linux-kernel - Re: [PATCH 2/3] xhci: Fix control transfer error on Etron xHCI host

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHN5xi1ZiOrZBUUAKmyJ5qtUUx5wLc3vyavQwA7k_Q47dN-WNg@mail.gmail.com>
Date: Thu, 12 Sep 2024 14:19:51 +0800
From: Kuangyi Chiang <ki.chiang65@...il.com>
To: Michał Pecio <michal.pecio@...il.com>
Cc: gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org, 
	linux-usb@...r.kernel.org, mathias.nyman@...el.com, stable@...r.kernel.org
Subject: Re: [PATCH 2/3] xhci: Fix control transfer error on Etron xHCI host

Hi,

Thank you for the review.

Michał Pecio <michal.pecio@...il.com> 於 2024年9月11日 週三 下午3:52寫道：
>
> Hi,
>
> > This happens when the xHCI driver enqueue a control TD (which cross
> > over the Link TRB between two ring segments, as shown) in the endpoint
> > zero's transfer ring. Seems the Etron xHCI host can not perform this
> > TD correctly, causing the USB transfer error occurred, maybe the upper
> > driver retry that control-IN request can solve problem, but not all
> > drivers do this.
> >
> > |     |
> > -------
> > | TRB | Setup Stage
> > -------
> > | TRB | Link
> > -------
> > -------
> > | TRB | Data Stage
> > -------
> > | TRB | Status Stage
> > -------
> > |     |
>
> I wonder about a few things.
>
> 1. What are the exact symptoms, besides Ethernet driver errors?
> Any errors from xhci_hcd? What if dynamic debug is enabled?

The xhci driver receives a transfer event TRB (completion code is
"USB Transaction Error") when the issue is triggered.

>
> 2. How did you determine that this is the exact cause?

The issue is triggered every time when a Link TRB follows a Setup
Stage TRB.

>
> 3. Does it happen every time when a Link follows Setup, or only
> randomly and it takes lots of control transfers to trigger it?

Yes, it happens every time.

>
> 4. How is it even possible? As far as I see, Linux simply queues
> three TRBs for a control URB. There are 255 slots in a segemnt,
> so exactly 85 URBs should fit, and then back to the first slot.

The xhci driver also queues no data control transfers.

>
> Regards,
> Michal

Thanks,
Kuangyi Chiang