From nobody Sun Jun 28 05:34:31 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 064EDC433F5 for ; Mon, 14 Feb 2022 09:52:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245729AbiBNJwx (ORCPT ); Mon, 14 Feb 2022 04:52:53 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:44180 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245572AbiBNJti (ORCPT ); Mon, 14 Feb 2022 04:49:38 -0500 Received: from mailout1.samsung.com (mailout1.samsung.com [203.254.224.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 04EDF1ADB0 for ; Mon, 14 Feb 2022 01:41:02 -0800 (PST) Received: from epcas2p4.samsung.com (unknown [182.195.41.56]) by mailout1.samsung.com (KnoxPortal) with ESMTP id 20220214094046epoutp01a9a9677883ff426ca6ee82de2247a8c2~Tnarp5s5A0762107621epoutp01T for ; Mon, 14 Feb 2022 09:40:46 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout1.samsung.com 20220214094046epoutp01a9a9677883ff426ca6ee82de2247a8c2~Tnarp5s5A0762107621epoutp01T DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1644831646; bh=4Xbhnx9uNz2JBzthPzEn/bH0Hr1fueiRHSuJySip1XI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cmcgtXPM6HvMsm8KW62JOvHXi+U2HcJEdEfJdI0SZYCbf+Ou2P6SIxUUIsi19lUer YQGwNe8wmuOBq38OjwlLXHMgs7/gvrrU2Ohx0Nq+d91wWCl44lfi94Wi5nT73KMMk6 FmG8kMIWF52hvuvVThuFqHNsd1r6/cZYwlm40rLc= Received: from epsnrtp1.localdomain (unknown [182.195.42.162]) by epcas2p1.samsung.com (KnoxPortal) with ESMTP id 20220214094045epcas2p18e0e821c5236e8ab61f01dacd790b957~TnarKScNJ2905329053epcas2p14; Mon, 14 Feb 2022 09:40:45 +0000 (GMT) Received: from epsmges2p3.samsung.com (unknown [182.195.36.92]) by epsnrtp1.localdomain (Postfix) with ESMTP id 4Jxzjl6hJvz4x9QK; Mon, 14 Feb 2022 09:40:43 +0000 (GMT) Received: from epcas2p3.samsung.com ( [182.195.41.55]) by epsmges2p3.samsung.com (Symantec Messaging Gateway) with SMTP id B5.DA.10014.8C12A026; Mon, 14 Feb 2022 18:32:56 +0900 (KST) Received: from epsmtrp1.samsung.com (unknown [182.195.40.13]) by epcas2p2.samsung.com (KnoxPortal) with ESMTPA id 20220214094041epcas2p2ec37c252dd5f9508454e9449c95e6c7a~Tnam8rKG51973219732epcas2p24; Mon, 14 Feb 2022 09:40:41 +0000 (GMT) Received: from epsmgms1p2.samsung.com (unknown [182.195.42.42]) by epsmtrp1.samsung.com (KnoxPortal) with ESMTP id 20220214094041epsmtrp130f8c9a1cd381b11e8e5d9564332e1cd~Tnam786tO2649526495epsmtrp1i; Mon, 14 Feb 2022 09:40:41 +0000 (GMT) X-AuditID: b6c32a47-489ff7000000271e-76-620a21c8a84b Received: from epsmtip1.samsung.com ( [182.195.34.30]) by epsmgms1p2.samsung.com (Symantec Messaging Gateway) with SMTP id DE.B1.08738.9932A026; Mon, 14 Feb 2022 18:40:41 +0900 (KST) Received: from ubuntu.dsn.sec.samsung.com (unknown [12.36.155.120]) by epsmtip1.samsung.com (KnoxPortal) with ESMTPA id 20220214094041epsmtip16bbeab070593c1ac6b2d8efe43af3ef0~TnamySefG0561905619epsmtip19; Mon, 14 Feb 2022 09:40:41 +0000 (GMT) From: Daehwan Jung To: Felipe Balbi , Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org (open list), Daehwan Jung , quic_wcheng@quicinc.com, quic_jackp@quicinc.com, Thinh.Nguyen@synopsys.com Subject: [PATCH v1 1/2] usb: dwc3: Not set DWC3_EP_END_TRANSFER_PENDING in ep cmd fails Date: Mon, 14 Feb 2022 18:37:17 +0900 Message-Id: <1644831438-125403-2-git-send-email-dh10.jung@samsung.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1644831438-125403-1-git-send-email-dh10.jung@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrMKsWRmVeSWpSXmKPExsWy7bCmue4JRa4kgw/3jSyOtT1ht7izYBqT RfPi9WwWl3fNYbNYtKyV2WLXv0VMFpt297FarFpwgN2Bw2PTqk42j/1z17B7TNxT59G3ZRWj x5b9nxk9Pm+SC2CLyrbJSE1MSS1SSM1Lzk/JzEu3VfIOjneONzUzMNQ1tLQwV1LIS8xNtVVy 8QnQdcvMAbpHSaEsMacUKBSQWFyspG9nU5RfWpKqkJFfXGKrlFqQklNgXqBXnJhbXJqXrpeX WmJlaGBgZApUmJCdse1URsE27oqL224xNjAe5Oxi5OSQEDCR+Danm72LkYtDSGAHo0TTlV4m kISQwCdGiWfXpCESnxklPvYtYobpeNB2mwkisYtRYtK9t1DtPxgl+k6BzOLgYBPQkvi+kBGk QUQgTGLisn0sIDXMAnuBVuy7ywqSEBaIlNj7byrYVBYBVYmuS+/BGngF3CTeTFwHtU1O4ua5 TjCbU8Bd4s7+4+wQ8UvsEp9/ZEDYLhJvn/SzQdjCEq+Ob4GqkZJ42d8GZRdL7PrUCna1hEAD o0TjgxNQC4wlZj1rZwQ5mllAU2L9Ln0QU0JAWeLILRaQCmYBPomOw3/ZIcK8Eh1tQhCNyhLT L09ghbAlJQ6+Pgc10EPi+/w/bJAgmcUocX7qZtYJjHKzEBYsYGRcxSiWWlCcm55abFRgDI+v 5PzcTYzg1KblvoNxxtsPeocYmTgYDzFKcDArifDGneVMEuJNSaysSi3Kjy8qzUktPsRoCgy7 icxSosn5wOSaVxJvaGJpYGJmZmhuZGpgriTO65WyIVFIID2xJDU7NbUgtQimj4mDU6qBKTB7 r0P13a9Hn9bIzvk760j7DMai+R+n/3IOc5S7uM7xX8a9XlUF//aT1XFLvlo0nl1VeDPlVsY8 n3MFQRtMohJ1nPlPTOnoeJ8rs7s/mVEvReFt/Yanx5+Z9jVKvRbTUI19+nTuxykv8taZprYu 9k+v3XlopmrPlG+zPUzZKhr3nlaUnynP/NCivlnDomRrgPnDxs3HzFlfVhTM+7Sv/OHjObl3 E5Z/N5pgHJe+9NOCY9WXdl/o8rR4raoiqGPRXe11f/vr+rm1Lic+9jdaf5qgu0nwjodcPQef z3W9Ep9Vh4vPPdbhlb4/T9Qk3aLttnteisWHkMgVx23czXfksM/55qE+bevl6RVvG9Q8lViK MxINtZiLihMBJqdt5/YDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprPLMWRmVeSWpSXmKPExsWy7bCSnO5MZa4kg0WvuSyOtT1ht7izYBqT RfPi9WwWl3fNYbNYtKyV2WLXv0VMFpt297FarFpwgN2Bw2PTqk42j/1z17B7TNxT59G3ZRWj x5b9nxk9Pm+SC2CL4rJJSc3JLEst0rdL4MrYdiqjYBt3xcVttxgbGA9ydjFyckgImEg8aLvN 1MXIxSEksINRYvWyLcwQCUmJpXNvsEPYwhL3W46wQhR9Y5RYc3wrkMPBwSagJfF9ISNIjYhA mMS/RxdZQGqYBQ4zSrS83cUGkhAWCJc4fus7K4jNIqAq0XXpPVgDr4CbxJuJ66CWyUncPNcJ ZnMKuEvc2X8cbLEQUE3Pg+XMExj5FjAyrGKUTC0ozk3PLTYsMMpLLdcrTswtLs1L10vOz93E CA5DLa0djHtWfdA7xMjEwXiIUYKDWUmEN+4sZ5IQb0piZVVqUX58UWlOavEhRmkOFiVx3gtd J+OFBNITS1KzU1MLUotgskwcnFINTJ5z94e6vA85Gv6s95fUysSpzee/yxvXucqnXsjn1Ob6 Z6evoXtrxR5j1o/3bvLOOvF/8+sbOz+KH/MM6HzX09K0hvNTVfSqhrsMJoZF5kklzSv+eRq7 zqnh87iruj7obfaGOS3L8j+0sXqHTHRtzKicvlnz+Q4T1XMv+bSLxa8yHJkfr8ZrMKv2wN0i AfUJ9ZMnPA7eeXTymd8W7BFcE04v/ZLs+Xg28/lFd/N8JindC6tqfsuhFad5XnlLT8pB95a5 W+0UXjgKfm7pYT6c8+lST4Bwk7aNq/ONeVbB/Y+LS1dcDX1hGFxy5/K6pXq6HU0bjFUMnu5N SH0tYcHSwCInslnqdL0TE/+djg1lSizFGYmGWsxFxYkAakU/xbICAAA= X-CMS-MailID: 20220214094041epcas2p2ec37c252dd5f9508454e9449c95e6c7a X-Msg-Generator: CA Content-Type: text/plain; charset="utf-8" X-Sendblock-Type: AUTO_CONFIDENTIAL CMS-TYPE: 102P DLP-Filter: Pass X-CFilter-Loop: Reflected X-CMS-RootMailID: 20220214094041epcas2p2ec37c252dd5f9508454e9449c95e6c7a References: <1644831438-125403-1-git-send-email-dh10.jung@samsung.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 It always sets DWC3_EP_END_TRANSFER_PENDING in dwc3_stop_active_transfer even if dwc3_send_gadget_ep_cmd fails. It can cause some problems like skipping clear stall commmand or giveback from dequeue. We fix to set it only when ep cmd success. Additionally, We clear DWC3_EP_TRANSFER_STARTED for next trb to start transfer not update transfer. Change-Id: I2e6b58acc99f385e467e8b639a3792a5e5f4d2bb Signed-off-by: Daehwan Jung --- drivers/usb/dwc3/gadget.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 183b90923f51..3ad3bc5813ca 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2044,6 +2044,12 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, dwc3_gadget_move_cancelled_request(r, DWC3_REQUEST_STATUS_DEQUEUED); =20 + /* If ep cmd fails, then force to giveback cancelled requests here */ + if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) { + dep->flags &=3D ~DWC3_EP_TRANSFER_STARTED; + dwc3_gadget_ep_cleanup_cancelled_requests(dep); + } + dep->flags &=3D ~DWC3_EP_WAIT_TRANSFER_COMPLETE; =20 goto out; @@ -3645,7 +3651,7 @@ static void dwc3_stop_active_transfer(struct dwc3_ep = *dep, bool force, =20 if (!interrupt) dep->flags &=3D ~DWC3_EP_TRANSFER_STARTED; - else + else if (!ret) dep->flags |=3D DWC3_EP_END_TRANSFER_PENDING; } =20 --=20 2.31.1 From nobody Sun Jun 28 05:34:31 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 976E3C433EF for ; Mon, 14 Feb 2022 09:52:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239625AbiBNJwb (ORCPT ); Mon, 14 Feb 2022 04:52:31 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:43332 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245519AbiBNJtO (ORCPT ); Mon, 14 Feb 2022 04:49:14 -0500 Received: from mailout3.samsung.com (mailout3.samsung.com [203.254.224.33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4E9D41AD82 for ; Mon, 14 Feb 2022 01:40:59 -0800 (PST) Received: from epcas2p3.samsung.com (unknown [182.195.41.55]) by mailout3.samsung.com (KnoxPortal) with ESMTP id 20220214094045epoutp035ab674503c0963b9029d8d0ceaf49834~TnaqrWa0Y0454904549epoutp03C for ; Mon, 14 Feb 2022 09:40:45 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout3.samsung.com 20220214094045epoutp035ab674503c0963b9029d8d0ceaf49834~TnaqrWa0Y0454904549epoutp03C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1644831645; bh=SflWUT3MSnU+DzFR1WmiJra5Ky7Db65Ttcox2ZzhX0Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ieSmqkIgh86dbNzomF3S6ihcwuIINTx4lUwXvIPS5cFAFPLbXYD8vcyHLz/5WJ7tg e5wjjJ0YzDkRhOzEi72TIKUHv50AHFlQMEDxOIU2+TtYQ0pzyt6Ae1BFT7ag/ibIqJ mHn++aufP6Be/V2gXJF4JPf0Yns7wEJ2mHTdcD1c= Received: from epsnrtp2.localdomain (unknown [182.195.42.163]) by epcas2p1.samsung.com (KnoxPortal) with ESMTP id 20220214094044epcas2p1df083cafe6518adb46b1494f3581a64c~TnaqPLvuj1972419724epcas2p1D; Mon, 14 Feb 2022 09:40:44 +0000 (GMT) Received: from epsmges2p4.samsung.com (unknown [182.195.36.88]) by epsnrtp2.localdomain (Postfix) with ESMTP id 4Jxzjl1tQ7z4x9Q7; Mon, 14 Feb 2022 09:40:43 +0000 (GMT) Received: from epcas2p3.samsung.com ( [182.195.41.55]) by epsmges2p4.samsung.com (Symantec Messaging Gateway) with SMTP id 91.19.12141.A932A026; Mon, 14 Feb 2022 18:40:42 +0900 (KST) Received: from epsmtrp1.samsung.com (unknown [182.195.40.13]) by epcas2p1.samsung.com (KnoxPortal) with ESMTPA id 20220214094042epcas2p118ac06692ad14f321a3fd59e57bcf1d5~TnaoNW2UJ1972419724epcas2p18; Mon, 14 Feb 2022 09:40:42 +0000 (GMT) Received: from epsmgms1p1new.samsung.com (unknown [182.195.42.41]) by epsmtrp1.samsung.com (KnoxPortal) with ESMTP id 20220214094042epsmtrp18668e522fd1f887f37fe744b8a53a3bd~TnaoMk2LF2665426654epsmtrp1D; Mon, 14 Feb 2022 09:40:42 +0000 (GMT) X-AuditID: b6c32a48-d73ff70000002f6d-3b-620a239afeb9 Received: from epsmtip1.samsung.com ( [182.195.34.30]) by epsmgms1p1new.samsung.com (Symantec Messaging Gateway) with SMTP id 63.8F.29871.A932A026; Mon, 14 Feb 2022 18:40:42 +0900 (KST) Received: from ubuntu.dsn.sec.samsung.com (unknown [12.36.155.120]) by epsmtip1.samsung.com (KnoxPortal) with ESMTPA id 20220214094042epsmtip18d5a380e01357722bf01d4d805e2fdaa~TnaoEF7dT0562805628epsmtip1I; Mon, 14 Feb 2022 09:40:42 +0000 (GMT) From: Daehwan Jung To: Felipe Balbi , Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org (open list), Daehwan Jung , quic_wcheng@quicinc.com, quic_jackp@quicinc.com, Thinh.Nguyen@synopsys.com Subject: [PATCH v1 2/2] usb: dwc3: Prevent cleanup cancelled requests at the same time. Date: Mon, 14 Feb 2022 18:37:18 +0900 Message-Id: <1644831438-125403-3-git-send-email-dh10.jung@samsung.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1644831438-125403-1-git-send-email-dh10.jung@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrCKsWRmVeSWpSXmKPExsWy7bCmue4sZa4kg8ON5hbH2p6wW9xZMI3J onnxejaLy7vmsFksWtbKbLHr3yImi027+1gtVi04wO7A4bFpVSebx/65a9g9Ju6p8+jbsorR Y8v+z4wenzfJBbBFZdtkpCampBYppOYl56dk5qXbKnkHxzvHm5oZGOoaWlqYKynkJeam2iq5 +AToumXmAN2jpFCWmFMKFApILC5W0rezKcovLUlVyMgvLrFVSi1IySkwL9ArTswtLs1L18tL LbEyNDAwMgUqTMjO+DTTrqBPtOLb/n2MDYyvBLsYOTkkBEwkdsz7xdbFyMUhJLCDUeJl+yom COcTo8SLdfdYIZxvjBLLZy9hg2n5N2UpVGIvo8S+g7NYQRJCAj8YJS595Oxi5OBgE9CS+L6Q ESQsIhAmMXHZPhaQemaQ+qZ9d8HqhQUiJf78vcoOYrMIqEp0nT/BAmLzCrhJ7Jj5CWqZnMTN c53MIDangLvEnf3H2UEGSQhcY5d42H6MGaLIReJK309WCFtY4tXxLewQtpTEy/42KLtYYten ViaI5gZGicYHJ6CajSVmPWtnBLmaWUBTYv0ufRBTQkBZ4sgtsHuYBfgkOg7/ZYcI80p0tAlB NCpLTL88AWqrpMTB1+egBnpITH/SxQwJn1mMEnvvzGCawCg3C2HBAkbGVYxiqQXFuempxUYF JvAIS87P3cQITm5aHjsYZ7/9oHeIkYmD8RCjBAezkghv3FnOJCHelMTKqtSi/Pii0pzU4kOM psDAm8gsJZqcD0yveSXxhiaWBiZmZobmRqYG5krivF4pGxKFBNITS1KzU1MLUotg+pg4OKUa mJrPhayL/aD3kpnnP9Oa4nYey09fy9k8NkUcVlwg+q6YN/aOqUPGi3Uz6tu3xa/aG3MmbdPO q5s+MLYucRa0lwiOnWwgf/SGqLpmr+oq4b1LPI8zLayZvttlHe+LrU9W13kV3y86dvLn45wt ClPDra2XiXmn3z1uNK/UWSy/LeKk19G+/RzVBV1Lz1sekJa76SB1mzW3+8btzP0+LJk3rVYl qpfXOm+4/y3rmcJRUwk/2TOtisEvBWsmunIfWyaUl/U+aVb4MRsO5Rsbj/5s23ihhu9nZ+YJ 60OzUpc4WNd/3lt6fvsM0weOJot+1LEv6ftZH8/ldNb+f163/t8nniqn533RlA5LcV3G0v3f UYmlOCPRUIu5qDgRAHIbSHH3AwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprLLMWRmVeSWpSXmKPExsWy7bCSnO4sZa4kg88XFS2OtT1ht7izYBqT RfPi9WwWl3fNYbNYtKyV2WLXv0VMFpt297FarFpwgN2Bw2PTqk42j/1z17B7TNxT59G3ZRWj x5b9nxk9Pm+SC2CL4rJJSc3JLEst0rdL4Mr4NNOuoE+04tv+fYwNjK8Euxg5OSQETCT+TVnK CmILCexmlDh6SwIiLimxdO4NdghbWOJ+yxGgGi6gmm9ANa8msnUxcnCwCWhJfF/ICFIjIhAm 8e/RRRaQGmaBw4wSLW93gdUIC4RL9M7NAqlhEVCV6Dp/ggXE5hVwk9gx8xMbxHw5iZvnOplB bE4Bd4k7+4+zQ9zjJtHzYDnzBEa+BYwMqxglUwuKc9Nziw0LDPNSy/WKE3OLS/PS9ZLzczcx gkNQS3MH4/ZVH/QOMTJxMB5ilOBgVhLhjTvLmSTEm5JYWZValB9fVJqTWnyIUZqDRUmc90LX yXghgfTEktTs1NSC1CKYLBMHp1QDk/GaNwc9v6sr1rzcsWeZu9vvr68/NZr9f6OyfVpMx733 XyTaRSMWcYhdSeAQvyIdNWenbc9nv5W51vxbOPS2FP3IOK57wbj01C/9rAfub376nub9mrRT uOT4Hu2q+8k8AhouutLh4VPCVS8FRG/t2iUceMK6XbPmqtGVl9bhPq+yWeaw7eisTRGLODnt erRIfuXJFbZKk44u47OV3bVZv9LwW1Bm4PMrE+ZrGd2cK3+C3V1hf8y1u3unXF/DPo+j/vfm q6z/zLNzxH0fnHrXYJB00LrvftkapwtfN2otk16ff89m0efJLb8mfiy2N1k4pSt8lnRi+3JF R3O+Myu2T879qn1J78HJcpkL/64k5CqxFGckGmoxFxUnAgDI1znIsAIAAA== X-CMS-MailID: 20220214094042epcas2p118ac06692ad14f321a3fd59e57bcf1d5 X-Msg-Generator: CA Content-Type: text/plain; charset="utf-8" X-Sendblock-Type: AUTO_CONFIDENTIAL CMS-TYPE: 102P DLP-Filter: Pass X-CFilter-Loop: Reflected X-CMS-RootMailID: 20220214094042epcas2p118ac06692ad14f321a3fd59e57bcf1d5 References: <1644831438-125403-1-git-send-email-dh10.jung@samsung.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 We added cleanup cancelled requests when ep cmd timeout on ep dequeue because there's no complete interrupt then. But, we find out new case that complete interrupt comes up later. list_for_each_entry_safe is used when cleanup cancelled requests and it has vulnerabilty on multi-core environment. dwc3_gadget_giveback unlocks dwc->lock temporarily and other core(ISR) can get lock and try to cleanup them again. It could cause list_del corruption and we use DWC3_EP_END_TRANSFER_PENDING to prevent it. 1. MTP server cancels -> ep dequeue -> ep cmd timeout(END_TRANSFER) -> cleanup cancelled requests -> dwc3_gadget_giveback -> list_del -> rel= ease lock temporarily 2. Complete with END_TRANSFER -> ISR(dwc3_gadget_endpoint_command_complete)= gets lock -> cleanup cancelled requests -> dwc3_gadget_giveback -> list_del 3. MTP server process gets lock again -> tries to access POISON list(list_d= el corruption) [ 205.014697] [2: MtpServer: 5032] dwc3 10b00000.dwc3: request cancel= led with wrong reason:5 [ 205.014719] [2: MtpServer: 5032] list_del corruption, ffffff88b6963= 968->next is LIST_POISON1 (dead000000000100) Change-Id: I9df055c6c04855edd09e330300914454a6657a23 Signed-off-by: Daehwan Jung Change-Id: If87c88c3bb4c17ea1a5bde2bfec1382769f7ecab Signed-off-by: Daehwan Jung --- drivers/usb/dwc3/gadget.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 3ad3bc5813ca..2e0183512d5b 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2046,8 +2046,11 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, =20 /* If ep cmd fails, then force to giveback cancelled requests here */ if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) { - dep->flags &=3D ~DWC3_EP_TRANSFER_STARTED; + dep->flags |=3D DWC3_EP_END_TRANSFER_PENDING; dwc3_gadget_ep_cleanup_cancelled_requests(dep); + + dep->flags &=3D ~DWC3_EP_TRANSFER_STARTED; + dep->flags &=3D ~DWC3_EP_END_TRANSFER_PENDING; } =20 dep->flags &=3D ~DWC3_EP_WAIT_TRANSFER_COMPLETE; @@ -3426,9 +3429,12 @@ static void dwc3_gadget_endpoint_command_complete(st= ruct dwc3_ep *dep, if (dep->stream_capable) dep->flags |=3D DWC3_EP_IGNORE_NEXT_NOSTREAM; =20 + if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) { + dwc3_gadget_ep_cleanup_cancelled_requests(dep); + } + dep->flags &=3D ~DWC3_EP_END_TRANSFER_PENDING; dep->flags &=3D ~DWC3_EP_TRANSFER_STARTED; - dwc3_gadget_ep_cleanup_cancelled_requests(dep); =20 if (dep->flags & DWC3_EP_PENDING_CLEAR_STALL) { struct dwc3 *dwc =3D dep->dwc; --=20 2.31.1