Hi,
Greg Kroah-Hartman wrote:
> On Sat, Dec 14, 2019 at 03:01:40AM +0000, Thinh Nguyen wrote:
>> Hi Greg and Felipe,
>>
>> Thinh Nguyen wrote:
>>> We can only check for IN direction if the request had completed. For OUT
>>> direction, it's perfectly fine that the host can send less than the
>>> setup length. Let's return true fall all cases of OUT direction.
>>>
>>> Fixes: e0c42ce590fe ("usb: dwc3: gadget: simplify IOC handling")
>>>
>>> Cc: stable@xxxxxxxxxxxxxxx
>>> Signed-off-by: Thinh Nguyen <thinhn@xxxxxxxxxxxx>
>>> ---
>>> drivers/usb/dwc3/gadget.c | 7 +++++++
>>> 1 file changed, 7 insertions(+)
>>>
>>> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
>>> index b3f8514d1f27..edc478c20846 100644
>>> --- a/drivers/usb/dwc3/gadget.c
>>> +++ b/drivers/usb/dwc3/gadget.c
>>> @@ -2470,6 +2470,13 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep,
>>>
>>> static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req)
>>> {
>>> + /*
>>> + * For OUT direction, host may send less than the setup
>>> + * length. Return true for all OUT requests.
>>> + */
>>> + if (!req->direction)
>>> + return true;
>>> +
>>> return req->request.actual == req->request.length;
>>> }
>>>
>> Not sure if it's too late, but after Tejas's patch* that fixes the SG
>> check in dwc3, it exposes another issue. Without this patch, quite a few
>> function drivers will not work with dwc3.
>>
>> If we can pick it up before the next merge, it'd be great.
> What exactly breaks without this patch? And how was the original patch
> ever tested?
>
> thanks,
>
> greg k-h
If the host happens to send less than the setup length, then the dwc3
driver thinks that the controller hasn't completed processing the
request. It will try to restart the transfer without giving back the
request to the function driver. As a result, the function driver may not
be able proceed as the dwc3 driver still owns the request.
As you are aware, Tejas's patch is still correct. We just didn't do a
full test suite with that patch to find more issues. Just so happened
that his patch uncovered another critical issue in dwc3. That's why I
sent the previous email hoping that we can get this fix in before the
next pull request. Seems like it's too late now, but that should be fine.
Thanks Greg,
Thinh
