linux-kernel - RE: [PATCH] usb: gadget: uvc_video: unlock before submitting a request to ep

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 14 May 2024 07:04:50 +0000
From: "Pandey, Radhey Shyam" <radhey.shyam.pandey@....com>
To: Thinh Nguyen <Thinh.Nguyen@...opsys.com>, Kuen-Han Tsai
	<khtsai@...gle.com>, "gregkh@...uxfoundation.org"
	<gregkh@...uxfoundation.org>
CC: Dan Scally <dan.scally@...asonboard.com>,
	"laurent.pinchart@...asonboard.com" <laurent.pinchart@...asonboard.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>, "Simek, Michal"
	<michal.simek@....com>, "'Mehta, Piyush'" <piyush.mehta@....com>, "Paladugu,
 Siva Durga Prasad" <siva.durga.prasad.paladugu@....com>, "Sayyed, Mubin"
	<mubin.sayyed@....com>
Subject: RE: [PATCH] usb: gadget: uvc_video: unlock before submitting a
 request to ep

> -----Original Message-----
> From: Pandey, Radhey Shyam
> Sent: Monday, January 29, 2024 3:38 PM
> To: Thinh Nguyen <Thinh.Nguyen@...opsys.com>
> Cc: Dan Scally <dan.scally@...asonboard.com>; Kuen-Han Tsai
> <khtsai@...gle.com>; gregkh@...uxfoundation.org;
> laurent.pinchart@...asonboard.com; linux-kernel@...r.kernel.org; linux-
> usb@...r.kernel.org; Simek, Michal <michal.simek@....com>; Mehta,
> Piyush <piyush.mehta@....com>; Paladugu, Siva Durga Prasad
> <siva.durga.prasad.paladugu@....com>; Sayyed, Mubin
> <mubin.sayyed@....com>
> Subject: RE: [PATCH] usb: gadget: uvc_video: unlock before submitting a
> request to ep
> 
> > -----Original Message-----
> > From: Thinh Nguyen <Thinh.Nguyen@...opsys.com>
> > Sent: Friday, January 19, 2024 7:45 AM
> > To: Pandey, Radhey Shyam <radhey.shyam.pandey@....com>
> > Cc: Thinh Nguyen <Thinh.Nguyen@...opsys.com>; Dan Scally
> > <dan.scally@...asonboard.com>; Kuen-Han Tsai <khtsai@...gle.com>;
> > gregkh@...uxfoundation.org; laurent.pinchart@...asonboard.com; linux-
> > kernel@...r.kernel.org; linux-usb@...r.kernel.org; Simek, Michal
> > <michal.simek@....com>; Mehta, Piyush <piyush.mehta@....com>;
> > Paladugu, Siva Durga Prasad <siva.durga.prasad.paladugu@....com>
> > Subject: Re: [PATCH] usb: gadget: uvc_video: unlock before submitting
> > a request to ep
> >
> > Hi,
> >
> > On Wed, Jan 10, 2024, Pandey, Radhey Shyam wrote:
> > >
> > > Thanks, Thinh. I came across this thread and wanted to check if you
> > > have some fix ready?
> 
> I have added Mubin to this thread as he is working on validating below fix.

Thinh:  Unfortunately, i am not able to replicate failure behaviour and 
validate the below fix. Tested webcam gadget taking stream from vivid 
and then frame capture on host using yavta. 

@Kuen-Han Tsai: Do you have failure environment to replicate the hang? 

> 
> >
> > Would you mind test this change to see if it fixes the issue:
> >
> > diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> > index 8d1881adcd80..f40c7b9105cc 100644
> > --- a/drivers/usb/dwc3/gadget.c
> > +++ b/drivers/usb/dwc3/gadget.c
> > @@ -1808,6 +1808,7 @@ static int dwc3_prepare_trbs(struct dwc3_ep
> *dep)
> >  	return ret;
> >  }
> >
> > +static void dwc3_gadget_ep_skip_trbs(struct dwc3_ep *dep, struct
> > +dwc3_request *req);
> >  static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep
> > *dep);  static void dwc3_gadget_restore_requests(struct dwc3_ep *dep);
> >
> > @@ -1874,9 +1875,27 @@ static int __dwc3_gadget_kick_transfer(struct
> > dwc3_ep *dep)
> >  		list_for_each_entry_safe(req, tmp, &dep->started_list, list)
> >  			dwc3_gadget_move_cancelled_request(req,
> > DWC3_REQUEST_STATUS_DEQUEUED);
> >
> > -		/* If ep isn't started, then there's no end transfer pending */
> > -		if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING))
> > -			dwc3_gadget_ep_cleanup_cancelled_requests(dep);
> > +		if ((dep->flags & DWC3_EP_DELAY_START) ||
> > +		    (dep->flags & DWC3_EP_WAIT_TRANSFER_COMPLETE) ||
> > +		    (dep->flags & DWC3_EP_TRANSFER_STARTED)) {
> > +			/* If ep isn't started, then there's no end transfer
> > pending */
> > +			if (!(dep->flags &
> > DWC3_EP_END_TRANSFER_PENDING))
> > +
> > 	dwc3_gadget_ep_cleanup_cancelled_requests(dep);
> > +		} else {
> > +			/*
> > +			 * To be in this condition means usb_ep_queue() isn't
> > +			 * completed yet. Since the controller hasn't owned
> > the
> > +			 * requests yet, don't give back the requests on failed
> > +			 * usb_ep_queue. Simply remove them from the
> > endpoint's
> > +			 * list.
> > +			 */
> > +			while (!list_empty(&dep->cancelled_list)) {
> > +				req = next_request(&dep->cancelled_list);
> > +				dwc3_gadget_ep_skip_trbs(dep, req);
> > +				dwc3_gadget_del_and_unmap_request(dep,
> > req, -EINPROGRESS);
> > +				req->status =
> > DWC3_REQUEST_STATUS_COMPLETED;
> > +			}
> > +		}
> >
> >  		return ret;
> >  	}
> >
> > BTW, what was the error code returned from usb_ep_queue()? Is it -
> > ETIMEDOUT?
> >
> > Thanks,
> > Thinh