linux-kernel - Re: [PATCH v2 0/2] usb: dwc3: Fix TRB reclaim regression and clean up reclaim logic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <AM8PR06MB7521B4FD884B6DBAA33F5B47BC78A@AM8PR06MB7521.eurprd06.prod.outlook.com>
Date: Tue, 24 Jun 2025 11:12:46 +0000
From: SCHNEIDER Johannes <johannes.schneider@...ca-geosystems.com>
To: Thinh Nguyen <Thinh.Nguyen@...opsys.com>, Greg Kroah-Hartman
	<gregkh@...uxfoundation.org>
CC: Pengutronix Kernel Team <kernel@...gutronix.de>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	GEO-CHHER-bsp-development <bsp-development.geo@...ca-geosystems.com>
Subject: Re: [PATCH v2 0/2] usb: dwc3: Fix TRB reclaim regression and clean up
 reclaim logic

Hoi,

> This patch series fixes a subtle regression introduced in the recent
> scatter-gather cleanup for the DWC3 USB gadget driver, and follows up
> with two clean-up patches to simplify and clarify related logic.
>
> Background:
>
> Commit 61440628a4ff ("usb: dwc3: gadget: Cleanup SG handling") removed
> some redundant state tracking in the DWC3 gadget driver, including how
> scatter-gather TRBs are reclaimed after use. However, the reclaim logic
> began relying on the TRB CHN (chain) bit to determine whether TRBs
> belonged to a chain — which led to missed TRB reclamation in some
> cases.
>
> This broke userspace-facing protocols like MTP (Media Transfer Protocol)
> when used via FunctionFS, causing incomplete transfers due to skipped
> zero-length packets (ZLPs) or improperly reclaimed short TRBs.
>
> The "offending" chunk from 61440628a4ff:
> 80                 ret = dwc3_gadget_ep_reclaim_completed_trb(dep, req,
> 81 -                               trb, event, status, true);
> 82 +                               trb, event, status,
> 83 +                               !!(trb->ctrl & DWC3_TRB_CTRL_CHN));
>
> Patch 1 fixes the issue by ensuring the HWO bit is always cleared
> on reclaimed TRBs, regardless of the CHN bit.
>
> Patches 2 and 3 follow up with simplifications:
> - Patch 2 removes the now-redundant `chain` argument to the reclaim function
> - Patch 3 simplifies the logic in `dwc3_needs_extra_trb()` to make the conditions easier to read and maintain
>
> All three patches have been tested on a imx8mp based hardware, with
> userspace MTP (viveris/uMTP-Responder) over FunctionFS and resolve the
> regression while preserving the recent cleanup work.
>
> Signed-off-by: Johannes Schneider <johannes.schneider@...ca-geosystems.com>
> ---
> Changes in v2:
> - dropped Patch 3, as it did change the logic
> - CC to stable
> - Link to v1: https://lore.kernel.org/r/20250621-dwc3-fix-gadget-mtp-v1-0-a45e6def71bb@leica-geosystems.com
>

please disregard v2 - a colleague (and the kernel test robot) pointed out to me that this is not the way :-)
-> i'll split the patch-stack and send them separately to mainline and stable as suggested

sorry for the chatter
Gruß
Johannes

>
> ---
> Johannes Schneider (2):
>       usb: dwc3: gadget: Fix TRB reclaim logic for short transfers and ZLPs
>       usb: dwc3: gadget: Simplify TRB reclaim logic by removing redundant 'chain' argument
>
>  drivers/usb/dwc3/gadget.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> ---
> base-commit: d0c22de9995b624f563bc5004d44ac2655712a56
> change-id: 20250621-dwc3-fix-gadget-mtp-3c09a6ab84c6
>
> Best regards,
> --
> Johannes Schneider <johannes.schneider@...ca-geosystems.com>
>