[PATCH] usb: dwc3: gadget: Fix request complete check

[PATCH] usb: dwc3: gadget: Fix request complete check

[Thinh Nguyen]

We can only check for IN direction if the request had completed. For OUT
direction, it's perfectly fine that the host can send less than the
setup length. Let's return true fall all cases of OUT direction.

Fixes: e0c42ce590fe ("usb: dwc3: gadget: simplify IOC handling")

Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
---
 drivers/usb/dwc3/gadget.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index b3f8514d1f27..edc478c20846 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2470,6 +2470,13 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep,
 
 static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req)
 {
+	/*
+	 * For OUT direction, host may send less than the setup
+	 * length. Return true for all OUT requests.
+	 */
+	if (!req->direction)
+		return true;
+
 	return req->request.actual == req->request.length;
 }
 
-- 
2.11.0

Re: [PATCH] usb: dwc3: gadget: Fix request complete check

[Thinh Nguyen]

Hi Greg and Felipe,

Thinh Nguyen wrote:
> We can only check for IN direction if the request had completed. For OUT
> direction, it's perfectly fine that the host can send less than the
> setup length. Let's return true fall all cases of OUT direction.
>
> Fixes: e0c42ce590fe ("usb: dwc3: gadget: simplify IOC handling")
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
> ---
>   drivers/usb/dwc3/gadget.c | 7 +++++++
>   1 file changed, 7 insertions(+)
>
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index b3f8514d1f27..edc478c20846 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -2470,6 +2470,13 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep,
>   
>   static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req)
>   {
> +	/*
> +	 * For OUT direction, host may send less than the setup
> +	 * length. Return true for all OUT requests.
> +	 */
> +	if (!req->direction)
> +		return true;
> +
>   	return req->request.actual == req->request.length;
>   }
>   

Not sure if it's too late, but after Tejas's patch* that fixes the SG 
check in dwc3, it exposes another issue. Without this patch, quite a few 
function drivers will not work with dwc3.

If we can pick it up before the next merge, it'd be great.

Thanks,
Thinh

*Patch on Greg's branch usb-linus: 8c7d4b7b3d43 ("usb: dwc3: gadget: Fix 
logical condition")

Re: [PATCH] usb: dwc3: gadget: Fix request complete check

[Greg Kroah-Hartman]

On Sat, Dec 14, 2019 at 03:01:40AM +0000, Thinh Nguyen wrote:
> Hi Greg and Felipe,
> 
> Thinh Nguyen wrote:
> > We can only check for IN direction if the request had completed. For OUT
> > direction, it's perfectly fine that the host can send less than the
> > setup length. Let's return true fall all cases of OUT direction.
> >
> > Fixes: e0c42ce590fe ("usb: dwc3: gadget: simplify IOC handling")
> >
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
> > ---
> >   drivers/usb/dwc3/gadget.c | 7 +++++++
> >   1 file changed, 7 insertions(+)
> >
> > diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> > index b3f8514d1f27..edc478c20846 100644
> > --- a/drivers/usb/dwc3/gadget.c
> > +++ b/drivers/usb/dwc3/gadget.c
> > @@ -2470,6 +2470,13 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep,
> >   
> >   static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req)
> >   {
> > +	/*
> > +	 * For OUT direction, host may send less than the setup
> > +	 * length. Return true for all OUT requests.
> > +	 */
> > +	if (!req->direction)
> > +		return true;
> > +
> >   	return req->request.actual == req->request.length;
> >   }
> >   
> 
> Not sure if it's too late, but after Tejas's patch* that fixes the SG 
> check in dwc3, it exposes another issue. Without this patch, quite a few 
> function drivers will not work with dwc3.
> 
> If we can pick it up before the next merge, it'd be great.

What exactly breaks without this patch?  And how was the original patch
ever tested?

thanks,

greg k-h

Re: [PATCH] usb: dwc3: gadget: Fix request complete check

[Thinh Nguyen]

Hi,

Greg Kroah-Hartman wrote:
> On Sat, Dec 14, 2019 at 03:01:40AM +0000, Thinh Nguyen wrote:
>> Hi Greg and Felipe,
>>
>> Thinh Nguyen wrote:
>>> We can only check for IN direction if the request had completed. For OUT
>>> direction, it's perfectly fine that the host can send less than the
>>> setup length. Let's return true fall all cases of OUT direction.
>>>
>>> Fixes: e0c42ce590fe ("usb: dwc3: gadget: simplify IOC handling")
>>>
>>> Cc: stable@vger.kernel.org
>>> Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
>>> ---
>>>    drivers/usb/dwc3/gadget.c | 7 +++++++
>>>    1 file changed, 7 insertions(+)
>>>
>>> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
>>> index b3f8514d1f27..edc478c20846 100644
>>> --- a/drivers/usb/dwc3/gadget.c
>>> +++ b/drivers/usb/dwc3/gadget.c
>>> @@ -2470,6 +2470,13 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep,
>>>    
>>>    static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req)
>>>    {
>>> +	/*
>>> +	 * For OUT direction, host may send less than the setup
>>> +	 * length. Return true for all OUT requests.
>>> +	 */
>>> +	if (!req->direction)
>>> +		return true;
>>> +
>>>    	return req->request.actual == req->request.length;
>>>    }
>>>    
>> Not sure if it's too late, but after Tejas's patch* that fixes the SG
>> check in dwc3, it exposes another issue. Without this patch, quite a few
>> function drivers will not work with dwc3.
>>
>> If we can pick it up before the next merge, it'd be great.
> What exactly breaks without this patch?  And how was the original patch
> ever tested?
>
> thanks,
>
> greg k-h

If the host happens to send less than the setup length, then the dwc3 
driver thinks that the controller hasn't completed processing the 
request. It will try to restart the transfer without giving back the 
request to the function driver. As a result, the function driver may not 
be able proceed as the dwc3 driver still owns the request.

As you are aware, Tejas's patch is still correct. We just didn't do a 
full test suite with that patch to find more issues. Just so happened 
that his patch uncovered another critical issue in dwc3. That's why I 
sent the previous email hoping that we can get this fix in before the 
next pull request. Seems like it's too late now, but that should be fine.

Thanks Greg,
Thinh

Re: usb: dwc3: gadget: Fix request complete check

[youling257]

"usb: dwc3: gadget: Fix logical condition" cause g_mass_storage not work,
test "usb: dwc3: gadget: Fix request complete check" fix the problem.