From patchwork Tue Oct 25 01:27:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thinh Nguyen X-Patchwork-Id: 13018412 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8885EC38A2D for ; Tue, 25 Oct 2022 01:44:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230300AbiJYBoK (ORCPT ); Mon, 24 Oct 2022 21:44:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44270 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230438AbiJYBnu (ORCPT ); Mon, 24 Oct 2022 21:43:50 -0400 Received: from mx0b-00230701.pphosted.com (mx0b-00230701.pphosted.com [148.163.158.9]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5CD975927A; Mon, 24 Oct 2022 18:28:12 -0700 (PDT) Received: from pps.filterd (m0098572.ppops.net [127.0.0.1]) by mx0b-00230701.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 29OLNx5i007175; Mon, 24 Oct 2022 18:28:00 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=synopsys.com; h=date : message-id : in-reply-to : references : from : subject : to : cc; s=pfptdkimsnps; bh=uYUGAVAa1Q97ISEtrVzAlQ5It6B9/TBGz8KCxuZyLj4=; b=fA/GTWMHO4AfAE2m5rr/4zJo7+cwECURbYfHN8KOF0U8b0jgiQpohUoQOU9inyITL0kp MPvBmpArWT582OKUpEk3xInv76Yu8IFjkMDZBPCf16bX5nxnxV8rQRDnU55oLoJZpl76 i38QLizwSQtM8VUPCB+RyMIvoiWeFa/LTynNiMXa7Qm0DiMFBxhtjLz1Bs/LTrPnrl+5 wn1DiiaEJbi5AaxXG78bNjHTYLMluZ8b7xIAIPevXB9AVsGu3TH7PzcaZ8lh1eAaUOWv 9ToL08YCsiTZeGlIF+N7clTLTmFFMthkVUG/69PVn90J8sjd9IG3DN3V3VpLtZ38tOKr bQ== Received: from smtprelay-out1.synopsys.com (smtprelay-out1.synopsys.com [149.117.87.133]) by mx0b-00230701.pphosted.com (PPS) with ESMTPS id 3kcf5gbp4g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Oct 2022 18:28:00 -0700 Received: from mailhost.synopsys.com (sv2-mailhost2.synopsys.com [10.205.2.134]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (Client CN "mailhost.synopsys.com", Issuer "SNPSica2" (verified OK)) by smtprelay-out1.synopsys.com (Postfix) with ESMTPS id 89453C00F4; Tue, 25 Oct 2022 01:27:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=synopsys.com; s=mail; t=1666661279; bh=DIoEktsoB9CAMG7gYxfrV0/WknKZPtxZ+gnVC0x+7Gs=; h=Date:In-Reply-To:References:From:Subject:To:Cc:From; b=kkNAYFGoWZTh8I3n+vTErXBYpPO+Q7cD9GH8Jjdaj2V9gILXUOHndLrrc28xZh4A3 oRZ0W7B4CBaWbYVnxLrQHCMeZfIUj5zVJtsnYsg/wkgq5MqUa/IQjw22klcVP/qCRq 4eMHi0uA4kng8vORwFSlp0dBPFhPAJO6tYzEBVLAzYKhT5Rmdj4QJel4+AYAUvBmWq ZosNULxUUE7N8Mr7w+1l6+7CRlyGbkGU+SGQNqqgOu8VwpGQWT8y6l2Z0uYNmgjS5I 7bQBO3+0N/yvuJxDyJex1x0828GtUpmbDRdVa9Ga5loZnjuWlHWYqe7kC4lBDKJMil dQ2iyui7Wwb6w== Received: from te-lab16-v2 (nanobot.internal.synopsys.com [10.204.48.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by mailhost.synopsys.com (Postfix) with ESMTPSA id 2ADBFA00AF; Tue, 25 Oct 2022 01:27:57 +0000 (UTC) Received: by te-lab16-v2 (sSMTP sendmail emulation); Mon, 24 Oct 2022 18:27:57 -0700 Date: Mon, 24 Oct 2022 18:27:57 -0700 Message-Id: <699a342b618611be834b06d9d64abae7d01486cd.1666661013.git.Thinh.Nguyen@synopsys.com> In-Reply-To: References: X-SNPS-Relay: synopsys.com From: Thinh Nguyen Subject: [PATCH v2 1/2] usb: dwc3: gadget: Stop processing more requests on IMI To: Felipe Balbi , Greg Kroah-Hartman , Thinh Nguyen , linux-usb@vger.kernel.org Cc: John Youn , stable@vger.kernel.org, Jeff Vanhoof , Dan Vacura X-Proofpoint-ORIG-GUID: KG1nHHNMpO7k3_znj41QVbPRssSuUmdY X-Proofpoint-GUID: KG1nHHNMpO7k3_znj41QVbPRssSuUmdY X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-10-24_09,2022-10-21_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_active_cloned_notspam policy=outbound_active_cloned score=0 mlxlogscore=716 lowpriorityscore=0 phishscore=0 malwarescore=0 clxscore=1015 impostorscore=0 bulkscore=0 spamscore=0 adultscore=0 mlxscore=0 priorityscore=1501 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000 definitions=main-2210250006 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org When servicing a transfer completion event, the dwc3 driver will reclaim TRBs of started requests up to the request associated with the interrupt event. Currently we don't check for interrupt due to missed isoc, and the driver may attempt to reclaim TRBs beyond the associated event. This causes invalid memory access when the hardware still owns the TRB. If there's a missed isoc TRB with IMI (interrupt on missed isoc), make sure to stop servicing further. Note that only the last TRB of chained TRBs has its status updated with missed isoc. Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") Cc: stable@vger.kernel.org Reported-by: Jeff Vanhoof Reported-by: Dan Vacura Signed-off-by: Thinh Nguyen Reviewed-by: Jeff Vanhoof Tested-by: Jeff Vanhoof --- Changes in v2: - No need to check for CHN=0 since only the last TRB has its status updated to missed isoc drivers/usb/dwc3/gadget.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index dd8ecbe61bec..230b3c660054 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -3248,6 +3248,10 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep, if (event->status & DEPEVT_STATUS_SHORT && !chain) return 1; + if ((trb->ctrl & DWC3_TRB_CTRL_ISP_IMI) && + DWC3_TRB_SIZE_TRBSTS(trb->size) == DWC3_TRBSTS_MISSED_ISOC) + return 1; + if ((trb->ctrl & DWC3_TRB_CTRL_IOC) || (trb->ctrl & DWC3_TRB_CTRL_LST)) return 1; From patchwork Tue Oct 25 01:28:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thinh Nguyen X-Patchwork-Id: 13018414 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2468C38A2D for ; Tue, 25 Oct 2022 01:44:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231635AbiJYBoN (ORCPT ); Mon, 24 Oct 2022 21:44:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42198 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231625AbiJYBnv (ORCPT ); Mon, 24 Oct 2022 21:43:51 -0400 Received: from mx0a-00230701.pphosted.com (mx0a-00230701.pphosted.com [148.163.156.19]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2BD135A83B; Mon, 24 Oct 2022 18:28:14 -0700 (PDT) Received: from pps.filterd (m0098571.ppops.net [127.0.0.1]) by mx0a-00230701.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 29OLNnHF020951; Mon, 24 Oct 2022 18:28:07 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=synopsys.com; h=date : message-id : in-reply-to : references : from : subject : to : cc; s=pfptdkimsnps; bh=j8u7odBZ81mHIRZo/nAx2BOvHTuFJvY2SBxLiVE7XW8=; b=g2djoElJlr2d635rDaxqamCOxBkKnJGFu+eLVDCALgsXZDpqeYebIJTXgpgygQ5ct3lA UIMoC0ugzgJThANzZNhDRShdO5vUTYJNpo5rc4XlXkXzWrhWW+Mji7iYi0zzPo6VO5O3 uiKVZP1DkBCq2Hqpl2LeUc/cm8/EK9sHaPqSeOBU/MYQ9z+tL8xt1J8K1QvVXbRKhVT/ lX99fcU1zm9SUwW5EHhaPqgGTMDC9bfKRem2jKoTzUoZ4SUsG3WZKSaQdvpX9MAL+57F tE28VNuEVfem01f7DgEwH/9S/0ZSRh+TCQdfRZfyTnWR/6lQYa5ZmY2zccWy6yKlP8hW ig== Received: from smtprelay-out1.synopsys.com (smtprelay-out1.synopsys.com [149.117.73.133]) by mx0a-00230701.pphosted.com (PPS) with ESMTPS id 3kcfhp3nx9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Oct 2022 18:28:07 -0700 Received: from mailhost.synopsys.com (sv1-mailhost2.synopsys.com [10.205.2.132]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (Client CN "mailhost.synopsys.com", Issuer "SNPSica2" (verified OK)) by smtprelay-out1.synopsys.com (Postfix) with ESMTPS id 1A1E24014E; Tue, 25 Oct 2022 01:28:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=synopsys.com; s=mail; t=1666661286; bh=7+buHRxrH15h1LLhl9qL95HI2i43zo5YDGWA6OAiTaw=; h=Date:In-Reply-To:References:From:Subject:To:Cc:From; b=HXITD/Jxu8NQ+daO8CGFXMgYzvy8C/QqSbQkjKw/FetR+uPnCNX7ydyvDE4AjWHDF 3bI4qBQLQruMLNRmaGvXUXYImD1L1RklDVNFlMKYaiZ9BMxVdExNqcpU2IPfkGHRNp sNqSPM4RTap9nVp4meQyY1IJKSMrj2yAlU+aaXeWWVPM/H+zlTHDBXl8u7+Dyn+oi7 b5tlH1oC88X/H24YL4hhzmowAIOBKPBgF6GSfFc80Ofw+cUNpj5yC7kcIstlxQpemm 89nt1j3VfomsAq9lMbJGO73ul/maJHbX94ACpzUslJR8tqUvqGun+D9NyOQyZypyFz Ow9+h3a22HXGA== Received: from te-lab16-v2 (nanobot.internal.synopsys.com [10.204.48.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by mailhost.synopsys.com (Postfix) with ESMTPSA id A0F2CA007F; Tue, 25 Oct 2022 01:28:04 +0000 (UTC) Received: by te-lab16-v2 (sSMTP sendmail emulation); Mon, 24 Oct 2022 18:28:04 -0700 Date: Mon, 24 Oct 2022 18:28:04 -0700 Message-Id: <453f4dc3189eb855e31768d5caa6bfc7f4bf5074.1666661013.git.Thinh.Nguyen@synopsys.com> In-Reply-To: References: X-SNPS-Relay: synopsys.com From: Thinh Nguyen Subject: [PATCH v2 2/2] usb: dwc3: gadget: Don't set IMI for no_interrupt To: Felipe Balbi , Greg Kroah-Hartman , Thinh Nguyen , linux-usb@vger.kernel.org Cc: John Youn , stable@vger.kernel.org, Jeff Vanhoof , Dan Vacura X-Proofpoint-GUID: vmE0e8uHF1a0MSEG2IkviMt6huOWc_kJ X-Proofpoint-ORIG-GUID: vmE0e8uHF1a0MSEG2IkviMt6huOWc_kJ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-10-24_09,2022-10-21_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_active_cloned_notspam policy=outbound_active_cloned score=0 mlxlogscore=655 malwarescore=0 clxscore=1015 impostorscore=0 adultscore=0 mlxscore=0 lowpriorityscore=0 suspectscore=0 phishscore=0 priorityscore=1501 spamscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000 definitions=main-2210250007 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The gadget driver may have a certain expectation of how the request completion flow should be from to its configuration. Make sure the controller driver respect that. That is, don't set IMI (Interrupt on Missed Isoc) when usb_request->no_interrupt is set. Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") Cc: stable@vger.kernel.org Signed-off-by: Thinh Nguyen Reviewed-by: Jeff Vanhoof Tested-by: Jeff Vanhoof --- Changes in v2: - None drivers/usb/dwc3/gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 230b3c660054..702bdf42ad2f 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -1292,8 +1292,8 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep, trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS; } - /* always enable Interrupt on Missed ISOC */ - trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; + if (!req->request.no_interrupt) + trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; break; case USB_ENDPOINT_XFER_BULK: