linux-kernel - [PATCH 1/8] usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 25 Jul 2018 17:21:24 +0530
From:   Anurag Kumar Vulisha <anurag.kumar.vulisha@...inx.com>
To:     <balbi@...nel.org>, <gregkh@...uxfoundation.org>
CC:     <v.anuragkumar@...il.com>, <linux-usb@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>,
        Anurag Kumar Vulisha <anurag.kumar.vulisha@...inx.com>
Subject: [PATCH 1/8] usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb()

In __dwc3_prepare_one_trb(), IOC bit is set if the total number of
available TRB's are zero. The number of available TRBs are calculated
using dwc3_calc_trbs_left(), which determines TRBs full or not based
on HWO bit set in the TRB.
During preparation of TRB __dwc3_prepare_one_trb() is always called
with a TRB which doesn't have HWO bit set. __dwc3_prepare_one_trb()
depends on dwc3_calc_trbs_left() to calculate the free available TRBs
and set IOC bit if not available. Since dwc3_calc_trbs_left()
determines TRB available based on HWO bit, there are chances that
dwc3_calc_trbs_left() wrongly calculates the present working TRB as
free TRB (since HWO bit is not yet set).
This patch corrects this issue by setting HWO bit before calling
dwc3_calc_trbs_left().

Signed-off-by: Anurag Kumar Vulisha <anurag.kumar.vulisha@...inx.com>
---
 drivers/usb/dwc3/gadget.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 69bf137..f73d219 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -990,6 +990,8 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
 			trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI;
 	}

+	trb->ctrl |= DWC3_TRB_CTRL_HWO;
+
 	if ((!no_interrupt && !chain) ||
 			(dwc3_calc_trbs_left(dep) == 0))
 		trb->ctrl |= DWC3_TRB_CTRL_IOC;
@@ -1000,8 +1002,6 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
 	if (usb_endpoint_xfer_bulk(dep->endpoint.desc) && dep->stream_capable)
 		trb->ctrl |= DWC3_TRB_CTRL_SID_SOFN(stream_id);

-	trb->ctrl |= DWC3_TRB_CTRL_HWO;
-
 	trace_dwc3_prepare_trb(dep, trb);
 }

-- 
2.1.1