linux-kernel - Re: [PATCH v2] usb: dwc3: gadget: Wait for end transfer complete before free irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Oct 2016 10:02:35 +0300
From:   Felipe Balbi <balbi@...nel.org>
To:     Baolin Wang <baolin.wang@...aro.org>
Cc:     gregkh@...uxfoundation.org, broonie@...nel.org,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        baolin.wang@...aro.org
Subject: Re: [PATCH v2] usb: dwc3: gadget: Wait for end transfer complete before free irq


Hi,

Baolin Wang <baolin.wang@...aro.org> writes:
> @@ -1742,6 +1791,17 @@ static int dwc3_gadget_stop(struct usb_gadget *g)
>  	dwc->gadget_driver	= NULL;
>  	spin_unlock_irqrestore(&dwc->lock, flags);
>  
> +	/*
> +	 * Since the xHCI will share the same interrupt with gadget, thus when
> +	 * free the gadget irq, it will not shutdown this gadget irq line. Then
> +	 * the gadget driver can not handle the end transfer command complete
> +	 * event after free the gadget irq, which will hang the system to crash.
> +	 *
> +	 * So we should wait for the end transfer command complete event before
> +	 * free it to avoid this situation.
> +	 */
> +	dwc3_wait_command_complete(dwc);

this doesn't make sense. We have already masked all interrupts before
getting here. We have also, already, disabled all endpoints.

I'm thinking this is a bug in configfs interface of Gadget API, not
dwc3. The only reason for this to happen would be if we get to
->udc_stop() with endpoints still enabled.

Can you check if that's the case? i.e. can you check if any endpoints
are still enabled when we get here?

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (801 bytes)