lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 10 Aug 2021 19:29:57 +0200
From:   Greg Kroah-Hartman <>
Cc:     Greg Kroah-Hartman <>,, Felipe Balbi <>,
        Wesley Cheng <>
Subject: [PATCH 5.13 089/175] usb: dwc3: gadget: Use list_replace_init() before traversing lists

From: Wesley Cheng <>

commit d25d85061bd856d6be221626605319154f9b5043 upstream.

The list_for_each_entry_safe() macro saves the current item (n) and
the item after (n+1), so that n can be safely removed without
corrupting the list.  However, when traversing the list and removing
items using gadget giveback, the DWC3 lock is briefly released,
allowing other routines to execute.  There is a situation where, while
items are being removed from the cancelled_list using
dwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable
routine is running in parallel (due to UDC unbind).  As the cleanup
routine removes n, and the pullup disable removes n+1, once the
cleanup retakes the DWC3 lock, it references a request who was already
removed/handled.  With list debug enabled, this leads to a panic.
Ensure all instances of the macro are replaced where gadget giveback
is used.

Example call stack:

__dwc3_gadget_ep_set_halt() - CLEAR HALT
  -> dwc3_gadget_ep_cleanup_cancelled_requests()
      ->dwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list]
      ->Thread#2 executes
      ->Already removed!

  ->waiting for dwc3 spin_lock
  ->Thread#1 released lock
      ->fetches n+1 item from cancelled_list (n removed by Thread#1)
        ->dwc3_gadget_del_and_unmap_request()- n+1

Fix this condition by utilizing list_replace_init(), and traversing
through a local copy of the current elements in the endpoint lists.
This will also set the parent list as empty, so if another thread is
also looping through the list, it will be empty on the next iteration.

Fixes: d4f1afe5e896 ("usb: dwc3: gadget: move requests to cancelled_list")
Cc: stable <>
Acked-by: Felipe Balbi <>
Signed-off-by: Wesley Cheng <>
Signed-off-by: Greg Kroah-Hartman <>
 drivers/usb/dwc3/gadget.c |   18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1741,9 +1741,13 @@ static void dwc3_gadget_ep_cleanup_cance
 	struct dwc3_request		*req;
 	struct dwc3_request		*tmp;
+	struct list_head		local;
 	struct dwc3			*dwc = dep->dwc;
-	list_for_each_entry_safe(req, tmp, &dep->cancelled_list, list) {
+	list_replace_init(&dep->cancelled_list, &local);
+	list_for_each_entry_safe(req, tmp, &local, list) {
 		dwc3_gadget_ep_skip_trbs(dep, req);
 		switch (req->status) {
@@ -1761,6 +1765,9 @@ static void dwc3_gadget_ep_cleanup_cance
+	if (!list_empty(&dep->cancelled_list))
+		goto restart;
 static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
@@ -2945,8 +2952,12 @@ static void dwc3_gadget_ep_cleanup_compl
 	struct dwc3_request	*req;
 	struct dwc3_request	*tmp;
+	struct list_head	local;
-	list_for_each_entry_safe(req, tmp, &dep->started_list, list) {
+	list_replace_init(&dep->started_list, &local);
+	list_for_each_entry_safe(req, tmp, &local, list) {
 		int ret;
 		ret = dwc3_gadget_ep_cleanup_completed_request(dep, event,
@@ -2954,6 +2965,9 @@ static void dwc3_gadget_ep_cleanup_compl
 		if (ret)
+	if (!list_empty(&dep->started_list))
+		goto restart;
 static bool dwc3_gadget_ep_should_continue(struct dwc3_ep *dep)

Powered by blists - more mailing lists