From: Felipe Balbi <balbi@kernel.org>
To: Jack Pham <jackp@codeaurora.org>,
Tejas Joglekar <Tejas.Joglekar@synopsys.com>
Cc: linux-usb@vger.kernel.org, John Youn <John.Youn@synopsys.com>,
Thinh Nguyen <Thinh.Nguyen@synopsys.com>,
stable@vger.kernel.org
Subject: Re: [PATCH] usb: dwc3: gadget: Fix logical condition
Date: Fri, 31 Jan 2020 10:07:57 +0200 [thread overview]
Message-ID: <87a76482w2.fsf@kernel.org> (raw)
In-Reply-To: <20200131032501.GA10078@jackp-linux.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 2601 bytes --]
Hi,
Jack Pham <jackp@codeaurora.org> writes:
> Hi Tejas & Felipe,
>
> On Wed, Nov 13, 2019 at 11:45:16AM +0530, Tejas Joglekar wrote:
>> This patch corrects the condition to kick the transfer without
>> giving back the requests when either request has remaining data
>> or when there are pending SGs. The && check was introduced during
>> spliting up the dwc3_gadget_ep_cleanup_completed_requests() function.
>>
>> Fixes: f38e35dd84e2 ("usb: dwc3: gadget: split dwc3_gadget_ep_cleanup_completed_requests()")
>>
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Tejas Joglekar <joglekar@synopsys.com>
>> ---
>> drivers/usb/dwc3/gadget.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
>> index 86dc1db788a9..e07159e06f9a 100644
>> --- a/drivers/usb/dwc3/gadget.c
>> +++ b/drivers/usb/dwc3/gadget.c
>> @@ -2485,7 +2485,7 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
>>
>> req->request.actual = req->request.length - req->remaining;
>>
>> - if (!dwc3_gadget_ep_request_completed(req) &&
>> + if (!dwc3_gadget_ep_request_completed(req) ||
>> req->num_pending_sgs) {
>> __dwc3_gadget_kick_transfer(dep);
>> goto out;
>
> Been staring at this for a while--I think I see a potential issue but
> not sure if it is or not.
>
> If this condition is true and causes an early return, the 'ret' value
> could be 0 which could allow the caller in cleanup_completed_requests()
> to continue looping over the started_list and calling
> cleanup_completed_request() again on the next req. But we just issued
> another START or UPDATE transfer command on the previous incomplete req
> and now the loop continued to try to reclaim the next TRB (and increment
> the dequeue pointer and whatnot) when it might actually be in progress.
>
> According to the code before f38e35dd84e2,
>
> list_for_each_entry_safe(req, tmp, &dep->started_list, list) {
>
> ...
> if (!dwc3_gadget_ep_request_completed(req) ||
> req->num_pending_sgs) {
> __dwc3_gadget_kick_transfer(dep);
> break;
> }
>
> The 'goto out' used to be a 'break', which terminates the list loop. But
> with the refactored code, the loop can only terminate if 'ret' is
> non-zero.
ret is initialized properly by dwc3_gadget_ep_reclaim*(). That goto is
correct.
> I haven't seen any real issue with the code as-is yet, but was just
> wondering if the 'goto out' should be replaced with a return 1?
let us know if you find any problems
--
balbi
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]
prev parent reply other threads:[~2020-01-31 8:08 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-13 6:15 [PATCH] usb: dwc3: gadget: Fix logical condition Tejas Joglekar
2019-11-22 4:00 ` Tejas Joglekar
2019-12-02 11:30 ` Tejas Joglekar
2019-12-03 13:58 ` Felipe Balbi
2020-01-31 3:25 ` Jack Pham
2020-01-31 8:07 ` Felipe Balbi [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87a76482w2.fsf@kernel.org \
--to=balbi@kernel.org \
--cc=John.Youn@synopsys.com \
--cc=Tejas.Joglekar@synopsys.com \
--cc=Thinh.Nguyen@synopsys.com \
--cc=jackp@codeaurora.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).