linux-kernel - [PATCH 3.2 47/94] usb: musb: Stop bulk endpoint while queue is rotated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lsq.1471110178.243145541@decadent.org.uk>
Date:	Sat, 13 Aug 2016 18:42:58 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:	akpm@...ux-foundation.org,
	"Andrew Goodbody" <andrew.goodbody@...brionix.com>,
	"Bin Liu" <b-liu@...com>,
	"Greg Kroah-Hartman" <gregkh@...uxfoundation.org>
Subject: [PATCH 3.2 47/94] usb: musb: Stop bulk endpoint while queue is
 rotated

3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Andrew Goodbody <andrew.goodbody@...brionix.com>

commit 7b2c17f829545df27a910e8d82e133c21c9a8c9c upstream.

Ensure that the endpoint is stopped by clearing REQPKT before
clearing DATAERR_NAKTIMEOUT before rotating the queue on the
dedicated bulk endpoint.
This addresses an issue where a race could result in the endpoint
receiving data before it was reprogrammed resulting in a warning
about such data from musb_rx_reinit before it was thrown away.
The data thrown away was a valid packet that had been correctly
ACKed which meant the host and device got out of sync.

Signed-off-by: Andrew Goodbody <andrew.goodbody@...brionix.com>
Signed-off-by: Bin Liu <b-liu@...com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
[bwh: Backported to 3.2: adjust context, indentation]
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 drivers/usb/musb/musb_host.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -1384,9 +1384,15 @@ static void musb_bulk_rx_nak_timeout(str
 	musb_ep_select(mbase, ep->epnum);
 	dma = is_dma_capable() ? ep->rx_channel : NULL;
 
-	/* clear nak timeout bit */
+	/*
+	 * Need to stop the transaction by clearing REQPKT first
+	 * then the NAK Timeout bit ref MUSBMHDRC USB 2.0 HIGH-SPEED
+	 * DUAL-ROLE CONTROLLER Programmer's Guide, section 9.2.2
+	 */
 	rx_csr = musb_readw(epio, MUSB_RXCSR);
 	rx_csr |= MUSB_RXCSR_H_WZC_BITS;
+	rx_csr &= ~MUSB_RXCSR_H_REQPKT;
+	musb_writew(epio, MUSB_RXCSR, rx_csr);
 	rx_csr &= ~MUSB_RXCSR_DATAERROR;
 	musb_writew(epio, MUSB_RXCSR, rx_csr);