linux-kernel - Re: [PATCH v2] usb: dwc3: gadget: Wait for end transfer complete before free irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Oct 2016 20:41:17 +0800
From:   Baolin Wang <baolin.wang@...aro.org>
To:     Felipe Balbi <balbi@...nel.org>
Cc:     Greg KH <gregkh@...uxfoundation.org>,
        Mark Brown <broonie@...nel.org>,
        USB <linux-usb@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] usb: dwc3: gadget: Wait for end transfer complete
 before free irq

Hi Felipe,

On 13 October 2016 at 19:23, Felipe Balbi <balbi@...nel.org> wrote:
>
> Hi,
>
> Baolin Wang <baolin.wang@...aro.org> writes:
>>>> Baolin Wang <baolin.wang@...aro.org> writes:
>>>>>>>> I'm thinking this is a bug in configfs interface of Gadget API, not
>>>>>>>> dwc3. The only reason for this to happen would be if we get to
>>>>>>>> ->udc_stop() with endpoints still enabled.
>>>>>>>>
>>>>>>>> Can you check if that's the case? i.e. can you check if any endpoints
>>>>>>>> are still enabled when we get here?
>>>>>>>
>>>>>>> No, it is not any endpoints are still enabled. Like I said in commit
>>>>>>> message, we will start end transfer command when disable the endpoint,
>>>>>>> if the end transfer command complete event comes after we have freed
>>>>>>> the gadget irq, it will trigger the interrupt line all the time to
>>>>>>> crash the system.
>>>>>>
>>>>>> I see what the problem is. Databook tells us we *must* set CMDIOC when
>>>>>> issuing EndTransfer command and we should always wait for Command
>>>>>> Complete IRQ. However, we took a shortcut and just delayed for 100us
>>>>>> after issuing End Transfer.
>>>>>
>>>>> Yes, but 100us delay is not enough in some scenarios, like changing
>>>>> function with configfs frequently, we will met problems.
>>>>
>>>> heh, 100us *is* enough. However we still get an IRQ because we requested
>>>> for it. If you want to fix this, then you need to find a way to get rid
>>>> of that 100us udelay() and add a proper wait_for_completion() to delay
>>>> execution until command complete IRQ fires up.
>>>
>>> I haven't tested this yet, but it shows the idea (I think we might still
>>> have a race with ep_queue if we're still waiting for End Transfer, but
>>
>> Yes, maybe we need check DWC3_EP_END_TRANSFER_PENDING flag when
>> queuing one request.
>
> Yeah, I'll add that check later. I still need to make sure we would
> still try to kick any transfers that might have been queued while
> waiting for End Transfer Command Complete IRQ.

OK. But I still worried if there are other races in some places which
is not easy to find out by testing. No introducing race condition
would be one better solution, anyway I would like to test the patch
you send out firstly.

>
>>> that's easy to sort out by checking for DWC3_EP_END_TRANSFER_PENDING
>>> before calling kick_transfer). Could you have a look and, perhaps, run a
>>> test?
>>
>> Sure. I will test it and send out the result tomorrow.
>
> Thank you
>
> --
> balbi



-- 
Baolin.wang
Best Regards