linux-kernel - Re: [PATCH] usb: cdns3: fix race condition before setting doorbell

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 7 Sep 2021 12:58:32 +0530
From:   Aswath Govindraju <a-govindraju@...com>
To:     Pawel Laszczak <pawell@...ence.com>, <peter.chen@...nel.org>
CC:     <rogerq@...nel.org>, <gregkh@...uxfoundation.org>,
        <felipe.balbi@...ux.intel.com>, <linux-usb@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <stable@...r.kernel.org>
Subject: Re: [PATCH] usb: cdns3: fix race condition before setting doorbell

On 07/09/21 11:56 am, Pawel Laszczak wrote:
> From: Pawel Laszczak <pawell@...ence.com>
> 
> For DEV_VER_V3 version there exist race condition between clearing
> ep_sts.EP_STS_TRBERR and setting ep_cmd.EP_CMD_DRDY bit.
> Setting EP_CMD_DRDY will be ignored by controller when
> EP_STS_TRBERR is set. So, between these two instructions we have
> a small time gap in which the EP_STSS_TRBERR can be set. In such case
> the transfer will not start after setting doorbell.
> 
> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
> cc: <stable@...r.kernel.org> # 5.12.x
> Signed-off-by: Pawel Laszczak <pawell@...ence.com>
> ---

Reviewed-by: Aswath Govindraju <a-govindraju@...com>
Tested-by: Aswath Govindraju <a-govindraju@...com>

>  drivers/usb/cdns3/cdns3-gadget.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
> index 80aaab159e58..e9769fab21ea 100644
> --- a/drivers/usb/cdns3/cdns3-gadget.c
> +++ b/drivers/usb/cdns3/cdns3-gadget.c
> @@ -1100,6 +1100,19 @@ static int cdns3_ep_run_stream_transfer(struct cdns3_endpoint *priv_ep,
>  	return 0;
>  }
>  
> +static void cdns3_rearm_drdy_if_needed(struct cdns3_endpoint *priv_ep)
> +{
> +	struct cdns3_device *priv_dev = priv_ep->cdns3_dev;
> +
> +	if (priv_dev->dev_ver < DEV_VER_V3)
> +		return;
> +
> +	if (readl(&priv_dev->regs->ep_sts) & EP_STS_TRBERR) {
> +		writel(EP_STS_TRBERR, &priv_dev->regs->ep_sts);
> +		writel(EP_CMD_DRDY, &priv_dev->regs->ep_cmd);
> +	}
> +}
> +
>  /**
>   * cdns3_ep_run_transfer - start transfer on no-default endpoint hardware
>   * @priv_ep: endpoint object
> @@ -1351,6 +1364,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
>  		/*clearing TRBERR and EP_STS_DESCMIS before seting DRDY*/
>  		writel(EP_STS_TRBERR | EP_STS_DESCMIS, &priv_dev->regs->ep_sts);
>  		writel(EP_CMD_DRDY, &priv_dev->regs->ep_cmd);
> +		cdns3_rearm_drdy_if_needed(priv_ep);
>  		trace_cdns3_doorbell_epx(priv_ep->name,
>  					 readl(&priv_dev->regs->ep_traddr));
>  	}
>