linux-kernel - Re: [PATCH] usb: dwc3: Potential fix of possible dwc3 interrupt storm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1aa3c54a-7dcf-4cc4-9b05-96c67dda4fdb@samsung.com>
Date: Mon, 16 Sep 2024 18:13:31 +0530
From: Selvarasu Ganesan <selvarasu.g@...sung.com>
To: Thinh Nguyen <Thinh.Nguyen@...opsys.com>
Cc: "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"jh0801.jung@...sung.com" <jh0801.jung@...sung.com>, "dh10.jung@...sung.com"
	<dh10.jung@...sung.com>, "naushad@...sung.com" <naushad@...sung.com>,
	"akash.m5@...sung.com" <akash.m5@...sung.com>, "rc93.raju@...sung.com"
	<rc93.raju@...sung.com>, "taehyun.cho@...sung.com"
	<taehyun.cho@...sung.com>, "hongpooh.kim@...sung.com"
	<hongpooh.kim@...sung.com>, "eomji.oh@...sung.com" <eomji.oh@...sung.com>,
	"shijie.cai@...sung.com" <shijie.cai@...sung.com>
Subject: Re: [PATCH] usb: dwc3: Potential fix of possible dwc3 interrupt
 storm


On 9/13/2024 11:30 PM, Thinh Nguyen wrote:
> On Fri, Sep 13, 2024, Thinh Nguyen wrote:
>> On Fri, Sep 13, 2024, Selvarasu Ganesan wrote:
>>> Hi Thinh,
>>>
>>> So far, there have been no reported error instances. But, we suspecting
>>> that the issue may be related to our glue driver. In our glue driver, we
>>> access the reference of evt->flags when starting or stopping the gadget
>>> based on a VBUS notification. We apologize for sharing this information
>>> so late, as we only became aware of it recently.
>>>
>>> The following sequence outlines the possible scenarios of race conditions:
>>>
>>> Thread#1 (Our glue Driver Sequence)
>>> ===================================
>>> ->USB VBUS notification
>>> ->Start/Stop gadget
>>> ->dwc->ev_buf->flags |= BIT(20); (It's for our reference)
>>> ->Call dwc3 exynos runtime suspend/resume
>>> ->dwc->ev_buf->flags &= ~BIT(20);
>>> ->Call dwc3 core runtime suspend/resume
>>>
>>> Thread#2
>>> ========
>>> ->dwc3_interrupt()
>>> ->evt->flags |= DWC3_EVENT_PENDING;
>>> ->dwc3_thread_interrupt()
>>> ->evt->flags &= ~DWC3_EVENT_PENDING;
>>>
>> This is great! That's likely the problem. Glad you found it.
>>
>>>
>>> After our internal discussions, we have decided to remove the
>>> unnecessary access to evt->flag in our glue driver. We have made these
>>> changes and initiated testing.
>>>
>>> Thank you for your help so far to understand more into our glue driver code.
>>>
>>> And We are thinking that it would be fine to reset evt->flag when the
>>> USB controller is started, along with the changes you suggested earlier.
>>> This additional measure will help prevent similar issues from occurring
>>> in the future.
>>>
>>> Please let us know your thoughts on this proposal. If it is not
>>> necessary, we understand and will proceed accordingly.
>>>
>> You can submit the change I suggested. That's a valid change. However,
>> we should not include the reset of the DWC3_EVENT_PENDING flag. Had we
>> done this, you may not found the issue above. It serves no purpose for
>> the core driver logic and will be an extra burden for us to maintain. (I
>> don't want to scratch my head in the future to figure out why that
>> change was needed or concern whether it can be removed without causing
>> regression).
>>
> Also, perhaps you may want to revisit and review the change below to see
> if the glue driver may be the culprit:
>
> 14e497183df2 ("usb: dwc3: core: Prevent USB core invalid event buffer address access")

Hi Thinh,

We reconfirmed that this issue not due to our glue driver.


Thanks,
Selva
> Thanks,
> Thinh