linux-kernel - Re: [RFC PATCH] usb: dwc3: Ignore late xferNotReady event to prevent halt timeout

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250804182220.mho2qjdtmvdkicec@synopsys.com>
Date: Mon, 4 Aug 2025 18:22:27 +0000
From: Thinh Nguyen <Thinh.Nguyen@...opsys.com>
To: Kuen-Han Tsai <khtsai@...gle.com>
CC: Thinh Nguyen <Thinh.Nguyen@...opsys.com>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [RFC PATCH] usb: dwc3: Ignore late xferNotReady event to prevent
 halt timeout

Hi,

On Mon, Aug 04, 2025, Kuen-Han Tsai wrote:
> During a device-initiated disconnect, an xferNotReady event for an ISOC
> IN endpoint can be received after the End Transfer command has already
> completed.

Some more info for clarity: the controller generates xferNotReady event
once when the host requests to send/receive data to an endpoint. The End
Transfer command resets the event filter and allow the controller to
generate the xferNotReady event again. This can occur in the middle of
device-initiated disconnect and before the controller is halted.

> 
> This late event incorrectly triggers a new Start Transfer, which
> prevents the controller from halting and results in a DSTS.DEVCTRLHLT
> bit polling timeout.
> 
> Ignore the late xferNotReady event if the controller is already in a
> disconnected state.
> 
> Signed-off-by: Kuen-Han Tsai <khtsai@...gle.com>

Please also add Fixes tag and Cc stable.

> ---
> Tracing:
> 
> # Stop active transfers by sending End Transfer commands
>  android.hardwar-913     [004] d..1.  6172.855517: dwc3_gadget_ep_cmd: ep1out: cmd 'End Transfer' [20d08] params 00000000 00000000 00000000 --> status: Successful
>  android.hardwar-913     [004] dn.1.  6172.855734: dwc3_gadget_ep_cmd: ep1in: cmd 'End Transfer' [40d08] params 00000000 00000000 00000000 --> status: Successful
>  ...
> # Recieve an xferNotReady event on an ISOC IN endpoint
>     irq/991-dwc3-29741   [000] D..1.  6172.856166: dwc3_event: event (35d010c6): ep1in: Transfer Not Ready [000035d0] (Not Active)
>     irq/991-dwc3-29741   [000] D..1.  6172.856190: dwc3_gadget_ep_cmd: ep1in: cmd 'Start Transfer' [35d60406] params 00000000 ffffb620 00000000 --> status: Successful
>  android.hardwar-913     [004] dn.1.  6172.868130: dwc3_gadget_ep_cmd: ep2in: cmd 'End Transfer' [30d08] params 00000000 00000000 00000000 --> status: Timed Out
>  ...
> # Start polling DSTS.DEVCTRLHLT
>  android.hardwar-913     [000] .....  6172.869253: dwc3_gadget_run_stop: start polling DWC3_DSTS_DEVCTRLHLT
>  ...
> # HALT timeout and show the endpoint status for debugging
>  android.hardwar-913     [004] .....  6177.479946: dwc3_gadget_run_stop: finish polling DWC3_DSTS_DEVCTRLHLT, is_on=0, reg=0
>  android.hardwar-913     [004] .....  6177.479957: dwc3_gadget_ep_status: ep1out: mps 1024/2765 streams 16 burst 5 ring 64/56 flags E:swbp:>
>  android.hardwar-913     [004] .....  6177.479958: dwc3_gadget_ep_status: ep1in: mps 1024/1024 streams 16 burst 2 ring 21/64 flags E:swBp:<
>  android.hardwar-913     [004] .....  6177.479959: dwc3_gadget_ep_status: ep2out: mps 1024/2765 streams 16 burst 5 ring 56/48 flags e:swbp:>
> 
> ---
>  drivers/usb/dwc3/gadget.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index 25db36c63951..506391699a10 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -3896,7 +3896,8 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
>  		dwc3_gadget_endpoint_transfer_in_progress(dep, event);
>  		break;
>  	case DWC3_DEPEVT_XFERNOTREADY:
> -		dwc3_gadget_endpoint_transfer_not_ready(dep, event);
> +		if (dwc->connected)

Move this check in dwc3_gadget_endpoint_transfer_not_ready().

> +			dwc3_gadget_endpoint_transfer_not_ready(dep, event);
>  		break;
>  	case DWC3_DEPEVT_EPCMDCMPLT:
>  		dwc3_gadget_endpoint_command_complete(dep, event);
> --
> 2.50.1.565.gc32cd1483b-goog
> 

And remove the RFC tag in $subject.

Thanks,
Thinh