From patchwork Thu Jun 1 21:27:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Elson Roy Serrao X-Patchwork-Id: 688159 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ECAFCC77B7E for ; Thu, 1 Jun 2023 21:27:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232161AbjFAV1v (ORCPT ); Thu, 1 Jun 2023 17:27:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48220 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230397AbjFAV1u (ORCPT ); Thu, 1 Jun 2023 17:27:50 -0400 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0464AE41; Thu, 1 Jun 2023 14:27:42 -0700 (PDT) Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 351L7bwa005951; Thu, 1 Jun 2023 21:27:40 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h=from : to : cc : subject : date : message-id; s=qcppdkim1; bh=FH0heBzwXcDeikXqMc1Y0eyAdfHDDH5YInxRnWMNIH4=; b=nfHAX+wJcFG8CReq+wLgWaq+uX59FJFWMyCzo0KhLC3AgTUAQ0Dr2TWLxOpQGyDafqjG eWgzUfsxIyuzKVQQ1k1Tq5pbea+ySAdroML+CrCWkIqsz4nrBMPfd6FxkUsqq2mLm6FX 7VaXeYNF3KQL7bHKvakhqve0BO6mr0ZhnbPkbvHBPR14fWlQ37Vw6FPN8hcr1xTEd3ih k4xtdsJ40SKMFvGul3sseEgX4S/KgVP0DwXKoFhDMeFgGyg+P9z3nH3x6pdSlicToKjs 2zv7eYNfz6aCoE2DOuxHNrC+lo/FKugC+wx++oU5lLf4uzr6KKo9nKm9zaVCyAg64MUA Xg== Received: from nalasppmta03.qualcomm.com (Global_NAT1.qualcomm.com [129.46.96.20]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 3qxugrs63u-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 01 Jun 2023 21:27:40 +0000 Received: from pps.filterd (NALASPPMTA03.qualcomm.com [127.0.0.1]) by NALASPPMTA03.qualcomm.com (8.17.1.5/8.17.1.5) with ESMTP id 351LRdwi028142; Thu, 1 Jun 2023 21:27:39 GMT Received: from pps.reinject (localhost [127.0.0.1]) by NALASPPMTA03.qualcomm.com (PPS) with ESMTP id 3qwp5n628a-1; Thu, 01 Jun 2023 21:27:39 +0000 Received: from NALASPPMTA03.qualcomm.com (NALASPPMTA03.qualcomm.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 351LRdW7028137; Thu, 1 Jun 2023 21:27:39 GMT Received: from hu-devc-lv-c.qualcomm.com (hu-eserrao-lv.qualcomm.com [10.47.235.164]) by NALASPPMTA03.qualcomm.com (PPS) with ESMTP id 351LRdfB028136; Thu, 01 Jun 2023 21:27:39 +0000 Received: by hu-devc-lv-c.qualcomm.com (Postfix, from userid 464172) id 0C9B420DF9; Thu, 1 Jun 2023 14:27:39 -0700 (PDT) From: Elson Roy Serrao To: gregkh@linuxfoundation.org, Thinh.Nguyen@synopsys.com Cc: linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, quic_wcheng@quicinc.com, quic_jackp@quicinc.com, Elson Roy Serrao Subject: [PATCH v2] usb: dwc3: gadget: Reset num TRBs before giving back the request Date: Thu, 1 Jun 2023 14:27:30 -0700 Message-Id: <1685654850-8468-1-git-send-email-quic_eserrao@quicinc.com> X-Mailer: git-send-email 2.7.4 X-QCInternal: smtphost X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-ORIG-GUID: QqUwWJcthw28D-oHwrBuvWnOwts8ObWV X-Proofpoint-GUID: QqUwWJcthw28D-oHwrBuvWnOwts8ObWV X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.573,FMLib:17.11.176.26 definitions=2023-06-01_08,2023-05-31_03,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 mlxlogscore=856 lowpriorityscore=0 bulkscore=0 suspectscore=0 mlxscore=0 phishscore=0 spamscore=0 impostorscore=0 priorityscore=1501 clxscore=1015 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2304280000 definitions=main-2306010184 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Consider a scenario where cable disconnect happens when there is an active usb reqest queued to the UDC. As part of the disconnect we would issue an end transfer with no interrupt-on-completion before giving back this request. Since we are giving back the request without skipping TRBs the num_trbs field of dwc3_request still holds the stale value previously used. Function drivers re-use same request for a given bind-unbind session and hence their dwc3_request context gets preserved across cable disconnect/connect. When such a request gets re-queued after cable connect, we would increase the num_trbs field on top of the previous stale value thus incorrectly representing the number of TRBs used. Fix this by resetting num_trbs field before giving back the request. Fixes: 09fe1f8d7e2f ("usb: dwc3: gadget: track number of TRBs per request") Signed-off-by: Elson Roy Serrao --- Changes in v2: - Addressed Thinh's comment to reset num_trbs in dwc3_gadget_del_and_unmap_request rather than calling skip_trbs. - Modify the commit message to match the modification. drivers/usb/dwc3/gadget.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 578804d..0ded919 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -198,6 +198,7 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep, list_del(&req->list); req->remaining = 0; req->needs_extra_trb = false; + req->num_trbs = 0; if (req->request.status == -EINPROGRESS) req->request.status = status;