think? Thanks.

1956 static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
1957                 const struct dwc3_event_depevt *event, int status)
1958 {
1959         struct dwc3_request     *req;
1960         struct dwc3_trb         *trb;
1961         unsigned int            slot;
1962         unsigned int            i;
1963         int                     ret;
1964
1965         do {
1966                 req = next_request(&dep->req_queued);
1967                 if (WARN_ON_ONCE(!req))
1968                         return 1;
1969
1970                 i = 0;
1971                 do {
1972                         slot = req->start_slot + i;
1973                         if ((slot == DWC3_TRB_NUM - 1) &&
1974                                 usb_endpoint_xfer_isoc(dep->endpoint.desc))
1975                                 slot++;
1976                         slot %= DWC3_TRB_NUM;
1977                         trb = &dep->trb_pool[slot];
1978
1979                         ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
1980                                         event, status);
1981                         if (ret)
1982                                 break;
1983                 } while (++i < req->request.num_mapped_sgs);
1984
1985                 dwc3_gadget_giveback(dep, req, status);
1986
1987                 if (ret)
1988                         break;
1989         } while (1);
.......

2011 static void dwc3_endpoint_transfer_complete(struct dwc3 *dwc,
2012                 struct dwc3_ep *dep, const struct dwc3_event_depevt *event)
2013 {
2014         unsigned                status = 0;
2015         int                     clean_busy;
2016         u32                     is_xfer_complete;
2017
2018         is_xfer_complete = (event->endpoint_event ==
DWC3_DEPEVT_XFERCOMPLETE);
2019
2020         if (event->status & DEPEVT_STATUS_BUSERR)
2021                 status = -ECONNRESET;
2022
2023         clean_busy = dwc3_cleanup_done_reqs(dwc, dep, event, status);
2024         if (clean_busy && (is_xfer_complete ||
2025
usb_endpoint_xfer_isoc(dep->endpoint.desc)))
2026                 dep->flags &= ~DWC3_EP_BUSY;

>
> --
> balbi



-- 
Baolin.wang
Best Regards