linux-kernel - Re: [PATCH] usb: dwc3: gadget: don't dequeue requests on already disabled endpoints

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 27 Mar 2020 10:14:10 +0100
From:   Lars-Peter Clausen <lars@...afoo.de>
To:     Michael Grzeschik <m.grzeschik@...gutronix.de>,
        alexandru.Ardelean@...log.com, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, balbi@...nel.org
Cc:     gregkh@...uxfoundation.org, bigeasy@...utronix.de,
        m.olbrich@...gutronix.de, kernel@...gutronix.de
Subject: Re: [PATCH] usb: dwc3: gadget: don't dequeue requests on already
 disabled endpoints

On 3/27/20 9:43 AM, Michael Grzeschik wrote:
> dwc3_gadget_ep_disable gets called before the last request gets
> dequeued.
>
> In __dwc3_gadget_ep_disable all started, pending and cancelled
> lists for this endpoint will call dwc3_gadget_giveback in
> dwc3_remove_requests.
>
> After that no list containing the afterwards dequed request,
> therefor it is not necessary to run the dequeue routine.
>
> Signed-off-by: Michael Grzeschik <m.grzeschik@...gutronix.de>
> ---
> @Lars-Peter Clausen:
>
> This patch addresses the case that not queued requests get dequeued.
> The only case that this happens seems on disabling the gadget.


I don't believe it does. Calling usb_ep_dequeue() is not limited to be 
called after the endpoint has been disabled. It is part of the API and 
can be called at any time. E.g. with function_fs you can abort a queued 
transfer from userspace at any time.

- Lars

>
>   drivers/usb/dwc3/gadget.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index 9a6f741d1db0dc..5d4fa8d6c93e49 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -1609,6 +1609,9 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
>   
>   	trace_dwc3_ep_dequeue(req);
>   
> +	if (!(dep->flags & DWC3_EP_ENABLED))
> +		return 0;
> +
>   	spin_lock_irqsave(&dwc->lock, flags);
>   
>   	list_for_each_entry(r, &dep->pending_list, list) {