linux-kernel - Re: [PATCH AUTOSEL 4.19 06/21] usb: dwc3: gadget: Ignore EP queue requests during bus reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 10 May 2021 14:03:18 +0200
From:   Pavel Machek <pavel@...x.de>
To:     Sasha Levin <sashal@...nel.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Wesley Cheng <wcheng@...eaurora.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-usb@...r.kernel.org
Subject: Re: [PATCH AUTOSEL 4.19 06/21] usb: dwc3: gadget: Ignore EP queue
 requests during bus reset

Hi!

> [ Upstream commit 71ca43f30df9c642970f9dc9b2d6f463f4967e7b ]
> 
> The current dwc3_gadget_reset_interrupt() will stop any active
> transfers, but only addresses blocking of EP queuing for while we are
> coming from a disconnected scenario, i.e. after receiving the disconnect
> event.  If the host decides to issue a bus reset on the device, the
> connected parameter will still be set to true, allowing for EP queuing
> to continue while we are disabling the functions.  To avoid this, set the
> connected flag to false until the stop active transfers is complete.

This is mismerged / crazy. Will probably break the driver completely.


> +++ b/drivers/usb/dwc3/gadget.c
> @@ -2717,6 +2717,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
>  
>  	dwc->connected = true;
>  
> +	/*
> +	 * Ideally, dwc3_reset_gadget() would trigger the function
> +	 * drivers to stop any active transfers through ep disable.
> +	 * However, for functions which defer ep disable, such as mass
> +	 * storage, we will need to rely on the call to stop active
> +	 * transfers here, and avoid allowing of request queuing.
> +	 */
> +	dwc->connected = false;
> +
>  	/*
>  	 * WORKAROUND: DWC3 revisions <1.88a have an issue which
>  	 * would cause a missing Disconnect Event if there's a

See how connected = true is immediately overwritten? In mainline
= true assignment is done below, so it does not have this problem.

Best regards,
								Pavel
-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)