From patchwork Mon Feb 14 09:37:17 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jung Daehwan X-Patchwork-Id: 12745311 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3344C433EF for ; Mon, 14 Feb 2022 09:50:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245224AbiBNJuU (ORCPT ); Mon, 14 Feb 2022 04:50:20 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:43850 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245379AbiBNJtY (ORCPT ); Mon, 14 Feb 2022 04:49:24 -0500 Received: from mailout3.samsung.com (mailout3.samsung.com [203.254.224.33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 894531AD90 for ; Mon, 14 Feb 2022 01:41:00 -0800 (PST) Received: from epcas2p4.samsung.com (unknown [182.195.41.56]) by mailout3.samsung.com (KnoxPortal) with ESMTP id 20220214094046epoutp0338619592c3d043463ea0287e88eaeaaa~TnarqPjCA0387703877epoutp03c for ; Mon, 14 Feb 2022 09:40:46 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout3.samsung.com 20220214094046epoutp0338619592c3d043463ea0287e88eaeaaa~TnarqPjCA0387703877epoutp03c DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1644831646; bh=4Xbhnx9uNz2JBzthPzEn/bH0Hr1fueiRHSuJySip1XI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cmcgtXPM6HvMsm8KW62JOvHXi+U2HcJEdEfJdI0SZYCbf+Ou2P6SIxUUIsi19lUer YQGwNe8wmuOBq38OjwlLXHMgs7/gvrrU2Ohx0Nq+d91wWCl44lfi94Wi5nT73KMMk6 FmG8kMIWF52hvuvVThuFqHNsd1r6/cZYwlm40rLc= Received: from epsnrtp1.localdomain (unknown [182.195.42.162]) by epcas2p1.samsung.com (KnoxPortal) with ESMTP id 20220214094045epcas2p18e0e821c5236e8ab61f01dacd790b957~TnarKScNJ2905329053epcas2p14; Mon, 14 Feb 2022 09:40:45 +0000 (GMT) Received: from epsmges2p3.samsung.com (unknown [182.195.36.92]) by epsnrtp1.localdomain (Postfix) with ESMTP id 4Jxzjl6hJvz4x9QK; Mon, 14 Feb 2022 09:40:43 +0000 (GMT) Received: from epcas2p3.samsung.com ( [182.195.41.55]) by epsmges2p3.samsung.com (Symantec Messaging Gateway) with SMTP id B5.DA.10014.8C12A026; Mon, 14 Feb 2022 18:32:56 +0900 (KST) Received: from epsmtrp1.samsung.com (unknown [182.195.40.13]) by epcas2p2.samsung.com (KnoxPortal) with ESMTPA id 20220214094041epcas2p2ec37c252dd5f9508454e9449c95e6c7a~Tnam8rKG51973219732epcas2p24; Mon, 14 Feb 2022 09:40:41 +0000 (GMT) Received: from epsmgms1p2.samsung.com (unknown [182.195.42.42]) by epsmtrp1.samsung.com (KnoxPortal) with ESMTP id 20220214094041epsmtrp130f8c9a1cd381b11e8e5d9564332e1cd~Tnam786tO2649526495epsmtrp1i; Mon, 14 Feb 2022 09:40:41 +0000 (GMT) X-AuditID: b6c32a47-489ff7000000271e-76-620a21c8a84b Received: from epsmtip1.samsung.com ( [182.195.34.30]) by epsmgms1p2.samsung.com (Symantec Messaging Gateway) with SMTP id DE.B1.08738.9932A026; Mon, 14 Feb 2022 18:40:41 +0900 (KST) Received: from ubuntu.dsn.sec.samsung.com (unknown [12.36.155.120]) by epsmtip1.samsung.com (KnoxPortal) with ESMTPA id 20220214094041epsmtip16bbeab070593c1ac6b2d8efe43af3ef0~TnamySefG0561905619epsmtip19; Mon, 14 Feb 2022 09:40:41 +0000 (GMT) From: Daehwan Jung To: Felipe Balbi , Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org (open list), Daehwan Jung , quic_wcheng@quicinc.com, quic_jackp@quicinc.com, Thinh.Nguyen@synopsys.com Subject: [PATCH v1 1/2] usb: dwc3: Not set DWC3_EP_END_TRANSFER_PENDING in ep cmd fails Date: Mon, 14 Feb 2022 18:37:17 +0900 Message-Id: <1644831438-125403-2-git-send-email-dh10.jung@samsung.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1644831438-125403-1-git-send-email-dh10.jung@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrMKsWRmVeSWpSXmKPExsWy7bCmue4JRa4kgw/3jSyOtT1ht7izYBqT RfPi9WwWl3fNYbNYtKyV2WLXv0VMFpt297FarFpwgN2Bw2PTqk42j/1z17B7TNxT59G3ZRWj x5b9nxk9Pm+SC2CLyrbJSE1MSS1SSM1Lzk/JzEu3VfIOjneONzUzMNQ1tLQwV1LIS8xNtVVy 8QnQdcvMAbpHSaEsMacUKBSQWFyspG9nU5RfWpKqkJFfXGKrlFqQklNgXqBXnJhbXJqXrpeX WmJlaGBgZApUmJCdse1URsE27oqL224xNjAe5Oxi5OSQEDCR+Danm72LkYtDSGAHo0TTlV4m kISQwCdGiWfXpCESnxklPvYtYobpeNB2mwkisYtRYtK9t1DtPxgl+k6BzOLgYBPQkvi+kBGk QUQgTGLisn0sIDXMAnuBVuy7ywqSEBaIlNj7byrYVBYBVYmuS+/BGngF3CTeTFwHtU1O4ua5 TjCbU8Bd4s7+4+wQ8UvsEp9/ZEDYLhJvn/SzQdjCEq+Ob4GqkZJ42d8GZRdL7PrUCna1hEAD o0TjgxNQC4wlZj1rZwQ5mllAU2L9Ln0QU0JAWeLILRaQCmYBPomOw3/ZIcK8Eh1tQhCNyhLT L09ghbAlJQ6+Pgc10EPi+/w/bJAgmcUocX7qZtYJjHKzEBYsYGRcxSiWWlCcm55abFRgDI+v 5PzcTYzg1KblvoNxxtsPeocYmTgYDzFKcDArifDGneVMEuJNSaysSi3Kjy8qzUktPsRoCgy7 icxSosn5wOSaVxJvaGJpYGJmZmhuZGpgriTO65WyIVFIID2xJDU7NbUgtQimj4mDU6qBKTB7 r0P13a9Hn9bIzvk760j7DMai+R+n/3IOc5S7uM7xX8a9XlUF//aT1XFLvlo0nl1VeDPlVsY8 n3MFQRtMohJ1nPlPTOnoeJ8rs7s/mVEvReFt/Yanx5+Z9jVKvRbTUI19+nTuxykv8taZprYu 9k+v3XlopmrPlG+zPUzZKhr3nlaUnynP/NCivlnDomRrgPnDxs3HzFlfVhTM+7Sv/OHjObl3 E5Z/N5pgHJe+9NOCY9WXdl/o8rR4raoiqGPRXe11f/vr+rm1Lic+9jdaf5qgu0nwjodcPQef z3W9Ep9Vh4vPPdbhlb4/T9Qk3aLttnteisWHkMgVx23czXfksM/55qE+bevl6RVvG9Q8lViK MxINtZiLihMBJqdt5/YDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprPLMWRmVeSWpSXmKPExsWy7bCSnO5MZa4kg0WvuSyOtT1ht7izYBqT RfPi9WwWl3fNYbNYtKyV2WLXv0VMFpt297FarFpwgN2Bw2PTqk42j/1z17B7TNxT59G3ZRWj x5b9nxk9Pm+SC2CL4rJJSc3JLEst0rdL4MrYdiqjYBt3xcVttxgbGA9ydjFyckgImEg8aLvN 1MXIxSEksINRYvWyLcwQCUmJpXNvsEPYwhL3W46wQhR9Y5RYc3wrkMPBwSagJfF9ISNIjYhA mMS/RxdZQGqYBQ4zSrS83cUGkhAWCJc4fus7K4jNIqAq0XXpPVgDr4CbxJuJ66CWyUncPNcJ ZnMKuEvc2X8cbLEQUE3Pg+XMExj5FjAyrGKUTC0ozk3PLTYsMMpLLdcrTswtLs1L10vOz93E CA5DLa0djHtWfdA7xMjEwXiIUYKDWUmEN+4sZ5IQb0piZVVqUX58UWlOavEhRmkOFiVx3gtd J+OFBNITS1KzU1MLUotgskwcnFINTJ5z94e6vA85Gv6s95fUysSpzee/yxvXucqnXsjn1Ob6 Z6evoXtrxR5j1o/3bvLOOvF/8+sbOz+KH/MM6HzX09K0hvNTVfSqhrsMJoZF5kklzSv+eRq7 zqnh87iruj7obfaGOS3L8j+0sXqHTHRtzKicvlnz+Q4T1XMv+bSLxa8yHJkfr8ZrMKv2wN0i AfUJ9ZMnPA7eeXTymd8W7BFcE04v/ZLs+Xg28/lFd/N8JindC6tqfsuhFad5XnlLT8pB95a5 W+0UXjgKfm7pYT6c8+lST4Bwk7aNq/ONeVbB/Y+LS1dcDX1hGFxy5/K6pXq6HU0bjFUMnu5N SH0tYcHSwCInslnqdL0TE/+djg1lSizFGYmGWsxFxYkAakU/xbICAAA= X-CMS-MailID: 20220214094041epcas2p2ec37c252dd5f9508454e9449c95e6c7a X-Msg-Generator: CA X-Sendblock-Type: AUTO_CONFIDENTIAL CMS-TYPE: 102P DLP-Filter: Pass X-CFilter-Loop: Reflected X-CMS-RootMailID: 20220214094041epcas2p2ec37c252dd5f9508454e9449c95e6c7a References: <1644831438-125403-1-git-send-email-dh10.jung@samsung.com> Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org It always sets DWC3_EP_END_TRANSFER_PENDING in dwc3_stop_active_transfer even if dwc3_send_gadget_ep_cmd fails. It can cause some problems like skipping clear stall commmand or giveback from dequeue. We fix to set it only when ep cmd success. Additionally, We clear DWC3_EP_TRANSFER_STARTED for next trb to start transfer not update transfer. Change-Id: I2e6b58acc99f385e467e8b639a3792a5e5f4d2bb Signed-off-by: Daehwan Jung --- drivers/usb/dwc3/gadget.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 183b90923f51..3ad3bc5813ca 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2044,6 +2044,12 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, dwc3_gadget_move_cancelled_request(r, DWC3_REQUEST_STATUS_DEQUEUED); + /* If ep cmd fails, then force to giveback cancelled requests here */ + if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) { + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + dwc3_gadget_ep_cleanup_cancelled_requests(dep); + } + dep->flags &= ~DWC3_EP_WAIT_TRANSFER_COMPLETE; goto out; @@ -3645,7 +3651,7 @@ static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, if (!interrupt) dep->flags &= ~DWC3_EP_TRANSFER_STARTED; - else + else if (!ret) dep->flags |= DWC3_EP_END_TRANSFER_PENDING; } From patchwork Mon Feb 14 09:37:18 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jung Daehwan X-Patchwork-Id: 12745310 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 313D3C433FE for ; Mon, 14 Feb 2022 09:50:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245673AbiBNJuM (ORCPT ); Mon, 14 Feb 2022 04:50:12 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:43380 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245523AbiBNJtO (ORCPT ); Mon, 14 Feb 2022 04:49:14 -0500 Received: from mailout3.samsung.com (mailout3.samsung.com [203.254.224.33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 54D4D1AD84 for ; Mon, 14 Feb 2022 01:40:59 -0800 (PST) Received: from epcas2p3.samsung.com (unknown [182.195.41.55]) by mailout3.samsung.com (KnoxPortal) with ESMTP id 20220214094045epoutp038d3bd72c215d371fb9e333f645f4baa4~Tnaqwj4Gt0454904549epoutp03D for ; Mon, 14 Feb 2022 09:40:45 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout3.samsung.com 20220214094045epoutp038d3bd72c215d371fb9e333f645f4baa4~Tnaqwj4Gt0454904549epoutp03D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1644831645; bh=SflWUT3MSnU+DzFR1WmiJra5Ky7Db65Ttcox2ZzhX0Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ieSmqkIgh86dbNzomF3S6ihcwuIINTx4lUwXvIPS5cFAFPLbXYD8vcyHLz/5WJ7tg e5wjjJ0YzDkRhOzEi72TIKUHv50AHFlQMEDxOIU2+TtYQ0pzyt6Ae1BFT7ag/ibIqJ mHn++aufP6Be/V2gXJF4JPf0Yns7wEJ2mHTdcD1c= Received: from epsnrtp2.localdomain (unknown [182.195.42.163]) by epcas2p1.samsung.com (KnoxPortal) with ESMTP id 20220214094044epcas2p1df083cafe6518adb46b1494f3581a64c~TnaqPLvuj1972419724epcas2p1D; Mon, 14 Feb 2022 09:40:44 +0000 (GMT) Received: from epsmges2p4.samsung.com (unknown [182.195.36.88]) by epsnrtp2.localdomain (Postfix) with ESMTP id 4Jxzjl1tQ7z4x9Q7; Mon, 14 Feb 2022 09:40:43 +0000 (GMT) Received: from epcas2p3.samsung.com ( [182.195.41.55]) by epsmges2p4.samsung.com (Symantec Messaging Gateway) with SMTP id 91.19.12141.A932A026; Mon, 14 Feb 2022 18:40:42 +0900 (KST) Received: from epsmtrp1.samsung.com (unknown [182.195.40.13]) by epcas2p1.samsung.com (KnoxPortal) with ESMTPA id 20220214094042epcas2p118ac06692ad14f321a3fd59e57bcf1d5~TnaoNW2UJ1972419724epcas2p18; Mon, 14 Feb 2022 09:40:42 +0000 (GMT) Received: from epsmgms1p1new.samsung.com (unknown [182.195.42.41]) by epsmtrp1.samsung.com (KnoxPortal) with ESMTP id 20220214094042epsmtrp18668e522fd1f887f37fe744b8a53a3bd~TnaoMk2LF2665426654epsmtrp1D; Mon, 14 Feb 2022 09:40:42 +0000 (GMT) X-AuditID: b6c32a48-d73ff70000002f6d-3b-620a239afeb9 Received: from epsmtip1.samsung.com ( [182.195.34.30]) by epsmgms1p1new.samsung.com (Symantec Messaging Gateway) with SMTP id 63.8F.29871.A932A026; Mon, 14 Feb 2022 18:40:42 +0900 (KST) Received: from ubuntu.dsn.sec.samsung.com (unknown [12.36.155.120]) by epsmtip1.samsung.com (KnoxPortal) with ESMTPA id 20220214094042epsmtip18d5a380e01357722bf01d4d805e2fdaa~TnaoEF7dT0562805628epsmtip1I; Mon, 14 Feb 2022 09:40:42 +0000 (GMT) From: Daehwan Jung To: Felipe Balbi , Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org (open list), Daehwan Jung , quic_wcheng@quicinc.com, quic_jackp@quicinc.com, Thinh.Nguyen@synopsys.com Subject: [PATCH v1 2/2] usb: dwc3: Prevent cleanup cancelled requests at the same time. Date: Mon, 14 Feb 2022 18:37:18 +0900 Message-Id: <1644831438-125403-3-git-send-email-dh10.jung@samsung.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1644831438-125403-1-git-send-email-dh10.jung@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrCKsWRmVeSWpSXmKPExsWy7bCmue4sZa4kg8ON5hbH2p6wW9xZMI3J onnxejaLy7vmsFksWtbKbLHr3yImi027+1gtVi04wO7A4bFpVSebx/65a9g9Ju6p8+jbsorR Y8v+z4wenzfJBbBFZdtkpCampBYppOYl56dk5qXbKnkHxzvHm5oZGOoaWlqYKynkJeam2iq5 +AToumXmAN2jpFCWmFMKFApILC5W0rezKcovLUlVyMgvLrFVSi1IySkwL9ArTswtLs1L18tL LbEyNDAwMgUqTMjO+DTTrqBPtOLb/n2MDYyvBLsYOTkkBEwkdsz7xdbFyMUhJLCDUeJl+yom COcTo8SLdfdYIZxvjBLLZy9hg2n5N2UpVGIvo8S+g7NYQRJCAj8YJS595Oxi5OBgE9CS+L6Q ESQsIhAmMXHZPhaQemaQ+qZ9d8HqhQUiJf78vcoOYrMIqEp0nT/BAmLzCrhJ7Jj5CWqZnMTN c53MIDangLvEnf3H2UEGSQhcY5d42H6MGaLIReJK309WCFtY4tXxLewQtpTEy/42KLtYYten ViaI5gZGicYHJ6CajSVmPWtnBLmaWUBTYv0ufRBTQkBZ4sgtsHuYBfgkOg7/ZYcI80p0tAlB NCpLTL88AWqrpMTB1+egBnpITH/SxQwJn1mMEnvvzGCawCg3C2HBAkbGVYxiqQXFuempxUYF JvAIS87P3cQITm5aHjsYZ7/9oHeIkYmD8RCjBAezkghv3FnOJCHelMTKqtSi/Pii0pzU4kOM psDAm8gsJZqcD0yveSXxhiaWBiZmZobmRqYG5krivF4pGxKFBNITS1KzU1MLUotg+pg4OKUa mJrPhayL/aD3kpnnP9Oa4nYey09fy9k8NkUcVlwg+q6YN/aOqUPGi3Uz6tu3xa/aG3MmbdPO q5s+MLYucRa0lwiOnWwgf/SGqLpmr+oq4b1LPI8zLayZvttlHe+LrU9W13kV3y86dvLn45wt ClPDra2XiXmn3z1uNK/UWSy/LeKk19G+/RzVBV1Lz1sekJa76SB1mzW3+8btzP0+LJk3rVYl qpfXOm+4/y3rmcJRUwk/2TOtisEvBWsmunIfWyaUl/U+aVb4MRsO5Rsbj/5s23ihhu9nZ+YJ 60OzUpc4WNd/3lt6fvsM0weOJot+1LEv6ftZH8/ldNb+f163/t8nniqn533RlA5LcV3G0v3f UYmlOCPRUIu5qDgRAHIbSHH3AwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprLLMWRmVeSWpSXmKPExsWy7bCSnO4sZa4kg88XFS2OtT1ht7izYBqT RfPi9WwWl3fNYbNYtKyV2WLXv0VMFpt297FarFpwgN2Bw2PTqk42j/1z17B7TNxT59G3ZRWj x5b9nxk9Pm+SC2CL4rJJSc3JLEst0rdL4Mr4NNOuoE+04tv+fYwNjK8Euxg5OSQETCT+TVnK CmILCexmlDh6SwIiLimxdO4NdghbWOJ+yxGgGi6gmm9ANa8msnUxcnCwCWhJfF/ICFIjIhAm 8e/RRRaQGmaBw4wSLW93gdUIC4RL9M7NAqlhEVCV6Dp/ggXE5hVwk9gx8xMbxHw5iZvnOplB bE4Bd4k7+4+zQ9zjJtHzYDnzBEa+BYwMqxglUwuKc9Nziw0LDPNSy/WKE3OLS/PS9ZLzczcx gkNQS3MH4/ZVH/QOMTJxMB5ilOBgVhLhjTvLmSTEm5JYWZValB9fVJqTWnyIUZqDRUmc90LX yXghgfTEktTs1NSC1CKYLBMHp1QDk/GaNwc9v6sr1rzcsWeZu9vvr68/NZr9f6OyfVpMx733 XyTaRSMWcYhdSeAQvyIdNWenbc9nv5W51vxbOPS2FP3IOK57wbj01C/9rAfub376nub9mrRT uOT4Hu2q+8k8AhouutLh4VPCVS8FRG/t2iUceMK6XbPmqtGVl9bhPq+yWeaw7eisTRGLODnt erRIfuXJFbZKk44u47OV3bVZv9LwW1Bm4PMrE+ZrGd2cK3+C3V1hf8y1u3unXF/DPo+j/vfm q6z/zLNzxH0fnHrXYJB00LrvftkapwtfN2otk16ff89m0efJLb8mfiy2N1k4pSt8lnRi+3JF R3O+Myu2T879qn1J78HJcpkL/64k5CqxFGckGmoxFxUnAgDI1znIsAIAAA== X-CMS-MailID: 20220214094042epcas2p118ac06692ad14f321a3fd59e57bcf1d5 X-Msg-Generator: CA X-Sendblock-Type: AUTO_CONFIDENTIAL CMS-TYPE: 102P DLP-Filter: Pass X-CFilter-Loop: Reflected X-CMS-RootMailID: 20220214094042epcas2p118ac06692ad14f321a3fd59e57bcf1d5 References: <1644831438-125403-1-git-send-email-dh10.jung@samsung.com> Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org We added cleanup cancelled requests when ep cmd timeout on ep dequeue because there's no complete interrupt then. But, we find out new case that complete interrupt comes up later. list_for_each_entry_safe is used when cleanup cancelled requests and it has vulnerabilty on multi-core environment. dwc3_gadget_giveback unlocks dwc->lock temporarily and other core(ISR) can get lock and try to cleanup them again. It could cause list_del corruption and we use DWC3_EP_END_TRANSFER_PENDING to prevent it. 1. MTP server cancels -> ep dequeue -> ep cmd timeout(END_TRANSFER) -> cleanup cancelled requests -> dwc3_gadget_giveback -> list_del -> release lock temporarily 2. Complete with END_TRANSFER -> ISR(dwc3_gadget_endpoint_command_complete) gets lock -> cleanup cancelled requests -> dwc3_gadget_giveback -> list_del 3. MTP server process gets lock again -> tries to access POISON list(list_del corruption) [ 205.014697] [2: MtpServer: 5032] dwc3 10b00000.dwc3: request cancelled with wrong reason:5 [ 205.014719] [2: MtpServer: 5032] list_del corruption, ffffff88b6963968->next is LIST_POISON1 (dead000000000100) Change-Id: I9df055c6c04855edd09e330300914454a6657a23 Signed-off-by: Daehwan Jung Change-Id: If87c88c3bb4c17ea1a5bde2bfec1382769f7ecab Signed-off-by: Daehwan Jung --- drivers/usb/dwc3/gadget.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 3ad3bc5813ca..2e0183512d5b 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2046,8 +2046,11 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, /* If ep cmd fails, then force to giveback cancelled requests here */ if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) { - dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + dep->flags |= DWC3_EP_END_TRANSFER_PENDING; dwc3_gadget_ep_cleanup_cancelled_requests(dep); + + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING; } dep->flags &= ~DWC3_EP_WAIT_TRANSFER_COMPLETE; @@ -3426,9 +3429,12 @@ static void dwc3_gadget_endpoint_command_complete(struct dwc3_ep *dep, if (dep->stream_capable) dep->flags |= DWC3_EP_IGNORE_NEXT_NOSTREAM; + if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) { + dwc3_gadget_ep_cleanup_cancelled_requests(dep); + } + dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING; dep->flags &= ~DWC3_EP_TRANSFER_STARTED; - dwc3_gadget_ep_cleanup_cancelled_requests(dep); if (dep->flags & DWC3_EP_PENDING_CLEAR_STALL) { struct dwc3 *dwc = dep->dwc;