linux-kernel - Re: [PATCH v2 1/8] usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 5 Sep 2018 05:33:39 +0000
From:   Thinh Nguyen <Thinh.Nguyen@...opsys.com>
To:     Anurag Kumar Vulisha <anurag.kumar.vulisha@...inx.com>,
        "balbi@...nel.org" <balbi@...nel.org>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC:     "v.anuragkumar@...il.com" <v.anuragkumar@...il.com>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 1/8] usb: dwc3: Correct the logic for checking TRB
 full in __dwc3_prepare_one_trb()

Hi Anurag,

On 8/17/2018 5:25 AM, Anurag Kumar Vulisha wrote:
> Availability of TRB's are calculated using dwc3_calc_trbs_left(), which
> determines available TRB's based on the HWO bit set in a TRB.
>
> __dwc3_prepare_one_trb() is called with a TRB which needs to be prepared
> for transfer. This __dwc3_prepare_one_trb() calls dwc3_calc_trbs_left()
> to determine total available TRBs and set IOC bit if the total available
> TRBs are zero. Since the present working TRB(which is passed as an
> argument to __dwc3_prepare_one_trb() )  doesn't have HWO bit already set,
> there are chances where dwc3_calc_trbs_left() wrongly calculates this
> present working TRB as free(since the HWO bit is not yet set). This could
> be a problem. This patch correct this issue by setting HWO bit before
> calling dwc3_calc_trbs_left()
>
> Signed-off-by: Anurag Kumar Vulisha <anurag.kumar.vulisha@...inx.com>
> ---
>  Changes in v2:
> 	1. Changed the commit message
> ---
>  drivers/usb/dwc3/gadget.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index 69bf137..f73d219 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -990,6 +990,8 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
>  			trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI;
>  	}
>  
> +	trb->ctrl |= DWC3_TRB_CTRL_HWO;
> +
>  	if ((!no_interrupt && !chain) ||
>  			(dwc3_calc_trbs_left(dep) == 0))
>  		trb->ctrl |= DWC3_TRB_CTRL_IOC;
> @@ -1000,8 +1002,6 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
>  	if (usb_endpoint_xfer_bulk(dep->endpoint.desc) && dep->stream_capable)
>  		trb->ctrl |= DWC3_TRB_CTRL_SID_SOFN(stream_id);
>  
> -	trb->ctrl |= DWC3_TRB_CTRL_HWO;
> -
>  	trace_dwc3_prepare_trb(dep, trb);
>  }
>  
How do you reproduce this issue? We should not set HWO before setting
other trb->ctrl bits. Can you provide a driver tracepoint? If there's an
issue with the check if ((!no_interrupt && !chain) ||
dwc3_calc_trbs_left == 0), then we may need to fix the check there.

BR,
Thinh