linux-kernel - [PATCH 0/3] usb: dwc3: Fix TRB reclaim regression and clean up reclaim logic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250621-dwc3-fix-gadget-mtp-v1-0-a45e6def71bb@leica-geosystems.com>
Date: Sat, 21 Jun 2025 21:07:13 +0200
From: Johannes Schneider <johannes.schneider@...ca-geosystems.com>
To: Thinh Nguyen <Thinh.Nguyen@...opsys.com>, 
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Pengutronix Kernel Team <kernel@...gutronix.de>, 
 linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org, 
 bsp-development.geo@...ca-geosystems.com, 
 Johannes Schneider <johannes.schneider@...ca-geosystems.com>
Subject: [PATCH 0/3] usb: dwc3: Fix TRB reclaim regression and clean up
 reclaim logic

Hoi,

This patch series fixes a subtle regression introduced in the recent
scatter-gather cleanup for the DWC3 USB gadget driver, and follows up
with two clean-up patches to simplify and clarify related logic.

Background:

Commit 61440628a4ff ("usb: dwc3: gadget: Cleanup SG handling") removed
some redundant state tracking in the DWC3 gadget driver, including how
scatter-gather TRBs are reclaimed after use. However, the reclaim logic
began relying on the TRB CHN (chain) bit to determine whether TRBs
belonged to a chain — which led to missed TRB reclamation in some
cases.

This broke userspace-facing protocols like MTP (Media Transfer Protocol)
when used via FunctionFS, causing incomplete transfers due to skipped
zero-length packets (ZLPs) or improperly reclaimed short TRBs.

The "offending" chunk from 61440628a4ff:
80                 ret = dwc3_gadget_ep_reclaim_completed_trb(dep, req,
81 -                               trb, event, status, true);
82 +                               trb, event, status,
83 +                               !!(trb->ctrl & DWC3_TRB_CTRL_CHN));

Patch 1 fixes the issue by ensuring the HWO bit is always cleared
on reclaimed TRBs, regardless of the CHN bit.

Patches 2 and 3 follow up with simplifications:
- Patch 2 removes the now-redundant `chain` argument to the reclaim function
- Patch 3 simplifies the logic in `dwc3_needs_extra_trb()` to make the conditions easier to read and maintain

All three patches have been tested on a imx8mp based hardware, with
userspace MTP (viveris/uMTP-Responder) over FunctionFS and resolve the
regression while preserving the recent cleanup work.

Signed-off-by: Johannes Schneider <johannes.schneider@...ca-geosystems.com>
---
Johannes Schneider (3):
      usb: dwc3: gadget: Fix TRB reclaim logic for short transfers and ZLPs
      usb: dwc3: gadget: Simplify TRB reclaim logic by removing redundant 'chain' argument
      usb: dwc3: gadget: Simplify logic in dwc3_needs_extra_trb()

 drivers/usb/dwc3/gadget.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)
---
base-commit: d0c22de9995b624f563bc5004d44ac2655712a56
change-id: 20250621-dwc3-fix-gadget-mtp-3c09a6ab84c6

Best regards,
-- 
Johannes Schneider <johannes.schneider@...ca-geosystems.com>