Hi,

Greg Kroah-Hartman wrote:

On Sat, Dec 14, 2019 at 03:01:40AM +0000, Thinh Nguyen wrote:

...

Hi Greg and Felipe,

Thinh Nguyen wrote:

...

We can only check for IN direction if the request had completed. For OUT direction, it's perfectly fine that the host can send less than the setup length. Let's return true fall all cases of OUT direction.

Fixes: e0c42ce590fe ("usb: dwc3: gadget: simplify IOC handling")

Cc: stable@vger.kernel.org Signed-off-by: Thinh Nguyen thinhn@synopsys.com

---

drivers/usb/dwc3/gadget.c | 7 +++++++ 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index b3f8514d1f27..edc478c20846 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2470,6 +2470,13 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep, static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req) {

• /*

• * For OUT direction, host may send less than the setup
  

• * length. Return true for all OUT requests.
  

• */
  

• if (!req->direction)

• return true;
  

• return req->request.actual == req->request.length; }

Not sure if it's too late, but after Tejas's patch* that fixes the SG check in dwc3, it exposes another issue. Without this patch, quite a few function drivers will not work with dwc3.

If we can pick it up before the next merge, it'd be great.

What exactly breaks without this patch? And how was the original patch ever tested?

thanks,

greg k-h

If the host happens to send less than the setup length, then the dwc3 driver thinks that the controller hasn't completed processing the request. It will try to restart the transfer without giving back the request to the function driver. As a result, the function driver may not be able proceed as the dwc3 driver still owns the request.

As you are aware, Tejas's patch is still correct. We just didn't do a full test suite with that patch to find more issues. Just so happened that his patch uncovered another critical issue in dwc3. That's why I sent the previous email hoping that we can get this fix in before the next pull request. Seems like it's too late now, but that should be fine.

Thanks Greg, Thinh