linux-kernel - Re: [PATCH v2] usb: dwc3: Wait unconditionally after issuing EndXfer command

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2024043022-chatroom-backwash-371e@gregkh>
Date: Tue, 30 Apr 2024 18:06:41 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Thinh Nguyen <Thinh.Nguyen@...opsys.com>
Cc: Prashanth K <quic_prashk@...cinc.com>,
	Wesley Cheng <quic_wcheng@...cinc.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: Re: [PATCH v2] usb: dwc3: Wait unconditionally after issuing EndXfer
 command

On Thu, Apr 25, 2024 at 11:22:08PM +0000, Thinh Nguyen wrote:
> On Thu, Apr 25, 2024, Prashanth K wrote:
> > Currently all controller IP/revisions except DWC3_usb3 >= 310a
> > wait 1ms unconditionally for ENDXFER completion when IOC is not
> > set. This is because DWC_usb3 controller revisions >= 3.10a
> > supports GUCTL2[14: Rst_actbitlater] bit which allows polling
> > CMDACT bit to know whether ENDXFER command is completed.
> > 
> > Consider a case where an IN request was queued, and parallelly
> > soft_disconnect was called (due to ffs_epfile_release). This
> > eventually calls stop_active_transfer with IOC cleared, hence
> > send_gadget_ep_cmd() skips waiting for CMDACT cleared during
> > EndXfer. For DWC3 controllers with revisions >= 310a, we don't
> > forcefully wait for 1ms either, and we proceed by unmapping the
> > requests. If ENDXFER didn't complete by this time, it leads to
> > SMMU faults since the controller would still be accessing those
> > requests.
> > 
> > Fix this by ensuring ENDXFER completion by adding 1ms delay in
> > __dwc3_stop_active_transfer() unconditionally.
> > 
> > Cc: <stable@...r.kernel.org>
> > Fixes: b353eb6dc285 ("usb: dwc3: gadget: Skip waiting for CMDACT cleared during endxfer")
> > Signed-off-by: Prashanth K <quic_prashk@...cinc.com>
> > ---
> > Changes in v2:
> > Changed the patch logic from CMDACT polling to 1ms mdelay.
> > Updated subject and commit accordingly.
> > Link to v1: https://urldefense.com/v3/__https://lore.kernel.org/all/20240422090539.3986723-1-quic_prashk@quicinc.com/__;!!A4F2R9G_pg!fa3zoJhmfdChG32lHtAa-7bxJpxPsw2wgzQwQAq9gWG2LwWyr9WnIzm9Eol6hmiKLEOTJuqjOeTYVYZ_sNnER6p_uF4$ 
> > 
> >  drivers/usb/dwc3/gadget.c | 3 +--
> >  1 file changed, 1 insertion(+), 2 deletions(-)
> > 
> > diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> > index 4df2661f6675..666eae94524f 100644
> > --- a/drivers/usb/dwc3/gadget.c
> > +++ b/drivers/usb/dwc3/gadget.c
> > @@ -1724,8 +1724,7 @@ static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool int
> >  	dep->resource_index = 0;
> >  
> >  	if (!interrupt) {
> > -		if (!DWC3_IP_IS(DWC3) || DWC3_VER_IS_PRIOR(DWC3, 310A))
> > -			mdelay(1);
> > +		mdelay(1);
> >  		dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
> >  	} else if (!ret) {
> >  		dep->flags |= DWC3_EP_END_TRANSFER_PENDING;
> > -- 
> > 2.25.1
> > 
> 
> Acked-by: Thinh Nguyen <Thinh.Nguyen@...opsys.com>

This patch breaks the build on my systems:

  CC [M]  drivers/usb/dwc3/gadget.o
drivers/usb/dwc3/gadget.c: In function ‘__dwc3_stop_active_transfer’:
drivers/usb/dwc3/gadget.c:1702:22: error: unused variable ‘dwc’ [-Werror=unused-variable]
 1702 |         struct dwc3 *dwc = dep->dwc;
      |                      ^~~
cc1: all warnings being treated as errors

so I can't take it :(