linux-kernel - Re: [PATCH v3] usb: dwc3: gadget: Fix TRB reclaim logic for short transfers and ZLPs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2025062818-existing-skies-6337@gregkh>
Date: Sat, 28 Jun 2025 17:19:29 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: SCHNEIDER Johannes <johannes.schneider@...ca-geosystems.com>
Cc: Thinh Nguyen <Thinh.Nguyen@...opsys.com>,
	Pengutronix Kernel Team <kernel@...gutronix.de>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	GEO-CHHER-bsp-development <bsp-development.geo@...ca-geosystems.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3] usb: dwc3: gadget: Fix TRB reclaim logic for short
 transfers and ZLPs

On Wed, Jun 25, 2025 at 07:49:16AM +0000, SCHNEIDER Johannes wrote:
> Commit 96c7bf8f6b3e ("usb: dwc3: gadget: Cleanup SG handling") updated
> the TRB reclaim path to use the TRB CHN (Chain) bit to determine whether
> a TRB was part of a chain. However, this inadvertently changed the
> behavior of reclaiming the final TRB in some scatter-gather or short
> transfer cases.
> 
> In particular, if the final TRB did not have the CHN bit set, the
> cleanup path could incorrectly skip clearing the HWO (Hardware Own)
> bit, leaving stale TRBs in the ring. This resulted in broken data
> transfer completions in userspace, notably for MTP over FunctionFS.
> 
> Fix this by unconditionally clearing the HWO bit during TRB reclaim,
> regardless of the CHN bit state. This restores correct behavior
> especially for transfers that require ZLPs or end on non-CHN TRBs.
> 
> Fixes 61440628a4ff ("usb: dwc3: gadget: Cleanup SG handling")

Forgot the ":" here :(

I've fixed it up...